Methods, systems, and computer readable media for resource object level authorization at a network function (nf)

A method for resource object level authorization at a network function implemented using hardware, the method comprising:

• maintaining, by a first network function (NF) implemented using hardware, a service based interface (SBI) resource object access authorization policy database containing policies for controlling access to SBI resource objects;
• dynamically populating, by the first NF, a resource object owner database containing records for resource objects and corresponding resource object owners, wherein dynamically populating the resource object owner database includes receiving, from consumer NFs, SBI resource object creation requests, extracting, from the 5G SBI resource object create requests, NF instance identifiers of the consumer NFs that originated the SBI resource object creation requests, receiving, from producer NFs, responses to the SBI resource object creation requests confirming successful creation of the resource objects, and, in response to receiving the responses to the SBI resource object creation requests, storing the NF instance identifiers of the consumer NFs and corresponding resource object identifiers in the resource object owner database;
• receiving, by the first NF and from a second NF implemented using hardware, a first SBI resource object access request for accessing a resource object;
• accessing, by the first NF and using information from the first SBI resource object access request, the resource object access authorization policy database and the resource object owner database and determining that an access to the resource object requested by the first resource object access request is not permitted;
• and
• in response to determining that the access to the resource object requested by the first resource object access request is not permitted, preventing the access to the resource object requested by the first resource object access request.

A method for resource object level authorization at a network function implemented using hardware, the method comprising:

• maintaining, by a first network function (NF) implemented using hardware, a service based interface (SBI) resource object access authorization policy database containing policies for controlling access to SBI resource objects;
• dynamically populating, by the first NF, a resource object owner database containing records for resource objects and corresponding resource object owners;
• receiving, by the first NF and from a second NF implemented using hardware, a first SBI resource object access request for accessing a resource object.
• accessing, by the first NF and using information from the first SBI resource object access request, the resource object access authorization policy database and the resource object owner database and determining that an access to the resource object requested by the first resource object access request is not permitted, wherein determining that the access requested by the first SBI resource object access request is not permitted includes determining that the access is only permitted to an owner of the resource object and determining that the second NF is not the owner of the resource object;
• and
• in response to determining that the access to the resource object requested by the first resource object access request is not permitted, preventing the access to the resource object requested by the first resource object access request.

A system for resource object level authorization at a network function implemented using hardware, the system comprising:

• a first network function (NF) implemented using hardware and including at least one processor and a memory;
• a service based interface (SBI) resource object access authorization policy database located in the memory for storing policies for controlling access to SBI resource objects;
• a resource object owner database for storing records containing resource object identifiers and corresponding resource object owner identifiers;
• a resource object access authorization manager for dynamically populating the records in the resource object owner database, receiving, from a second NF implemented using hardware, a first SBI resource object access request for accessing a resource object, accessing, using information from the first SBI resource request, the resource object access authorization policy database and the resource object owner database, determining that an access to the resource object requested by the first SBI resource object access request is not permitted, and, in response to determining that the access to the resource object requested by the first SBI resource object access request is not permitted, preventing the access to the resource object requested by the first SBI resource object access request, wherein, in determining that the access requested by the first SBI resource object access request is not permitted, the resource object access authorization manager is configured to determine that the access is only permitted to an owner of the resource object and determining that the second NF is not the owner of the resource object.

A system for resource object level authorization at a network function implemented using hardware, the system comprising:

• a first network function (NF) implemented using hardware and including at least one processor and a memory;
• a service based interface (SBI) resource object access authorization policy database located in the memory for storing policies for controlling access to SBI resource objects;
• a resource object owner database for storing records containing resource object identifiers and corresponding resource object owner identifiers;
• a resource object access authorization manager for dynamically populating the records in the resource object owner database, receiving, from a second NF implemented using hardware, a first SBI resource object access request for accessing a resource object, accessing, using information from the first SBI resource request, the resource object access authorization policy database and the resource object owner database, determining that an access to the resource object requested by the first SBI resource object access request is not permitted, and, in response to determining that the access to the resource object requested by the first SBI resource object access request is not permitted, preventing the access to the resource object requested by the first SBI resource object access request, wherein, in dynamically populating the resource object owner database, the resource object access authorization manager is configured to receive, from consumer NFs, SBI resource object creation requests, extract, from the SBI resource object creation requests, NF instance identifiers of the consumer NFs that originated the resource object creation requests, receive, from producer NFs, responses to the SBI resource object creation requests confirming successful creation of the resource objects, and, in response to receiving the responses, store the NF instance identifiers of the consumer NFs and corresponding resource object identifiers in the resource object owner database.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

• maintaining, by a first network function (NF) implemented using hardware, a service based interface (SBI) resource object access authorization policy database containing policies for controlling access to SBI resource objects;
• dynamically populating, by the first NF, a resource object owner database containing records for resource objects and corresponding resource object owners;
• receiving, by the first NF and from a second NF implemented using hardware, a first SBI resource object access request for accessing a resource object;
• accessing, by the first NF and using information from the first SBI resource object access request, the resource object access authorization policy database and the resource object owner database and determining that an access to the resource object requested by the first SBI resource object access request is not permitted;
• in response to determining that the access to the resource object requested by the first SBI resource object access request is not permitted, preventing the access to the resource object requested by the first SBI resource object access request;
• and
• receiving, at the first NF and from a third NF implemented using hardware, a second SBI resource object access request for accessing the resource object, accessing the resource object access authorization policy database and the resource object owner database using information from the second SBI resource object access request and granting the third NF access to the resource object.