Public Key Binding in 5G Access Tokens for NF Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G communication systems face challenges in service access authorization, particularly in roaming scenarios where explicit authentication between network functions (NFs) is lacking, relying on implicit authentication through intermediate hops which may not ensure secure mutual authentication between NF service consumers and producers across different networks.
Innovation Solution
The proposed solution involves binding a service consumer's certified public key to an access token generated by the NRF, which the service consumer digitally signs and sends to the service producer, enabling the producer to verify the signature using the bound public key for explicit authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If implicit authentication through intermediate hops is used in roaming scenarios, then service access can be granted without direct authentication between NFs, but security reliability is compromised because explicit mutual authentication between service consumer and producer is not ensured
Solution Approach 1:
The service consumer's public key is bound to the access token in advance by the NRF during token generation. This preliminary binding ensures that when the service producer receives the token, the authentication relationship is already established, enabling explicit mutual authentication without adding complex interaction steps during service access.
Solution Approach 2:
The access token acts as an intermediary carrier that transports the service consumer's public key from the NRF to the service producer. This intermediary mechanism enables direct authentication between service consumer and producer while maintaining the roaming architecture, resolving the contradiction between ease of operation and authentication security.
2Reliability
If public key binding to access token is implemented, then explicit authentication between service consumer and producer is enabled, but the complexity of the authorization system increases due to additional cryptographic operations
Solution Approach 1:
The service consumer autonomously performs the digital signature operation on the access token using its own private key. This self-service approach eliminates the need for the NRF or other intermediaries to perform complex cryptographic verification, reducing system complexity while maintaining high authentication security.
Solution Approach 2:
The patent replaces traditional mechanical authentication mechanisms (such as password verification or certificate chain validation) with cryptographic digital signature verification. This substitution enables secure explicit authentication with simpler system architecture, as the public key bound in the token directly enables verification without requiring complex trust establishment protocols.
3Reliability
If digital signature verification is performed by the service producer, then authentication reliability is improved, but processing time increases due to additional verification steps
Solution Approach 1:
The public key binding to the access token is performed in advance by the NRF during token issuance. This preliminary preparation ensures that when the service producer needs to verify the service consumer's identity, the public key is already available in the token, eliminating the need for time-consuming key retrieval or certificate validation processes during service access.
Solution Approach 2:
The service consumer's public key is copied into the access token structure during token generation. This copying mechanism allows the service producer to perform fast local verification using the embedded public key, avoiding network delays associated with real-time key exchange or certificate validation, thus reducing processing time while maintaining authentication reliability.
Data Source
AI summary
A request is received at an authorization entity for access to a service producer by a service consumer. The request comprises a public key of the service consumer. The authorization entity generates an access token with the public key of the service consumer bound thereto. The authorization entity sends the access token to the service consumer. The service consumer digitally signs the access token using a private key that corresponds to the public key bound to the access token to form a digital signature. The service consumer sends the access token with the public key bound thereto and the digital signature to the service producer. The service producer validates the access token, obtains the public key from the access token, and verifies the digital signature using the obtained public key of the service consumer. The service consumer is authorized when the access token is successfully validated and the digital signature is successfully verified.