Mitigation against access token theft attack in direct and indirect communications in sba

A method, comprising:

• receiving an access token request comprising an authentication code of a network function service consumer, NFc, and further comprising a public key of the NFc or a hash of the public key of the NFc;
• authenticating the NFc based on the authentication code of the NFc;
• verifying, whether a public key included in the authentication code corresponds to the NFc;
• if verified that the public keys are the same,
• generating an access token comprising the public key of the NFc or a hash of the public key of the NFc;
• and
• sending the access token to the NFc and/or a service communication proxy, SCP.

A method, comprising:

• receiving, from a service communication proxy, SCP, or from a network function service consumer, NFc, a service request comprising an access token and an authentication code of the NFc, the access token further comprising a public key of the NFc or a hash of the public key of the NFc;
• verifying, whether the public key included in the access token is same as a public key included in the authentication code of the NFc;
• and
• if verified that the public keys are the same, sending a service response to the NFc.

An apparatus, comprising

• at least one processor;
• and
• at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
• obtain a first access token request from a network function service consumer, NFc, the first access token request comprising an authentication code of the NFc;
• authenticate the network function consumer, NFc, based on a check whether the authentication code is signed by the NFc;
• send a second access token request to a network authorization entity or function, wherein the second access token request comprises the authentication code of the NFc and the second access token request further comprises a public key of the NFc or a hash of the public key of the NFC;
• based thereon, receive an access token from the network authorization entity or function, wherein the access token comprises the public key of the NFc or a hash of the public key of the NFc;
• and
• send a service request to a network function service provider, NFp, wherein the service request comprises said access token and the authentication code of the NFc.

An apparatus, comprising

• at least one processor;
• and
• at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
• receive an access token request comprising an authentication code of a network function service consumer, NFc, and further comprising a public key of the NFc or a hash of the public key of the NFc;
• authenticate the NFc based on the authentication code of the NFc;
• verify, whether a public key included in the authentication code corresponds to the NFc;
• if verified that the public keys are the same, generate an access token comprising the public key of the NFc or a hash of the public key of the NFc;
• and
• send the access token to the NFc and/or a service communication proxy, SCP.

An apparatus, comprising

• at least one processor;
• and
• at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
• receive, from a service communication proxy, SCP, or from a network function service consumer, NFc, a service request comprising an access token and an authentication code of the NFc, the access token further comprising a public key of the NFc or a hash of the public key of the NFc;
• verify, whether the public key included in the access token is same as a public key included in the authentication code of the NFc;
• and
• if verified that the public keys are the same, send a service response to the NFc.