Access Token Revocation Mapping for Abnormal 5G Network Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the 5G Service-Based Architecture (SBA), there is no mechanism to revoke access tokens for abnormal network functions (NFs) once they are issued, posing a security risk as abnormal NFs can cause damage without complete removal.
Innovation Solution
A first device stores a mapping of access tokens with associated devices and, upon detecting abnormality, sends an indication to revoke the access token to target devices, using callback URIs for communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are issued to network functions for accessing NF services, then service access is enabled, but security risk increases when NFs become abnormal since there is no revocation mechanism
Solution Approach 1:
The system performs preliminary actions by storing mapping relationships between access tokens, NF instances, and callback URIs before abnormality occurs. When abnormality is detected, the revocation process can immediately execute using pre-stored mappings, enabling timely token revocation without complex real-time investigation.
Solution Approach 2:
The system implements feedback by establishing a callback mechanism where the NF service consumer sends notifications to the NF service provider about token revocation status. This feedback loop ensures that both parties are aware of the revocation state, improving security while maintaining manageable complexity through automated notification processes.
2Duration of action of stationary object
If access tokens are made valid for extended duration, then service availability is improved, but security vulnerability increases as abnormal NFs can use tokens indefinitely
Solution Approach 1:
The system applies preliminary anti-action by preparing and executing revocation mechanisms before abnormal NFs can cause extensive damage. When abnormality is detected, the system immediately initiates token revocation processes and notifies relevant parties, countering the potential harmful effects before they can fully manifest.
Solution Approach 2:
The system transforms the static token validity model into a dynamic one by enabling token revocation based on real-time NF status detection. Tokens remain valid during normal operation but can be dynamically revoked when abnormality is detected, balancing service availability with security responsiveness.
3Reliability
If complete removal of abnormal NFs is implemented, then security is improved, but service disruption increases as NFs cannot be used after abnormality detection
Solution Approach 1:
The system applies segmentation by separating the NF instance from its access tokens. When abnormality is detected, only the tokens are revoked while the NF instance itself remains operational. This allows the NF to continue providing services while losing access through revoked tokens, thus maintaining productivity while achieving security goals.
Solution Approach 2:
The system performs preliminary token revocation actions upon detecting NF abnormality, preventing further damage before complete service disruption. By acting preliminarily to revoke tokens rather than immediately removing the NF, the system maintains service availability while securing against further abuse.
Data Source
AI summary
Example embodiments of the present disclosure relate to access token revocation in security management. In an example method, in response to providing, to a second device, an access token for the second device to access a NF service from a third device, a first device stores a mapping indicating an association among the access token, the second device and the third device. In response to determining that the second device is abnormal, the first device sends, to at least one target device based on the mapping, an indication of revoking the access token. In this way, at least one target device associated with revoked access token can be informed and potential damage caused by the abnormal NF can be eliminated.