UE Authorization Tokens for Secure API Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile communication systems lack effective methods to manage user authorization for accessing resources, leading to potential privacy infringements and unauthorized access that can cause damage to users.
Innovation Solution
A method involving a terminal generating and managing tokens for authentication and revocation to authorize and control access to user resources, ensuring only authorized API invokers can access UE resources, using encryption and revocation tokens to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user authorization management is implemented using traditional methods, then system compatibility is maintained, but user privacy protection is insufficient and unauthorized access cannot be prevented
Solution Approach 1:
The patent introduces a token as an intermediary element between the user and the API invoker. The token contains authorization information and serves as a mediator to verify access rights without exposing sensitive user data. This resolves the contradiction by providing strong privacy protection through the token intermediary while keeping the authorization management process relatively simple through standardized token issuance and verification mechanisms.
Solution Approach 2:
The patent creates a copy of authorization information in the form of a token that can be transmitted and verified without exposing the original user credentials. The token is a simplified copy containing only the necessary authorization data, which protects user privacy while enabling verification. This copying approach reduces complexity compared to managing full user credential verification.
2Reliability
If access control is strengthened to prevent unauthorized access, then user safety is improved, but access efficiency decreases due to additional verification steps
Solution Approach 1:
The patent performs authorization verification in advance by issuing a token before the actual API invocation. The token contains pre-validated authorization information, so when the API invoker presents the token, the verification is quick and straightforward. This preliminary action improves user safety through proper authorization checks while maintaining access efficiency by avoiding repeated verification steps during actual data access.
Solution Approach 2:
The token serves as a self-verifying credential that contains all necessary authorization information. The API exposing function can independently verify the token without needing to contact the user or perform complex checks. This self-service approach strengthens safety through proper verification while improving efficiency by eliminating lengthy authentication processes.
3Reliability
If token-based authorization is implemented, then unauthorized access is prevented, but system complexity increases due to token management overhead
Solution Approach 1:
The patent designs a universal token that can be used across multiple API invocations and different API exposing functions. The same token issuance and verification mechanism applies to all users and APIs, creating a standardized approach. This universality provides strong access control security while reducing overall system complexity by avoiding the need for multiple different authorization mechanisms.
Solution Approach 2:
The patent transforms the authorization management problem from managing complex user credentials to managing simpler token parameters. The token contains essential authorization parameters (user ID, API identifier, timestamp, signature) that are easier to handle and verify than full credential sets. This parameter transformation improves security while reducing management complexity.
Data Source
AI summary
The present disclosure relates to a 5G or 6G communication system for supporting a higher data transfer rate. A method performed by a terminal of a mobile communication system according to the present disclosure comprises the steps of: receiving a user authentication request for an API call from a first network entity; generating a first token to authenticate the API call; transmitting the first token to the first network entity as a response for the user authentication request; generating a first discard token for discarding the first token; and transmitting the first discard token to a second network entity.