NRF JWKS Retrieval and Update Sync for Access Token Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing 3GPP OAuth authorization framework does not provide a method to distribute the Network Repository Function's (NRF) public key set (JWKS) to Network Function (NF) service producers, leading to costly and error-prone manual configuration and inefficient retrieval of JSON Web Keys (JWKs) for verifying access tokens.
Innovation Solution
A mechanism is provided for NF service producers to automatically retrieve the JWKS from the NRF through standardized URIs during bootstrapping, and to dynamically subscribe to notifications of key set updates, eliminating manual configuration and ensuring immediate updates across all NF service producers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of JWKS is used in NF service producers, then the system can verify access tokens, but the configuration process is costly and error-prone
Solution Approach 1:
The NF service producer automatically retrieves JWKS from the NRF using standardized URIs during bootstrapping and through dynamic subscription to key set update notifications, eliminating the need for manual configuration and reducing errors while maintaining verification reliability
Solution Approach 2:
The system implements a feedback mechanism where the NF service producer subscribes to notifications of key set updates from the NRF, ensuring immediate updates across all producers and maintaining synchronization without manual intervention
2Reliability
If the NF service producer accesses the key set URI for each token verification, then the latest key set is retrieved, but the verification process becomes inefficient
Solution Approach 1:
The NF service producer retrieves the key set in advance during bootstrapping and caches it locally, then uses dynamic subscription to receive update notifications only when changes occur, avoiding repeated URI accesses while ensuring the latest key set is used for verification
Solution Approach 2:
The system maintains continuous synchronization through event subscription mechanisms, where the NF service producer receives push notifications upon key set updates, ensuring the cached key set remains current without requiring continuous or frequent polling of the URI
3Ease of manufacture
If manual configuration of JWKS is used, then initial setup can be completed, but updates and revocations cannot be deployed immediately
Solution Approach 1:
The NF service producer automatically discovers and retrieves the initial key set from the NRF using standardized URIs during bootstrapping, and subsequently receives update notifications through dynamic subscription, enabling immediate deployment of updates and revocations without manual reconfiguration
Solution Approach 2:
The system transitions from static manual configuration to dynamic automated retrieval and update mechanisms, where the NF service producer can dynamically subscribe to key set update events and receive real-time notifications, enabling immediate adaptation to changes in the key set
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments described herein provide methods and apparatuses for providing a network function, NF, service producer access to a key set, wherein the key set is for use in verifying an access token received from an NF service consumer. A method in a network repository function, NRF, comprises receiving a request from the NF service producer to provide an indication of services provided by the NRF; and responsive to the request, transmitting a first address where the key set can be retrieved, as part of an indication of an authorization service.