5G Network Slice Access Tokens for Service Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication systems lack effective mechanisms to verify the network slice identity of network function service consumers and producers, leading to potential security issues and unauthorized access in 5G networks.
Innovation Solution
Enhance the access token request process by including a client credentials assertion (CCA) and expand access tokens to include network slice identifiers, enabling verification of network slice identities through comparison with registered profiles and profiles in the network repository function (NRF) and network function service producer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are expanded to include network slice identifiers and verification mechanisms are implemented, then security and authorization control are improved, but device complexity and processing overhead increase
Solution Approach 1:
The access token is segmented to include distinct components: network slice identifiers, service consumer identifiers, and authorization scopes. This segmentation allows the system to verify specific slice identities without processing entire token structures, reducing computational complexity while maintaining security.
Solution Approach 2:
Network slice identifiers and authorization parameters are pre-configured and embedded in access tokens during token issuance. The network repository function pre- validates service consumer credentials and slice associations before generating tokens, eliminating the need for complex real-time verification of all parameters during service access.
2Reliability
If client credentials assertion and profile verification are implemented, then unauthorized access is prevented, but processing time and operational complexity increase
Solution Approach 1:
Service consumer profiles, including network slice associations and authorization permissions, are pre-configured and stored in the network repository function before actual service access requests. When access tokens are issued, verification against these pre-configured profiles occurs once during token generation, rather than repeatedly during each service interaction, significantly reducing processing time.
Solution Approach 2:
The network repository function creates and stores copies of service consumer profiles and network slice configuration data in advance. During access verification, the system compares token contents against these pre-existing profile copies rather than querying original data sources repeatedly, accelerating the verification process while maintaining security.
Data Source
AI summary
There is provided a method, apparatus and computer program product for causing a network repository function to perform: receiving, from a network function service consumer, an access request for an access authorization token, the request comprising a first identification of the network function service consumer and a first identification of at least one network slice on which access is requested; generating an access token in response to the request, the access token comprising at least one network slice identifier for the at least one network slice identified by the first identification; and providing the generated access token to the network function in response to the request for an access authorization token.