# US 12,015,923 B2 · Methods, systems, and computer readable media for mitigating effects of access token misuse > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,923 B2 - Document ID: US12015923B2 - Status: Granted - Kind: B2 - Application number: 17/557,324 - Filed: 2021-12-21 - Published: 2023-06-22 - Granted: 2024-06-18 - Earliest claimed: 2021-12-21 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Rajiv Krishan; Doki Satish Kumar Patro - Web page: https://patentgrep.com/patent/US12015923B2 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04L 63/0281: {Proxies} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer readable media for mitigating effects of access token misuse are disclosed. One example method for mitigating effects of access token misuse comprises: at a network function (NF) comprising at least one processor: receiving, from a sender, a service request comprising an access token, wherein the access token includes an access token identifier and usage attributes indicating a message rate limit and/or a message count limit; determining, using the usage attributes associated with the access token, that the service request should be rejected; and rejecting the service request. ## Claims ### Claim 1 A method for mitigating effects of access token misuse, the method comprising: at a network function (NF) comprising at least one processor: receiving, from a sender, a service request comprising an access token, wherein the access token includes an access token identifier and usage attributes indicating a message rate limit, wherein the access token comprises an OAuth 2.0 access token and the usage attributes indicating the message rate limit include a claim of the OAuth 2.0 access token specifying a message rate limit or a message count limit; after the service request is received, updating a message rate value of a rate counter for indicating a received rate of service requests associated with the access token; determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token, that the service request should be rejected, wherein determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token that the service request should be rejected includes comparing the message rate value and the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token and determining that the message rate value exceeds the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token; and rejecting the service request. ### Claim 2 (depends on 1) The method of claim 1 comprising: at the NF: after the service request is received: updating a message count value of a message counter for indicating a received number of service requests associated with the access token. ### Claim 3 (depends on 2) The method of claim 2 wherein the claim of the OAuth 2.0 access token specifies the message count limit and determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token, that the service request should be rejected includes determining that the message rate value exceeds the message rate limit or determining that the message count value exceeds the message count limit and, in response, determining that the service request should be rejected. ### Claim 4 (depends on 2) The method of claim 2 wherein the access token identifier is usable for identifying the message rate value and/or the message count value maintained by the NF. ### Claim 5 (depends on 1) The method of claim 1 comprising: at an NF repository function (NRF) and prior to the NF receiving the service request: receiving, from a consumer NF, an access token request; generating the access token including the access token identifier and the usage attributes; and sending the access token to the consumer NE, wherein the consumer NE is different from the sender of the service request. ### Claim 6 (depends on 1) The method of claim 1 wherein the service request is rejected regardless of an expiration period associated with the access token. ### Claim 7 (depends on 1) The method of claim 1 wherein the NF includes a service communication proxy (SCP), a security edge protection proxy (SEPP), a proxy NF, or a producer NF. ### Claim 8 (depends on 1) The method of claim 1 comprising: at the NF: generating usage information indicating usage of the access token; and sending the usage information to an NF repository function (NRF) or a network operator. ### Claim 9 A system for mitigating effects of access token misuse, the system comprising: at least one processor; a memory; and a network function (NF) implemented using the at least one processor and the memory, the NF configured for: receiving, from a sender, a service request comprising an access token, wherein the access token includes an access token identifier and usage attributes indicating a message rate limit, wherein the access token comprises an OAuth 2.0 access token and the usage attributes indicating the message rate limit include a claim of the OAuth 2.0 access token specifying a message rate limit or a message count limit; after the service request is received, updating a message rate value of a rate counter for indicating a received rate of service requests associated with the access token; determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token, that the service request should be rejected, wherein determining using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token that the service request should be rejected includes comparing the message rate value and the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token and determining that the message rate value exceeds the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token; and rejecting the service request. ### Claim 10 (depends on 9) The system of claim 9 wherein the NF is configured for: after the service request is received: updating a message count value of a message counter for indicating a received number of service requests associated with the access token. ### Claim 11 (depends on 10) The system of claim 10 wherein the claim of the OAuth 2.0 access token specifies the message count limit and the NF is configured for determining that the message rate value exceeds the message rate limit or determining that the message count value exceeds the message count limit and, in response, determining that the service request should be rejected. ### Claim 12 (depends on 10) The system of claim 10 wherein the access token identifier is usable for identifying the message rate value and/or the message count value maintained by the NE. ### Claim 13 (depends on 9) The system of claim 9 comprising: an NF repository function (NRF) configured for: prior to the NF receiving the service request: receiving, from a consumer NF, an access token request; generating the access token including the access token identifier and the usage attributes; and sending the access token to the consumer NF, wherein the consumer NF is different from the sender of the service request. ### Claim 14 (depends on 9) The system of claim 9 wherein the service request is rejected regardless of an expiration period associated with the access token. ### Claim 15 (depends on 9) The system of claim 9 wherein the NF includes a service communication proxy (SCP), a security edge protection proxy (SEPP), a proxy NF, or a producer NF. ### Claim 16 (depends on 9) The system of claim 9 wherein the NF is configured for: generating usage information indicating usage of the access token; and sending the usage information to an NF repository function (NRF) or a network operator. ### Claim 17 (depends on 16) The system of claim 16 wherein the usage attributes of the access token are adjusted for subsequent access token requests using the usage information or wherein the usage information or related information is deleted after the access token expires. ### Claim 18 A non-transitory computer readable medium having stored thereon executable instructions that when executed by at least one processor of a network function (NF) cause the NF to perform steps comprising: receiving, from a sender, a service request comprising an access token, wherein the access token includes an access token identifier and usage attributes indicating a message rate limit, wherein the access token comprises an OAuth 2.0 access token and the usage attributes indicating the message rate limit include a claim of the OAuth 2.0 access token specifying a message rate limit or a message count limit; after the service request is received, updating a message rate value of a rate counter for indicating a received rate of service requests associated with the access token; determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token, that the service request should be rejected, wherein determining, using the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token that the service request should be rejected includes comparing the message rate value and the message rate limit or the message count limit specified by the claim of the OAuth 2.0 access token and determining that the message rate value exceeds the message rate limit or the message count limit specified b the claim of the OAuth 2.0 access token; and rejecting the service request.