Device and method for providing mobile edge computing services in a wireless communication system

Abstract

The present disclosure relates to a fifth generation (5G) or pre-5G communication system, such as long term evolution (LTE), for supporting a higher data transmission rate than a fourth generation (4G) system. The present disclosure relates to authentication and authorization of edge computing applications in a wireless communication system and an operation method of a user equipment (UE). The method may include: sending a first message containing at least one of information related to the UE or a type of user agent to a server, performing an authentication process for an edge computing service according to an authentication method determined based on the first message, receiving a second message indicating authorization for the edge computing service based on an authentication code generated by the server according to the executed authentication process, and using the edge computing service within a scope corresponding to the granted authorization.

Description

Technical Field

[0001] The present disclosure relates to a wireless communication system. More specifically, the present disclosure relates to an apparatus and method for providing a mobile edge computing (MEC) service in a wireless communication system. Background Art

[0002] In order to meet the increased demand for wireless data services since the deployment of the 4th generation (4G) communication system, efforts have been made to develop improved 5th generation (5G) or pre-5G communication systems. Therefore, 5G or pre-5G communication systems are also referred to as "beyond 4G networks" or "post-long term evolution (LTE) systems".

[0003] 5G communication systems are considered to be implemented in higher frequency (mmWave) bands (e.g., 60 GHz bands) to achieve higher data rates. In order to reduce the propagation loss of radio waves and increase the transmission distance, beamforming, massive multiple-input multiple-output (MIMO), full-dimensional MIMO (FD-MIMO), array antennas, analog beamforming, and massive antenna technologies are discussed in 5G communication systems.

[0004] Furthermore, in the 5G communication system, development of system network improvements based on advanced small base stations, cloud radio access networks (RAN), ultra-dense networks, device-to-device (D2D) communications, wireless backhaul, mobile networks, cooperative communications, coordinated multipoint (CoMP), receiving-end interference cancellation, etc. is underway. In the 5G system, hybrid frequency shift keying (FSK) and quadrature amplitude modulation (FQAM) and sliding window superposition coding (SWSC) as advanced coding modulation (ACM) and filter bank multi-carrier (FBMC), non-orthogonal multiple access (NOMA), and sparse code multiple access (SCMA) as advanced access technologies have been developed.

[0005] At the same time, technologies for providing edge computing services related to 5G systems are emerging. "Edge computing" is a technology that provides computing resources to users who are physically close. In particular, mobile edge computing is edge computing implemented in mobile environments such as 5G systems, which is expected to provide more powerful computing capabilities with low latency.

[0006] The above information is described as background information only to assist with an understanding of the present disclosure. No determination is made, and no assertion is made, as to whether any of the above might be applicable as prior art to the present disclosure. Summary of the invention

[0007] Technical Solution

[0008] Aspects of the present disclosure at least solve the above problems and / or disadvantages and provide at least the following advantages. Therefore, one aspect of the present disclosure provides an apparatus and method for providing a mobile edge computing (MEC) service in a wireless communication system.

[0009] Another aspect of the present disclosure provides an apparatus and method for performing an authentication process for granting authority to a mobile edge computing service in a wireless communication system.

[0010] Additional aspects will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the presented embodiments.

[0011] In addition, the present disclosure provides an apparatus and method for determining an authentication method for authorization of a mobile edge computing service in a wireless communication system.

[0012] Furthermore, the present disclosure provides an apparatus and method for determining whether to grant permission to a mobile edge computing service in a wireless communication system.

[0013] According to one aspect of the present disclosure, a method for operating a user equipment (UE) in a wireless communication system is provided. The method includes: sending a first message including at least one of information related to the UE or a type of a user agent to a server; performing an authentication process for an edge computing service according to an authentication method determined based on the first message; receiving a second message indicating authorization to grant the edge computing service based on an authorization code generated by the server according to the executed authentication process; and using the edge computing service within a scope corresponding to the authorized authorization.

[0014] According to another aspect of the present disclosure, a UE device in a wireless communication system is provided. The device includes a transceiver and at least one processor connected to the transceiver, wherein the at least one processor can be configured to: send a first message to a server, the first message including at least one of information related to the UE or a type of a user agent; perform an authentication process for an edge computing service according to an authentication method determined based on the first message; based on an authentication code generated by the server according to the executed authentication process, receive a second message indicating the authority granted to the edge computing service; and use the edge computing service within a scope corresponding to the granted authority.

[0015] According to another aspect of the present disclosure, a method for a server to authorize an edge computing service is provided. The method includes: receiving a first message from a UE including at least one of information related to the UE or a type of a user agent; performing an authentication process according to an authentication method determined based on the first message; sending an authentication code generated according to the performed authentication process to the UE; and sending a second message indicating the authorization of the edge computing service based on the authentication code, wherein the edge computing service can be used by the UE within a scope corresponding to the authorized authorization.

[0016] According to another aspect of the present disclosure, a server device for authorizing edge computing applications in a wireless communication system is provided. The device includes a transceiver and at least one processor connected to the transceiver, wherein the at least one processor can be configured to: receive a first message from a UE, the first message including information related to the UE or at least one of the types of user agents; perform an authentication process according to an authentication method determined based on the first message; send an authentication code generated according to the executed authentication process to the UE; and send a second message indicating the authorization of edge computing services based on the authentication code, wherein the UE can use the edge computing services within the scope corresponding to the authorized authorization.

[0017] The apparatus and method according to various embodiments can provide differentiated edge computing services to individual mobile communication subscribers without requiring additional subscriber information for edge computing services. In addition, the apparatus and method according to various embodiments enable an efficient authentication process to be performed using a more appropriate authentication method.

[0018] Effects obtained from the present disclosure may not be limited to the above-mentioned effects, and other effects that are not mentioned may be clearly understood by those skilled in the art to which the present disclosure belongs through the following description.

[0019] Other aspects, advantages, and salient features of the disclosure will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the accompanying drawings, discloses various embodiments of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other aspects, features and advantages of certain embodiments of the present disclosure will become more apparent through the following description in conjunction with the accompanying drawings, in which:

[0021] Figure 1 A wireless communication system according to an embodiment of the present disclosure is shown;

[0022] Figure 2 An example of providing a mobile edge computing (MEC) service in a wireless communication system according to an embodiment of the present disclosure is shown;

[0023] Figure 3The structure of authentication and authorization for edge applications in a wireless communication system according to an embodiment of the present disclosure is shown;

[0024] Figure 4 The configuration of a terminal in a wireless communication system according to an embodiment of the present disclosure is shown;

[0025] Figure 5 The configuration of a server in a wireless communication system according to an embodiment of the present disclosure is shown;

[0026] Figure 6 A flowchart of a process in which a user equipment (UE) performs authentication on an edge application in a wireless communication system according to an embodiment of the present disclosure is shown;

[0027] Figure 7 A flowchart of applying an authentication and authorization function (AAF) to perform an authentication process on an edge application in a wireless communication system according to an embodiment of the present disclosure is shown;

[0028] Fig. 8A A signal exchange diagram showing an authentication process for an edge application in a wireless communication system according to an embodiment of the present disclosure is shown;

[0029] Figure 8B Another signal exchange diagram for performing an authentication process for an edge application in a wireless communication system according to an embodiment of the present disclosure is shown;

[0030] Fig. 9 A flow chart of a method for UE to determine an edge application authentication in a wireless communication system according to an embodiment of the present invention is shown;

[0031] Fig.10 A flowchart of a method for determining an edge application authentication by an AAF in a wireless communication system according to an embodiment of the present disclosure is shown;

[0032] Fig.11 A signal exchange diagram showing an authentication process based on USIM credentials in a wireless communication system according to various embodiments is shown;

[0033] Fig.12 A signal exchange diagram for performing an authentication process based on a user portal in a wireless communication system according to an embodiment of the present disclosure is shown;

[0034] Fig.13 An example of a user portal screen for performing an authentication process based on a user portal in a wireless communication system according to an embodiment of the present disclosure is shown;

[0035] Fig.14 A signal exchange diagram showing an authentication process performed based on automatically generated credentials in a wireless communication system according to an embodiment of the present disclosure;

[0036] Fig.15 A signal exchange diagram for performing an authentication process based on an OTP in a wireless communication system according to an embodiment of the present disclosure is shown;

[0037] Fig.16 A signal interaction diagram is shown in the case where an access token is successfully generated in a wireless communication system according to an embodiment of the present invention;

[0038] Fig.17 A signal interaction diagram is shown in the case where access token generation fails in a wireless communication system according to an embodiment of the present invention;

[0039] Fig.18 A flowchart of granting permissions to an edge application by a UE in a wireless communication system according to an embodiment of the present disclosure is shown;

[0040] Fig.19 A flowchart of AAF granting permissions to edge applications in a wireless communication system according to an embodiment of the present disclosure is shown;

[0041] Fig. 20 A flowchart of an application function (AF) granting permissions to an edge application in a wireless communication system according to an embodiment of the present disclosure is shown;

[0042] Fig.21 A signal exchange diagram for granting permissions to edge applications in a wireless communication system according to an embodiment of the present disclosure is shown;

[0043] Fig. 22 A signal exchange diagram is shown to obtain user consent to use personal information in a wireless communication system according to an embodiment of the present disclosure;

[0044] Fig.23 A signal exchange diagram using personal information in a wireless communication system according to an embodiment of the present disclosure is shown;

[0045] Fig.24 A network structure for mapping an authentication and authorization structure for edge applications to an edge computing structure in a wireless communication system according to an embodiment of the present disclosure is shown; and

[0046] Fig.25 A process of determining an authentication method by a terminal and an AAF when multiple authentication methods are provided in a wireless communication system according to an embodiment of the present disclosure is shown.

[0047] Throughout the drawings, like reference numerals will be understood to refer to like parts, components, and structures. DETAILED DESCRIPTION

[0048] The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of the various embodiments of the present disclosure as defined by the claims and their equivalents. It includes various specific details to assist in understanding, but these are to be regarded as exemplary only. Therefore, it will be appreciated by those of ordinary skill in the art that various changes and modifications may be made to the various embodiments described herein without departing from the scope and spirit of the present disclosure. In addition, descriptions of well-known functions and configurations may be omitted for clarity and brevity.

[0049] The terms and words used in the following description and claims are not limited to the literal meanings, but are used only by the inventor to enable a clear and consistent understanding of the present disclosure. Therefore, it should be clear to those skilled in the art that the following description of various embodiments of the present disclosure is provided for illustrative purposes only, and not for the purpose of limiting the present disclosure as defined by the attached claims and their equivalents.

[0050] It is to be understood that the singular forms "a", "an", and "the" include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to "a component surface" includes reference to one or more of such surfaces.

[0051] Hereinafter, the present disclosure relates to an apparatus and method for providing a mobile edge computing (MEC) service in a wireless communication system. Specifically, the present disclosure describes a technology for providing different edge computing services to respective subscribers through an authentication process according to an authentication method determined based on various information and an authorization process for edge applications in a wireless communication system.

[0052] In the following description, for the sake of convenience, terms indicating signals, terms indicating channels, terms indicating control information, terms indicating network entities, terms indicating data stored in network entities, terms indicating messages exchanged between entities, terms indicating device elements, etc. are exemplarily used. Therefore, the present disclosure is not limited by the terms used below, and other terms indicating subjects having equivalent technical meanings may be used.

[0053] In addition, the various embodiments of the present disclosure will be described using terms and names defined in some communication standards (eg, the 3rd Generation Partnership Project (3GPP) standard) as examples. However, the various embodiments of the present disclosure can be applied to other communication systems through easy modifications.

[0054] Figure 1 A wireless communication system according to an embodiment of the present disclosure is shown. Figure 1 The wireless communication system shown includes an edge computing system 100 and a 5G system 140.

[0055] Reference Figure 1, the edge computing system may include edge servers 102 and 106 , a user equipment (UE) 104 , a configuration server 108 , and a domain name system (DNS) server 110 .

[0056] Each of the edge servers 102 and 106 is a server that the UE 104 accesses in order to use a mobile edge computing (MEC) service. A third-party application server provided by a third party may be driven in each of the edge servers 102 and 106.

[0057] The configuration server 108 is an initial access server for providing configuration information for using the MEC service to the UE 104. The configuration server 108 can perform the function of sending the configuration information for using the MEC service to the UE 104. The configuration server 108 knows the deployment of the edge servers 102 and 106. Therefore, the UE 104 can access the configuration server 108 before using the MEC service, thereby obtaining the configuration information required for the MEC service, such as information about the edge servers 102 and 106 that the UE 104 must access at a specific location.

[0058] The DNS server 110 may be used to resolve the Internet Protocol (IP) addresses of the edge servers 102 and 106 or the IP addresses of the application servers operating in the upper layers of the edge servers 102 and 106. That is, the DNS server 110 may be a network function that knows information about the edge servers 102 and 106 or information about the application servers driven in the upper layers of the edge servers 102 and 106. The DNS server 110 may be provided to each edge server 120 covering a specific area or a single DNS server 110 may be provided to the entire edge computing system. In the case where the DNS server 110 for MEC is provided to each edge data network 120 covering a specific area, the UE 104 is required to identify information about the DNS of the corresponding location. In the case where a single DNS server 110 is provided for the entire edge computing system, the DNS server 110 needs to identify information about the edge servers 102 and 106 deployed in the entire network and information about the application servers provided by the edge computing system, and the corresponding information may be provided by the edge servers 102 and 106 to the DNS server 110.

[0059] UE 104 is a device used by a user and performs communication with 5G-RAN 142 through a wireless channel. In some cases, UE 104 may be operated without user intervention. That is, UE 104 may be a device that performs machine type communication (MTC) and may not be held by a user. UE 104 may be referred to as a "terminal", "mobile station", "subscriber station", "remote terminal", "wireless terminal", "user equipment" or another term having a technical meaning equivalent to the above names as well as "UE".

[0060] In addition, the 5G system may include a 5G radio access network (RAN) 142, a user plane function (UPF) 144, an access and mobility management function (AMF) 146, a session management function (SMF) 148, a policy and charging function (PCF) 150, and a network exposure function (NEF) 152. AMF 146 is a network function that manages the mobility of UE 104. SMF 148 is a network function that manages a packet data network (PDN) connection provided to the UE. The connection may be referred to as a "protocol data unit (PDU) session". PCF 150 is a network function that applies a service policy, a charging policy, and a PDU session policy for a mobile communication service provider to the UE. NEF 152 is capable of accessing information for managing UEs in a 5G network, thereby performing subscription to a mobility management event of the corresponding UE, subscription to a session management event of the corresponding UE, requesting session related information, configuring charging information of the corresponding UE, requesting a change in the PDU session policy of the corresponding terminal, and sending small data for the corresponding UE. 5G-RAN 142 refers to a base station that provides wireless communication functions for UE. UPF 144 can act as a gateway for sending packets sent and received by UE. Since UPF 144 can be located near edge server 106 to support MEC services, UPF 144 can send data packets to edge data network 120 to achieve low-latency transmission. UPF 144 can also be connected to data network 130 leading to the Internet. Therefore, UPF 144 can route data sent by UE to the Internet to data network 130. In addition, although Figure 1 Not shown, but the 5G system may also include unified data management (UDM). The UDM refers to a network function that stores subscriber information.

[0061] Figure 2 An example of providing a mobile edge computing service in a wireless communication system according to an embodiment of the present disclosure is shown.

[0062] refer to Figure 2, the example wireless communication includes UDM 202, EF 204, Internet 206, UPF 208, EF 210, UPF 212, UE 214, UE 216, a first cloud application 222, a second cloud application 224, a first edge application 232, and a second edge application 234.

[0063] Reference Figure 2 , UE 214 and UE 216 may be located in an edge network service area where edge computing services can be provided through an edge data network. In this case, the mobile communication service provider may provide different services to each UE. That is, the mobile communication service provider may distinguish service content such as whether to provide edge computing services based on at least one of the information related to the subscriber or the service provider policy. An example of distinguishing edge computing services is shown in Table 1 below.

[0064] Table 1

[0065] UE Whether to provide edge computing services Edge Applications Location UE 1 O APP 1, APP 2 The whole area UE 2 O APP 1 The whole area UE 3 O AAP 2 Eastern District UE 4 X - -

[0066] Referring to Table 1, the service provider may determine to provide edge computing services to UE 1, UE 2, and UE 3 and not to provide edge computing services to UE 4. In addition, the service provider may allow UE 1 to use edge applications APP 1 and APP 2 throughout the edge network service area, may allow UE 2 to use edge application APP 1 throughout the edge network service area, and may allow UE3 to use edge application APP 2 in the eastern area of ​​the edge network service area. On the other hand, the service provider may determine not to allow UE 4 to use edge computing services. That is, the service provider may provide differentiated services for the type of edge computing services provided and the service provision area, as well as whether edge computing services are provided. For example, if UE 216 corresponds to UE 1, a service that enables the use of edge applications APP 1 and APP 2 throughout the edge network service area may be provided to UE 216. In this case, UE 216 can use at least one of the first edge application and the second edge application provided by enabling function (EF) 210 through the edge data network. At the same time, if UE 216 corresponds to UE 4, UE 216 cannot use edge computing services. Therefore, the UE 214 can use at least one of the first cloud application and the second cloud application through the Internet 206.

[0067] As a function of enabling MEC services for edge application servers, the above EF 204 or 210 may perform a function of managing information about edge application servers. In addition, EF 204 or 210 may perform a function of notifying the UE of information about the edge data network in which the edge application is running and a fully qualified domain name (Fully Qualified Domain Name (FQDN)) or an IP address required to send data to the corresponding edge application server.

[0068] Figure 3 The structure of authentication and authorization for edge applications in a wireless communication system according to an embodiment of the present disclosure is shown.

[0069] Reference Figure 3 , a structure for authentication and authorization includes a UE 310, an application authentication and authorization function (AAF) 320, an application function (AF) 330, a UDM 340, an authentication server function (AUSF) 350, and an application profile record (APR) 360.

[0070] UE 310 may include user agent 312 and application 314. In this case, application 314 is an application separated from the edge application, and UE 310 may perform an authentication process of the application layer using user agent 312 and application 314.

[0071] The AAF 320 may include an authorization endpoint 322, an application security anchor function (ASAF) 324, a portal 326, and a token endpoint 328. The AAF 320 may receive a message sent to the authorization endpoint 322 for the UE to perform an authentication process using an edge computing service, and the AAF 320 may perform the authentication process. In this case, the authorization endpoint 322 may be an authorization endpoint of a request for comment (RFC) 8252. In addition, after the authentication process is completed, the AAF 320 may receive a message sent from the UE to the token endpoint 328, and may perform an authorization process for the edge computing service. In this case, the token endpoint 328 may be a token endpoint of RFC 8252. In addition, in the case where the authentication process is performed according to an authentication method based on USIM credentials, the ASAF 324 may perform a function corresponding to a security-related function performed by a security anchor function (SEAF) in the application layer. In addition, if the authentication process is performed according to an authentication method based on a user portal, the AAF 320 may use the portal 326 to perform the function of a web portal server.

[0072] In addition, the AF 330 may perform a function of a general application server for verifying a token sent from the UE. For example, the AF 330 may perform a function corresponding to that of a resource server of RFC 6750.

[0073] In addition, the UDM 340 may store information related to the user of the UE, thereby providing information required to perform an authentication process and an authorization process between the UE and the AAF.

[0074] Furthermore, if authentication and key agreement (AKA) using USIM credentials is performed, the AUSF 350 may operate as an AKA authentication server.

[0075] In addition, APR 360 may store information and configuration files related to the application, thereby providing information about the application that may be required when performing an authentication process and an authorization process.

[0076] The detailed operations of the objects used for the above authentication and authorization will be described in detail below.

[0077] Figure 4 The configuration of a terminal in a wireless communication system according to an embodiment of the present disclosure is shown. Figure 4 The configuration shown in can be understood as Figure 3 The term "unit" or "-device" used hereinafter means a unit that processes at least one function or operation and may be implemented as hardware, software, or a combination thereof.

[0078] Reference Figure 4 , the UE includes a communication unit 410 (eg, a transceiver), a storage unit 420, and a controller 430 (eg, at least one processor).

[0079] The communication unit 410 performs the function of sending and receiving signals through a wireless channel. For example, the communication unit 410 performs the conversion function between the baseband signal and the bit string according to the physical layer standard of the system. In addition, when sending data, the communication unit 410 encodes and modulates the transmission bit string to generate a composite symbol. In addition, when receiving data, the communication unit 410 demodulates and decodes the baseband signal to recover the received bit string. In addition, the communication unit 410 up-converts the baseband signal to an RF band signal so as to be sent through an antenna, and down-converts the RF band signal received by the antenna to a baseband signal. For example, the communication unit 410 may include a transmission filter, a reception filter, an amplifier, a mixer, an oscillator, a DAC, an ADC, etc.

[0080] In addition, the communication unit 410 may include multiple transmission and reception paths. In addition, the communication unit 410 may include at least one antenna array, which includes multiple antenna elements. In terms of hardware, the communication unit 410 may include digital circuits and analog circuits {e.g., radio frequency integrated circuits (RFIC)}. In this case, the digital circuits and analog circuits may be implemented as a single package. In addition, the communication unit 410 may include multiple RF chains. In addition, the communication unit 410 may perform beamforming.

[0081] The communication unit 410 transmits and receives signals as described above. Therefore, all or some of the communication unit 410 may be referred to as a "transmitter", "receiver" or "transceiver". In addition, the transmission and reception performed here through the wireless channel include the above-mentioned processes performed by the communication unit 410.

[0082] The storage unit 420 stores data such as basic programs, application programs, configuration information, etc. for UE operation. The storage unit 420 may include a volatile memory, a non-volatile memory, or a combination thereof. In addition, the storage unit 420 provides the stored data at the request of the controller 430.

[0083] The controller 430 controls the overall operation of the UE. For example, the controller 430 sends and receives signals through the communication unit 410. In addition, the controller 430 records data in the storage unit 420 and reads data from the storage unit 420. In addition, the controller 430 can perform the functions of the protocol stack required by the communication standard. To this end, the controller 430 may include at least one processor or microprocessor, or may be a part of a processor. For example, a part of the communication unit 410 or the controller 430 may be referred to as a "communication processor (CP)". According to various embodiments, the controller 430 may perform control so that the UE performs operations according to the various embodiments described below.

[0084] Figure 5 FIG. 1 shows a configuration of a server in a wireless communication system according to an embodiment of the present disclosure. Figure 5 The configuration shown in can be understood as having Figure 3 3. The configuration of a device for performing the functions of at least one of the AAF 320, AF 330, UDM 340, AUSF 350, and APR 360 shown in FIG. The term "unit" or "-device" used hereinafter means a unit that processes at least one function or operation and may be implemented as hardware, software, or a combination thereof.

[0085] Reference Figure 5 , the server includes a communication unit 510 (eg, a transceiver), a storage unit 520, and a controller 530 (eg, at least one processor).

[0086] The communication unit 510 provides an interface for communicating with other devices in the network. That is, the communication unit 510 converts a bit string sent from the server to another device into a physical signal, and converts a physical signal received from another device into a bit string. That is, the communication unit 510 can send and receive signals. Therefore, the communication unit 510 can be referred to as a "modem", "transmitter", "receiver" or "transceiver". In this case, the communication unit 510 allows the server to communicate with other devices or systems through a backhaul connection (e.g., a wired backhaul or a wireless backhaul) or a network.

[0087] The storage unit 520 stores data such as basic programs, application programs, configuration information, etc. for the operation of the server. The storage unit 520 may include a volatile memory, a nonvolatile memory, or a combination thereof. In addition, the storage unit 520 provides the stored data at the request of the controller 530.

[0088] The controller 530 controls the overall operation of the server. For example, the controller 530 sends and receives signals through the communication unit 510. In addition, the controller 530 records data in the storage unit 520 and reads data from the storage unit 520. To this end, the controller 530 may include at least one processor. According to various embodiments, the controller 530 may perform control so that the server performs operations according to various embodiments described below.

[0089] Figure 6 A flowchart of a process of UE executing an authentication of an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Figure 6 An operation method of UE 310 is shown.

[0090] Reference Figure 6, in operation 601, the UE sends an authentication initiation message to the AAF (e.g., AAF 320). That is, the UE may send a message to the AAF for initiating an authentication process for obtaining edge application authorization. According to various embodiments, the authentication initiation message may include information indicating an authentication method to be performed between the UE and the AAF. For example, the authentication initiation message may include at least one of a UE user-related identifier, a UE edge enabler client (EEC) identifier, a response type, a redirection address {Uniform Resource Locator (URL)}, and a type of user agent. The UE user-related identifier may be a subscriber identifier, such as a subscription private identity (SUPI) or a general public subscription identity (GPSI). Here, the GPSI may be identification information such as an email address or a mobile station international subscriber directory number (MSISDN). In addition, the UE user-related identifier may be an identifier of a UE device, such as a permanent equipment identifier (PEI). The response type refers to the type of information or message indicating the authentication result sent from the AAF after the authentication process is completed. For example, the response type may be at least one of an authentication code or an access token. The redirection address is an address that guides the authentication of the edge application, and it refers to the URL that the UE is to access when the authentication is successful. The user agent may be at least one of an identifier of a browser or an identifier of a program for performing an authentication process.

[0091] In operation 603, the UE performs an authentication process according to the determined authentication method. Specifically, the UE may perform an authentication process according to the authentication method determined based on the information contained in the authentication initiation message. The authentication method may include at least one of an authentication method based on USIM credentials, an authentication method based on a user portal, an authentication method based on automatically generated credentials, or an authentication method based on OTP. According to an embodiment, the AAF may determine at least one of the above-mentioned authentication methods by identifying the information included in the authentication initiation message. According to another embodiment, after the UE determines the authentication method, an authentication initiation message including information indicating the determined authentication method may be sent to the AAF. According to various embodiments, in addition to the UE user-related identifier and user agent type included in the authentication initiation message, the authentication method may also be determined by further considering the policy of the mobile communication service provider, the application-related policy, and the like.

[0092] In operation 605, the UE receives an authentication result from the AAF. If the authentication process is successfully performed according to the determined authentication method, the UE may receive a message from the AAF indicating that the authentication has been successfully performed. For example, the UE may receive a message including an authentication code from the AAF. In addition, the UE may receive a message further including a redirection address. According to various embodiments, the authentication code may be issued based on the authorization profile information of the edge application of each subscriber. Specifically, the AAF may receive an authorization profile for each subscriber corresponding to the information contained in the authentication initiation message from the UDM, and may generate an authentication code based on the authorization profile for each subscriber. By receiving the authentication code generated based on the authorization profile of each subscriber, the UE may use the authentication code to request the issuance of an access token. In addition, the UE may access the website indicated by the redirection address contained in the message indicating the authentication result.

[0093] Figure 7 A flowchart of an AAF performing an authentication process on an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Figure 7 The method of operation of AAF 320 is shown.

[0094] Reference Figure 7 , in operation 701, the AAF receives an authentication initiation message from the UE. That is, the AAF may receive a message from the UE for initiating an authentication process in order to obtain authorization for the edge application. According to various embodiments, the authentication initiation message may include information indicating an authentication method to be performed between the UE and the AAF. For example, the authentication initiation message may include at least one of a UE user-related identifier, a response type, a redirection address, and a type of user agent. The UE user-related identifier may be a user identifier such as SUPI or GPSI. Here, GPSI may be identification information such as an email address or MSISDN. In addition, the UE user-related identifier may be an identifier of a UE device, such as PEI. The response type refers to the type of information or message indicating the authentication result sent from the AAF after the authentication process is completed. For example, the response type may be at least one of an authentication code or an access token. The redirection address is an address that guides the authentication edge application, and refers to the URL that the UE is to access when the authentication is successful. The user agent may be at least one of an identifier of a browser or an identifier of a program for performing the authentication process.

[0095] In operation 703, the AAF performs an authentication process according to the determined authentication method. Specifically, the AAF may perform an authentication process according to the authentication method determined based on the information contained in the authentication initiation message. The authentication method may include at least one of an authentication method based on USIM credentials, an authentication method based on a user portal, an authentication method based on automatically generated credentials, or an authentication method based on OTP. According to an embodiment, the AAF may determine at least one of the above-mentioned authentication methods by identifying information included in the authentication initiation message. According to another embodiment, after the UE determines the authentication method, an authentication initiation message including information indicating the determined authentication method may be sent to the AAF. According to various embodiments, in addition to the UE user-related identifier and the type of user agent included in the authentication initiation message, the authentication method may be determined by further considering the policy of the mobile communication service provider, the application-related policy, and the like.

[0096] In operation 705, the AAF sends the authentication result to the UE. If the authentication process is successfully performed according to the determined authentication method, the AAF may send a message to the UE indicating that the authentication has been successfully performed. For example, the AAF may send a message including an authentication code to the UE. In addition, the AAF may send a message also including a redirection address. According to various embodiments, the authentication code may be issued based on the authorization profile information of the edge application of each subscriber. Specifically, the AAF may receive an authorization profile of each user corresponding to the information contained in the authentication initiation message from the UDM, and may generate an authentication code based on the authorization profile of each user. By receiving the authentication code generated based on the authorization profile of each subscriber from the AAF, the UE can use the authentication code to request the issuance of an access token. In addition, the UE can access the website indicated by the redirection address contained in the message indicating the authentication result.

[0097] Fig. 8A A signal exchange diagram for performing an authentication process for an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Fig. 8A The illustrated signal exchange diagram may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the UDM 340 .

[0098] Reference Fig. 8A, in operation 801, UE 310 sends an authentication initiation message to AAF 320. AAF 320 may receive an authentication initiation message from UE 310. That is, a message for initiating an authentication process for obtaining authorization for an edge application may be sent from UE 310 to AAF 320. According to various embodiments, the authentication initiation message may include information indicating an authentication method to be performed between UE 310 and AAF 320. For example, the authentication initiation message may include at least one of a UE user-related identifier, a response type, a redirection address, and a type of user agent. The UE user-related identifier may be a user identifier such as SUPI or GPSI. Here, GPSI may be identification information such as an email address or MSISDN. In addition, the UE user-related identifier may be an identifier of a UE device, such as PEI. The response type refers to the type of information or message indicating the authentication result to be sent from AAF 320 after the authentication process is completed. For example, the response type may be at least one of an authentication code or an access token. The redirection address is an address that guides the authentication edge application, and refers to the URL that UE 310 is to access when the authentication is successful. The user agent may be at least one of an identifier of a browser or an identifier of a program for performing an authentication process.

[0099] In operation 803, the AAF 320 determines an authentication method. The AAF 320 may determine the authentication method based on information included in the authentication initiation message received from the UE 310. In addition to the UE user-related identifier, the EEC identifier, and the type of the user agent contained in the authentication initiation message, the AAF 320 may determine the authentication method by further considering the policy of the mobile communication service provider, the policy related to the application, etc. According to various embodiments, the authentication method may include at least one of an authentication method based on a USIM credential, an authentication method based on a user portal, an authentication method based on an automatically generated credential, or an authentication method based on an OTP. The AAF 320 may identify an authentication method corresponding to the type of the identifier and the user agent associated with the UE user among the above authentication methods. Alternatively, the AAF 320 may identify whether the type of the UE user-related identifier and the user agent corresponds to at least one of the authentication methods supported by the policy of the mobile communication service provider or the application-related policy, thereby determining the authentication method. According to the policy of the edge computing service provider or the mobile communication service provider, the AAF 320 may determine non-authentication in an environment where the terminal is securely connected to the service provider network.

[0100] In operation 805, the UE 310 and the AAF 320 perform an authentication process according to the determined authentication method. That is, the UE 310 and the AAF 320 may perform an authentication process according to an authentication method determined by the AAF 320 among an authentication method based on a USIM credential, an authentication method based on a user portal, an authentication method based on automatically generated credentials, or an authentication method based on an OTP. Fig. 8A It is not shown, but a signal exchange may be performed with at least one object other than the UE 310, the AAF 320, and the UDM 340. Alternatively, if the AAF 320 determines non-authentication, the AAF 320 and the UE 310 do not perform an authentication procedure.

[0101] In operation 807, the AAF 320 sends an authorization request message to the UDM 340. The UDM 340 may receive the authorization request message from the AAF 320. Specifically, if the authentication process is successfully performed, an authorization request message requesting an authorization profile of the edge application may be sent from the AAF 320 to the UDM 340. According to various embodiments, the authorization request message may include at least one of a subscriber identifier (e.g., SUPI, GPSI, etc.) or an identifier of the UE device (e.g., PEI) or an indicator of configuring the use of the edge application (e.g., application usage). In this case, the subscriber identifier and the identifier of the UE device may be acquired from information included in the authentication initiation message received from the UE 310.

[0102] In operation 809, the UDM 340 sends an authorization response message to the AAF 320. The AAF 320 may receive the authorization response message from the UDM 340. Specifically, the UDM 340 may identify information related to the UE user based on information included in the authorization request message received from the UDM 340, and an authorization response message including an authorization profile corresponding to the identified subscriber may be sent from the UDM 340 to the AAF 320. According to various embodiments, the authorization profile may include information on whether the requested edge computing service to the UE 310 is allowed, information on whether the user of the UE 310 has subscribed to the requested edge computing service, an edge computing service profile identifier, an edge computing service profile index, subscriber category information, and at least one of a subscriber level. The edge computing service profile identifier and the edge computing service profile index represent identifiers indicating negotiation information determined by a prior agreement between a mobile communication service provider and an edge application service provider. In addition, the subscriber category represents class or category information (e.g., class A or class B) of a subscriber managed by the mobile communication service provider. In addition, the subscriber level indicates a priority given to a corresponding subscriber, information providing a differentiated edge computing service, or information about a class of each subscriber (e.g., level 1 or level 2). That is, the UDM 340 may retrieve information such as a subscriber category corresponding to an identifier associated with the UE 310 requesting authentication, information about the requested edge computing service, and information about a relationship between a user of the UE 310 and a corresponding edge application, and may provide the retrieved information to the AAF 320 using an authorization response message.

[0103] In operation 811, the AAF 320 generates an authentication result. If the AAF 320 determines non-authentication and allows access to the UE 310 or the edge enabler client (EEC) in the UE, a successful authentication result may be generated. The AAF 320 may generate an authentication result based on the authorization response message received from the UDM 340. That is, the AAF 320 may determine whether to generate an authentication code based on the authorization response message received from the UDM 340. Specifically, if the AAF 320 identifies information indicating that the requested edge computing service is not allowed based on the authorization profile included in the authorization response message, the AAF 320 may not generate an authentication code. In addition, if the AAF 320 identifies information indicating that the requested edge computing service is allowed, the AAF 320 may generate an authentication code.

[0104] In operation 813, the AAF 320 sends the authentication result to the UE 310. The UE 310 may receive the authentication result from the AAF 320. According to various embodiments, if the authentication code is generated, the AAF 320 may send a message indicating that the authentication has been successfully performed to the UE 310. That is, the AAF 320 may send a message including the authentication code to the UE 310. In addition, the AAF 320 may send a message also including a redirection address. By receiving the authentication code generated based on the authorization profile of each subscriber from the AAF 320, the UE 310 may use the authentication code in order to request the issuance of an access token. In addition, the UE 310 may access the website indicated by the redirection address included in the message indicating the authentication result. According to various embodiments, if the authentication code is not generated, the AAF 320 may send a message indicating that the authentication has failed to the UE 310.

[0105] Figure 8B Another signal exchange diagram for performing an authentication process for an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Figure 8B The signal exchange diagram shown may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the UDM 340 .

[0106] Reference Figure 8B , in operation 851, UE 310 determines an authentication method. UE 310 may predetermine an authentication method before initiating an authorization process. Specifically, UE 310 may determine an authentication method based on user input or a pre-acquired service provider policy, and may identify a UE user-related identifier, an EEC identifier, and a type of user agent corresponding to the determined authentication method. According to various embodiments, the authentication method may include at least one of an authentication method based on a USIM credential, an authentication method based on a user portal, an authentication method based on automatically generated credentials, or an authentication method based on an OTP. That is, UE 310 may determine an authentication method corresponding to the user input or an authentication method supported by the service provider's policy from the above-mentioned authentication methods, and may identify the type of identifier and user agent used in the authentication according to the determined authentication method.

[0107] In operation 853, UE 310 sends an authentication initiation message to AAF 320. AAF 320 may receive an authentication initiation message from UE 310. That is, a message for initiating an authentication process for obtaining edge application authorization may be sent from UE 310 to AAF 320. According to various embodiments, the authentication initiation message may include information indicating an authentication method to be performed between UE 310 and AAF 320. For example, the authentication initiation message may include at least one of a UE user-related identifier, an EEC identifier, a response type, a redirection address, and a type of user agent. The UE user-related identifier may be a user identifier such as SUPI or GPSI. Here, GPSI may be identification information such as an email address or MSISDN. In addition, the UE user-related identifier may be an identifier of a UE device, such as PEI. The response type refers to the type of information or message indicating the authentication result to be sent from AAF 320 after the authentication process is completed. For example, the response type may be at least one of an authentication code or an access token. The redirection address is an address that guides the authentication edge application, and refers to the website address that UE 310 is to access when the authentication is successful. The user agent may be at least one of an identifier of a browser or an identifier of a program for performing an authentication process.

[0108] In operation 855, the UE 310 and the AAF 320 perform an authentication process according to the determined authentication method. That is, the UE 310 and the AAF 320 may perform an authentication process according to the authentication method determined by the AAF 320 among the USIM credential-based authentication method, the user portal-based authentication method, the automatically generated credentials-based authentication method, or the OTP-based authentication method. Figure 8B Not shown, but signal exchange with at least one object other than the UE 310, the AAF 320, and the UDM 340 may be performed according to the determined authentication method.

[0109] In operation 857, the AAF 320 sends an authorization request message to the UDM 340. The UDM 340 may receive the authorization request message from the AAF 320. Specifically, if the authentication process is successfully performed, an authorization request message for requesting an authorization profile of the edge application may be sent from the AAF 320 to the UDM 340. According to various embodiments, the authorization request message may include at least one of the following: a subscriber identifier (e.g., SUPI, GPSI, etc.), an EEC identifier, an identifier of the UE device (e.g., PEI), or an indicator for configuring the use of the edge application (e.g., application use). In this case, the subscriber identifier, the EEC identifier, and the identifier of the UE device may be acquired from the information included in the authentication initiation message received from the UE 310.

[0110] In operation 859, the UDM 340 sends an authorization response message to the AAF 320. The AAF 320 may receive the authorization response message from the UDM 340. Specifically, the UDM 340 may identify information related to the UE user based on information included in the authorization request message received from the UDM 340, and may send an authorization response message including an authorization profile corresponding to the identified subscriber from the UDM 340 to the AAF 320. According to various embodiments, the authorization profile may include information about whether the requested edge computing service to the UE 310 is allowed, information about whether the user of the UE 310 has subscribed to the requested edge computing service, an edge computing service profile identifier, an allowed EEC identifier, an edge computing service profile index, at least one of subscriber category information and a subscriber level. The edge computing service profile identifier and the edge computing service profile index represent identifiers indicating negotiation information determined by a prior agreement between a mobile communication service provider and an edge application service provider. In addition, the subscriber category represents class or category information (e.g., class A or class B) of a subscriber managed by the mobile communication service provider. In addition, the subscriber level indicates a priority given to a corresponding subscriber, information providing a differentiated edge computing service, or information about a class of each subscriber (e.g., level 1 or level 2). That is, the UDM 340 may retrieve information such as a subscriber class corresponding to an identifier or an EEC identifier associated with the UE 310 requesting authentication, information about the requested edge computing service, and information about a relationship between a user of the UE 310 and a corresponding edge application, and may provide the retrieved information to the AAF 320 using an authorization response message.

[0111] In operation 861, the AAF 320 generates an authentication result. The AAF 320 may generate an authentication result based on the authorization response message received from the UDM 340. That is, the AAF 320 may determine whether to generate an authentication code based on the authorization response message received from the UDM 340. Specifically, if the AAF 320 identifies information indicating that the requested edge computing service is not allowed based on the authorization profile included in the authorization response message, the AAF 320 may not generate an authentication code. In addition, if the AAF 320 identifies information indicating that the requested edge computing service is allowed, the AAF 320 may generate an authentication code.

[0112] In operation 863, the AAF 320 sends the authentication result to the UE 310. The UE 310 may receive the authentication result from the AAF 320. According to various embodiments, if the authentication code is generated, the AAF 320 may send a message indicating that the authentication has been successfully performed to the UE 310. That is, the AAF 320 may send a message including the authentication code to the UE 310. In addition, the AAF 320 may send a message also including a redirection address. By receiving the authentication code generated based on the authorization profile of each subscriber from the AAF 320, the UE 310 may use the authentication code in order to request the issuance of an access token. In addition, the UE 310 may access the website indicated by the redirection address included in the message indicating the authentication result. According to various embodiments, if the authentication code is not generated, the AAF 320 may send a message indicating that the authentication has failed to the UE 310.

[0113] Fig. 9 A flowchart of a method for determining an authentication of an edge application by a UE in a wireless communication system according to an embodiment of the present disclosure is shown. Fig. 9 An operation method of UE 310 is shown.

[0114] Reference Fig. 9 , at operation 901, the UE receives a policy for an authentication method. The UE may predetermine an authentication method before initiating an authentication process. That is, the UE may determine the authentication method in consideration of a policy of a service provider including information about an authentication method configured by a service provider. Information about the above-mentioned authentication method may be sent to the UE through any of various paths. For example, the UE may obtain information about an authentication method configured by a service provider from a separate configuration server by using an application layer of a user plane. For example, the UE may obtain information about an authentication method configured by a service provider through a non-access layer (NAS) message from a 5G system. The information about the authentication method configured by the service provider that may be pre-stored in the UE may include at least one of a type of authentication credential information, an authentication domain of a service provider, and an authentication method. The type of authentication credential information may include at least one of a SUPI, a subscription hidden identifier (SUCI), a GPSI including an MSISDN, an EEC identifier, or an indicator indicating an identification (ID) type of an application layer managed by a service provider. In addition, the authentication domain of the service provider may include at least one of an identifier of the service provider, a domain name of the service provider, a mobile network code (MNC) of the service provider, or a mobile country code (MCC) of the service provider. In addition, the authentication method may include at least one of an authentication method based on USIM credentials, an authentication method based on a user portal, an authentication method based on automatically generated credentials, an authentication method based on an OTP, a method using a generic bootstrapping architecture (GBA), and an authentication method using authentication credentials stored in the UE.

[0115] In operation 903, the UE determines an authentication method based on at least one of the received policy or user input. That is, the UE may determine the authentication method based on at least one of the received policy or user input, and may identify the UE user-related identifier, the EEC identifier, and the type of the user agent corresponding to the determined authentication method. The UE may send an authentication initiation message including the UE user-related identifier and the type of the user agent to the AAF, thereby performing the authentication process according to the determined authentication method. The service provider's policy may include information about a variety of authentication methods supported by the service provider, and the UE may determine at least one of the multiple authentication methods. For example, if multiple authentication methods are identified from the received policy, the UE may determine the authentication method corresponding to the user input among the multiple authentication methods. For example, the UE may determine the authentication method according to the priority configured for each authentication method identified from the received policy. According to various embodiments, the UE user-related identifier may include at least one of a SUPI, a SUCI, an MSISDN, a separate user identifier used by the service provider to manage subscribers, or an identifier (e.g., PEI) of a UE device. Alternatively, the UE user-related identifier may be an edge enabler client (EEC) identifier of the UE. For example, if the authentication method configured by the service provider is an authentication method based on the USIM credentials, the UE may send at least one of the SUPI or SUCI as the UE user-related identifier to the AAF, or send an authentication initiation message including the GPSI related to the SUPI or SUCI. In addition, the UE may send an authentication initiation message to the AAF, the authentication initiation message including an identifier for determining whether the type of the user agent corresponds to the network browser implementing the authentication method based on the USIM credentials or a separate user agent. In this case, a separate user agent specified by the service provider or developed by the manufacturer of the UE device may be used.

[0116] Fig.10 A flowchart of an AAF for determining an authentication method of an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.10 The method of operation of AAF 320 is shown.

[0117] Reference Fig.10, in operation 1001, the AAF identifies the information included in the authentication initiation message. Specifically, the AAF can identify the format of the UE user-related identifier or the edge enabler client identifier (EEC ID) contained in the authentication initiation message. For example, if the UE user-related identifier is GPSI, the AAF can determine the authentication method based on the user name and domain name contained in the identifier. For example, if the UE user-related identifier is MSISDN, the AAF can identify the local network used to perform the authentication process and the AUSF corresponding to the local network based on the identified MSISDN. For example, if the UE user-related identifier is PEI, the AAF can determine the authentication method by identifying information about the UE device.

[0118] In operation 1003, the AAF determines an authentication method based on at least one of the identified information or policies. The AAF may determine the authentication method based on the information identified from the authentication initiation message. In an embodiment, if the UE user-related identifier is a GPSI, the AAF may select different authentication methods according to the format of the username and the domain name. Alternatively, the AAF may select different authentication methods using an EEC identifier. That is, if the identifier has a format of a network access identifier (NAI), the identifier may be configured in a format such as "username@domainname", and the AAF may select different authentication methods according to the formats of the respective parts "username" and "domainname". For example, in the case where the domain name format is "5gc.mnc<MNC>.mcc<MCC>.3gppnetwork.org", the user name may include an international mobile subscriber identifier (IMSI) or a value of a SUCI. In this case, the AAF may identify a local network and an AUSF corresponding to the local network for performing the authentication process from the MNC and the MCC based on the domain name, and may select an AUSF group based on the SUCI contained in the user name. Therefore, the AAF may select an authentication method based on the USIM credentials, which authentication method is a method using a hypertext transfer protocol (HTTP) in order to perform the authentication process. As another example, in a case where the domain name has a format such as "operator.com", a separate UE subscription identifier may be included in the user name, where the UE subscription identifier is registered in a portal server operated by the service provider or a third-party service provider. In this case, if the AAF supports a separate UE subscription identifier, and if the type of user agent included in the authentication initiation message is identified as a web browser, the AAF may select an authentication method based on the user portal in order to perform the authentication process. According to another embodiment, in a case where the UE user-related identifier is an MSISDN, the AAF may select a local network and an AUSF of the local network based on the MSISDN, and may select an authentication method based on the OTP, which is a method using the MSISDN. According to another embodiment, in a case where the UE user-related identifier is a PEI, the AAF may select an authentication method based on automatically generated credentials, which is a method utilizing UE subscription information. Alternatively, if the AAF 320 receives a request from the UE to generate a key from an AKMA anchor function (AAnF) or AUSF in the 5GC network using an application's authentication and key management (AKMA) key, the AAF 320 may request the NEF or AUSF in the 5GC network to generate the key.

[0119] Fig.11A signal exchange diagram for performing an authentication process based on USIM credentials in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.11 The signal exchange diagram shown may be understood as a signal flow exchanged between the UE 310, the AAF 320, the UDM / ARPF (Authentication Credentials Storage and Processing Function) 340 and the AUSF 350. The authentication process described in FIG11 may follow the HTTP AKA process.

[0120] Reference Fig.11 In operation 1101, the AAF 320 sends a first authentication request message to the AUSF 350. The AUSF 350 may receive the first authentication request message from the AAF 320. Specifically, the AAF 320 identifies the AUSF 350 for performing the authentication process according to the USIM credentials determined based on the authentication initiation message received from the UE 310. If the AUSF 350 is identified, the AAF 320 sends a first authentication request message for requesting authentication to the identified AUSF 350. The first authentication request message may be referred to as "authentication request", but is not limited thereto, and various names for requesting authentication may be used for it. According to various embodiments, the first authentication request message may include at least one of a UE user-related identifier, an identifier of the AAF 320 (AAF ID), and an identifier of an application provider (application provider ID). In this case, the UE user-related identifier may be an identifier corresponding to the determined authentication method among GPSI, SUPI, and SUCI. In addition, the identifier of the AAF 320 may be an identifier for identifying each AAF 320 that sends the first authentication request message. In addition, the identifier of the application provider may be an identifier for identifying a separate service provider having a cooperative relationship with the mobile communication service provider, and may be in the form of a reverse fully qualified domain name (FQDN).

[0121] In operation 1103, the AUSF 350 sends an authentication acquisition request message to the UDM / ARPF 340. The UDM / ARPF 340 may receive the authentication acquisition request message from the AUSF 350. The authentication acquisition request message may be referred to as a "UE authentication acquisition request message". Specifically, the AUSF 350 selects the UDM / ARPF 340 and sends the authentication acquisition request message to the selected UDM / ARPF 340. The authentication acquisition request message may be understood as a message for the AUSF 350 to send information received from the AAF 320 to the UDM / ARPF 340. According to various embodiments, the authentication acquisition request message may include at least one of a UE user-related identifier, an identifier of the AAF 320, and an identifier of an application provider. That is, the authentication acquisition request message may include the same information as that included in the first authentication request message received from the AAF 320, or may be obtained by adding the above information to the information included in the first authentication request message, and then the authentication acquisition request message may be sent to the UDM / ARPF 340. The UE user-related identifier may be an identifier corresponding to the determined authentication method among GPSI, SUPI, and SUCI. In addition, the identifier of the AAF 320 may be an identifier for identifying each AAF 320 that sends the first authentication request message. In addition, the identifier of the application provider may be an identifier for identifying a separate service provider that has a cooperative relationship with the mobile communication service provider, and may have a reverse FQDN form.

[0122] In operation 1105, the UDM / ARPF 340 generates an authentication vector. That is, the UDM / ARPF 340 may generate an authentication vector (AV) based on the information included in the received authentication acquisition request message. Specifically, the UDM / ARPF 340 may identify the USIM credentials of the UE based on the UE user-related identifier identified by the authentication acquisition request message. For example, the UDM / ARPF 340 may identify the USIM credentials of the UE by performing a conversion of the GPSI identified from the authentication acquisition request message. The UDM / ARPF 340 may identify the USIM credentials and may generate an authentication vector using the information included in the authentication acquisition request message. For example, the UDM / ARPF 340 may generate an XRES* using at least one of the received identifier of the AAF 320 and the identifier of the application provider. That is, in the case of generating the XRES*, at least one of the identifier of the AAF 320 and the identifier of the application provider may be added. Therefore, the UDM / ARPF 340 may generate an authentication vector including XRES*, a random number (RAND), an authentication token (AUTN), and KAUSF 350 (or AUSF 350) used as an authentication key, which are information for the UE 310 to perform authentication.

[0123] In operation 1107, the UDM / ARPF 340 sends an authentication-obtained response message to the AUSF 350. The AUSF 350 may receive the authentication-obtained response message from the UDM 340. The authentication-obtained response message may be referred to as a "UE authentication-obtained response message". That is, the UDM / ARPF 340 may send a message to the AUSF 350 for sending information required to perform authentication to the UE 310. Specifically, the UDM / ARPF 340 may send an authentication-obtained response message including an application layer authentication vector to the AUSF 350, and the application layer authentication vector may include XRES*, RAND, AUTN, and KAUSF 350. That is, the authentication vector may be expressed as "Application HE AV=RAND, AUTN, XRES*, KAUSF 350".

[0124] In operation 1109, the AUSF 350 stores the XRES* and generates the HXRES*. That is, the AUSF 350 may identify the authentication vector from the authentication acquisition response message received from the UDM / ARPF 340, and may store information included in the identified authentication vector. For example, the AUSF 350 may store the XRES* of the authentication vector, and may derive the HXRES* based on the XRES*.

[0125] In operation 1111, the AUSF 350 sends a first authentication response message to the AAF 320. The AAF 320 may receive the first authentication response message from the AUSF 350. That is, the AUSF 350 may send a message to the AAF 320 for sending information required for the UE 310 to perform authentication. Specifically, the AUSF 350 may send a first authentication response message including an application layer authentication vector to the AAF 320. The application layer authentication vector may include HXRES* generated by the AUSF 350. That is, the application layer authentication vector 350 sent by the AUSF may include RAND, AUTN, and HXRES*, and may be expressed as "Application HE AV=RAND, AUTN, HXRES*".

[0126] In operation 1113, the AAF 320 sends a second authentication request message to the UE 310. The UE 310 may receive the second authentication request message from the AAF 320. The second authentication request message may be referred to as an "application authentication request message". That is, the AAF 320 may send a message for sending information required for authentication to the UE 310, wherein the information is received from the AUSF 350. According to various embodiments, since the authentication method based on the USIM credential may be performed according to the HTTP protocol, the second authentication request message may be sent using an HTTP response message. For example, the second authentication request message may be sent to the UE 310 as a "401 Not Found" response code or a message "WWW-authentication: Digest". In this case, the "Digest" may include RAND and AUTN among the information included in the application layer authentication vector received from the AUSF 350. That is, the second authentication request message having the format "WWW-authentication: Digest (RAND, AUTN)" may be sent from the AAF 320 to the UE 310.

[0127] In operation 1115, the UE 310 performs the AKA algorithm. Specifically, the UE 310 may generate RES* and AUTN by performing the AKA algorithm. The UE 310 verifies whether the generated AUTN value matches the AUTN value included in the second authentication request message received from the AAF 320.

[0128] In operation 1117, UE 310 sends a second authentication response message to AAF 320. AAF 320 may receive the second authentication response message from UE 310. The second authentication response message may be referred to as an "application authentication response message". Specifically, if the authentication is successful as a result of comparing the AUTN value generated by UE 310 with the AUTN value received from AAF 320, UE 310 may send a second authentication response message to AAF 320 in order to send RES*. According to various embodiments, the second authentication response message may be sent using an HTTP request message. In this case, the second authentication response message may include an Authorization Summary header. That is, a second authentication response message in the form of "Authorization Summary (RES*)" may be sent from UE 310 to AAF 320.

[0129] In operation 1119, the AAF 320 calculates XRES* and HXRES*. The AAF 320 may calculate XRES* and HXRES* using RES* included in the second authentication response message received from the UE 310. The UE 310 may compare whether the value of HXRES* matches the target value. In this case, the target value may be determined using HXRES* included in the authentication vector of the first authentication response message. The AAF 320 may verify whether the value of HXRES* corresponds to the target value for user authentication of the UE 310.

[0130] In operation 1121, the AAF 320 transmits a third authentication request message to the AUSF 350. The AUSF 350 may receive the third authentication request message from the AAF 320. Since it is confirmed that the calculated value of HXRES* matches the value of HXRES* received from the AUSF 350, the AAF 320 may transmit a message for transmitting the RES* received from the UE 310 to the AUSF 350. Therefore, the third authentication request message may include RES*.

[0131] In operation 1123, the AUSF 350 identifies RES*. That is, the AUSF 350 may determine whether the value of RES* transmitted from the UE corresponds to the value stored in the AUSF 350. The AUSF 350 may determine whether the authentication of the UE 310 is successful by identifying the value of RES*.

[0132] In operation 1125, the AUSF 350 transmits a third authentication response message to the AAF 320. The AAF 320 may receive the third authentication response message from the AUSF 350. If it is determined that the authentication of the UE 310 is successful, the AUSF 350 may transmit a message indicating the authentication success to the AAF 320. In this case, the AUSF 350 transmits the third authentication response message to the AAF 320, the third authentication response message including a separate indicator indicating the authentication success and the KAAF 320 used as an authentication key.

[0133] If the UE determines the authentication method based on the user portal, the UE may send an authentication initiation message including a type of user agent indicating at least one of various browsers to the AAF. Alternatively, if the type of user agent included in the authentication initiation message received by the AAF indicates at least one of various browsers, the AAF may perform a process according to the authentication method determined based on the user portal. Alternatively, if the AAF fails to determine a suitable authentication method based on the authentication initiation message, the authentication method based on the user portal may be determined. In the following, reference will be made to Fig.12 and 13 An authentication process is described in detail in the case of determining a user portal based authentication method.

[0134] Fig.12 A signal exchange diagram for performing an authentication process based on a user portal in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.13 An example of a user portal screen for performing an authentication process based on a user portal in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.12 The signal exchange diagram shown can be understood as the signal flow exchanged between UE 310 and AAF 320. Fig.11 conduct Fig.12 Description.

[0135] Reference Fig.12 In operation 1201, the AAF 320 transmits a message for inputting authentication credential information to the UE 310. The UE 310 may receive the message for inputting authentication credential information from the AAF 320. Specifically, the AAF 320 may transmit a message including an HTML address for displaying a screen capable of inputting credential information for authentication (such as a user ID and a password) to the UE 310. For example, the AAF 320 may transmit an HTML address of a screen 1300 including an input field 1310 for inputting a user ID and an input field 1320 for inputting a password to the UE 310.

[0136] In operation 1203, the UE 310 may send authentication credential information to the AAF 320. The AAF 320 may receive the authentication credential information from the UE 310. The UE 310 may perform rendering of the received HTML file using a browser corresponding to the type of user agent indicated by the authentication initiation message, thereby displaying the screen 1300 on the display panel of the UE 310. The UE 310 may receive an input of at least one of a user ID or an email address to the input field 1310 and an input of a password to the input field 1320. The UE 310 may send the input user ID and password to the AAF 320 as the authentication credential information.

[0137] The UE 310 and the AAF 320 perform an authentication process using the input authentication credential information in operation 1205. The UE 310 may perform an authentication process for verifying a user ID and a password through interaction with a portal included in the AAF 320.

[0138] According to the above-mentioned embodiment of determining the authentication method, the UE and the AAF may determine to perform the authentication process based on the automatically generated credentials. In this case, at least one of the SUPI, PEI, and MSISDN (which are UE user related information that is avoided from being disclosed to the public) may be used to generate authentication information, and the authentication information generated by the negotiated one-way hash function may be verified. In the following, reference will be made to Fig.14 An authentication process according to an authentication method based on automatically generated credentials is described in detail.

[0139] Fig.14 A signal exchange diagram for performing an authentication process based on automatically generated credentials in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.14 The illustrated signal exchange diagram may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the UDM 340 .

[0140] Reference Fig.14 In operation 1401, the AAF 320 sends a profile request message to the UDM 340. The UDM 340 may receive the profile request message from the AAF 320. Specifically, the AAF 320 may select a UDM 340 that performs an authentication process using a UE user-related identifier identified from an authentication initiation message received from the UE 310 and information about the type of user agent. The AAF 320 may request the selected UDM 340 for information required to perform the authentication process based on the automatically generated credentials. That is, the AAF 320 may send the profile request message including the UE user-related identifier to the UDM 340. For example, the AAF 320 may request the UDM 340 for information required to perform authentication for a user of the UE corresponding to the GPSI by sending the profile request message including the GPSI.

[0141] In operation 1403, the UDM 340 sends a profile response message to the AAF 320. The AAF 320 may receive the profile response message from the UDM 340. That is, the UDM 340 may send the profile response message to the AAF 320, the profile response message including subscriber information indicating at least one of the SUPI, PEI, and MSISDN corresponding to the GPSI. As described above, the SUPI, PEI, and MSISDN are identifiers that are not disclosed to the public and may be used to automatically generate credentials. That is, an authentication method based on credentials generated using information related to the UE 310 may be used.

[0142] In operation 1405, the AAF 320 generates a digest. The AAF 320 may acquire subscriber information for identifying the UE based on the profile response message received from the UDM 340. In addition, the AAF 320 generates a random number (RAND) to generate a digest using the acquired subscriber information and the RAND. In this case, as described above, the subscriber information may correspond to at least one of the SUPI, PEI, and MSISDN, and the digest may be expressed as "Digest = H (RAND | SUPI)".

[0143] In operation 1407, AAF 320 sends an authentication request message to UE 310. UE 310 may receive the authentication request message from AAF 320. The authentication request message may be referred to as an "application authentication request message". That is, AAF 320 may send a message for sending the generated digest to UE 310. According to various embodiments, the authentication request message may be sent in the form of an HTTP response message. AAF 320 may send an HTTP response message to UE 310 by inserting the generated digest into the field "WWW-authenticate". In this case, the authentication request message may include a form such as "WWW-authenticate: Digest Random: RAND".

[0144] In operation 1409, the UE 310 verifies the digest and generates a message authentication code (MAC). If the digest identified from the authentication request message is verified, the UE 310 may generate the MAC using at least one of the SUPI, PEI, MSISDN corresponding to the subscriber information for identifying the UE 310, or the RAND generated by the AAF 320. That is, the MAC may be expressed as "MAC=H(RAND|MSISDN|PEI|SUPI)".

[0145] In operation 1411, UE 310 sends an authentication response message to AAF 320. AAF 320 may receive the authentication response message from UE 310. The authentication response message may be referred to as an "application authentication response message". Specifically, UE 310 may send an authentication response message having a MAC inserted therein to AAF 320, the MAC being generated based on the verified digest. According to various embodiments, the authentication response message may be sent in the form of an HTTP request message. In this case, UE 310 may send the authentication response message to AAF 320 by including the MAC in the header field "authorization" of the HTTP request message.

[0146] In operation 1413, the AAF 320 verifies the MAC. That is, the AAF 320 may verify that the MAC generated by the UE 310 matches the UE user-related identifier received from the UDM 340. The verification of the MAC may be performed according to any of various methods, such as a hash function-based method.

[0147] In operation 1415, the AAF 320 generates an authentication code. If the MAC is verified, the AAF 320 may determine that the authentication is successful. Therefore, the AAF 320 may generate an authentication code that the UE 310 may use in order to obtain an access token issued for the edge application.

[0148] In operation 1417, the AAF 320 sends the authentication result to the UE 310. The UE 310 may receive the authentication result from the AAF 320. The authentication result may be referred to as an "application authentication result message". The AAF 320 may send a message indicating that the authentication has been successfully performed to the UE 310. According to various embodiments, the AAF 320 may send a message including an authentication code to the UE 310. In addition, the AAF 320 may send a message further including a redirection address to the UE 310.

[0149] FIG. 15 shows a signal exchange diagram for performing an authentication process based on OTP in a wireless communication system according to an embodiment of the present disclosure. Fig.15 The illustrated signal exchange diagram may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the UDM 340 .

[0150] Reference Fig.15 , in operation 1501, the AAF 320 sends a profile request message to the UDM 340. The UDM 340 may receive the profile request message from the AAF 320. Specifically, the AAF 320 may select a UDM 340 for performing an authentication process, the selection using a UE user-related identifier identified in an authentication initiation message received from the UE 310 and information about the type of user agent. The AAF 320 may send a profile request message including the UE user-related identifier to the selected UDM 340. For example, the AAF 320 may send a profile request message including a GPSI, thereby requesting the UDM 340 for information required to perform authentication on a UE user corresponding to the GPSI.

[0151] In operation 1503, the UDM 340 transmits a profile response message to the AAF 320. The AAF 320 may receive the profile response message from the UDM 340. The UDM 340 may identify at least one of the SUPI, PEI, and MSISDN of the UE 310 based on the received GPSI. Therefore, the UDM 340 may transmit a profile response message to the AAF 320, the profile response message including subscriber information indicating at least one of the identified SUPI, PEI, and MSISDN.

[0152] In operation 1505, an OTP is transmitted from the AAF 320 to the UE 310. Based on the profile response message received from the UDM 340, the AAF 320 may acquire subscriber information for identifying the UE. In this case, as described above, the subscriber information may correspond to at least one of the SUPI, PEI, and MSISDN. The AAF 320 may transmit a one-time password (OTP) corresponding to at least one of the acquired SUPI, PEI, and MSISDN to the UE 310 through a separate path. For example, the AAF 320 may transmit the OTP corresponding to the acquired subscriber information to the UE 310 through a short message service (SMS). For example, the AAF 320 may transmit the OTP to the UE 310 corresponding to the acquired subscriber information through a NAS message.

[0153] In operation 1507, the AAF 320 sends an authentication request message to the UE 310. The UE 310 may receive the authentication request message from the AAF 320. The authentication request message may be referred to as an "application authentication request message". That is, upon receiving a request to initiate an authentication process from the UE 310, the AAF 320 may send the authentication request message as a response message after a predetermined process. In this case, the AAF 320 generates a random number (RAND) that may be used to verify a message authentication code (MAC), and may send an authentication request message including the generated RAND to the UE 310.

[0154] In operation 1509, the UE 310 generates a MAC. The UE 310 may generate the MAC using at least one of the SUPI, PEI, MSISDN, RAND generated by the AAF 320, and the received OTP value corresponding to the subscriber information for identifying the UE 310. That is, the MAC may be expressed as "MAC=H(OTP, RAND|MSISDN|PEI|SUPI)".

[0155] In operation 1511, UE 310 sends an authentication response message to AAF 320. AAF 320 may receive the authentication response message from UE 310. The authentication response message may be referred to as an "application authentication response message". Specifically, UE 310 may send an authentication response message to AAF 320, the authentication response message having a MAC inserted therein, the MAC being generated based on at least one of the above-mentioned subscriber information, RAND, and OTP value.

[0156] In operation 1513, the AAF 320 verifies the MAC. The AAF 320 may generate the MAC based on at least one of the subscriber information received from the UDM 340 through the profile response message, the RAND generated by the AAF 320, and the OTP value transmitted to the UE 310. In addition, the AAF 320 may identify the MAC generated by the UE 310 from the authentication response message received by the UE 310. Therefore, the AAF 320 may verify the MAC generated by the UE 310 using the MAC generated by the AAF 320.

[0157] In operation 1515, the AAF 320 generates an authentication code. If the authentication is successful as determined by the verification of the MAC, the AAF 320 may generate an authentication code. According to various embodiments, the AAF 320 may generate an authentication code according to an OAUTH2 framework, which is a protocol for managing third-party authentication and granting authorization to it using a token. That is, the AAF 320 may generate an authentication code for the UE 310 to receive an access token issued for an edge application.

[0158] In operation 1517, the AAF 320 sends the authentication result to the UE 310. The UE 310 may receive the authentication result from the AAF 320. The authentication result may be referred to as an "application authentication result message". The AAF 320 may send a message to the UE 310 indicating that the authentication has been successfully performed. According to various embodiments, the AAF 320 may send a message including an authentication code to the UE 310. In addition, the AAF 320 may send a message to the UE 310 further including a redirection address.

[0159] If the authentication code is obtained by performing the above authentication process, the UE can use the obtained authentication code to perform a process for obtaining an access token. Fig.16 and 17 Describes in detail the process of obtaining an access token.

[0160] Fig.16 A signal interaction diagram is shown when an access token is successfully generated in a wireless communication system according to an embodiment of the present disclosure. Fig.16 The signal exchange diagram shown may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the APR 360 .

[0161] Reference Fig.16In operation 1601, the UE 310 sends a request message to the AAF 320. The AAF 320 may receive the request message from the UE 310. That is, the UE 310 may send a message for requesting an access token to the AAF 320 after successfully performing the authentication process. According to various embodiments, the request message may include at least one of an authorization type, an authentication code, a redirection address, and a client ID. The request message may be referred to as an "access token request message".

[0162] In operation 1603, the AAF 320 checks the authentication code. The AAF 320 may identify the authentication code based on the received request message. The AAF 320 may verify the validity of the identified authentication code based on at least one predetermined criterion. For example, the validity of the authentication code may be determined based on at least one of the validity period of the authentication code, the GPSI identified in the authentication code, or information other than the authentication code included in the request message.

[0163] In operation 1605, the AAF 320 obtains profile information. If the validity of the authentication code is verified, the AAF 320 may obtain a subscriber profile corresponding to the verified authentication code. According to various embodiments, the subscriber profile may include information for identifying the user of the UE 310 requesting issuance of the access token (e.g., a UE user-related identifier) ​​and subscriber information corresponding to the user (e.g., a subscriber level, a subscriber category, etc.). Although Fig.16 Not shown, but the AAF 320 may request a subscriber profile from the UDM to obtain information about the UE 310 or user requesting issuance of an access token.

[0164] In operation 1607, the AAF 320 sends a profile request message to the APR 360. The APR 360 may receive the profile request message from the AAF 320. The profile request message may be referred to as an "application profile request message". That is, the AAF 320 may send a message requesting a profile about at least one edge application to the APR 360. In this case, profile information about the edge application for which the UE 310 requests issuance of an access token is requested. According to various embodiments, the profile request message may include at least one of an identifier of an application profile (application profile ID) or a category of a corresponding application profile.

[0165] In operation 1609, APR 360 sends a profile response message to AAF 320. AAF 320 may receive the profile response message from APR 360. The profile response message may be referred to as an "application profile response message". APR 360 may identify whether the application profile requested by the profile request message is allowed based on pre-stored information about the edge application. At least one application profile may be requested from AAF 320, and APR 360 may retrieve or identify an allowable application profile based on a policy associated with the application. Therefore, APR 360 may send a profile response message including information indicating at least one of an allowable application profile or an disallowed application profile to AAF 320.

[0166] In operation 1611, the AAF 320 generates an access token. The AAF 320 may acquire the allowed application profile based on the profile response message received from the APR 360. The AAF 320 may generate the access token by configuring the permissions according to the acquired subscriber profile. According to various embodiments, the access token includes at least one of an identifier associated with a UE user (e.g., a subscriber identifier or an identifier of a UE device), an identifier of an application profile, a subscriber category, a subscriber level, and information for identifying the AAF 320 for verifying the access token. The information for identifying the AAF 320 for verifying the access token may include at least one of an address of an AAF 320 endpoint, an identifier of an application provider, and an AAF 320 ID.

[0167] In operation 1613, AAF 320 sends a response message to UE 310. UE 310 may receive the response message from AAF 320. Specifically, after encrypting the generated access token, AAF 320 may send a response message for delivering the encrypted access token to UE 310. Accordingly, the access token may be used to determine whether UE 310 is allowed to use the edge computing service corresponding to the application profile. The response message may be referred to as an "access token response message".

[0168] Fig.17 A signal interaction diagram is shown in the case where access token generation fails in a wireless communication system according to an embodiment of the present disclosure. Fig.17 The signal exchange diagram shown in FIG. 1 may be understood as a signal flow exchanged between UE 310 and AAF 320.

[0169] Reference Fig.17In operation 1701, the UE 310 sends a request message to the AAF 320. The AAF 320 may receive the request message from the UE 310. That is, the UE 310 may send a message requesting an access token to the AAF 320 after the authentication process is successful. According to various embodiments, the request message may include at least one of an authorization type, an authentication code, a redirection address, and a client ID. The request message may be referred to as an "access token request message".

[0170] In operation 1703, the AAF 320 verifies the authentication code. The AAF 320 may identify the authentication code based on the received request message. The AAF 320 may determine whether to generate an access token using the information identified from the request message. For example, if the validity period of the authentication code has passed, if the GPSI identified from the authentication code does not match the GPSI received from the UDM, or if the client ID included in the request message does not match, the AAF 320 may determine not to generate an access token. In addition, if it is determined that the profile information received from the UDM is invalid, the AAF 320 may determine not to generate an access token.

[0171] In operation 1705, the AAF 320 sends a response message to the UE 310. The UE 310 may receive the response message from the AAF 320. That is, the AAF 320 may send a message to the UE 310 indicating that the access token has not been generated. For example, the response message may include at least one of information about the reason for rejecting the authentication code and a redirection address. That is, the AAF 320 may send the reason for rejecting the authentication code to the UE 310 through the response message. In addition, the AAF 320 may send a redirection address that may be determined according to the reason for rejecting the authentication code through the response message. The response message may be referred to as an "access token response message".

[0172] Fig.18 A flow chart of a UE granting permissions to an edge application in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.18 An operation method of UE 310 is shown.

[0173] Reference Fig.18 , at operation 1801, the UE sends a request message including an access token to the AF. That is, if the access token is received from the AAF according to the verification of the authentication code, the UE may send a request message to the AF requesting authorization of the edge application. In this case, the UE may send the access token to the AF through the request message. The access token may include at least one of a UE user-related identifier (e.g., a user identifier or an identifier of a UE device), an identifier of an application profile, a user category, a user level, and information identifying the AAF for verifying the access token.

[0174] In operation 1803, the UE receives a response message based on the verification result of the access token from the AF. Specifically, the AF can identify the AAF for verifying the access token based on the received access token. The AF can send a message including the access token and information requesting authorization for the edge application to the identified AAF. If the AAF successfully verifies the access token, the AF receives at least one of the allowable permission information or the allowable application profile of the edge application corresponding to the information contained in the access token from the AAF. Therefore, the UE can receive a response message from the AF, which includes information about the edge application allowed according to at least one of the subscriber category and subscriber level associated with the UE. According to various embodiments, the information about the edge application may include the address of the application server corresponding to the edge application. For example, the address of the application server may include at least one of the FQDN, the Internet Protocol (IP) address, or the address of the edge computing service endpoint. If the AAF fails to verify the access token, the AF receives a verification response message from the AAF indicating the reason for the failure of verification of the access token. Therefore, the UE may receive a response message from the AF, the response message including at least one of information indicating a reason why verification of the access token has failed and a redirection address for re-performing an authentication procedure for acquiring a valid access token.

[0175] Fig.19 A flowchart of AAF granting permissions to edge applications in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.19 The method of operation of AAF 320 is shown.

[0176] Reference Fig.19 In operation 1901, the AAF receives a request message from the AF requesting verification of an access token. Specifically, the AF may identify the AAF for verifying the access token based on the access token included in the request message received from the UE. The AAF may receive a verification request message from the AF, the verification request message including the access token and information for requesting authorization for the edge application. That is, after the AF identifies the AAF, the AAF may receive a message from the AF requesting verification of the access token.

[0177] In operation 1903, the AAF performs verification of the access token. The AAF may verify the access token based on at least one of the validity period of the access token and information related to the permissions of the access token. For example, the AAF may identify whether the validity period of the access token has passed when performing verification. If the validity period has not passed, the AAF may determine that the verification of the access token is successful. If the validity period has passed, the AAF may determine that the verification of the access token has failed. In addition, the AAF may identify whether at least one of the resources allowed by the access token or the resources requested by the UE belongs to the permissions of the access token. If at least one of the resources allowed by the access token or the resources requested by the UE belongs to the permissions of the access token, the AAF may determine that the verification of the access token is successful. If at least one of the resources allowed by the access token or the resources requested by the UE does not belong to the permissions of the access token, the AAF may determine that the verification of the access token has failed.

[0178] In operation 1905, the AAF sends a verification response message to the AF based on the verification result of the access token. That is, the AAF may send a response message indicating the verification result of the access token to the AF. If it is determined that the verification of the access token is successful, the AAF may send a verification response message to the AF, which includes information about the allowable permissions of the edge application corresponding to the information contained in the access token or at least one of the allowable application profiles. If it is determined that the verification of the access token fails, the AAF may send a verification response message indicating the reason for the failure of the verification of the access token to the AF. In this case, the reason for the verification failure may be sent to the AF, such as a situation where the access token is invalid due to exceeding the validity period or the requested resource does not belong to the permissions of the access token.

[0179] Fig. 20 A flowchart of an AF for granting permissions to edge applications in a wireless communication system according to an embodiment of the present disclosure is shown. Fig. 20 The method of operation of AF 330 is illustrated.

[0180] Reference Fig. 20, in operation 2001, the AF sends a request message to the AAF requesting verification of the received access token. Specifically, the AF may identify the AAF used to verify the access token based on the information for identifying the AAF used to verify the access token contained in the access token received from the UE. According to various embodiments, the information for identifying the AAF used to verify the access token may include at least one of the address of the AAF endpoint, the identifier of the application provider, and the AAF ID. For example, if the access token has the format of a JSON Web Token (JWT), the "Issuer ID" field, which is identification information of the token issuer, may include information determined based on the identifier of the application provider and the AAF ID and the "Published on (IAT)" field, which is information indicating the time when the token was issued, and may include the address of the AAF endpoint. Therefore, the AF may send a verification request message including the access token and authorization request information to the identified AAF.

[0181] In operation 2003, the AF receives a verification response message from the AAF based on the verification result of the access token. That is, the AF can receive a response message indicating the verification result of the access token from the AAF. If it is determined that the verification of the access token is successful, the AF can receive a verification response message from the AAF, which includes at least one of the allowed permission information or allowed application profiles of the edge application corresponding to the information contained in the access token. If it is determined that the verification of the access token fails, the AF can receive a verification response message from the AAF indicating the reason for the failure of the verification of the access token. In this case, the reason for the verification failure can be sent to the AF, such as a case where the access token is invalid due to exceeding the validity period or a case where the requested resource does not belong to the permissions of the access token.

[0182] In operation 2005, the AF sends a response message to the UE based on the verification response message. If the AAF successfully verifies the access token, the AF may receive a verification response message indicating the verification success from the AAF, and then may send a response message including information about edge applications allowed according to at least one of a subscriber category and a subscriber level associated with the UE to the UE. According to various embodiments, the information about the edge application may include the address of an application server corresponding to the edge application. For example, the address of the application server may include at least one of an FQDN, an IP address, or an edge computing service endpoint address. As described above, if the verification of the access token is successful, the verification response message may include information about the allowed permissions of the edge application corresponding to the information included in the access token or at least one of the allowed application profiles. If the AAF fails to verify the access token, the AF may receive a verification response message indicating the reason for the verification failure of the access token from the AAF, and then send a response message to the UE, the response message including information indicating the reason for the verification failure of the access token and at least one of the redirection addresses for re-performing the authentication process to obtain a valid access token.

[0183] Fig.21 A signal exchange diagram for granting permissions to edge applications in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.21 The illustrated signal exchange diagram may be understood as a signal flow exchanged between the UE 310 , the AAF 320 , and the AF 330 .

[0184] Reference Fig.21 , in operation 2101, UE 310 sends a request message to AF 330. AF 330 may receive the request message from UE 310. The request message may be referred to as an "application request message". That is, if an access token is received from AAF 320 based on successful verification of the authentication code, UE 310 may send a request message to AF 330 requesting authorization for the edge application. In this case, UE 310 may send the access token to AF 330 via a request message. The access token may include at least one of a UE user-related identifier (e.g., a subscriber identifier or an identifier of a UE device), an identifier of an application profile, a subscriber category, a subscriber level, and information for identifying AAF 320 for verifying the access token.

[0185] In operation 2103, AF 330 sends a verification request message to AAF 320. AAF 320 may receive the verification request message from AF 330. Specifically, AF 330 may identify AAF 320 for verifying the access token based on information for identifying AAF 320 for verifying the access token, which information is included in the access token received from UE 310. The verification request message may be referred to as an "access token verification request message". According to various embodiments, the information for identifying AAF 320 for verifying the access token may include at least one of an address of an AAF 320 endpoint, an identifier of an application provider, and AAF 320ID. For example, if the access token has a format of JWT, the "issuer ID" field as identification information of the token issuer may include information determined based on the identifier of the application provider and AAF 320ID and information of a field "issued on (IAT)" indicating the token issuance time, and may include the address of the AAF endpoint. Therefore, the AF 330 may send a verification request message including an access token and authorization request information to the identified AAF 320 .

[0186] In operation 2105, AAF 320 sends a verification response message to AF 330. AF 330 may receive a verification response message from AAF 320. That is, AAF 320 may send a response message to AF 330, which indicates the verification result of the access token. The verification response message may be referred to as an "access token verification response message". If it is determined that the verification of the access token is successful, AAF 320 may send a verification response message to AF 330, which includes at least one of the information of the allowed permissions of the edge application corresponding to the information included in the access token or the allowed application profile. If it is determined that the verification of the access token fails, AAF 320 may send a verification response message to AF 330 indicating the reason for the failure of the verification of the access token. In this case, the reason for the verification failure may be sent to AF 330, such as a case where the access token is invalid due to exceeding the validity period or a case where the requested resource does not belong to the permissions of the access token.

[0187] In operation 2107, AF 330 sends a response message to UE 310. UE 310 may receive a response message from AF 330. The response message may be referred to as an "application response message". If the verification of the access token by AAF 320 is successful, AF 330 may receive a verification response message indicating the verification success from AAF 320, and then may send a response message to UE 310, the response message including information about edge applications allowed according to at least one of a subscriber category and a subscriber level associated with UE 310. According to various embodiments, the information about the edge application may include an address of an application server corresponding to the edge application. For example, the address of the application server may include at least one of an FQDN, an IP address, or an edge computing service endpoint address. As described above, if the verification of the access token is successful, the verification response message may include information about the allowed permissions of the edge application corresponding to the information included in the access token or at least one of the allowed application profiles. If AAF 320 fails to verify the access token, AF 330 may receive a verification response message from AAF 320 indicating the reason why verification of the access token failed, and may then send a response message to the UE, the response message including information indicating the reason why verification of the access token failed and at least one of a redirection address for re-performing the authentication process to obtain a valid access token.

[0188] like Figures 18 to 21 Based on the information included in the access token, different edge computing services can be provided to each UE or UE user. That is, the AF can send information to the UE to provide differentiated edge computing services based on application profiles, subscriber categories, subscriber classes, etc., so as to allow the use of edge computing services. For example, if the AF receives a request for a list of edge applications from the UE, the AF can perform verification of the access token and can determine a list of edge applications available to the UE based on the subscriber category received from the AAF. An example of a list of available edge applications for each subscriber class is shown in Table 2 below.

[0189] Table 2

[0190] Subscriber Class Available edge applications Class A APP 1 and APP 2 Class B APP 1 and APP 2 Class C APP 1

[0191] Referring to Table 2, APP 1 and APP 2 may be allowed for subscribers belonging to subscriber class A. In addition, APP 1 and APP 2 may be allowed for subscribers belonging to subscriber class B. Furthermore, for subscribers belonging to subscriber class C, only APP 1 may be allowed to be used, not APP 2. That is, different edge applications may be provided according to subscriber classes.

[0192] In addition, if information about available edge applications is sent to the UE, and if a request for the address of the application server of the edge application is received from the UE, the AF can send different addresses for the application based on the subscriber category and subscriber class. An example of the address of the application server of the edge application is shown in Table 3 below.

[0193] Table 3

[0194] Edge Applications FQDN Class A Class B APP 1 ex.app1.com fast.app1.com slow.app1.com APP 2 svc.app2.com fast.app2.com slow.app2.com

[0195] Referring to Table 3, in the case of APP 1, if FQDN is requested as the address of the application server, the address "ex.app1.com" may be provided. In addition, in the case of subscriber class A, the address "fast.app1.com" may be provided to the UE; and in the case of subscriber class B, the address "slow.app1.com" may be provided to the UE. That is, the edge application APP 1 may be provided at different speeds according to the subscriber class. Similarly, in the case of APP 2, if FQDN is requested as the address of the application server, the address "svc.app2.com" may be provided. In addition, in the case of subscriber class A, the address "fast.app2.com" may be provided to the UE; and in the case of subscriber class B, the address "slow.app2.com" may be provided to the UE. That is, the edge application APP 2 may be provided at different speeds according to the subscriber class.

[0196] The following will refer to Fig. 22 and 23 , describes in detail an embodiment of user consent and utilization of personal information when personal information about the user is requested to provide edge computing services.

[0197] Fig. 22 A signal exchange diagram for obtaining user consent to use personal information in a wireless communication system according to an embodiment of the present disclosure is shown. Fig. 22 The illustrated signal exchange diagram may be understood as a signal flow exchanged between the UE 310 and the EF 210.

[0198] refer to Fig. 22 In operation 2201, UE 310 and EF 210 perform a process of obtaining user consent to use personal information. For example, when performing the above-mentioned authentication procedure or after the authentication procedure is completed, the client, i.e., the external user agent, may request personal information about the user. That is, a request is made to the user of UE 310 requesting the edge computing service for consent to granting authority to personal information. The personal information about the user may include various information, such as location information of UE 310.

[0199] In operation 2203, EF 210 stores information about user consent or refusal. EF 210 may store information about whether the user agrees to use personal information. Information about user consent or refusal may be maintained within the validity period of the authentication result obtained through the above authentication process. If the validity period during which the authentication result remains valid expires, EF 210 may delete the information about user consent or refusal.

[0200] Fig.23 A signal exchange diagram using personal information in a wireless communication system according to an embodiment of the present disclosure is shown. Fig.23 The signal exchange diagram shown can be understood as the signal flow exchanged between AMF 146 / NEF 152, EF 204 or 210, and edge server 102 or 106.

[0201] refer to Fig.23 In operation 2301, the edge server 102 or 106 sends a request message for using personal information to the EF 204 or 210. The EF 204 or 210 receives the request message for using personal information from the edge server 102 or 106. The edge server 102 or 106 that provides an edge application to a UE may send a message requesting to utilize personal information about a user of a corresponding UE to the EF 204 or 210.

[0202] In operation 2303, EF 204 or 210 determines whether the user agrees to use the personal information. Fig. 22 As shown, EF204 or 210 can identify whether the user agrees to use the requested personal information based on pre-stored information about the user's consent or refusal. In this case, EF 204 or 210 can identify the availability of the requested personal information before the validity period during which the authentication result remains valid.

[0203] In operation 2305, EF 204 or 210 sends a personal information request message to AMF 146 and NEF 152. AMF 146 and NEF 152 receive the personal information request message from EF 204 or 210. If it is confirmed that the user agrees to use the requested personal information based on the information about the user's consent or refusal, EF 204 or 210 may send a request message for acquiring the current status of the corresponding personal information to AMF 146 and NEF 152. That is, EF 204 or 210 may acquire currently valid information about the function (e.g., positioning of the UE) that the user agrees to. Although Fig.23146 and NEF 152 are described in the above, but additional entities may receive request messages depending on the type of personal information requested. For example, if edge server 102 or 106 requests location information about a UE, EF 204 or 210 may send a message to a location service (LCS) and AMF 146 and NEF requesting the current location information of the UE.

[0204] Fig.24 A network structure according to an embodiment of the present disclosure is shown, in which a structure for authentication and authorization of edge applications is mapped to an edge computing structure in a wireless communication system.

[0205] Specifically, Fig.24 A network structure is shown in which entities of various embodiments are mapped to an edge computing structure.

[0206] refer to Fig.24 , the edge enabler client (EEC) 318 may be a software module including both the user agent 312 and the application 314. Alternatively, the EEC 318 in the UE 310 may be a software module including the user agent 312.

[0207] The edge enabler client 318 can be identified using an EEC identifier. The EEC identifier can be a value derived from the subscriber's identifier. In the case where the EEC identifier is derived from the subscriber's identifier, the EEC may include an identifier of a mobile communication service provider derived from a subscription permanent identifier (SUPI), a mobile station international subscriber number (MSISDN) or a universal public subscription identifier (GPSI) and a serial number that distinguishes the mobile communication service provider. In the case where the EEC identifier is provided by a terminal manufacturer, the EEC identifier can be derived from a permanent equipment identifier (PEI). In the case where the EEC identifier is derived from the PEI, the EEC identifier may include identification information, which includes the manufacturer's identifier, the manufacturer's number, the SW number, the model name, etc. Alternatively, the EEC identifier may be a value preset by a software module using the EEC. If the EEC identifier is an identifier of a software module, the EEC identifier may follow the format of a universal unique identifier (UUID). The EEC identifier may include a unique software package name that can identify a software package, which may follow the reverse format of a fully qualified domain name (FQDN), such as "com.samsung.mecframework". In addition, the software package name may include a version name of the software. The EEC identifier can be downloaded from the edge computing service provider so as to be then installed in the terminal. The EEC identifier may include a serial number issued by the edge computing service provider. In addition, the EEC identifier may include an identifier for distinguishing the edge computing service provider.

[0208] exist Fig.24 In the embodiment described in, the edge enabler client 318 may include Figure 3 The functionality of the user agent 312 and application 314 in the embodiments described in .

[0209] exist Fig.24 In the embodiment described in Figure 3 The functions of the AAF 320 in the embodiment described in the embodiment. The AAF 320 may be set in the 3GPP core network 2410. Alternatively, the AAF 320 may be implemented together with the edge configuration server 2430. Alternatively, as Fig.24 As shown, the AAF 320 may operate separately from the 3GPP core network 2410 and the edge configuration server 2430 .

[0210] The edge enabler client 318 receives configuration information required to exchange application data traffic with the edge application server 2422. The edge enabler client 318 obtains address information about available edge application servers 2422 in the edge data network 2420.

[0211] exist Fig.24 In the embodiment described in , the edge enabler server (EES) 2424 performs the following functions required by the edge application server 2422 and the edge enabler client 318.

[0212] 1. Exchange configuration information required for application data services with edge application server 2422

[0213] 2. Provide information related to the edge application server 2422 to the edge enabler client 318

[0214] 3. Provide application programming interfaces (APIs) for network functions provided by 3GPP networks

[0215] exist Fig.24 In the embodiment described in , the edge configuration server (ECS) 2430 performs the functions required for the edge enabler client 318 to connect to the edge enabler server 2424. The edge configuration server 2430 provides advance information about edge configuration information to the edge enabler client 318. The edge configuration information is information required for the edge enabler client 318 to connect to the edge enabler server 2424 and information used to establish a connection with the edge enabler server 2424.

[0216] exist Fig.24 In the embodiment described in , the application client 316 is an application program installed and executed in the UE 310. Fig.24In the depicted embodiment, edge application server (EAS) 2422 performs the functions of a server in an edge hosting platform in edge data network 2420 or edge hosting environment. Application client 316 connects to the available services in edge application server 2424.

[0217] Fig.25 A process of determining an authentication method by a terminal and an AAF in a case where a plurality of authentication methods are provided in a wireless communication system according to various embodiments is illustrated. Fig.25 Also included are embodiments in which the authentication method uses Application Authentication and Key Management (AKMA) provided by the 5G Core (5GC) network.

[0218] exist Fig.25 In the embodiment of the present invention, UE 2521 corresponds to Fig.24 UE 310 in the embodiment of FIG. Fig.25 , UE 2521 has an edge enabler client (EEC) 2522 and a communication processor (CP) 2523 therein. CP 2523 is a device inside UE 2521 that implements a wireless interface for accessing 5G access and 5G core networks and LTE access and EPC (EPC) networks, and includes a modem function therein. CP 2523 in UE 2521 accesses the EPC network or the 5GC network.

[0219] In step 2501a, CP 2523 performs registration with EPC 2524. The registration request message of CP 2523 may include information of EPC-AKA authentication. In step 2501a, CP 2523 of UE 2521 performs an initial attachment procedure to the EPC 2524 network. In step 2501a, UE 2521 and EPC 2524 network perform an EPC authentication and key agreement (AKA) authentication procedure.

[0220] Alternatively, UE 2521 performs a registration process to the 5GC 2525 network in steps 2501b-1 and 2501b-2.

[0221] In step 2501b-1, CP 2523 performs registration to 5GC 2525. The registration request message of CP 2523 may include information about at least one of 5GC-AKA authentication or non-3GPP AKA authentication. 5GC-AKA or Extensible Authentication Protocol (EAP)-AKA authentication is performed in the process of registering with the 5GC 2525 network.

[0222] In step 2501b-2, 5GC 2525 performs UE configuration update. The UE configuration update message may include at least one of the ECS address, AAF address, and AKMA key availability. After successfully registering to the 5GC 2525 network, the 5GC 2525 network sends information about the edge configuration server (ECS) 2527 through the UE configuration update process. In step 2501b-2, the access and mobility management function (AMF) of 5GC2525 may send information about whether the AKMA key for ECS authentication is available to the CP 2523 of UE 2521.

[0223] In step 2502, CP 2523 sends information about the CN type and the availability of the AKMA key to EEC 2522. CP 2523, which has successfully registered with the EPC 2524 network or the 5GC 2525 network, sends information indicating successful access to EPC 2524 or 5GC 2525 to EEC 2522. In this case, CP 2523 may send information about the type (CN-type) of the successfully accessed 3GPP core network (CN) to EEC 2522. The 3GPP core network type information may be a 3GPP core network type such as EPC 2524 and 5GC 2525. In addition, CP 2523 may also send information about the authentication method performed in the EPC 2524 and 5GC 2525 networks and the credential information available to CP 2523 to EEC 2522. The information about the authentication method may be EPC-AKA, 5GC-AKA, or EAP-AKA, and the available credential information may include AKMA credentials, AKMA authentication methods, and certificates. In the case where AKMA is available for CP 2523, CP 2523 may allocate a new AKMA key ID for generating an authentication key for EEC 2522, and may generate an AKMA key corresponding to the AKMA key ID. The AKMA credential generated by CP 2523 may be sent to EEC 2522. Another method for EEC 2522 to receive an AKMA key credential from CP 2523 is for EEC 2522 to send information including an EEC ID, an ECS ID associated with EEC 2522, or an identifier of an edge computing service provider (ECSP) to CP 2523, and CP 2523 generates a new AKMA ID including an EEC ID, an ECSP identifier, and ECS information in response to a request from EEC 2522. CP 2523 may send a new AKMA key ID and an AKMA key to EEC 2522.

[0224] In step 2503, UE 2521 determines "CN type" and "AKMA support". In step 2503, EEC 2522 in UE 2521 derives available authentication methods from information received from CP 2523 in UE 2521. For example, in the case where CP 2523 has performed registration with 5GC 2525, information indicating that AKMA is available can be derived. CP 2523 can send information about whether AKMA is supported through a registration process or a security mode command (SMC) process to the 5GC2525 network, and can receive information indicating that 5GC 2525 supports AKMA from the AMF or AUSF of 5GC 2525. CP 2523 determines whether AKMA is supported through the above-mentioned capability information exchange process. If it is determined that AKMA is available, CP 2523 can send such information to EEC 2522 in the same manner as step 2502, and EEC 2522 can identify whether AKMA is supported. In step 2503, the EEC 2522 in the UE 2521 may determine whether the accessed 3GPP core network type (CN type) information and possible authentication methods are available. Based on this information, the EEC 2522 may select an available authentication method for performing the EEC 2522 authentication and authorization process.

[0225] In step 2504, the EEC 2522 sends a provisioning request message to the ECS 2527. The provisioning request message may include information about at least one of the EEC ID, GPSI, PLMN ID, CN type, and supported EEC authentication methods. In step 2504, the EEC 2522 uses the address of the ECS 2527 preset in the EEC 2522 (corresponding to the address of the ECS 2527). Fig.24In step 2504, the ECS 2527 receives the provisioning request message, identifies the security credentials included in the provisioning request message, and determines whether authentication has been performed. For an authentication provisioning message that does not include appropriate security credentials, the ECS 2527 may determine to redirect the message to the AAF 2526 to perform authentication. The ECS 2527, which has determined to redirect to the AAF 2526, may send a preset list of EEC authentication methods that can be used for the AAF 2526 to the EEC 2522. In addition, the ECS 2527 may send information including the address of the AAF 2526, an indicator indicating that redirection is required, and a reason for performing the redirection to the EEC 2522. The reason for performing the redirection may include an indicator indicating that EEC authentication / authorization is required or information indicating that the security credentials included in the ECS 2527 are not appropriate.

[0226] In step 2505, ECS 2527 sends a provisioning response message to EEC 2522. The provisioning response message may include information about at least one of an AAF address, a redirection request, supported EEC authentication methods, and an MNO authentication request. In step 2505, EEC 2522 receives the provisioning response message. The provisioning response message received by EEC 2522 includes an AAF address, a redirection request, an indicator indicating that EEC authentication / authorization is required, and authentication methods supported by AAF 2526.

[0227] In step 2506, the EEC 2522 selects an authentication method. The EEC 2522 in the UE 2521 has information about whether to provide an authentication method using credentials for authentication stored in the EEC 2522 (e.g., credentials and keys for the EEC 2522) or using input directly received through a user interface, and the authentication method received from the CP 2523. In the case where multiple EEC authentication methods are provided as described above, the EEC 2522 may determine the authentication method according to the priority of the authentication method, which is defined in the EEC 2522 by pre-configuration. Alternatively, the priority of the authentication method may be changed by user settings. The EEC 2522 may select a suitable authentication method, or may also select multiple authentication methods. If the EEC 2522 is currently connected to the 3GPP core network in step 2502, and if the EEC 2522 receives an indicator indicating that MNO authentication is required in step 2505, the EEC 2522 must select an authentication method through the 3GPP core network. For example, such an authentication method may be a generic bootstrapping architecture (GBA) authentication method using AKA authentication in an EPC 2524 network, an AKMA authentication method in a 5GC 2525 network, an AKMA method of application layer authentication, etc. In addition, it may be an HTTP (Hypertext Transfer Protocol) AKA method using an application layer protocol. Alternatively, in the case where ECS 2527 is an edge computing service provider rather than a mobile communication service provider, the provisioning response message in step 2505 may include information about the edge computing service provider, and if EEC 2522 has authentication information identified by an identifier of the edge computing service provider, EEC 2522 may select an authentication method by the information about the edge computing service provider.

[0228] In step 2507, the EEC 2522 sends an EEC 2522 authentication / authorization request message to the AAF 2526. The EEC 2522 authentication / authorization request message may include information about at least one of the EEC 2522 ID, GPSI, PLMN ID, and a security credential identifier (e.g., AKMA key ID, GBA, ID-PW, certificate, etc.). In step 2507, the EEC 2522 sends an EEC authentication / authorization request message to the AAF 2526 according to the authentication method selected in step 2506. The EEC authentication / authorization request message may include an identifier of UE 2521 (e.g., a general public subscription identity (GPSI)), an identifier of EEC 2522 (EEC ID), a current serving PLMN identifier, and a home PLMN identifier. In addition, EEC 2522 may send a list of security credentials currently available for UE 2521 to AAF 2526. EEC 2522 may send a list of available credentials or identifiers of available security credentials to AAF 2526. Alternatively, EEC 2522 may send a list of supported authentication methods. The available credential identifier may include information about at least one of, for example, an AKMA key identifier, a GBA identifier, a GBA request indicator, support / non-support for ID-PW authentication, and a certificate.

[0229] In step 2508, AAF 2526 determines the EEC 2522 authentication / authorization method. In step 2508, AAF 2526 may receive a plurality of authentication methods and security credential identifiers supported by EEC 2522, and may determine the authentication method through information configured in AAF 2526 and information on whether interaction with a 3GPP network is supported.

[0230] For example, if one or more of the following conditions are met, the AAF 2526 may determine the AKMA authentication method as the EEC authentication method.

[0231] 1.EEC 2522 is currently connected to the 3GPP core network.

[0232] 2. The EEC 2522 receives an indicator indicating support for AKMA, or receives an AKMA key identifier.

[0233] 3. The AAF 2526 is capable of interacting with the AAnF, which provides AKMA key generation functionality in the 3GPP 5GC network identified by the home PLMN identifier received from the EEC 2522.

[0234] 4. Confirmed to support AKMA key generation via NEF.

[0235] Alternatively, if one or more of the following conditions are met, the AAF 2526 may select the GBA authentication method as the EEC authentication method.

[0236] 1. GBA is supported in the Home PLMN network identified by the Home PLMN Identifier.

[0237] 2. EEC 2522 is currently connected to the 3GPP core network, and the connected network is the EPC network.

[0238] 3.EEC 2522 can interact with GBA servers.

[0239] 4. An indicator is received from UE 2521 indicating that the client function for GBA interaction is available.

[0240] In step 2509, AAF 2526 sends an EEC 2522 authentication / authorization response message to EEC 2522. The EEC 2522 authentication / authorization response message may include information about at least one of the selected EEC 2522 security credential ID and the selected authentication method. In step 2509, AAF 2526 sends the EEC authentication method determined in step 2508 to EEC 2522.

[0241] If a security credential identifier to be used in the EEC authentication method is selected, in step 2509, AAF2526 sends the selected security credential identifier (ID) to EEC 2522.

[0242] UE 2521 sends an EEC authentication request according to the determined authentication method. If the determined authentication method is the AKMA method, UE 2521 generates an AKMA key and an AKMA key identifier. The AKMA key can be generated by issuing a request to CP 2523. In order to generate the AKMA key, EEC 2522 can generate an AKMA key and an AKMA key identifier by further including an EEC ID, an ECSP identifier, and an indicator for identifying an edge computing service. The newly generated AKMA key can be used to verify messages between EEC 2522 and AAF 2526. In step 2510, EEC 2522 sends a message to AAF 2526 using the newly generated AKMA key.

[0243] In step 2510, the EEC 2522 sends an EEC authentication / authorization request message to the AAF 2526. The EEC authentication / authorization request message may include information about at least one of the EEC ID, GPSI, PLMN ID, AKMA key ID, and AKMA authentication code (MAC). In step 2510, the AAF 2526 receives the authentication request message from the EEC 2522. The authentication request message may include information about at least one of the EEC ID, GPSI, PLMN ID, AKMA key ID, and an authentication code authenticated using the AKMA key.

[0244] In step 2511, the AAF 2526 discovers the 5GNF (i.e., AAnF address) used as the AKMA key ID. The AAF 2526 discovers the NEF or AAnF address of the 5GC 2525 network preset for each PLMN. Alternatively, the AAF 2526 may discover the AAnF through the AANF address contained in the authentication request message sent by the EEC 2522 or the routing information to the AAnF.

[0245] In step 2512, the AAF 2526 sends an AKMA key derivation request message to the 5GC 2525. The AKMA key derivation request message may include information about at least one of the GPSI and the AKMA key ID. In step 2512, the AAF 2526 sends an AKMA key derivation request message to the 5GC 2525.

[0246] In step 2513, 5GC 2525 sends an AKMA key derivation response message to AAF 2526. The AKMA key derivation response message may include information about at least one of EEC ID, GPSI, PLMN ID, CN type, and AF key. 5GC 2525 derives the AKMA key from the AKMA key ID, ECSP identifier, GPSI, and AUSF key corresponding to the subscriber using information indicating the ECSP identifier, EEC ID, etc. as parameters. In step 2513, 5GC 2525 sends the derived AKMA key to AAF 2526.

[0247] In step 2514, the AAF 2526 performs verification. The AAF 2425 receiving the AKMA key from the 5GC 2525 network verifies the AKMA authentication code received in step 2510.

[0248] In step 2515, AAF 2526 sends a request message for edge computing related profiles (e.g., GPSI) to 5GC 2525. If the verification is successful, AAF 2526 directly requests edge computing related information from UDM in the 3GPP 5GC 2525 network. AAF 2526 can send a request for edge computing related information via NEF in the 5GC 2525 network.

[0249] In step 2516, 5GC 2525 sends a response message including an edge computing related profile to AAF 2526. AAF 2526 receives edge computing related subscriber information from the 5GC 2525 network. The edge computing related subscriber information may include at least one of the following information.

[0250] 1. Edge Computing Service Profile Identifier

[0251] 2. Edge computing service profile index

[0252] 3. At least one of the following: subscriber category information and subscriber level

[0253] 4. Information about whether the user subscribes to edge computing services

[0254] 5. List of S-NSSAI and DNN licensed by Edge Computing Service Providers (ECSP)

[0255] 6. List of S-NS SAI or DNN permitted for edge computing purposes

[0256] 7. List of ECSP identifiers under edge computing protocols

[0257] 8. Application configuration file:

[0258] 8-1. Information about the minimum and maximum delays between UE 2521 and the application layer edge application server (EAS)

[0259] 8-2. Information about the transfer rate in the application layer: maximum transfer rate and average transfer rate

[0260] 8-3. Required computing resource information: maximum and average CPU / GPU performance, CPU / GPU type, and required memory and storage size

[0261] 9. List of S-NSSAI and DNN that meet the application profile conditions

[0262] 10. S-NSSAI and DNN, application profile information satisfied by S-NSSAI and DNN, or application profile index of predefined application profile conditions

[0263] In step 2517, AAF 2526 generates an access token using an edge computing related profile. AAF 2526 may generate an access token based on edge computing profile information received from the 3GPP core network. The access token for edge computing access includes at least one of the following information.

[0264] 1. Token Release Date

[0265] 2. Expiration time

[0266] 3. Application Profile Index

[0267] 4. Subscription Level

[0268] 5. Subscription Category

[0269] 6. 3GPP core network operator PLMN identifier

[0270] 7. Information about the ECSP or PLMN that issued the token

[0271] 8. Information on S-NSSAI and DNN for edge computing in EEC 2522

[0272] 9. Signature of the token issuer: This signature is an authentication code that can verify the token contents and is generated using the issued AKMA key.

[0273] The issued edge computing access token can be encrypted using the AKMA key.

[0274] In step 2518, AAF 2526 sends an EEC authentication / authorization response message to EEC 2522. The EEC authentication / authorization response message may include information about at least one of the authentication result and the access token. The edge computing access token issued in step 2517 is sent to UE 2521 together with the authentication result in step 2518.

[0275] After step 2518, EEC 2522 can decrypt the sent access token using the AKMA key. Fig.24 The ECS 2430 in the embodiment) and the EES (corresponding to Fig.24When interacting with the EES 2424 in the embodiment, the EEC 2522 can use the access token. In addition, if the application client of UE 2521 requests a slice, EEC2522 can request access to the specified slice specified in the access token. If the application client requests a specific slice, but the edge computing profile information allowed in the access token received by EEC 2522 does not include information about the specific slice requested by the application client, EEC 2522 can reject the application client's request to generate a new slice. If the application client requests to use a specific DNN or generate a specific DNN, EEC 2522 identifies whether the access token includes information about the specific DNN. If information about the specific DNN is not included in the allowed DNN information, EEC 2522 can reject the application client's request to use the specific DNN or generate the specific DNN. Alternatively, EEC 2522 can provide services to the application client using a DNN different from the requested specific DNN.

[0276] The methods disclosed in the claims and / or the methods according to the various embodiments described in the present disclosure may be implemented by hardware, software, or a combination of hardware and software.

[0277] When these methods are implemented by software, a computer-readable storage medium for storing one or more programs (software modules) may be provided. One or more programs stored in the computer-readable storage medium may be configured to be executed by one or more processors in an electronic device. At least one program may include instructions for causing an electronic device to perform methods according to various embodiments of the present disclosure as defined in the appended claims and / or disclosed herein.

[0278] The program (software module or software) can be stored in a non-volatile memory, including random access memory and flash memory, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magneto-optical storage device, compact disc-ROM (CD-ROM), digital versatile disc (DVD) or other types of optical storage devices or tapes. Alternatively, any combination of some or all of them can form a memory for storing programs. In addition, multiple such memories may be included in the electronic device.

[0279] In addition, the program can be stored in an attachable storage device that can access the electronic device through a communication network such as the Internet, an intranet, a local area network (LAN), a wide area network (WLAN), and a storage area network (SAN), or a combination thereof. Such a storage device can access the electronic device through an external port. In addition, a separate storage device on a communication network can access a portable electronic device.

[0280] In the embodiments of the present disclosure described in detail above, the elements included in the present disclosure are expressed in the singular or plural, depending on the detailed embodiments presented. However, for the convenience of description, the singular form or plural form is appropriately selected according to the presented situation, and the present disclosure is not limited to the elements expressed in the singular or plural. Therefore, the elements expressed in the plural may also include a single element, or the elements expressed in the singular may also include multiple elements.

[0281] While the present disclosure has been shown and described with reference to various embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents.

Claims

1. A method performed by a user equipment (UE) in a wireless communication system, the method comprising: performing an authentication procedure with an authentication server function (AUSF) to access a wireless communication system; Obtaining an authentication and key management (AKMA) key for an application of an edge computing service based on the authentication process; Sending a request message for requesting authorization of an edge computing service to a server, wherein the request message includes an AKMA key identifier (ID) corresponding to the AKMA key; receiving a response message from the server indicating that the permission to the edge computing service is granted, wherein the response message includes an access token of the edge computing service; and The edge computing service corresponding to the access token is used.

2. The method of claim 1, wherein: The authentication process is based on at least one of transmission of Universal Subscriber Identity Module (USIM) credentials, a user portal, credentials generated using information related to the UE, or a One-Time Password (OTP).

3. The method of claim 1, wherein: In case the authentication process is performed based on USIM credentials, the execution of the authentication process includes: receiving from the server a message including random number information and an authentication token required for the UE to perform an authentication process; and Identify whether the authentication token contained in the received message matches the authentication token generated by the UE.

4. The method of claim 1, wherein: In the case where the authentication process is performed based on a user portal, the execution of the authentication process includes: displaying a screen for inputting the authentication credential information based on a message for inputting the authentication credential information received from the server; detecting input of the authentication credential information; and sending the authentication credential information to the server, and The authentication credential information includes at least one of a user identification (ID) or a password.

5. The method of claim 1, wherein: In case the authentication process is performed based on credentials generated using information related to the UE, the performing of the authentication process includes: receiving from the server a request message including random number information generated by the server; Generate a message authentication code (MAC) based on at least one of the random number information contained in the received request message or the information related to the UE; sending a response message including the MAC to the server; and The authentication code is received from the server based on verification of the MAC included in the response message.

6. The method of claim 1, wherein: In case the authentication process is performed based on the transmission of a one-time password (OTP), the execution of the authentication process includes: Receive an OTP from the server; receiving from the server a request message including random number information generated by the server; Generate a message authentication code (MAC) based on at least one of the random number information included in the received request message, the value of the received OTP, or information related to the UE; sending a response message including the MAC to the server; and The authentication code is received from the server based on verification of the MAC included in the response message.

7. The method of claim 1, wherein: The access token is encrypted based on the AKMA ID.

8. A method for authorizing an edge computing service performed by a server, the method comprising: receiving a request message for requesting authorization of an edge computing service from a user equipment (UE), wherein the request message includes an AKMA key identifier (ID) corresponding to an AKMA key; and Sending a response message to the UE indicating authorization to the edge computing service, wherein the response message includes an access token of the edge computing service, The edge computing service corresponding to the access token is used by the UE.

9. The method of claim 8, wherein: The access token is encrypted based on the AKMA ID.

10. A user equipment (UE) in a wireless communication system, the UE comprising: Transceiver; and a processor, coupled to the transceiver and configured to: performing an authentication procedure with an authentication server function (AUSF) to access a wireless communication system; Obtaining an authentication and key management (AKMA) key for an application of an edge computing service based on the authentication process; Sending a request message for requesting authorization of an edge computing service to a server, wherein the request message includes an AKMA key identifier (ID) corresponding to the AKMA key, receiving a response message from the server indicating authorization granted to the edge computing service, wherein the response message includes an access token of the edge computing service, and The edge computing service corresponding to the access token is used.

11. The UE according to claim 10, wherein: The authentication process is based on at least one of transmission of Universal Subscriber Identity Module (USIM) credentials, a user portal, credentials generated using information related to the UE, or a One-Time Password (OTP).

12. The UE according to claim 10, wherein: In case the authentication process is performed based on USIM credentials, then in order to perform the authentication process, the processor is further configured to: receiving from the server a message including random number information and an authentication token required for the UE to perform an authentication process; and Identifying whether the authentication token in the received message matches an authentication token generated by the UE.

13. The UE according to claim 10, wherein: The access token is encrypted based on the AKMA ID.

Images