NF Set Access Token Sharing for Lower Authorization Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing telecommunications networks face inefficiencies in the number of messages exchanged between network function (NF) service consumers and producers, particularly when multiple instances within a set of NFs need to access services, leading to increased network traffic and processing demands on authorization servers.
Innovation Solution
A mechanism where a network function set shares an access token among its instances, allowing them to access services without individual requests to the authorization server, reducing the need for repeated token requests and minimizing network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each NF service consumer instance requests access tokens individually from the authorization server, then security authorization is maintained for each instance, but the number of messages exchanged and processing load on the authorization server increases
Solution Approach 1:
The patent merges the authorization process at the NF set level rather than individual NF instance level. The authorization server issues a single access token to the NF set, which is then shared among all NF service consumer instances within that set. This combining approach maintains security authorization while eliminating redundant token request messages, directly resolving the contradiction between reliable authorization and network traffic efficiency.
Solution Approach 2:
The access token is designed with universal applicability across multiple NF instances within the same NF set. Instead of instance-specific tokens, a single token serves multiple functions and multiple instances, allowing any NF service consumer in the set to access the NF service producer without individual authorization requests. This multi-functionality resolves the contradiction by maintaining authorization reliability while improving productivity through reduced messaging.
2Reliability
If multiple NF instances within a set access services individually through separate token requests, then each instance receives proper authorization, but processing demands on authorization servers increase
Solution Approach 1:
The patent combines multiple individual authorization requests into a single authorization transaction. The NF set collectively receives one access token from the authorization server, which validates the authorization once for the entire set rather than validating separately for each instance. This merging directly reduces processing load while maintaining authorization reliability through set-level validation.
Solution Approach 2:
The authorization server performs the authorization validation in advance at the NF set level before individual NF instances need to access services. By pre-authorizing the entire NF set and issuing a shared token, the system eliminates the need for repeated real-time validation requests from each instance, thereby reducing processing demands on the authorization server while ensuring reliable authorization.
3Adaptability or versatility
If individual NF service consumers request access tokens separately, then instance-specific authorization is ensured, but the number of messages exchanged increases
Solution Approach 1:
The patent merges the message exchange process by having the NF set receive a single access token from the authorization server that represents authorization for all instances. This single message replaces multiple individual token request-response message pairs, directly reducing the quantity of messages exchanged while maintaining adaptability through set-based access control.
Solution Approach 2:
The access token is designed as a universal credential for the entire NF set, enabling all NF service consumer instances to access services without individual requests. This universal token reduces message quantity by serving multiple instances simultaneously, while adaptability is maintained through the NF set identifier that groups instances with common authorization requirements.
Data Source
Figure 1
Figure 2A
Figure 2B~2C
AI summary
This specification describes apparatus comprising means for: sending, from a first network function service consumer instance to an authorisation server, a request for an access token for use in accessing a service provided by a network function service producer, wherein the request includes an identifier of a set of network function service consumer instances of which the first network function service consumer instance is a member; receiving, at the first network function service consumer instance from the authorisation server, an access token for use in accessing the service provided by the network function service producer, wherein the access token includes the identifier of the set of network function service consumer instances of which the first network function service consumer instance is a member; and sending, from the first network function service consumer instance to the network function service producer, a request to access the service provided by the network function service producer, wherein the request to access the service includes the access token.