Security Event Data Access Using Profile-Based NF Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authorization mechanisms in wireless communications systems do not adequately verify if network function (NF) service consumers are permitted to access security event data, leading to unauthorized entities potentially accessing sensitive security and privacy data, exposing network vulnerabilities and subscriber information.
Innovation Solution
Implement a token-based authentication and authorization mechanism where an authorization server, such as an NRF, generates and issues tokens to NFs requesting access to security event data, verifying their authorization based on profiles, ensuring only authorized entities can access and process this data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authorization mechanisms are used for NF service consumers to access services, then the system maintains simplicity and ease of operation, but unauthorized entities can access security event data exposing network vulnerabilities and subscriber information
Solution Approach 1:
The patent introduces an authorization server as an intermediary component that mediates between NF service consumers and security event data. This server verifies authorization requests by checking profiles stored in a database, thereby enhancing security without requiring complex authorization logic within the consumer functions themselves. The intermediary handles the complexity of authorization verification centrally.
Solution Approach 2:
The authorization mechanism is segmented into distinct functional components: an authorization server that handles verification, a database that stores profiles, and NF service consumers that make requests. This segmentation allows each component to have well-defined responsibilities, simplifying the overall system architecture while maintaining strong authorization capabilities.
2Object-affected harmful factors
If access control for security event data is strengthened, then unauthorized access is reduced, but system complexity and overhead increase
Solution Approach 1:
The system performs preliminary authorization verification before allowing access to security event data. The authorization server checks the consumer's profile in advance to determine if access is permitted. This preliminary action prevents unauthorized access attempts from reaching the data storage, reducing the burden on subsequent security mechanisms and minimizing system overhead.
Solution Approach 2:
Instead of implementing complex access control logic in every data access point, the system uses a simplified token-based mechanism where authorization decisions are pre-computed and stored as profiles. These profiles act as copies of authorization decisions that can be quickly verified without re-evaluating complex access control policies at each access point.
3Reliability
If token-based authentication is implemented for NFs accessing security event data, then access security is enhanced, but authentication overhead and processing time increase
Solution Approach 1:
The authorization server creates token representations (copies) of authorization decisions that can be quickly verified. Instead of performing complex authentication calculations during each data access request, the system uses pre-generated tokens that encode authorization information, allowing for rapid verification without repeating the full authentication process.
Solution Approach 2:
Authentication and authorization decisions are made in advance during the token generation phase. The authorization server performs all necessary verification and creates valid tokens before the actual data access occurs. This preliminary action shifts the computational burden to a separate phase, allowing subsequent data access operations to proceed with minimal processing time.
Data Source
AI summary
Various aspects of the present disclosure relate to authorized access to security event data. An apparatus, such as a network equipment (NE) that implements a first network function (NF) (e.g., a network repository function (NRF)), receives a request from a second NF (e.g., an operator security function (OSF)) for a token to access security event data from a third NF (e.g., an NF service producer). The first NF generates the token using a profile of the second NF. The first NF transmits the token to the second NF. A fourth NF (e.g., a data collection function) can request a second token from the first NF to access the security event data for the second NF. The third NF can transmit the security event data to the second NF via the fourth NF or directly. This enables secure and authorized access to security event data in wireless communication networks.