Network Slice Authorization Using App Certificate and Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized applications can overload network resources and compromise security by accessing network slices without authorization, impacting authorized applications and network operators.
Innovation Solution
An application authorization service on end devices validates certificates, attestation values, and tokens to ensure only authorized applications access network slices, preventing unauthorized access and resource wastage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If network slices are made accessible to applications without strict authorization checks, then application connectivity and network access speed are improved, but network security and resource stability deteriorate due to unauthorized access
Solution Approach 1:
The patent implements preliminary authorization checks by validating application certificates, attestation values, and tokens before granting network slice access. The authorization service performs these verification actions in advance, establishing access rights before the application actually connects to the network slice, thus maintaining both fast access for authorized apps and security through pre-validation.
Solution Approach 2:
The patent introduces an authorization service as an intermediary component between the application and the network slice. This mediator validates certificates, attestation values, and tokens, and enforces authorization decisions without requiring applications to directly verify security credentials themselves. The intermediary handles the complex security verification while maintaining a simple interface for applications.
2Reliability
If authorization validation procedures are made comprehensive and strict, then network security and resource protection are improved, but processing time and system complexity worsen
Solution Approach 1:
The authorization service performs comprehensive validation of certificates, attestation values, and tokens in advance before network slice access is granted. By completing these security checks beforehand, the system ensures thorough verification without adding delays during actual network operations, as the authorization decision is cached and reused.
Solution Approach 2:
The patent implements self-service mechanisms where applications provide their own certificates and attestation values to the authorization service. The authorization service autonomously validates these credentials against stored references and makes independent authorization decisions, reducing the need for back-and-forth communication and manual verification processes.
3Object-affected harmful factors
If certificate and token validation is performed for every application request, then unauthorized access prevention is improved, but computational overhead and energy consumption worsen
Solution Approach 1:
The authorization service performs comprehensive validation of certificates, attestation values, and tokens in advance before network slice access is granted. By completing these security checks beforehand, the system ensures thorough verification without adding delays during actual network operations, as the authorization decision is cached and reused.
Solution Approach 2:
The patent implements a reference-based validation approach where the authorization service stores reference copies of valid certificates, attestation values, and tokens. Instead of re-validating the complete cryptographic chains for every request, the service compares application-provided credentials against these stored references, significantly reducing computational overhead while maintaining security.
4Reliability
If network slice access is restricted through authorization services, then resource protection and network stability are improved, but application versatility and ease of operation worsen
Solution Approach 1:
The authorization service implements a universal validation framework that handles multiple types of credentials (certificates, attestation values, tokens) through a single unified interface. This multi-functional approach protects diverse network slices with consistent authorization mechanisms while allowing applications to access different slice types through the same authorization process, maintaining both security and versatility.
Solution Approach 2:
The patent introduces an authorization service as an intermediary component between the application and the network slice. This mediator validates certificates, attestation values, and tokens, and enforces authorization decisions without requiring applications to directly verify security credentials themselves. The intermediary handles the complex security verification while maintaining a simple interface for applications.
Data Source
AI summary
A method, a network device, and a non-transitory computer-readable storage medium are described in relation to an application authorization service. The application authorization service may be performed at an end device and invoked responsive to the launching of an application. The application authorization service may include validating an application certificate associated with the application, validating an attestation value, and validating a token provided by the application. The application may provide a request that includes an application identifier and a token. The application may be granted access to a network or denied access depending on the outcome of the validation procedures. The granted access may include assignment of a network slice. The application certificate, a secured token, and a secured attestation value may be stored in a secure environment at the end device and used for validation procedures.