Client authentication and access token ownership validation
A method of performing authentication of a client for wireless communication includes: sending, by the client, a request to an authorization server via a proxy node, to obtain an access token, wherein the request to obtain the access token contains a client signature of the client; authenticating, by the authorization server, the client as a valid recipient of the access token; and authorizing, by the authorization server, the access token to the client after authenticating the client, wherein the authorization is based on at least the client signature contained in the request to obtain the access token.
1 . A method of performing authentication of a client for wireless communication, comprising:
sending, by the client, a request to an authorization server via a proxy node, to obtain an access token, wherein the request to obtain the access token contains a client signature of the client;
authenticating, by the authorization server, the client as a valid recipient of the access token; and
authorizing, by the authorization server, the access token to the client after authenticating the client, wherein the authorization is based on at least the client signature contained in the request to obtain the access token;
wherein the authentication is based on a hash of a combination of the request to obtain the access token and a shared secret key common to the client and the authorization server, and wherein the output of the hash is added to the request to obtain the access token, and wherein the authorization server authenticates the hash by i) hashing the request to obtain the access token and the shared secret key, and ii) comparing the output of the hashing by the authorization server with hash added to the request to obtain the access token received from the client via the proxy node.
2 . The method of claim 1 , wherein the authentication of the access token is under OAuth 2.0 protocol, and wherein the client is a consumer Network Function (cNF), the authorization server is a network repository function (NRF), and the proxy node is a Service Communication Proxy (SCP).
3 . The method of claim 1 , wherein the request to obtain the access token additionally contains a timestamp of when the client issued the request to obtain the access token.
4 . The method of claim 1 , wherein the request to obtain the access token additionally contains an increasing random number inserted by the client and tracked by both the client and the authorization server.
5 . The method of claim 1 , wherein the request to obtain the access token additionally contains a client certificate added by the proxy node.
6 . The method of claim 1 , wherein the request to obtain the access token additionally contains a client certificate added by the client.
7 . The method of claim 1 , wherein the client is authenticated during access token allocation, whereby signing of the access token is not implemented for the authentication.
8 . The method of claim 1 , wherein one of discovery or registration is implemented through the proxy node, and wherein the authentication is performed during the one of the discovery or the registration of the client with the authorization server.