Security relating to digital identities and representations

Abstract

There are provided measures for security related to digital identities and representations. Such measures exemplarily comprise: receiving a first authentication request from a communication endpoint, the first authentication request comprising a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being a digital representation of a digital service participant; and sending a second authentication request to an application function entity, the second authentication request including the preliminary identifier and a second identifier of the communication endpoint.

Description

TECHNICAL FIELD

[0001] Various example embodiments relate to security related to digital identities and representations. More specifically, various example embodiments illustratively relate to measures (including methods, apparatuses, and computer program products) for implementing security related to digital identities and representations. BACKGROUND

[0002] This specification generally relates to avatars in cyberspace.

[0003] An example of an avatar is a digital representation that is specific to a media encoding a person's or some software-generated entity's facial (possibly bodily) position, motion, and expression.

[0004] The word avatar originates from a work associated with Hinduism, referring to the physical form of a deity on Earth, particularly Vishnu.

[0005] In computing, an avatar is a graphical representation of a user or a user's character or persona. In many games from the late 1970s to the late 1980s, the word was used to describe a player's character. In 1992, Neal Stephenson used the word in his novel Snow Crash to describe a virtual simulation of a human form, where he also coined the term "metaverse".

[0006] Today, there are many ways to use avatars in addition to being a digital representation of a character in a video game. A representation is often considered to be one-to-one (one person represented by one digital representation), but this is not always the case. Some people are represented in multiple ways (especially over time), some groups use avatars to represent them, and sometimes programs or automated services are represented with avatars (which are not human users at all). In most applications, people can choose their own avatar, and they can change these frequently, even adopting other users' avatars (if there is no policy preventing this).

[0007] Avatars can act as a digital representation of a user in internet forums. These are often an animated version of a person's face or an image representing them.

[0008] Digital representations can be static (that is, they are not generally animated), and are used to provide a memorable, unique personality to a user in online forums without revealing their actual appearance. This is a common use on social media platforms.

[0009] In social forums where avatars are remotely controlled, avatars can be animated. An early example of this was "Second Life".

[0010] Such platforms do not feature games, but rather “players” (i.e. participants) interact, build things, share information and purchase virtual equipment. Some institutions have created online virtual presences (such as universities, private companies, even political parties) to enable interaction between users represented as avatars.

[0011] Furthermore, avatars have been used to improve interaction between people using software or accessing online services and software. One example is “Clippy” - a paperclip representing the “help feature” in Microsoft Office 97.

[0012] There are many other such digital representations, for example, for online chat services, for help desks, etc.

[0013] Motion capture / animated avatars are used to represent people. They model and reproduce or mimic the movements, facial expressions of the user, and for “speaking”, often in a way that is reminiscent of cartoons, specific facial animations are represented. One area where this has been developed is a kind of content production by “vtuber” writers. Tools for creating avatars (vtube animation software) can be coupled with motion capture software to allow writers to generate video content in the form of animations. Creators are represented by the media generated by means of models and cameras. Sound can be added or recorded with video input.

[0014] “Live” social media applications can be designed around animation technology, and visual capture can provide users with the opportunity to transmit their own digital representation as a cartoon, with coding and real-time rendering. Communication partners can be human users or “robots”. Generally, “chatbot” services do not include such animated figures - icons or static images are used to represent artificial intelligence (AI).

[0015] Fine-grained “video capture”, then converted into cartoon form with audio and rendered into media is a computationally intensive task. There are many tools that can create avatars and vtube video clips, but these are generally not “live”.

[0016] Generally in the context of (graphical) network services, in particular in the context of the 3rd Generation Partnership Project (3GPP) 5th Generation (5G) and beyond, it is desirable to have a secure, reliable association between an avatar and the actual owner or user of the avatar, and to identify it.

[0017] Thus, the problem arises that measures are needed to allow for a differentiated verification of avatars and owners and their (legal) use.

[0018] Therefore, there is a need to provide security related to digital identities and representations. SUMMARY

[0019] Various example embodiments are intended to address at least some of the issues and / or problems and disadvantages described above.

[0020] Various aspects of the exemplary embodiments are set forth in the appended claims.

[0021] According to one exemplary aspect, a method is provided for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the method comprising: sending an authentication request to a communication endpoint, the authentication request including a pair of pre-identifiers indicating the digital representation entity and the communication endpoint; and receiving an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

[0022] According to one exemplary aspect, a method for providing a communication endpoint is provided, the method comprising: receiving a first authentication request from a digital representation entity that is a digital representation participant in a digital service or from an application, the first authentication request including a provisioned identifier indicating a pair of said digital representation entity and said communication endpoint; and sending a second authentication request to a network entity, the second authentication request including said provisioned identifier and identifier of said communication endpoint.

[0023] According to one exemplary aspect, a method for a network entity is provided, the method comprising: receiving a first authentication request from a communication endpoint, the first authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of a digital service participant; and sending a second authentication request to an application function entity, the second authentication request including the pre-identifier and the second identifier of the communication endpoint.

[0024] According to one exemplary aspect, a method for applying a functional entity is provided, the method comprising: receiving an authentication request from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant; and verifying authentication of the preliminary identifier by performing authentication.

[0025] According to one exemplary aspect, an apparatus for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the apparatus comprising: a transmitting circuit system configured to send an authentication request to a communication endpoint, the authentication request including a pair of preliminary identifiers indicating the digital representation entity and the communication endpoint; and a receiving circuit system configured to receive an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

[0026] According to one exemplary aspect, an apparatus for a communication endpoint is provided, the apparatus comprising: a receiving circuitry configured to receive a first authentication request from a digital representation entity that is a digital representation participant in a digital service or from an application, the first authentication request including a provisioned identifier indicating a pair of said digital representation entities and said communication endpoint; and a transmitting circuitry configured to transmit a second authentication request to a network entity, the second authentication request including said provisioned identifier and identifier of said communication endpoint.

[0027] According to one exemplary aspect, an apparatus for a network entity is provided, the apparatus comprising: a receiving circuitry system configured to receive a first authentication request from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of a digital service participant; and a transmitting circuitry system configured to transmit a second authentication request to an application function entity, the second authentication request including the preliminary identifier and the second identifier of the communication endpoint.

[0028] According to one exemplary aspect, an apparatus for applying a functional entity is provided, the apparatus comprising: a receiving circuitry system configured to receive an authentication request from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant; and a verification circuitry system configured to verify authentication of the preliminary identifier by performing authentication.

[0029] According to one exemplary aspect, an apparatus for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the apparatus comprising: at least one processor; at least one memory including computer program code; and at least one interface configured to communicate with at least one other apparatus, the at least one processor, together with the at least one memory and the computer program code, being configured to cause the apparatus to perform: sending an authentication request to a communication endpoint, the authentication request including a pair of pre-identifiers indicating the digital representation entity and the communication endpoint; and receiving an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

[0030] According to one exemplary aspect, an apparatus for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the apparatus comprising: at least one processor; at least one memory including computer program code; and at least one interface configured to communicate with at least one other apparatus, the at least one processor, together with the at least one memory and the computer program code, being configured to cause the apparatus to perform: receiving a first authentication request from the digital representation entity as a digital service participant or from an application, the first authentication request including a provisioned identifier indicating a pair of said digital representation entity and said communication endpoint; and sending a second authentication request to a network entity, the second authentication request including said provisioned identifier and identifier of said communication endpoint.

[0031] According to one exemplary aspect, an apparatus for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the apparatus comprising: at least one processor; at least one memory including computer program code; and at least one interface configured to communicate with at least one other apparatus, the at least one processor, together with the at least one memory and the computer program code, being configured to cause the apparatus to perform: receiving a first authentication request from a communication endpoint, the first authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant; and sending a second authentication request to an application function entity, the second authentication request including the pre-identifier and the second identifier of the communication endpoint.

[0032] According to one exemplary aspect, an apparatus for a digital representation entity, the digital representation entity being a digital representation of a digital service participant, the apparatus comprising: at least one processor; at least one memory including computer program code; and at least one interface configured to communicate with at least one other apparatus, the at least one processor, together with the at least one memory and the computer program code, being configured to cause the apparatus to perform: receiving an authentication request from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant; and authentication of the preliminary identifier by performing authentication.

[0033] According to one exemplary aspect, a computer program product is provided, the computer program product including computer-executable computer program code, which, when the program is run on a computer (e.g., a computer of the apparatus according to any one of the foregoing apparatus-related exemplary aspects of this disclosure), is configured to cause the computer to perform a method according to any one of the foregoing method-related exemplary aspects of this disclosure.

[0034] Such computer program products may include (or embody) a (tangible) computer-readable (storage) medium, etc., on which computer-executable computer program code is stored, and / or the program can be directly loaded into the internal memory of a computer or its processor.

[0035] Any of the above aspects enables efficient verification of avatars and owners and their (legitimate) use, thereby addressing at least some of the identified problems and shortcomings associated with the prior art.

[0036] Security related to digital identity and representation is provided through exemplary embodiments. More specifically, measures and mechanisms for implementing security related to digital identity and representation are provided through exemplary embodiments.

[0037] Therefore, improvements have been achieved through methods, apparatuses, and computer program products that enable / implement security related to digital identity and representation. Attached Figure Description

[0038] The present disclosure will now be described in more detail by way of non-limiting example with reference to the accompanying drawings, in which...

[0039] Figure 1 This is a block diagram illustrating an apparatus according to an example embodiment.

[0040] Figure 2 This is a block diagram illustrating an apparatus according to an example embodiment.

[0041] Figure 3 This is a block diagram illustrating an apparatus according to an example embodiment.

[0042] Figure 4 This is a block diagram illustrating an apparatus according to an example embodiment.

[0043] Figure 5 This is a block diagram illustrating an apparatus according to an example embodiment.

[0044] Figure 6 This is a block diagram illustrating an apparatus according to an example embodiment.

[0045] Figure 7 This is a block diagram illustrating an apparatus according to an example embodiment.

[0046] Figure 8 This is a schematic diagram of a process according to an example embodiment.

[0047] Figure 9 This is a schematic diagram of a process according to an example embodiment.

[0048] Figure 10 This is a schematic diagram of a process according to an example embodiment.

[0049] Figure 11 This is a schematic diagram of a process according to an example embodiment.

[0050] Figure 12 A schematic diagram of a signaling sequence according to an example embodiment is shown, and

[0051] Figure 13 Instead, a block diagram of an apparatus according to an example embodiment is shown. Detailed Implementation

[0052] This disclosure is described herein with reference to specific, non-limiting examples and embodiments that are now considered conceivable. Those skilled in the art will understand that this disclosure is by no means limited to these examples, but can be applied more broadly.

[0053] It should be noted that the following description of this disclosure and its embodiments primarily relates to specifications used as non-limiting examples of certain exemplary network configurations and deployments. That is, this disclosure and its embodiments are primarily described with respect to 3GPP specifications used as non-limiting examples of certain exemplary network configurations and deployments. Therefore, the description of the exemplary embodiments given herein specifically refers to terms directly related to them. Such terms are used only in the context of the presented non-limiting examples and are naturally not intended to limit this disclosure in any way. More precisely, any other communication or communication-related system deployments, etc., can be utilized as long as they conform to the features described herein.

[0054] In the following, various embodiments and implementations of this disclosure and its aspects or examples are described using several variations and / or substitutions. It should be generally noted that, depending on certain needs and constraints, all of the described variations and / or substitutions may be provided individually or in any conceivable combination (including combinations of individual features of the various variations and / or substitutions).

[0055] As used herein, “at least one of the following:”, “at least one of…”, and similar wording such as a list of two or more elements joined by “and” or “or” means at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

[0056] According to example embodiments, measures and mechanisms are generally provided for (enabling / implementing) security related to digital identity and representation.

[0057] The example implementation is designed with the premise that 5G systems (5GS) (as an example of communication systems) will be able to authenticate and authorize avatars to be used in services (especially in mobile metaverse services).

[0058] The authorization of an avatar by a 5G system (as an example of a communication system) implies the pre-authentication of the user behind the avatar. Once the 5G / User Equipment (UE) provides the avatar to the metaverse (as an example of a mobile service utilizing an avatar), the metaverse will believe (guarantee) that the avatar belongs only to an authenticated and authorized user, and that the binding between the user and the avatar is credible, that is, avatar X does indeed belong to user X.

[0059] Therefore, in short, according to the example embodiment, authentication and authorization of the avatar are achieved using cryptographic tokens.

[0060] Specifically, according to the example embodiment, authorization is managed at the 5G system (as an example of a communication system), an encrypted token is provided after authorization, and the token is used in avatar authentication at the metaverse (as an example of a mobile service utilizing an avatar).

[0061] The example implementation is described in more detail below.

[0062] Figure 1 This is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a network entity 10, such as a digital representation entity including a transmitting circuitry system 11 and a receiving circuitry system 12 (the digital representation entity is a digital representation of a digital service participant, such as an avatar). The transmitting circuitry system 11 sends an authentication request to a communication endpoint, the authentication request including a pair of pre-defined identifiers indicating the digital representation entity and the communication endpoint. The receiving circuitry system 12 receives an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token. Figure 8 This is a schematic diagram of a process according to an example embodiment. According to Figure 1 The device can perform Figure 8 This method, but is not limited to this method. Figure 8 The method can be derived from Figure 1 The device may be used to perform the operation, but it is not limited to the device itself.

[0063] like Figure 8As shown, the process according to the example embodiment includes an operation of sending an authentication request (S81) to a communication endpoint and an operation of receiving an authentication response (S82) from the communication endpoint, the authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and the authentication response including a (result confirmation and) authorization token.

[0064] In an embodiment, Figure 1 At least some functions of the illustrated apparatus can be shared between two physically separate devices that form an operational entity. Therefore, the apparatus can be considered as depicting an operational entity comprising one or more physically separate devices for performing at least some of the described processes.

[0065] The result confirmation can be implicit.

[0066] The pre-identifier can be a digital identity.

[0067] according to Figure 8 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such variations, an exemplary method based on an example embodiment may include sending a communication request to an application functional entity, including an identifier of the communication endpoint and the authorization token.

[0068] The identifier of the communication endpoint can be GPSI.

[0069] Figure 2 This is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a network entity 20, such as a communication endpoint (e.g., a terminal, UE) including a receiving circuit system 21 and a transmitting circuit system 22. The receiving circuit system 21 receives a first authentication request from a digital representation entity that is a digital service participant or from an application, the first authentication request including a provisioned identifier indicating a pair of said digital representation entity and said communication endpoint. The transmitting circuit system 22 sends a second authentication request to the network entity, the second authentication request including the provisioned identifier and an identifier of said communication endpoint. Figure 9 This is a schematic diagram of a process according to an example embodiment. According to Figure 2 The device can perform Figure 9 This method, but is not limited to this method. Figure 9 The method can be derived from Figure 2 The device may be used to perform the operation, but it is not limited to the device itself.

[0070] like Figure 9As shown, the process according to the example embodiment includes receiving (S91) a first authentication request from a digital representation entity that is a digital representation participant in a digital service or from an application, and sending (S92) a second authentication request to a network entity. The first authentication request includes a pair of pre-identifiers indicating the digital representation entity and the communication endpoint, and the second authentication request includes the pre-identifier and the identifier of the communication endpoint.

[0071] Figure 3 This is a block diagram illustrating an apparatus according to an example embodiment. Specifically, Figure 3 It shows Figure 2 A variation of the device shown. According to... Figure 2 The device may therefore also include a decryption circuit system 31 and / or a driving circuit system 32.

[0072] In an embodiment, Figure 2 (or Figure 3 At least some functions of the apparatus shown can be shared between two physically separate devices that form an operational entity. Therefore, the apparatus can be considered as an operational entity that describes one or more physically separate devices for performing at least some of the described processes.

[0073] Numbers can represent entities that can be incarnations.

[0074] The pre-identifier can be a digital identity.

[0075] The identifier for the communication endpoint can be SUCI.

[0076] according to Figure 9 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such a variation, an exemplary method according to an example embodiment may include receiving a first authentication response from the network entity, decrypting the encrypted authorization token into a decrypted authorization token using a first key, and sending a second authentication response to the digital representation entity, the first authentication response including (result confirmation and) the encrypted authorization token, and the second authentication response including (result confirmation and) the decrypted authorization token.

[0077] The result confirmation can be implicit.

[0078] according to Figure 9 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such variations, an exemplary method based on an example embodiment may include the operation of deriving the first key from the second key.

[0079] Figure 4This is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a network entity 40 (such as a network node or entity, for example, a home network (HN)) including a receiving circuitry system 41 and a transmitting circuitry system 42. The receiving circuitry system 41 receives a first authentication request from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of a digital service participant. The transmitting circuitry system 42 sends a second authentication request to an application function entity, the second authentication request including the preliminary identifier and a second identifier of the communication endpoint. Figure 10 This is a schematic diagram of a process according to an example embodiment. According to Figure 4 The device can perform Figure 10 This method, but is not limited to this method. Figure 10 The method can be derived from Figure 4 The device may be used to perform the operation, but it is not limited to the device itself.

[0080] like Figure 10 As shown, the process according to the example embodiment includes an operation of receiving (S101) a first authentication request from a communication endpoint and an operation of sending (S102) a second authentication request to an application function entity. The first authentication request includes a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint. The digital representation entities are digital representations of digital service participants. The second authentication request includes the pre-identifier and the second identifier of the communication endpoint.

[0081] Figure 5 This is a block diagram illustrating an apparatus according to an example embodiment. Specifically, Figure 5 It shows Figure 4 A variation of the device shown. According to... Figure 4 The apparatus may therefore also include a generation circuit system 51, an encryption circuit system 52 and / or a propagation circuit system 53.

[0082] In an embodiment, Figure 4 (or Figure 5 At least some functions of the apparatus shown can be shared between two physically separate devices that form an operational entity. Therefore, the apparatus can be considered as an operational entity that describes one or more physically separate devices for performing at least some of the described processes.

[0083] The pre-identifier can be a digital identity.

[0084] Numbers can represent entities that can be incarnations.

[0085] The first identifier of the communication endpoint can be SUCI.

[0086] The second identifier of the communication endpoint can be GPSI.

[0087] according to Figure 10 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such a variation, an exemplary method according to an example embodiment may include operations such as receiving a first authentication response from the application functional entity, generating an authorization token, encrypting the authorization token into an encrypted authorization token using a first key, and sending a second authentication response to the communication endpoint, the first authentication response including (result confirmation and) the second identifier of the communication endpoint, and the second authentication response including (result confirmation and) the encrypted authorization token.

[0088] The result confirmation can be implicit.

[0089] according to Figure 10 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such variations, an exemplary method based on an example embodiment may include the operation of deriving the first key from the second key.

[0090] Figure 6 This is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a network entity 60, such as an application function entity (e.g., a metaverse AF (application function)) including a receiving circuitry system 61 and an authentication circuitry system 62. The receiving circuitry system 61 receives an authentication request from the network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entities being digital representations of digital service participants. The authentication circuitry system 62 verifies the authentication of the preliminary identifier (by performing authentication). Figure 11 This is a schematic diagram of a process according to an example embodiment. According to Figure 6 The device can perform Figure 11 This method, but is not limited to this method. Figure 11 The method can be derived from Figure 6 The device may be used to perform the operation, but it is not limited to the device itself.

[0091] like Figure 11 As shown, the process according to the example embodiment includes an operation of receiving (S111) an authentication request from a network entity and an operation of verifying (S112) the authentication of the pre-identifier (by performing authentication), the authentication request including a pre-identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant.

[0092] Figure 7This is a block diagram illustrating an apparatus according to an example embodiment. Specifically, Figure 7 It shows Figure 6 A variation of the device shown. According to... Figure 6 The device may therefore also include a maintenance circuit system 71, a transmission circuit system 72, and / or a query circuit system 73.

[0093] In an embodiment, Figure 6 (or Figure 7 At least some functions of the apparatus shown can be shared between two physically separate devices that form an operational entity. Therefore, the apparatus can be considered as an operational entity that describes one or more physically separate devices for performing at least some of the described processes.

[0094] The pre-identifier can be a digital identity.

[0095] Numbers can represent entities that can be incarnations.

[0096] The identifier of the communication endpoint can be GPSI.

[0097] according to Figure 11 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such variations, an exemplary method based on an example embodiment may include operations for maintaining the context of the communication endpoint associated with the identifier of the digital representation entity and the communication endpoint.

[0098] according to Figure 11 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such a variation, an exemplary method according to an example embodiment may include the operation of sending an authentication response to the network entity, the authentication response including (result confirmation and) the identifier of the communication endpoint.

[0099] The result confirmation can be implicit.

[0100] according to Figure 11 Variations of the illustrated process provide exemplary additional operations, which are independent of each other. According to such variations, an exemplary method based on an example embodiment may include receiving a communication request from the digital representation entity, including the identifier [GPSI] of the communication endpoint and an authorization token, and querying the network entity for verification of the authorization token.

[0101] The example embodiments summarized and described above are explained below in more specific terms.

[0102] Figure 12A schematic diagram of a signaling sequence according to an example embodiment is shown, specifically illustrating avatar authentication at the Metaverse AF and authorization for using Metaverse services managed at the 5G system.

[0103] Figure 12 The diagram illustrates the process of avatar authentication and authorization.

[0104] According to an example embodiment, the avatar is authenticated at the Metaverse AF (e.g., via an Extensible Authentication Protocol (EAP) or any other authentication mechanism), which maintains the association between the avatar's identity in the Metaverse and the UE identifier (e.g., a General Public Subscription Identifier (GPSI)) in the 5GS. Upon successful authentication, the 5GS generates an authorization token with this association, which is securely sent to the UE and subsequently to the avatar, allowing it to access Metaverse services.

[0105] Specifically, in Figure 12 In step 1, a digital identity is prepared for Avatar_A in UE_A. Similar preparations are also performed on other UEs (e.g., UE_B, UE_C, etc.).

[0106] exist Figure 12 In step 2, 5GS master authentication for UE_A was successful. NAS and AS security contexts were then activated.

[0107] exist Figure 12 In step 3, according to the example embodiment, UE_A decides to use Avatar_A, or the application on the UE decides to use Avatar_A, and therefore it requests the UE to authenticate.

[0108] exist Figure 12 In step 4, according to the example embodiment, since the UE has already strengthened its connection with the network via the Non-Access Stratum (NAS) Control Plane (CP) or User Plane (UP) messages, it sends a Digital_Identity_A with a Subscription Hidden Identifier (SUCI) or 5G Globally Unique Temporary UE Identity (5G-GUTI) to the home network in the "Authentication Request" message (example: it could be an AVATAR authentication message).

[0109] When the 5G-GUTI is sent to the serving network, the Subscription Permanent Identifier (SUPI) is transferred to the home network along with the Digital_Identity_A.

[0110] exist Figure 12In step 5, if a SUCI is received in the Unified Data Manager (UDM), the UDM / SIDF (Subscription Identifier Dehiding Function) dehides it and verifies the SUPI and Digital_Identity_A. If UE_A / Avatar_A has a valid subscription using 5G services and primarily using metaverse services, the UDM notifies the Authentication Server Function (AUSF) and requests the AUSF to continue the authentication of Digital_Identity_A using an external metaverse authentication server. The UE subscription data in the UDM also contains information about which metaverse(s) the UE allows, and information about which metaverse server will be used to authenticate which avatar accordingly.

[0111] Alternatively, UE can also provide a metaverse server identity.

[0112] exist Figure 12 In step 6, according to the example embodiment, the home network sends an "authentication request" message with GPSI (UE_A) and digital identity (Digital_Identity_A) to the metaverse AF (which may be an authentication AAA server).

[0113] exist Figure 12 In steps 7 and 8, according to the example embodiment, Metaverse AF verifies whether the digital identity (Digital_Identity_A) and Avatar_A are authenticated. If further authentication is required, additional message exchanges are performed between Avatar_A and the Metaverse Authentication, Authorization, and Accounting (AAA) server.

[0114] exist Figure 12 In step 9, according to the example embodiment, after successful authentication, the Metaverse AF will maintain a “Metaverse UE Context” with the association between GPSI (UE_A) and Avatar (Avatar_A) identities.

[0115] exist Figure 12 In step 10, Metaverse AF will respond to the home network with an "authentication response" message containing GPSI and the "SUCCESS" indication.

[0116] exist Figure 12 In step 11, according to the example embodiment, the home network will use the generated authorization token and limited validity period for the Avatar_A serving the metaverse.

[0117] The token can be an OAuth 2.0 self-contained token as described in [RFC6819], in which all the information necessary to verify the validity of the token is contained within the token itself.

[0118] existFigure 12 In step 12, according to the example embodiment, an encryption key (which may be K) is used. AUSF Or from K AUSF The newly derived key is derived from the previous one, for example, "K". AVATAR The token is encrypted using a key that is independently derived by both the UE and the home network. Note that the encrypted token can only be decrypted on the UE side, and the serving network cannot decrypt the token or reuse it for other avatars.

[0119] According to an example embodiment, a key derivation function (KDF) can be used to extract key information from K. AUSF Generate a new key K AVATAR The hash of a digital identity can be used as a "salt," or it can be any contextual information.

[0120] exist Figure 12 In step 13, according to the example embodiment, the home network will send an "authentication response" (which may be an AVATAR authentication response) message with an encryption token to UE_A.

[0121] exist Figure 12 In step 14, according to the example embodiment, UE_A will use the same generation key (K). AUSF or K AVATAR (Use this to decrypt the token.)

[0122] exist Figure 12 In step 15, according to the example embodiment, after decryption, the token is shared with Avatar_A.

[0123] exist Figure 12 In step 16, according to the example embodiment, Avatar_A can use the token and GPSI to communicate with the Metaverse AF service.

[0124] exist Figure 13 In step 17, according to the example embodiment, Metaverse AF can use 5GS to verify the token.

[0125] The above processes and functions can be implemented by corresponding functional components, processors, etc., as described below.

[0126] In the foregoing exemplary description of network entities, functional blocks have been used to describe only units relevant to understanding the principles of this disclosure. A network entity may include further units necessary for its respective operation. However, descriptions of these units are omitted in this specification. The arrangement of functional blocks in the device should not be construed as limiting this disclosure, and functionality may be performed by a single block or further divided into sub-blocks.

[0127] When the foregoing description states that the device (i.e., a network node or entity (or some other component)) is configured to perform certain functions, this should be interpreted as equivalent to a description stating that at least one processor or corresponding circuitry (potentially cooperating with computer program code stored in the memory of the respective device) is configured to cause the device to perform at least the functions thus mentioned. Furthermore, such functions should be interpreted as equivalent to those implemented by a circuitry or component specifically configured to perform the corresponding functions (i.e., the expression "a unit configured as..." is interpreted as equivalent to expressions such as "a component for...").

[0128] exist Figure 13 Alternate illustrations of a device according to an example embodiment are depicted. Figures 1 to 12 As shown, according to an example embodiment, the device (network node or entity) 10' (corresponding to network node or entity 10) includes a processor 131, a memory 132, and an interface 133 connected via a bus 134, etc. Furthermore, according to an example embodiment, the device (network node or entity) 20' (corresponding to network node or entity 20) includes a processor 131, a memory 132, and an interface 133 connected via a bus 134, etc. Furthermore, according to an example embodiment, the device (network node or entity) 40' (corresponding to network node or entity 40) includes a processor 131, a memory 132, and an interface 133 connected via a bus 134, etc. Furthermore, according to an example embodiment, the device (network node or entity) 60' (corresponding to network node or entity 60) includes a processor 131, a memory 132, and an interface 133 connected via a bus 134, etc. These devices can be connected to another device (e.g., any other device among devices 10', 20', 40', and 60') via a link 135.

[0129] Processor 131 and / or interface 133 may also include modems, etc., to enable separate communication via (hardwired or wireless) links. Interface 133 may include suitable transceivers coupled to one or more antennas or communication components for separate (hardwired or wireless) communication with linked or connected devices. Interface 133 is generally configured to communicate with at least one other device (i.e., its interface).

[0130] The memory 132 may store a corresponding program assumed to include program instructions or computer program code, which, when executed by a corresponding processor, enables the corresponding electronic device or apparatus to operate according to the example embodiment.

[0131] Generally speaking, a corresponding device / apparatus (and / or part thereof) may refer to a component for performing a corresponding operation and / or displaying a corresponding function, and / or a corresponding device (and / or part thereof) may have a function for performing a corresponding operation and / or displaying a corresponding function.

[0132] When a processor (or some other component) is described in the following description as being configured to perform some function, this should be interpreted as equivalent to a description stating that at least one processor (potentially cooperating with computer program code stored in the memory of the respective device) is configured to cause the device to perform at least the function thus mentioned. Furthermore, such function should be interpreted as being equivalent to being implemented by a component specifically configured to perform the corresponding function (i.e., the statement "a processor configured [to cause the device] to perform xxx" is interpreted as equivalent to a statement such as "a component for xxx").

[0133] According to an example embodiment, an apparatus representing a network node or entity 10 (e.g., a digital representation entity, which is a digital representation of a digital service participant) includes: at least one processor 131; at least one memory 132 including computer program code; and at least one interface 133 configured to communicate with at least another apparatus. The processor (i.e., at least one processor 131 together with at least one memory 132 and the computer program code) is configured to perform sending an authentication request to a communication endpoint, the authentication request including a pair of pre-identifiers indicating the digital representation entity and the communication endpoint (therefore the apparatus includes corresponding sending components), and to perform receiving an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token (therefore the apparatus includes corresponding receiving components).

[0134] According to an example embodiment, an apparatus representing a network node or entity 20 (e.g., a communication endpoint) includes: at least one processor 131; at least one memory 132 including computer program code; and at least one interface 133 configured to communicate with at least another apparatus. The processor (i.e., at least one processor 131 together with at least one memory 132 and the computer program code) is configured to execute receiving a first authentication request from a digital representation entity that is a digital representation participant in a digital service or from an application, the first authentication request including a pair of pre-identifiers indicating the digital representation entity and the communication endpoint (therefore the apparatus includes corresponding receiving components), and executing sending a second authentication request to the network entity, the second authentication request including the pre-identifier and an identifier of the communication endpoint (therefore the apparatus includes corresponding sending components).

[0135] According to an example embodiment, an apparatus representing a network node or entity 10 (e.g., a network entity) includes: at least one processor 131; at least one memory 132 including computer program code; and at least one interface 133 configured to communicate with at least another apparatus. The processor (i.e., at least one processor 131 together with at least one memory 132 and the computer program code) is configured to execute receiving a first authentication request from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of a digital service participant (therefore the apparatus includes corresponding receiving components), and executing sending a second authentication request to an application function entity, the second authentication request including the preliminary identifier and a second identifier of the communication endpoint (therefore the apparatus includes corresponding sending components).

[0136] According to an example embodiment, an apparatus representing a network node or entity 10 (e.g., an application function entity) includes: at least one processor 131; at least one memory 132 including computer program code; and at least one interface 133 configured to communicate with at least another apparatus. The processor (i.e., at least one processor 131 together with at least one memory 132 and the computer program code) is configured to execute receiving an authentication request from the network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, the digital representation entity being a digital representation of a digital service participant (therefore the apparatus includes corresponding components for receiving), and to execute authentication by performing authentication to verify the preliminary identifier (therefore the apparatus includes corresponding components for verification).

[0137] For further details regarding the operability / functionality of individual devices, please refer to the above combination. List of acronyms and abbreviations A description of any one of the items.

[0138] For the purposes of this disclosure as stated above, it should be noted that: --The method steps that may be implemented as part of software code and run using a processor at a network server or network entity (as an example of a device, apparatus and / or its modules, or as an example of an entity including a device and / or its modules) are software code independent and can be described using any known or future-developed programming language, as long as the functionality defined by the method steps is preserved; --In general, any method or step is suitable to be implemented as software or hardware without changing the idea of ​​the embodiment or its modifications in terms of the implemented functionality; --The method steps and / or devices, units, or components that may be implemented as hardware components (e.g., devices that perform the functions of the devices according to the above embodiments) at the apparatus(s) or any modules(s) defined above are hardware-independent and may be implemented using any known or future-developed hardware technology or any combination of such technologies, such as MOS (Metal-Oxide-Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BiCMOS (Bipolar CMOS), ECL (Emitter-Coupled Logic), TTL (Transistor-Transistor Logic), etc., using, for example, ASIC (Application-Specific Integrated Circuit) components, FPGA (Field-Programmable Gate Array) components, CPLD (Complex Programmable Logic Device) components, or DSP (Digital Signal Processor) components; -- Devices, units, or components (e.g., network entities or network registers defined above, or any of their respective units / components) may be implemented as individual devices, units, or components, but this does not preclude them from being implemented in a distributed manner throughout the system, as long as the functionality of the devices, units, or components is preserved; -- Devices (such as user equipment and network entities / network registers) may be represented by semiconductor chips, chipsets or (hardware) modules including such chips or chipsets; however, this does not preclude the possibility that the functionality of a device or module may be implemented as software in a (software) module (such as a computer program or computer program product including executable software code portions for execution / running on a processor) rather than by hardware. --A device can be considered as an assembly of more than one device, for example, whether these devices are functionally cooperative or functionally independent, but are all housed in the same device housing.

[0139] Generally speaking, it should be noted that the corresponding functional blocks or elements according to the foregoing aspects can be implemented in hardware and / or software by any known means, provided that they are adapted only to perform the functions described in the corresponding parts. The mentioned method steps can be implemented in separate functional blocks or by separate devices, or one or more method steps can be implemented in a single functional block or by a single device.

[0140] Generally, any method or step is suitable for implementation as software or hardware without altering the ideas of this disclosure. Devices and components may be implemented as individual devices, but this does not preclude them from being implemented in a distributed manner throughout the system, provided that the functionality of the devices is preserved. Such and similar principles should be considered known to those skilled in the art.

[0141] Software in the sense of this specification includes: software code, which includes code components or portions for performing corresponding functions or computer programs or computer program products, and software (or computer programs or computer program products) embodied on a tangible medium, such as a computer-readable (storage) medium on which corresponding data structures or code components / portions are stored, or potentially embodied in signals or chips during its processing.

[0142] This disclosure also covers any conceivable combination of the above-described method steps and operations, as well as any conceivable combination of the above-described nodes, devices, modules or elements, provided that the above-described concepts of methodology and structural arrangement are applicable.

[0143] In view of the foregoing, measures are provided for security related to digital identity and representation. Such measures exemplarily include: receiving a first authentication request from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of a digital service participant; and sending a second authentication request to an application function entity, the second authentication request including the preliminary identifier and a second identifier of the communication endpoint.

[0144] Although the present disclosure has been described above with reference to examples in the accompanying drawings, it should be understood that the present disclosure is not limited thereto. Rather, it will be apparent to those skilled in the art that the present disclosure can be modified in various ways without departing from the scope of the inventive spirit disclosed herein. ​ 3GPP 3rd Generation Partner Program 5G 5th generation 5G-GUTI: The World's Only Temporary UE Identity 5GS 5G system AAA certification authorization billing AF application functions AI (Artificial Intelligence) AUSF Authentication Server Functionality CP control plane EAP Extensible Authentication Protocol GPSI General Public Subscription Identifier HN Home Network KDF key derivation function NAS Non-Access Layer NW Network RAN (Radio Access Network) SIDF Subscription Identifier Unhiding Function SN service network SUCI subscription hidden identifier SUPI subscription permanent identifier UDM Unified Data Manager UE User Equipment UP User Plane UPF User Plane Functions

Claims

1. A method for digitally representing an entity, said digitally representing an entity as a digital representation of a digital service participant, the method comprising: Send an authentication request to the communication endpoint, the authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and Receive an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

2. The method according to claim 1, further comprising: Send a communication request to the application function entity, including the identifier of the communication endpoint and the authorization token.

3. A method for a communication endpoint, the method comprising: A first authentication request is received from a digital representation entity that is a participant in a digital service or from an application. The first authentication request includes pre-defined identifiers indicating a pair of said digital representation entities and said communication endpoints. A second authentication request is sent to the network entity, the second authentication request including the pre-identifier and the identifier of the communication endpoint.

4. The method according to claim 3, further comprising: Receive a first authentication response from the network entity, the first authentication response including a result confirmation and an encrypted authorization token. The encrypted authorization token is decrypted into a decryption authorization token using the first key, and A second authentication response is sent to the digital representation entity, the second authentication response including result confirmation and the decryption authorization token.

5. The method according to claim 4, further comprising: The first key is derived from the second key.

6. A method for a network entity, the method comprising: A first authentication request is received from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, wherein the digital representation entities are digital representations of a digital service participant. A second authentication request is sent to the application function entity, the second authentication request including the pre-identifier and the second identifier of the communication endpoint.

7. The method according to claim 6, further comprising: A first authentication response is received from the application functional entity, the first authentication response including result confirmation and the second identifier of the communication endpoint. Generate authorization token, The authorization token is encrypted into an encrypted authorization token using the first key, and A second authentication response is sent to the communication endpoint, the second authentication response including result confirmation and the encrypted authorization token.

8. The method according to claim 7, further comprising: The first key is derived from the second key.

9. The method according to any one of claims 6 to 8, wherein The network entity is an authentication server functional entity or a unified data manager.

10. A method for applying a functional entity, the method comprising: An authentication request is received from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, wherein the digital representation entity is a digital representation of a digital service participant, and The authentication of the pre-identifier is verified by performing authentication.

11. The method of claim 10, further comprising: Maintain the context of the communication endpoint associated with the identifier of the digital representation entity and the communication endpoint.

12. The method according to claim 10 or 11, further comprising: Send an authentication response to the network entity, the authentication response including result confirmation and the identifier of the communication endpoint.

13. The method according to any one of claims 10 to 12, further comprising: Receive a communication request from the digital representation entity, including the identifier and authorization token of the communication endpoint, and Query the network entity to verify the authorization token.

14. An apparatus for digitally representing an entity, said digitally representing an entity as a digital representation of a digital service participant, the apparatus comprising: A transmitting circuit system configured to send an authentication request to a communication endpoint, the authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and A receiving circuit system configured to receive an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

15. The apparatus of claim 14, further comprising: A transmitting circuit system configured to send a communication request to an application function entity, including the identifier of the communication endpoint and the authorization token.

16. An apparatus for a communication endpoint, the apparatus comprising: A receiving circuitry system configured to receive a first authentication request from a digital representation entity that is a participant in a digital service or from an application, the first authentication request including a pre-identifier indicating a pair of said digital representation entities and said communication endpoint, and A transmitting circuit system configured to send a second authentication request to a network entity, the second authentication request including the pre-identifier and the identifier of the communication endpoint.

17. The apparatus of claim 16, further comprising: A receiving circuitry system configured to receive a first authentication response from the network entity, the first authentication response including a result confirmation and an encrypted authorization token. A decryption circuit system configured to decrypt the encrypted authorization token into a decryption authorization token using a first key, and A transmitting circuit system configured to send a second authentication response to the digital representation entity, the second authentication response including a result confirmation and the decryption authorization token.

18. The apparatus of claim 17, further comprising: A derivation circuit system configured to derive the first key from the second key.

19. An apparatus for a network entity, the apparatus comprising: A receiving circuitry system configured to receive a first authentication request from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, the digital representation entities being digital representations of digital service participants. A transmitting circuit system configured to send a second authentication request to an application function entity, the second authentication request including the pre-identifier and a second identifier of the communication endpoint.

20. The apparatus of claim 19, further comprising: A receiving circuitry system configured to receive a first authentication response from the application functional entity, the first authentication response including a result acknowledgment and the second identifier of the communication endpoint. A generation circuit system, configured to generate authorization tokens. An encryption circuit system configured to encrypt the authorization token into an encrypted authorization token using a first key, and A transmitting circuit system configured to send a second authentication response to the communication endpoint, the second authentication response including a result confirmation and the encrypted authorization token.

21. The apparatus of claim 20, further comprising: A derivation circuit system configured to derive the first key from the second key.

22. The apparatus according to any one of claims 19 to 21, wherein The network entity is an authentication server functional entity or a unified data manager.

23. An apparatus for applying a functional entity, the apparatus comprising: A receiving circuitry system configured to receive an authentication request from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, wherein the digital representation entity is a digital representation of a digital service participant, and A verification circuit system configured to verify the authentication of the pre-identifier by performing authentication.

24. The apparatus of claim 23, further comprising: A maintenance circuit system configured to maintain the context of the communication endpoint associated with the identifier of the digital representation entity and the communication endpoint.

25. The apparatus according to claim 23 or 24, further comprising: A transmitting circuit system configured to send an authentication response to the network entity, the authentication response including a result confirmation and the identifier of the communication endpoint.

26. The apparatus according to any one of claims 23 to 25, further comprising: A receiving circuitry system configured to receive a communication request from the digital representation entity, including the identifier and authorization token of the communication endpoint, and A query circuit system configured to query the authorization token for verification from the network entity.

27. An apparatus for digitally representing an entity, said digitally representing an entity as a digital representation of a digital service participant, the apparatus comprising: At least one processor, At least one memory, said at least one memory including computer program code, and At least one interface, the at least one interface being configured to communicate with at least another device. The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Send an authentication request to the communication endpoint, the authentication request including a pre-identifier indicating a pair of digital representation entities and the communication endpoint, and Receive an authentication response from the communication endpoint, the authentication response including a result confirmation and an authorization token.

28. The apparatus of claim 27, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Send a communication request to the application function entity, including the identifier of the communication endpoint and the authorization token.

29. An apparatus for a communication endpoint, the apparatus comprising: At least one processor, At least one memory, said at least one memory including computer program code, and At least one interface, the at least one interface being configured to communicate with at least another device. The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: A first authentication request is received from a digital representation entity that is a participant in a digital service or from an application. The first authentication request includes pre-defined identifiers indicating a pair of said digital representation entities and said communication endpoints. A second authentication request is sent to the network entity, the second authentication request including the pre-identifier and the identifier of the communication endpoint.

30. The apparatus of claim 29, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Receive a first authentication response from the network entity, the first authentication response including a result confirmation and an encrypted authorization token. The encrypted authorization token is decrypted into a decryption authorization token using the first key, and A second authentication response is sent to the digital representation entity, the second authentication response including result confirmation and the decryption authorization token.

31. The apparatus of claim 30, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: The first key is derived from the second key.

32. An apparatus for a network entity, the apparatus comprising: At least one processor, At least one memory, said at least one memory including computer program code, and At least one interface, the at least one interface being configured to communicate with at least another device. The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: A first authentication request is received from a communication endpoint, the first authentication request including a preliminary identifier indicating a pair of digital representation entities and the communication endpoint, and a first identifier of the communication endpoint, wherein the digital representation entities are digital representations of a digital service participant. A second authentication request is sent to the application function entity, the second authentication request including the pre-identifier and the second identifier of the communication endpoint.

33. The apparatus of claim 32, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: A first authentication response is received from the application functional entity, the first authentication response including result confirmation and the second identifier of the communication endpoint. Generate authorization token, The authorization token is encrypted into an encrypted authorization token using the first key, and A second authentication response is sent to the communication endpoint, the second authentication response including result confirmation and the encrypted authorization token.

34. The apparatus of claim 33, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: The first key is derived from the second key.

35. The apparatus according to any one of claims 32 to 34, wherein The network entity is an authentication server functional entity or a unified data manager.

36. An apparatus for applying a functional entity, the apparatus comprising: At least one processor, At least one memory, said at least one memory including computer program code, and At least one interface, the at least one interface being configured to communicate with at least another device. The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: An authentication request is received from a network entity, the authentication request including a preliminary identifier indicating a pair of digital representation entities and a communication endpoint, and an identifier of the communication endpoint, wherein the digital representation entity is a digital representation of a digital service participant, and The authentication of the pre-identifier is verified by performing authentication.

37. The apparatus of claim 36, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Maintain the context of the communication endpoint associated with the identifier of the digital representation entity and the communication endpoint.

38. The apparatus according to claim 36 or 37, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Send an authentication response to the network entity, the authentication response including result confirmation and the identifier of the communication endpoint.

39. The apparatus according to any one of claims 36 to 38, wherein The at least one processor, together with the at least one memory and the computer program code, is configured to cause the device to perform: Receive a communication request from the digital representation entity, including the identifier and authorization token of the communication endpoint, and Query the network entity to verify the authorization token.

40. A computer program product comprising computer-executable computer program code, the computer-executable computer program code being configured, when the program is run on a computer, to cause the computer to perform the method according to any one of claims 1 to 2, 3 to 5, 6 to 9, or 10 to 13.

41. The computer program product of claim 40, wherein the computer program product includes a computer-readable medium on which the computer-executable computer program code is stored, and / or wherein the program can be directly loaded into the internal memory of the computer or its processor.

Images