Service Mesh Authentication for 5G Indirect Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G service-based architecture, prior authentication methods require mutual authentication over a transport layer, which is undesirable in indirect communication scenarios where a proxy device prevents direct authentication between devices.
Innovation Solution
A client assertion scheme is implemented above the transport layer for both direct and indirect communications, including verifiable identity information in access requests and encrypting access tokens with the consumer device's public key to ensure secure authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mutual authentication over transport layer is used, then authentication security is improved, but device complexity increases and cannot work in indirect communication scenarios
Solution Approach 1:
The patent introduces a service mesh as an intermediary layer between the service provider and consumer. The service mesh handles authentication and authorization decisions, allowing the consumer to access services without establishing direct authenticated connections to the service provider. This resolves the contradiction by enabling authentication in indirect communication scenarios while simplifying the consumer's authentication burden.
Solution Approach 2:
The authentication mechanism is segmented into separate components: service provider authentication, consumer authentication, and service mesh authentication. Each component handles specific authentication tasks independently, allowing the system to maintain security while working through proxy devices in indirect communication scenarios.
2Reliability
If transport layer authentication is required, then authentication reliability is improved, but adaptability to indirect communication scenarios deteriorates
Solution Approach 1:
The patent moves authentication from the transport layer to the application layer by introducing service mesh side authentication. This dimensional shift allows authentication to occur at a different layer of the communication stack, enabling it to function reliably in indirect communication scenarios where transport layer authentication would be insufficient or impossible.
Solution Approach 2:
The service mesh acts as an intermediary that bridges direct and indirect communication scenarios. It provides consistent authentication and authorization functionality whether the communication is direct or goes through proxy devices, thereby improving adaptability while maintaining reliability.
3Ease of operation
If access tokens are transmitted in plain text, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The service mesh acts as a secure intermediary that receives access tokens from service consumers and validates them before allowing access to services. This eliminates the need for consumers to handle or transmit tokens themselves, maintaining ease of operation while improving security through centralized validation.
Solution Approach 2:
The service mesh handles token validation and service access decisions autonomously, without requiring the consumer to implement complex security measures. The consumer simply provides the access token, and the service mesh self-manages the security validation process.
Data Source
AI summary
Systems and methods for securing network communications between a first device and a second device over a service-based architecture, include receiving, at the first device, an access request including: a request to use a service of the service-based architecture, an authentication public key certificate associated with the second device or a proxy device therefore, a unique identifier of the second device, and a digital signature using the private key associated with the authentication public key certificate. The first device may verify the authentication public key certificate and generate an encrypted access response including an access token that allows access to the service, which is then transmitted back to the second device for further use in accessing the service-based architecture.