Systems and method for authentication and authorization in networks using service based architecture

1. A method for securing network communications between a first device and a second device over a service-based architecture, comprising:

receiving, at the first device, an access request comprising:

an identity assertion comprising:

an authentication public key certificate associated with the second device or a proxy device therefore,

a unique identifier of the second device, and

a digital signature using a private key associated with the authentication public key certificate;

verifying, by the first device, the validity of the identity assertion;

generating an access response that either allows or denies access to the service based on the validation result of the identity assertion; and

transmitting the access response to the second device.

2. The method of claim 1 , the verifying the validity of the identity assertion comprising one or more of:

validating the authentication public key certificate,

validating the digital signature,

validating the unique identifier of the second device against the identity in the authentication public key certificate.

3. The method of claim 1 , the identity assertion further comprising at least one of:

an initiation time defining when the identity assertion was generated, and

an expiration time defining when the identity assertion expires; and

the verifying including validating at least one of the initiation time and the expiration time.

4. The method of claim 1 , the access response further comprising an access token that permits the second device to access the service from the first device or another device of the service based architecture.

5. The method of claim 1 , the identity assertion corresponding to a JavaScript Object Notation (JSON) Web Token (JWT) protocol.

6. The method of claim 1 , the identity assertion being received on a layer, of a protocol stack, other than a transport layer.

7. The method of claim 1 , the identity assertion being received on an application layer of a protocol stack.

8. The method of claim 7 , the application layer being an HTTP layer.

9. The method of claim 1 , the first device implementing a Network Repository Function (NRF); the second device implementing a proxy device.

10. The method of claim 1 , the first device implementing a Network Repository Function (NRF); the second device implementing a Network Function Consumer (cNF).

11. The method of claim 1 , the second device being a wireless communication device operating on a 5G communications network.

12. The method of claim 1 , the service-based architecture implemented on a 5G communications network.

13. The method of claim 1 , the access request being a relayed access request received by the first device from a proxy device communicatively between the first device and the second device.

14. The method of claim 1 , the first device being a client device and the second device being a web-based server.

15. The method of claim 1 , the identity assertion further including an encryption key; the generating the access response including encrypting one or more of parameters in the access response, and an access token based on the encryption key.

16. The method of claim 1 , the step of receiving occurring on an application-layer of a protocol stack; further comprising establishing authentication between the first device and a device that transmits the access request on a transport layer of the protocol stack.

17. A method for securing communications between a consumer device and a second device of a service-based architecture, comprising:

generating, at the first device, an access request including:

a request to use a service of the service-based architecture, and

an identity assertion comprising at least:

an authentication public key certificate associated with the second device,

a unique identifier of the second device, and

a digital signature using the private key associated with the authentication public key certificate;

transmitting the access request in an application layer of a protocol stack.

18. The method of claim 17 ,

the identity assertion in the service request further comprising at least one of:

an initiation time defining when the identity assertion was generated, and

an expiration time defining when the identity assertion expires.

19. The method of claim 17 , the identity assertion further including an encryption key.