Network Function Token Verification for Service Domain Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In current OAuth authentication mechanisms, network function consumers can access services without authorization, compromising network security.
Innovation Solution
Implement a communication method where network function elements verify service requests based on service domain information within access tokens to ensure authorized access, including integrity protection and identity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OAuth authentication mechanism is used, then access token can be obtained for service consumption, but network function consumers can access services without authorization compromising network security
Solution Approach 1:
The access token is segmented into multiple fields, including service domain information (service area, service type) and consumer domain information (consumer ID, validity time). This segmentation allows the network function to verify specific authorization attributes separately, preventing unauthorized access while maintaining convenient service consumption within authorized scopes.
Solution Approach 2:
The network function performs preliminary verification of the access token before providing services. It checks the service domain information in the token against the current service request to ensure the consumer is authorized for the specific service area and type before allowing access, thereby preventing unauthorized consumption.
2Productivity
If access token is used for service consumption, then communication between network functions is enabled, but malicious consumers can obtain services without authorization
Solution Approach 1:
The network function provides feedback by verifying the access token contents against the service request parameters. It compares the service domain information in the token with the actual service being requested and provides authorization feedback to allow or deny access, preventing malicious consumers from obtaining unauthorized services.
Solution Approach 2:
The access token includes dynamic parameters such as validity time and service area restrictions. The network function changes the authorization state based on these parameters, allowing service consumption only within the specified time window and service domain, thereby preventing unauthorized access while maintaining communication efficiency.
3Reliability
If service domain information is added to access token, then authorization verification is improved, but token structure becomes more complex
Solution Approach 1:
The access token structure is designed with multi-functionality, where the service domain information fields (service area, service type) serve multiple purposes: they define authorization scope, enable service routing, and provide verification criteria. This universal design improves authorization verification accuracy without proportionally increasing token structure complexity.
Data Source
AI summary
Embodiments of this application provide a communication method and a communication apparatus. The method includes: A second network function network element receives a service request message from a first network function network element, and determines, based on a first token, whether to provide a service for the first network function network element. The service request message is used to request the second network function network element to provide the service for the first network function network element, and includes the first token and second service domain information indicating a service area of the service requested by the first network function network element, the first token includes first service domain information indicating a service area range in which the first network function network element is capable of obtaining the service from the second network function network element.