NRF Access Token Handling for Unique SNPN Roaming Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In standalone non-public network (SNPN) roaming scenarios, service authorization or service requests cannot be successfully completed due to the inability to uniquely identify the home and visited networks using existing methods that rely on public land mobile network (PLMN) identifiers.
Innovation Solution
Incorporating standalone non-public network (SNPN) information, such as network identifiers (NID) and PLMN IDs, into the access token generation process to ensure unique network identification, enhancing service authorization reliability and security by checking SNPN information during token verification and interface context matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If PLMN ID is used to identify networks in roaming scenario, then existing PLMN roaming can be supported, but SNPN roaming cannot be uniquely identified
Solution Approach 1:
The patent embeds SNPN information within the existing PLMN ID framework by adding SNPN indicators and identifiers to the access token and request messages. This nested structure allows the system to maintain backward compatibility with PLMN roaming while enabling SNPN roaming identification, resolving the contradiction between adaptability and reliability.
Solution Approach 2:
The patent extends the network identification from a single dimension (PLMN ID only) to multiple dimensions by incorporating SNPN indicators, SNPN identifiers, and network type information. This dimensional expansion enables unique identification of SNPN networks while maintaining compatibility with existing PLMN identification mechanisms.
2Reliability
If SNPN information is added to requests, then network unique identification is achieved, but request message complexity increases
Solution Approach 1:
The patent designs the access token and request message structures to serve multiple functions: they continue to carry PLMN ID for basic identification while simultaneously accommodating SNPN indicators and SNPN identifiers. This multi-functionality allows the same message structure to handle both PLMN and SNPN roaming scenarios without requiring separate complex message formats.
Solution Approach 2:
The patent introduces SEPP (Security Edge Protection Proxy) as an intermediary component that handles the complexity of SNPN information processing. The SEPP manages the addition, verification, and transmission of SNPN information in request messages, shielding the core network functions from direct complexity while enabling reliable network identification.
3Reliability
If access token includes SNPN information, then service authorization reliability is improved, but token processing complexity increases
Solution Approach 1:
The patent performs preliminary actions by having the first NRF (Network Repository Function) automatically add SNPN information to the access token before it is issued. The second NRF also preliminarily verifies SNPN information consistency before authorization. This advance preparation reduces the complexity of real-time processing and ensures reliable service authorization.
Solution Approach 2:
The patent implements feedback mechanisms where the second NRF verifies SNPN information in the access token against network records before granting authorization. This feedback loop ensures consistency and reliability while allowing the system to handle complexity through structured verification procedures rather than complex real-time processing.
Data Source
AI summary
A service authorization method and system, and an apparatus are disclosed. According to the method: A first NRF receives a first request requesting an access token for accessing service of a second NF in a second network from a first NF, where the first NF and the first NRF are located in a first network, and the first request includes SNPN information of the first network and/or the second network. The first NRF forwards the first request to a second NRF located in the second network. The second NRF generates an access token in response to the first request, where the access token includes the SNPN information of the first network and/or the second network. The second NRF sends the access token to the first NRF. The first NRF receives the access token and sends the access token to the first NF.