Method and system for authenticating application program interface (API) invokers
A method and system for authenticating application program interface (API) invokers using a common application program interface framework (CAPIF) is provided. The method includes establishing by a CAPIF core function (CCF) a secure Transport Layers Security (TLS) connection with at least one API invoker, on receiving a connection request from the at least one API invoker to access at least one service API on a CAPIF-2e interface. Further, the method includes determining by the CCF at least one security method to be used by the at least one API invoker for a CAPIF-2e interface security (C2eIS) of the at least one API invoker for accessing the at least one service API on a CAPIF-2e interface. The method further includes enabling the C2eIS by an API exposing function (AEF) the at least one API invoker based on the determined at least one security method.
1. A method performed by a first entity implementing a common application program interface framework (CAPIF) core function (CCF) in a communication system, the method comprising:
establishing a session with a second entity implementing an authenticating application program interface (API) invoker using a transport layers security (TLS);
receiving, from the second entity, a security method request message including information on a security method for a third entity implementing an API exposing function (AEF);
identifying the security method for authentication between the second entity and the third entity from at least one of a TLS-pre-shared key (TLS-PSK), a TLS-public key infrastructure (TLS-PKI), or an OAuth 2.0 based on the information on the security method and an access scenario; and
transmitting, to the second entity, the security method and security information associated with the security method,
wherein the access scenario indicates whether the second entity accesses the third entity prior to service API invocation, and
wherein the security method is used to provide an interface authentication and protection of the second entity.
2. The method of claim 1 , wherein a capability of the second entity is further used to determine the security method.
3. A method performed by a second entity implementing an authenticating application program interface (API) invoker in a communication system, the method comprising:
establishing a session with a first entity implementing a common application program interface framework (CAPIF) core function (CCF) using a transport layers security (TLS);
transmitting, to the first entity, a security method request message including information on a security method for a third entity implementing an API exposing function (AEF); and
receiving, from the first entity, the security method for authentication between the second entity and the third entity, and security information associated with the security method,
wherein the security method is identified from at least one of a TLS-pre-shared key (TLS-PSK), a TLS-public key infrastructure (TLS-PKI), or an OAuth 2.0 based on the information on the security method and an access scenario,
wherein the access scenario indicates whether the second entity accesses the third entity prior to service API invocation, and
wherein the security method is used to provide an interface authentication and protection of the second entity.
4. The method of claim 3 , wherein a capability of the second entity is further used to determine the security method.
5. A first entity implementing a common application program interface framework (CAPIF) core function (CCF) in a communication system, the first entity comprising:
a transceiver; and
at least one processor configured to:
establish a session with a second entity implementing an authenticating application program interface (API) invoker using a transport layers security (TLS),
receive, via the transceiver from the second entity, a security method request message including information on a security method for a third entity implementing an API exposing function,
identify the security method for authentication between the second entity and the third entity from at least one of a TLS-pre-shared key (TLS-PSK), a TLS-public key infrastructure (TLS-PKI), or an OAuth 2.0 based on the information on the security method and an access scenario, and
transmit, via the transceiver to the second entity, the security method and security information associated with the security method,
wherein the access scenario indicates whether the second entity accesses the third entity prior to service API invocation, and
wherein the security method is used to provide an interface authentication and protection of the second entity.
6. The first entity of claim 5 , wherein a capability of the second entity is further used to determine the security method.
7. A second entity implementing an authenticating application program interface (API) invoker in a communication system, the second entity comprising:
a transceiver; and
at least one processor configured to:
establish a session with a first entity implementing a common application program interface framework (CAPIF) core function (CCF) using a transport layers security (TLS),
transmit, via the transceiver to the first entity, a security method request message including information on a security method for a third entity implementing an API exposing function (AEF), and
receive, via the transceiver from the first entity, the security method for authentication between the second entity and the third entity, and security information associated with the security method,
wherein the security method is identified from at least one of a TLS-pre-shared key (TLS-PSK), a TLS-public key infrastructure (TLS-PKI), or an OAuth 2.0 based on the information on the security method and an access scenario,
wherein the access scenario indicates whether the second entity accesses the third entity prior to service API invocation, and
wherein the security method is used to provide an interface authentication and protection of the second entity.
8. The second entity of claim 7 , wherein a capability of the second entity is further used to determine the security method.