Service Communication Proxy Token Audience Mismatch Handling

Solution Overview

Problem

In the context of token-based authorization for indirect communication with delegated discovery in 3GPP networks, there is a mismatch between the list of allowed producers in the token audience and the list of discovered producers in the discovery response, which can prevent the Service Communication Proxy (SCP) from fulfilling service requests.

Innovation Solution

The SCP determines if there is a mismatch between the list of Network Function (NF) service producers in the authorization token and the list of NF service producers in the discovery response. If a mismatch is found, the SCP transmits a service response error message to the consumer device, indicating the mismatch between the token and the discovery response.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the SCP uses an authorization token with a list of allowed producers, then the security authorization is maintained, but the mismatch between token audience and discovery result prevents service requests from being fulfilled

Engineering Contradiction:

Improveservice request fulfillmentVSAvoidtoken-producer list matching

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The SCP sends a feedback message to the consumer device indicating the mismatch between the token audience and discovery result, enabling the consumer to request an updated token that matches the current producer list

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs service discovery before service consumption to obtain the current list of available producers, allowing the SCP to compare this list against the token audience and detect mismatches proactively

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If the SCP requests a new token from the NRF, then the token audience can be updated to match discovered producers, but the SCP itself cannot request a new token on behalf of the consumer

Engineering Contradiction:

Improvetoken audience alignmentVSAvoidauthorization mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The consumer device acts as an intermediary that receives the mismatch notification from the SCP and independently requests an updated token from the NRF, bridging the gap between the SCP's inability to request tokens and the need for token updates

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The consumer device autonomously requests and obtains a new token from the NRF based on the mismatch notification, without requiring the SCP to perform the token request operation on its behalf

Inventive Principle:

Principle #25Self-service

3Duration of action of stationary object

If the token is older than the discovery result, then the token remains valid for previously discovered producers, but it cannot authorize access to newly discovered producers

Engineering Contradiction:

Improvetoken validityVSAvoidservice discovery freshness

Core Design Contradiction:

Duration of action of stationary objectVSProductivity

Solution Approach 1:

The system performs service discovery before service consumption to obtain the current list of available producers, allowing the SCP to compare this list against the token audience and detect mismatches proactively

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The SCP sends a feedback message to the consumer device indicating the mismatch between the token audience and discovery result, enabling the consumer to request an updated token that matches the current producer list

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12309275B2Handling of token audience mismatch

Publication Date: 2025.05.20 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

A method performed by a service communication proxy (SCP). The method comprises determining whether or not there is a mismatch between a first list of Network Function (NF) service producers in an authorization token and a second list of NF service producers in a discovery response. The method further comprises responsive to determining that there is a mismatch between the first list of NF service producers and the second list of NF service producers, transmitting a service response error message to an NF consumer device that transmitted the authorization token, the service response error message indicating a mismatch between the authorization token and the discovery response.