# An Introduction of a Modular Framework for Securing 5G Networks and Beyond
## 2 Related Work
### Security Mechanisms
#### 2.1.2 Authorisation  
Mobile networks implicitly authorise service access after authentication. Generally, for authorisation, access control can be used to implement permission and access rights by protecting access to an object. When a subject wants to access, the subject's name is checked against a list; if it is on the list, then access is granted [16]. Conventional access control approaches to provide service access authorisation to the system have been proposed in related work and include Role-Based Access Control RBAC [17], Discretion Access Control (DAC) [18] and Attribute-Based Access Control (ABAC) [19]. Such access control mechanisms sometimes require additional techniques such as Encryption-based Access Control (EBAC) to provide a robust and efficient authorisation to complex systems including heterogeneous networks (HetNets). However, due to the complex characteristics of 5G, they are unable to provide a controllable and efficient mechanism to meet the criteria of 5G network service authorisation [12].  
RBAC is a framework for specifying user access authorisation to resources, roles and responsibilities, and it follows principles such as the separation of duties, the least privilege and administrative activity segmentation. In contrast to ABAC, access control policies are developed by directly linking attributes with subjects. To achieve fine-grained access control, an efficient ABAC authorisation technique is employed based on user attributes and the access control authority grants the access rights.  
Approaches based on Capability-Based Access Control (CBAC) have been suggested as a possible solution for the 5G network. CBAC uses an unforgeable token that designates  
Figure 1: 5G security entities.  
access to a resource to inform of abilities according to a set of rights [20]. Capabilities are a two-pronged method to access control, in which each subject is assigned to a capability list that specifies each object and the actions that the subject is authorised to perform on it. The access matrix is stored by row in the metadata of the object [16]. The subject presents a capability to the service server (SS) to obtain access to an object and the capability is transferable and non-forgeable. Local SPs could perform the CBAC, capability token validation and access right authorisation processes. This can be accomplished by locally implementing permission processes on distributed edge devices, making it feasible for D2D communications. Many access control systems for mobile network applications have adopted capability-based methods, but this has raised a few issues such as capability propagation and revocation [21].  
With in-network caching, content objects may not always arrive from their original producer such as the SP, and content security cannot be considered in the traditional mobile network model based on secure and wireless or point-to-point channels [22]. This implies that content must be encrypted to prevent unauthorised access, invalid disclosure or modification by unauthorised parties using EBAC. By offering a framework for delivering access permissions to services, the existing access control mechanism reflects a good conceptualisation of authorisations. All these access control policies can be implemented independently or as an integrated access control solution.  
The authorisation mechanism described in [6] uses the OAuth 2.0 framework as defined in RFC 6749 [23]. It states that client credentials should be used as grants and access tokens shall be in JavaScript Object Notation (JSON) web token format, which can be protected with JSON web signature in the form of a digital signature or message authentication code (MAC) built on JSON web signature [24].