Authorization Token Reuse via Partial Scope Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In mobile communication systems, existing authorization token management systems face challenges in efficiently utilizing tokens across different service requests, particularly when token scopes do not fully match the requested scopes, leading to unnecessary token requests and potential rejections.
Innovation Solution
A method and apparatus that allow a client function to delegate service requests to a proxy function, which discovers a service producer via a network repository function, and includes an authorization token in subsequent service requests if the token scope partly matches the requested scope, while determining token usability and requesting new tokens as needed based on service producer information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system requires exact token scope matching for service requests, then authorization security is improved, but token reuse efficiency deteriorates
Solution Approach 1:
The patent applies partial matching instead of requiring complete scope matching. The client function determines that an authorization token can be used when the token scope partially matches the requested scope, rather than requiring exact matches. This allows tokens to be reused across multiple service requests with different but overlapping scopes, improving efficiency while maintaining security through the partial match verification process
Solution Approach 2:
The patent changes the matching parameter from exact scope matching to partial scope matching. By modifying the matching criterion from requiring complete overlap between token scope and requested scope to accepting partial overlap, the system enables broader token reuse while still ensuring that the token provides sufficient authorization for the requested service operations
2Measurement precision
If the system requests new authorization tokens for each service request, then authorization accuracy is improved, but system overhead increases
Solution Approach 1:
The patent implements preliminary verification of token scope matching at the client function before submitting service requests. By performing the scope matching check in advance and reusing tokens that partially match, the system avoids the overhead of requesting new tokens for each service request while maintaining authorization accuracy through the preliminary verification step
Solution Approach 2:
The client function performs self-verification of token usability by determining whether an existing authorization token's scope partially matches the requested scope. This self-service approach eliminates the need for the network repository function to verify each token request, reducing system overhead while maintaining authorization accuracy through the client's own determination logic
3Manufacturing precision
If the system performs strict scope matching verification, then authorization precision is improved, but processing time increases
Solution Approach 1:
The patent performs partial scope matching verification instead of complete scope matching. The client function determines whether the token scope partially matches the requested scope by comparing service names and operation types, which requires less processing time than verifying complete scope equivalence while still maintaining sufficient authorization precision for service execution
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A technique comprising: sending to a proxy function from a client function a first service request for which the client function delegates to the proxy function discovery, via a network repository function, of a service producer for the first service request; receiving at the client function in reply to the service request a service response, wherein the service response includes an authorisation token indicating a token scope; and in response to a determination that the indicated token scope at least partly matches a requested scope for a second service request regardless of whether the token scope fully matches the requested scope, including the authorisation token in the second service request.