# US 12,192,351 B2 · Methods, systems, and computer readable media for sharing key identification and public certificate data for access token verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,351 B2 - Document ID: US12192351B2 - Status: Granted - Kind: B2 - Application number: 17/536,021 - Filed: 2021-11-27 - Published: 2023-06-01 - Granted: 2025-01-07 - Earliest claimed: 2021-11-27 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Rajiv Krishan; Doki Satish Kumar Patro - Web page: https://patentgrep.com/patent/US12192351B2 ## CPC - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/069: using certificates or pre-shared keys - H04W 12/108: Source integrity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method for sharing key identification (key ID) and public certificate data for access token verification comprises, at a network function (NF) repository function (NRF) including at least one processor, receiving, from a producer NF, an NF registration message including key ID version information. In response to detecting the key ID version information, sending, to the producer NF, an NF registration response message including a current key ID version value, at least one digital certificate, and at least one corresponding public key to the producer NF. The method further includes receiving, from the producer NF, an NF update message that includes the current key ID version value and in response to determining that the current key ID version value in the NF update message does not match an updated key ID version value maintained at the NRF, sending an NF update response message that the updated key ID version value, at least one updated digital certificate, and at least one corresponding updated public key to the producer NF. ## Claims ### Claim 1 A method for sharing key identification (key ID) and public certificate data for access token verification, the method comprising: at a network function (NF) repository function (NRF) including at least one processor: receiving, from a producer NF, an NF registration message including key ID version information; in response to detecting the key ID version information, sending, to the producer NF, an NF registration response message including a current key ID version value, at least one digital certificate, and at least one corresponding public key to the producer NF, wherein the current key ID version value is associated with one or more digital certificates and one or more public keys of the NRF corresponding to one or more private keys of the NRF used by the NRF to digitally sign access tokens; adding, by the NRF, a new private key to the one or more private keys of the NRF and a new public key to the one or more public keys of the NRF, and, in response, generating an updated key ID version value; receiving, from the producer NF, an NF update message that includes the current key ID version value; and in response to determining that the current key ID version value in the NF update message does not match the updated key ID version value maintained at the NRF, sending to the producer NF an NF update response message that includes the updated key ID version value, at least one updated digital certificate, and the new public key, wherein the new public key corresponds to the new private key, and the NRF uses the new private key to digitally sign access tokens and wherein the new public key is usable by the producer NF to verify whether a digital signature of an access token received from a consumer NF requesting service was created by the NRF using the new private key. ### Claim 2 (depends on 1) The method of claim 1 wherein the current key ID version value is communicated via a custom header section of the NF update message that includes a vendor-dynamic-keyID-version parameter. ### Claim 3 (depends on 1) The method of claim 1 wherein the at least one updated digital certificate and the new public key are communicated via a custom header section of the NF update response message that includes a vendor-dynamic-keyID-pair parameter. ### Claim 4 (depends on 1) The method of claim 1 wherein the NF update message is an NF heart-beat request message and the NF update response message is a heart-beat response message. ### Claim 5 (depends on 1) The method of claim 1 comprising, in response to determining that the current key ID version value in the NF update message matches the updated key ID version value maintained at the NRF, sending an NF update response message that includes the current key ID version value. ### Claim 6 (depends on 1) The method of claim 1 wherein the NRF is configured to update the current key ID version value in response to adding or deleting a public key. ### Claim 7 (depends on 1) The method of claim 1, wherein the access token includes at least one key ID originating from the NRF. ### Claim 8 A system for sharing key identification (key ID) and public certificate data for access token verification, the system comprising: a network function (NF) repository function (NRF) including at least one processor and a memory; and a key identifier distribution manager (KDM) implemented by the at least one processor configured for receiving, from a producer NF, an NF registration message including key identifier (ID) version information; in response to detecting the key ID version information, sending, to the producer NF, an NF registration response message including a current key ID version value, at least one digital certificate, and at least one corresponding public key to the producer NF, wherein the current key ID version value is associated with one or more digital certificates and one or more public keys of the NRF corresponding to one or more private keys of the NRF used by the NRF to digitally sign access tokens; adding a new private key to the one or more private keys of the NRF and a new public key to the one or more public keys of the NRF, and, in response, generating an updated key ID version value; receiving, from the producer NF, an NF update message that includes the current key ID version value; and in response to determining that the current key ID version value in the NF update message does not match the updated key ID version value maintained at the NRF, sending to the producer NF an NF update response message that includes the updated key ID version value, at least one updated digital certificate, and the new public key, wherein the new public key corresponds to the new private key and the NRF uses the new private key to digitally sign access tokens and wherein the new public key is usable by the producer NF to verify whether a digital signature of an access token received from a consumer NF requesting service was created by the NRF using the new private key. ### Claim 9 (depends on 8) The system of claim 8 wherein the current key ID version value is communicated via a first custom header section of the NF update message that includes a vendor-dynamic-key ID-version parameter. ### Claim 10 (depends on 8) The system of claim 8 wherein the at least one updated digital certificate and the new public key are communicated via a custom header section of the NF update response message that includes a vendor-dynamic-keyID-pair parameter. ### Claim 11 (depends on 8) The system of claim 8 wherein the NF update message is an NF heart-beat request message and the NF update response message is a heart-beat response message. ### Claim 12 (depends on 8) The system of claim 8 wherein in response to determining that the current key ID version value in the NF update message matches the updated key ID version value maintained at the NRF, the KDM is further configured to send an NF update response message that includes the current key ID version value. ### Claim 13 (depends on 8) The system of claim 8 wherein the NRF is configured to update the current key ID version value in response to adding or deleting a public key. ### Claim 14 (depends on 8) The system of claim 8, wherein the access token includes at least one key ID originating from the NRF. ### Claim 15 One or more non-transitory computer readable media having stored thereon executable instructions that when executed by a processor of a network function (NF) repository function (NRF) control the NRF to perform steps comprising: receiving, from a producer NF, an NF registration message including key identifier (ID) version information; in response to detecting the key ID version information, sending, to the producer NF, an NF registration response message including a current key ID version value, at least one digital certificate, and at least one corresponding public key to the producer NF, wherein the current key ID version value is associated with one or more digital certificates and one or more public keys of the NRF corresponding to one or more private keys of the NRF used by the NRF to digitally sign access tokens; adding, by the NRF, a new private key to the one or more private keys of the NRF and a new public key to the one or more public keys of the NRF, and, in response, generating an updated key ID version value; receiving, from the producer NF, an NF update message that includes the current key ID version value; and in response to determining that the current key ID version value in the NF update message does not match the updated key ID version value maintained at the NRF, sending to the producer NF an NF update response message that includes the updated key ID version value, at least one updated digital certificate, the new public key, wherein the new public key corresponds to the new private key and the NRF uses the new private key to digitally sign access tokens and wherein the new public key is usable by the producer NF to verify whether a digital signature of an access token received from a consumer NF requesting service was created by the NRF using the new private key. ### Claim 16 (depends on 15) The one or more non-transitory computer readable media of claim 15 wherein the current key ID version value is communicated via a custom header section of the NF update message that includes a vendor-dynamic-keyID-version parameter. ### Claim 17 (depends on 15) The one or more non-transitory computer readable media of claim 15 wherein the at least one updated digital certificate and the new public key are communicated via a custom header section of the NF update response message that includes a vendor-dynamic-key ID-pair parameter. ### Claim 18 (depends on 15) The one or more non-transitory computer readable media of claim 15 wherein the NF update message is an NF heart-beat request message and the NF update response message is a heart-beat response message. ### Claim 19 (depends on 15) The one or more non-transitory computer readable media of claim 15 comprising, in response to determining that the current key ID version value in the NF update message matches the updated key ID version value maintained at the NRF, sending an NF update response message that includes the current key ID version value. ### Claim 20 (depends on 15) The one or more non-transitory computer readable media of claim 15 wherein the NRF is configured to update the current key ID version value in response to adding or deleting a public key.