Service Communication Proxy OAuth Authorization for Indirect 5G Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G communication systems face challenges in service access authorization due to the introduction of new intermediate nodes and service-based architecture, particularly in the Rel-16 Option D architectural option where direct OAuth service access authorization is not feasible.
Innovation Solution
Implementing a Service Communication Proxy (SCP) to act as an OAuth client on behalf of Network Functions (NFs), obtaining and caching access tokens, and verifying their integrity on the producer side, thereby enabling OAuth-based service access authorization in indirect communication models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct OAuth service access authorization is used between Network Functions, then authentication is straightforward, but the service-based architecture with intermediate nodes makes direct authorization infeasible
Solution Approach 1:
The patent introduces a Service Communication Proxy (SCP) as an intermediary component that mediates between service consumers and service producers. The SCP obtains access tokens from the authorization entity on behalf of network functions and manages the token exchange process, enabling OAuth-based authorization in the service-based architecture without requiring direct authentication between all network function pairs.
2Productivity
If Service Communication Proxy obtains and caches access tokens, then service access efficiency is improved, but token security and validation complexity increases
Solution Approach 1:
The Service Communication Proxy performs preliminary actions by obtaining and caching access tokens in advance before they are needed for service access. This allows the proxy to quickly present valid tokens when service consumers need to access service producers, improving service access efficiency without requiring real-time authentication for each service request.
Solution Approach 2:
The patent implements validation mechanisms where the Service Communication Proxy verifies token integrity and validates claims extracted from access tokens. This feedback loop ensures that cached tokens remain secure and valid, with the proxy able to detect and handle expired or invalid tokens appropriately.
3Reliability
If access tokens are validated at the service producer side, then authorization security is ensured, but processing time increases
Solution Approach 1:
The Service Communication Proxy performs preliminary validation of access tokens before forwarding service requests to service producers. By pre-verifying token integrity and validating claims in advance, the proxy reduces the validation burden on service producers and minimizes the time added to service request processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A service request is received at a first service communication proxy element, wherein the service request is received from a service consumer and is a request to access at least one service of a service producer. The first service communication proxy element determines at least one target service producer based on the service request. The first service communication proxy element sends an access token request to an authorization entity, wherein the access token request is generated based on the determining step. The first service communication proxy element receives an access token response from the authorization entity, wherein the access token response comprises an access token. The first service communication proxy element may then send a service request with the access token to a second service communication proxy element, wherein the second service communication proxy element is associated with the target service producer. The method may apply to roaming and non-roaming scenarios.