Access token revocation in security management
Example embodiments of the present disclosure relate to access token revocation in security management. In an example method, in response to providing, to a second device, an access token for the second device to access a NF service from a third device, a first device stores a mapping indicating an association among the access token, the second device and the third device. In response to determining that the second device is abnormal, the first device sends, to at least one target device based on the mapping, an indication of revoking the access token. In this way, at least one target device associated with revoked access token can be informed and potential damage caused by the abnormal NF can be eliminated.
1 . A device comprising:
at least one processor; and
at least one memory storing instructions of a network repository function of a communication network, wherein the instructions when executed by the at least one processor, cause the device at least to perform operations comprising:
in response to providing, to a network function service consumer of the communication network, an access token for the network function service consumer to use to access a service of a network function service producer, storing a mapping indicating an association among the access token, the network function service consumer, and at least one target; and
in response to determining that the network function service consumer is abnormal, revoking the access token to be used by the network function service consumer, and sending, to the at least one target based on the mapping, a first indication indicating the access token provided by the network function service consumer is to be ignored by the at least one target, wherein the at least one target comprises at least one of the network function service producer or a proxy of the communication network, wherein the proxy is configured to verify the access token for the network function service producer.
2 . The device of claim 1 , wherein the operations further comprise:
receiving, from a network data analytics function (NWDAF), an indication that the network function service consumer is abnormal.
3 . The device of claim 1 , wherein the operations further comprise:
receiving a first callback uniform resource identifier (URI) from the network function service producer while the network function service producer registers with the network repository function, or
receiving the first callback URI from the proxy while the proxy registers with the network repository function device.
4 . The device of claim 3 , wherein the sending comprises:
sending the first indication based on the first callback URI.
5 . The device of claim 1 , wherein the operations further comprise:
sending a second indication that the access token is revoked to at least one of the network function service consumer or another proxy requesting the access token from the network repository function on behalf of the network function service consumer.
6 . The device of claim 5 , wherein the operations further comprise:
receiving, from the network function service consumer, a second callback URI while the network function service consumer requests the access token from the network repository function, or
receiving, from the other proxy, the second callback URI while the other proxy requests the access token from the network repository function.
7 . The device of claim 6 , wherein the sending of the second indication comprises:
sending the second indication based on the second callback URI.
8 . The device of claim 1 , wherein the operations further comprise:
in response to determining that the access token is generated for a second public land mobile network (PLMN) different from a first PLMN associated with the network repository function, sending, to a security edge protection proxy associated with the first PLMN, a third indication of blocking traffic from the second PLMN.
9 . The device of claim 1 , wherein the operations further comprise at least one of:
discarding the mapping in response to expiry of the access token;
rejecting a further request for the access token sent by the network function service consumer; or
sending an error code in response to receiving a further access token request for the network function service consumer.
10 . The device of claim 1 , wherein the determining that the network function service consumer is abnormal comprises:
receiving, from a network function, an indication indicating that the network function service consumer is abnormal.
11 . The device of claim 10 , wherein the network function comprises at least one of:
a network data analytics function (NWDAF);
a network function providing a management data analytics service (MDAS); or
an operations, administration and maintenance (OAM) function.
12 . A method of a network repository function of a communication network, the method comprising:
in response to providing, to a network function service consumer of the communication network, an access token for the network function service consumer to use to access a service from a network function service producer of the communication network, storing, at the network repository function, a mapping indicating an association among the access token, the network function service consumer, and at least one target; and
in response to determining that the network function service consumer is abnormal, revoking the access token, and sending, from the network repository function and to the at least one target based on the mapping, a first indication indicating the access token provided by the network function service consumer is to be ignored by the at least one target, wherein the at least one target comprises at least one of the network function service producer or a proxy of the communication network, wherein the proxy is configured to verify the access token for the network function service producer.
13 . The method of claim 12 , further comprising:
receiving, from a network data analytics function (NWDAF), an indication that the network function service consumer is abnormal.
14 . The method of claim 12 , further comprising:
receiving a first callback uniform resource identifier (URI) from the network function service producer while the network function service producer registers with the network repository function; or
receiving the first callback URI from the proxy while the proxy registers with the network repository function.
15 . The method of claim 14 , wherein the sending comprises:
sending the first indication based on the first callback URI.
16 . The method of claim 12 , further comprising:
sending a second indication that the access token is revoked to at least one of the network function service consumer or another proxy requesting the access token from the network repository function on behalf of the network function service consumer.
17 . The method of claim 16 , further comprising:
receiving, from the network function service consumer, a second callback URI while the network function service consumer requests the access token from the network repository function; or
receiving, from the other proxy, the second callback URI while the other proxy requests the access token from the network repository function, wherein
the sending of the second indication comprises sending the second indication based on the second callback URI.
18 . A device comprising:
at least one processor; and
at least one memory storing instructions of a network repository function, wherein when the instructions are executed by the at least one processor, the device is caused to perform operations comprising:
in response to providing, to a network function service consumer, an access token for the network function service consumer to use to access a service of a network function service producer, storing a mapping indicating an association among the access token, the network function service consumer, and the network function service producer;
in response to determining that the network function service consumer is abnormal, sending, to the network function service producer based on the mapping, an indication of revoking the access token; and
in response to determining that the access token is generated for a second public land mobile network (PLMN) different from a first PLMN associated with the network repository function, sending, to a security edge protection proxy associated with the first PLMN, an indication of blocking of traffic received from the second PLMN.