SEPP Token Validation for Inter-PLMN Roaming Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Inter-PLMN roaming scenarios in network function authorization are complex due to the need for pre-provisioning of certificates and public keys across numerous roaming partners, leading to performance bottlenecks and insecure solutions.
Innovation Solution
Implementing a Security Edge Protection Proxy (SEPP) to manage token generation and validation, offloading cryptographic operations and certificate management to improve system performance and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-provisioning of certificates and public keys is performed across numerous roaming partners, then network function authorization can be established between PLMNs, but system complexity and provisioning difficulty increase significantly
Solution Approach 1:
The patent introduces a home SEPP as an intermediary component that centralizes certificate and public key management. Instead of provisioning certificates directly between numerous roaming partners, the home SEPP acts as a trusted mediator that generates and distributes public keys to visiting SEPPs. This intermediary approach reduces provisioning complexity from O(n²) direct pairings to O(n) centralized distributions, while maintaining authorization reliability through the trusted mediation layer.
Solution Approach 2:
The patent extracts the complex certificate management functionality from individual network functions and consolidates it into a dedicated SEPP component. By separating the public key distribution function from general network authorization, the system reduces provisioning complexity while maintaining reliable authorization. The SEPP specifically handles the extraction and management of cryptographic materials, leaving other NFs to focus on their core authorization functions.
2Reliability
If cryptographic operations are performed by network functions during token validation, then security is maintained, but processing performance decreases due to intensive computational load
Solution Approach 1:
The patent extracts cryptographic validation operations from network functions and relocates them to the SEPP component. The NF receives pre-validated public keys from the home SEPP, eliminating the need for NFs to perform intensive cryptographic operations during token validation. This extraction maintains security through the trusted SEPP validation while improving NF processing performance by removing computational overhead.
Solution Approach 2:
The patent implements preliminary cryptographic validation by the home SEPP before tokens are distributed to visiting NFs. Public keys are pre-provisioned and validated by the trusted home SEPP, so that when NFs receive tokens during roaming, the cryptographic verification has already been performed in advance. This preliminary action shifts the computational burden to off-peak provisioning times, improving real-time processing performance while maintaining security.
3Adaptability or versatility
If multiple certificates are provisioned for each roaming partner, then comprehensive authorization coverage is achieved, but provisioning time and resource consumption increase
Solution Approach 1:
The patent implements a universal public key provisioning model where the home SEPP generates a single comprehensive public key that serves multiple authorization purposes across different roaming partners. Instead of provisioning separate certificates for each partner-NF pair, the home SEPP creates a universal credential that enables broad authorization coverage. This multi-functional approach reduces provisioning time from O(n²) individual certifications to O(n) universal key distributions, while maintaining comprehensive authorization coverage through the versatile home SEPP credential.
Data Source
AI summary
In some implementations, a device in a first public land mobile network (PLMN) may receive a request for services with a network function producer (NF-P) in the first PLMN, wherein the request for services includes a first token that is associated with a network function consumer (NF-C) in a second PLMN. The device may validate the first token using a signing certificate associated with a signer of the first token. The device may transmit the request for services to the NF-P, wherein the request for services includes a second token that is based on a successful validation of the first token, and a successful validation of the second token enables the NF-P to provide a service to the NF-C based on an authorization of the NF-C during an inter-PLMN roaming.