Network function request error handling

Abstract

According to an example aspect, a method is provided, comprising: receiving, through a service communication agent, a service request for a service from a network function producer to a network function consumer, and in response to an error in obtaining an access token from a network repository function based on the service request, transmitting a response to the service request to the network function consumer, wherein the access token is used to authorize access to the service at the network function producer, and the response indicates an access token error.

Description

Technical Field

[0001] The present disclosure relates to error handling of network function requests (eg, access token requests) in a communication network. Background Art

[0002] In a network that supports wireless or wire-based communications, discovering network functions, NFs, and network function services is of interest because many network function instances may be virtualized and dynamic. A core network CN entity may seek to discover a group of one or more NF instances and NF service instances of a specific NF service or NF type. Examples of such CN entities include NFs and service communication agents SCPs. Examples of NF instances to be discovered include application functions, gateways, and subscriber data repositories, as well as application-related functions, such as functions for vertical industry support or entertainment. Other examples include resource control or management functions, session management or control functions, intercommunication, data management or storage functions, authentication functions, or a combination of one or more of these functions. NF service instances, also referred to as NF services, include individual services provided by NFs. An NF may be configured to provide more than one service, each of which may be reached using different methods (e.g., different addresses or ports or communication protocols).

[0003] NF service discovery may be enabled via a NF discovery process, for example, as specified in technical specifications established by the 3rd Generation Partnership Project 3GPP or GSMA, GSM Association for wireless communication networks. The Network Repository Function NRF may be configured to act as a service access authorization server and provide a cryptographic access token to a (service consuming) network function consumer or an SCP on behalf of the network function consumer, which authorizes the network function consumer to use services provided by a (service providing) network function producer. Summary of the invention

[0004] According to some aspects, the subject matter of independent claims is provided. Some embodiments are defined in the dependent claims. The scope of protection sought by various embodiments of the invention is defined by the independent claims. The embodiments, examples and features (if any) described in this specification that do not fall within the scope of the independent claims are to be interpreted as examples that help understand the various embodiments of the invention.

[0005] According to a first aspect of the present disclosure, a device is provided, comprising at least one processing core, at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to use the at least one processing core to enable the device to at least: receive a service request for a service from a network function producer from a network function consumer, and in response to an error in obtaining an access token from a network repository function based on the service request, transmit a response to the service request to the network function consumer, wherein the access token is used to authorize access to the service at the network function producer, and the response indicates an access token error.

[0006] According to a second aspect of the present disclosure, a method is provided, comprising: receiving a service request for a service from a network function producer from a network function consumer through a service communication agent, and in response to an error in obtaining an access token from a network repository function based on the service request, transmitting a response to the service request to the network function consumer, wherein the access token is used to authorize access to the service at the network function producer, and the response indicates an access token error.

[0007] According to a third aspect, a device is provided, comprising at least one processing core, at least one memory containing computer program code, wherein the at least one memory and the computer program code are configured to use the at least one processing core to enable the device to at least: transmit a service request for a service from a network function producer to a service communication agent; receive a response to the service request from the service communication agent, wherein the response indicates an access token error; and control network function service access based on the access token error indicated in the response.

[0008] According to a fourth aspect, a method is provided, comprising: transmitting, by a network function consumer, a service request for a service from a network function producer to a service communication agent; receiving a response to the service request from the service communication agent, wherein the response indicates an access token error; and controlling network function service access based on the access token error indicated in the response.

[0009] According to some other aspects, a computer program (product), computer-readable medium or non-transitory computer-readable medium is provided, which includes a set of computer-readable instructions, which, when executed by at least one processor, cause the device to perform the method of the second aspect or the fourth aspect, or an embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 describing example systems according to at least some embodiments;

[0011] Figure 2a and 2bdescribing methods according to at least some embodiments;

[0012] Figure 3 and 4 describing signaling according to at least some embodiments; and

[0013] Figure 5 is an example device capable of supporting at least some embodiments. DETAILED DESCRIPTION

[0014] Figure 1 An example system is illustrated including two public land mobile networks PLMN 110, 112, each of which is equipped with a network function NF 120, 122. A network function may refer to an operational and / or physical entity. A network function may be a specific network node or element, or a specific function or set of functions implemented by one or more entities (e.g., a virtualized network element VNF). One physical node may be configured to execute multiple NFs. A network function may be implemented as a network element on dedicated hardware, a software instance running on dedicated hardware, or a virtualized function materialized on an appropriate platform (e.g., on a cloud infrastructure). Examples of such network functions include resource control or management functions, session management or control functions, interworking, data management or storage functions, authentication functions, or a combination of one or more of these functions.

[0015] In the case of the third generation partnership project 3GPP, the fifth generation 5G, and the system service-based architecture SBA, the core network NF may include at least some of the access and mobility management function AMF, the session management function SMF, the network slice selection function NSSF, the network exposure function NEF, the network repository function NRF, the unified data management UDM, the authentication server function AUSF, the policy control function PCF, and the application function AF. The PLMN may each further include a security edge protection agent SEPP 130, 132, which is configured to operate as a security edge node or gateway. For example, NFs can communicate with each other using a representative state transfer application programming interface. These may be referred to as Restful APIs. Other examples of NFs include NFs related to gaming, streaming media, or industrial process control. The system may also include nodes from a 3G or 4G node system, such as a home subscriber server HSS, and suitable interworking functions for protocol translation between, for example, diameter and REST API Json. Although the terminology of the 5G system is mainly used herein to describe, the principles of the present invention are also applicable to other communication networks using agents as described herein, such as 4G networks and non-3GPP networks.

[0016] Although Figure 1The example of has two PLMNs 110, 122, but in general, at least some embodiments of the present invention may be implemented in a single PLMN, which does not necessarily have a SEPP. In the inter-PLMN case, the SEPP 130, 132 is a network node located at the border of the operator network, which can be configured to receive a message (e.g., HTTP request or HTTP response from a NF), apply protection to send and forward the reformatted message to a receiving SEPP through a chain of intermediate nodes (e.g., IP eXchange, IPX). The receiving SEPP receives the message sent by the sending SEPP and forwards the message to a NF within its operator network, such as an AUSF.

[0017] exist Figure 1 In the example of , NF services may be provided by service producing NFs (hereinafter referred to as NFc 120 and NFp 122) for service consuming NFs. They may also be referred to as NF service consumers and NF service producers, respectively. As noted, NFc and NFp may reside in the same PLMN or in different PLMNs.

[0018] Service communication proxy SCP 150, 152 may be deployed for indirect communication between network functions NF. SCP is an intermediate network entity used to assist indirect communication between NFc and NFp, including routing messages, such as control plane messages between NFs. SCP may discover and select NFp on behalf of NFc. SCP may request an access token from NRF or authorization server on behalf of NFc to access the services of NFp.

[0019] NF discovery and NF service discovery enable an entity (e.g., NFc 120 or SCP 150) to discover a set of NF instances and NF service instances of a specific NF service or NFp type. The NRF 140, 142 may include functionality for supporting NF and NF service registration, NF and NF service discovery, and NF state change subscription and notification functionality. In addition or alternatively, the NRF may be configured to act as a service access authorization server. The NRF may maintain NF profiles for available NFp entities and their supported services. The NRF may notify the subscribed NFc or SCP of newly registered, updated, or deregistered NFp entities and their NF services. Thus, the NRF may provide advice to the NFc entity or SCP on where (that is, from which NFp entity) to obtain the required services. The NRF may be co-located with the SCP, for example, running in the same computing substrate. Alternatively, the NRF may be located in a node physically distinct from the SCP, or even hosted by a service provider.

[0020] In order for the NFc 120 or SCP 150 to obtain information about the NFp and / or NF services registered or configured in the PLMN / slice, the NFc 120 or SCP 150 may initiate a discovery process with an NRF (e.g., cNRF 140) based on local configuration. The discovery process may be initiated by providing the type of NFp and optionally a list of specific services it is attempting to discover. The NFc 120 or SCP 150 may additionally or alternatively provide other service parameters, such as information related to the network slice.

[0021] Direct communication may be applied between NFc 120 and NFp 122 for NF services, or NF service communication may be performed indirectly via SCP 150, 152. In direct communication, NFc 120 performs discovery of target NFp 122 by local configuration or via local NRF, NRFc 140. In indirect communication, NFc 120 may delegate discovery of target NFp 122 to SCP 150. In the latter case, SCP may perform discovery and / or selection of target NFp 122 using parameters provided by NFc 120, such as reference to one or more NRFs. In 5G Service Based Interface (SBI) Model D, NFc may delegate NFp discovery and selection to SCP, and may also delegate service access authorization, i.e., delegate access token retrieval for access to a specific NFp service to SCP.

[0022] It should be noted that at least some of the entities or nodes 120, 122, 140, 142 may function in both service consumption and service provision roles, and their physical structures may be similar or identical, while in this example, their roles in the delivery of a particular message or service are identified by using a prefix / suffix "c" or "p", indicating whether they are service consumption or service production NFs. It should be noted that instead of "c" and "p", "v" for visited and "h" for home may be used to refer to at least some of the corresponding entities in the visited and home PLMNs. In some embodiments, the system implementing embodiments of the present disclosure includes fourth generation 4G and fifth generation 5G parts.

[0023] In general, a network support function such as an NRF may be further configured to act as a service access authorization server and provide a cryptographic access token to the NFc or the SCP on behalf of the NFc to authorize the NFc to use the services provided by the NFp. In general, an NRF is a terminological example of a network support node. In general, an SCP is a terminological example of a proxy entity.

[0024] In some embodiments, for the purpose of authorizing NFc to access services of NFp, OAuth-based service authorization and / or token exchange is applied between NFc and NFp. In addition to OAuth, another authorization framework may be applied. Thus, for example, a network entity such as NRF may be or perform as an authorization server AS, such as an OAuth authorization server. NFc may be an OAuth client, and NFp may operate as an OAuth resource server, and they may be configured to support the OAuth authorization framework defined, for example, in IETF RFC 6749.

[0025] When requesting a service from NFp, NFc or SCP may include an access token in the request message, for example in an "Authorization Bearer" header. For example, NRF may act as an OAuth 2.0 authorization server. The access token may include, for example, an identifier of NFc, NRF and / or NFp, a timestamp and / or an identifier of a specific service authorized for NFc using the access token. The access token may include its own token identifier, such as a serial number. The token identifier may uniquely identify the token. The access token may be cryptographically signed using the private key of the NRF. The validity of such cryptographic signature may be verified using the corresponding public key of the NRF, for example, the public key that NFp may obtain when registering the services it provides with the NRF. When NFc contacts NFp, it may present the access token, which NFp may then verify, for example, at least in part by using a copy of its NRF's public key.

[0026] In indirect communication with delegated discovery (also called Model D in 3GPP specifications), the SCP, upon receiving a service request from NFc, performs NF discovery, access token request procedures, and requests services from NFp using the obtained access token. Therefore, in indirect communication with delegated discovery, the consumer does not perform any discovery or selection. NFc adds any necessary discovery and selection parameters to the service request that are required to find a suitable producer. SCP routes the request to the appropriate producer instance using the request address and the discovery and selection parameters in the request message. SCP may use NRF to perform discovery and obtain discovery results.

[0027] During NF discovery, during the access token request process or during a service request from SCP to NFp, the service of SCP to NFc (in response to its service request) may fail. When the service request is rejected during the NF discovery process using NRF, NFc is informed of this. When NFc has delegated the access token retrieval for accessing a specific NFp service to SCP and the service request is rejected as a result, NFc is unaware of the reason for the failure of the service request.

[0028] Improvements in error handling and indication are now provided, especially for delegated service access authorization.

[0029] Figure 2a A method for access token acquisition process error handling is described. The method may be performed by a proxy network entity (hereinafter referred to as a service communication agent or SCP, in some embodiments referred to as a 3GPP SBA SCP (e.g., SCP 150)), or when installed therein, in a control device configured to control its functions.

[0030] Block 200 includes receiving a service request from a network function consumer, hereinafter referred to as NFc (eg, NFc 120), for a service generated by a network function producer, hereinafter referred to as NFp (eg, NFp 122).

[0031] Block 210 includes transmitting a response to the service request to the NFc in response to an error in obtaining an access token from a network repository function, hereinafter referred to as an NRF (e.g., NRF 140 or 142), based on the service request. The access token is used to authorize access to a service at the NFp, and the response indicates an access token error.

[0032] Figure 2b A method for controlling access to a network function service is described. The method may be performed by a service requesting or consuming network entity (hereinafter referred to as a network function consumer or NFc, in some embodiments referred to as a 3GPP SBA NFc (e.g., NFc 120)), or when installed therein, in a control device configured to control its functions.

[0033] Block 250 includes transmitting a service request for a service from a network function producer to a service communication agent (which may interoperably perform Figure 2b Block 260 includes receiving a response to the service request from the service communication agent, wherein the response indicates an access token error. Block 270 includes controlling network function service access based on the access token error indicated in the response.

[0034] Therefore, in the case where NFc has delegated service access authorization and access token retrieval to SCP, NFc can also be informed of the reason for the failure of the service request. This facilitates NFc to react appropriately to the failed service request and improves error handling and service access reliability level. In this case, when the access token request is rejected by NRF, NFc can also be informed of the exact error details and error message, and NRF can operate as an OAuth2 authorization server. This is useful and important for NFc, for example, for troubleshooting, even if NFc has delegated service access authorization to SCP.

[0035] For example, the responses in blocks 210 and 260 may indicate that the access token acquisition process failed due to lack of appropriate client credentials to authorize provision of an access token to the NFc (on behalf of the SCP of the NFc). Accordingly, the NFc may initiate certain further actions in block 270 based on the received indicated access token error, such as retransmission through another SCP. Additionally or alternatively, the NFc may issue an alarm and / or update an error log based on at least some of the received error information.

[0036] Although example embodiments are described herein with reference to 3GPP 5G SBA entities and / or using similarly named entities, the features disclosed herein may also be applied to other systems. For example, a service communication agent may generally refer to a (network function) proxy network entity, a network repository function may refer to a (network function) authorization entity, a network function consumer may refer to a network entity that uses or consumes a service, and a network function producer may refer to a service providing network entity.

[0037] In order for the SCP to acquire an access token on behalf of the NFc, the NFc needs to send a specific IE in the service request (e.g., its own NFInstance ID, NFType, etc.). In some embodiments, an access token error is detected and block 210 is already entered before the request for an access token is transmitted from the SCP to the NRF (and in the event that it is not transmitted).

[0038] In response to failure to generate an appropriate access token request based on the service request, an error may be detected and block 210 may be entered. This may be due to insufficient information received in the service request 200 from the NF, in response to which the SCP cannot issue an access token request, but enters block 210. Therefore, there may be other blocks after block 200 to check the service request, and if the predefined (which may include one or more predefined IEs) required for the access token request are not included (or erroneously included) in the service request, then block 210 is entered. In an embodiment, block 210 is entered in response to detecting that NFc identification information, such as NFInstanceId, is not included in the service request, such as NFc instance identifier. Some other examples of such information include client credentials and network function type.

[0039] Therefore, the SCP may include an indication of a missing access token information element in the response 210, 260 indicating an access token error. This may be defined as a new HTTP application error. Other reasons (regarding the failure to obtain an access token due to failure to generate an appropriate access token request) may be indicated in the response 210. The missing information may be specified as a reason value, for example, missing client credentials or missing requester-nf-instance-id.

[0040] The access token error may be due to the NRF rejecting the access token request transmitted by the SCP based on the service request 200, 250. The SCP can detect this based on the access token response received from the NRF. The SCP can indicate the rejection of the access token request in the response 210, 260 by a specific error reason value (e.g., access token request rejected or access token rejected).

[0041] refer to Figure 3 and 4 Signaling instance where NFc wishes to consume services provided by NFp. Indirect communication via SCP is used. Figure 3 To illustrate a more general signaling example, Figure 4 Other embodiments and messages for 3GPP SBI over HTTP are described. NFc requests a service by transmitting a service request 300, 400 to SCP. The service request may include, for example, NF instance identification information and NFc's credential data elements, such as client credential assertion CCA, a data element that enables the receiving NF (e.g., NRF or NFp) to authenticate NFc.

[0042] The SCP may perform NF discovery 302, 304, 402 using the NRF in response to a service request 300, 400 from a network function consumer. Thus, the SCP transmits a discovery request 302 based on the information expressed in the service request 300, 400, which may describe the service sought by the NFc. The SCP may include at least one of the following in the discovery request: a credential data element of the NFc and / or a credential data element of the SCP itself.

[0043] In response to the discovery request 302 or other message from the SCP related to representing the NFc, the NRF may perform a determination as to whether the SCP is authorized to represent the NFc. After determining whether the SCP is authorized, the NRF may transmit a discovery response 304 as an NF profile message, which may describe the NFp entity that provides the service that the NFc wishes to obtain. The SCP may select one of the NFp entities from the profile message 304 on behalf of the NFc.

[0044] The SCP may then transmit an access token request 306, 404 to request an access token for the selected NFp. Figure 4 In the example of , the access token request is Nnrf Access Token Get Request. The access token request may include an identifier of the selected NFp and the client credentials from the NFc. In block 406, the SCP may perform 308, 406 the credential verification process for the received CCA.

[0045] Based on (the result of) the verification process, the NRF transmits an access token response 310, 408. In response to the failure of the credential verification 308, 406, the response 310, 408 received by the SCP indicates a rejection of the access token request. The response may include other information about the reason for the rejection. The access token request may be rejected in response to an authentication failure of the NFc, for example, due to missing or incorrect client credentials, or the NFc is not authorized to access the services of the NFp.

[0046] The SCP may generate and transmit a response 312, 410 indicating an access token error to the NFc in response to the received response to the access token request, some other example embodiments being further described below.

[0047] In responses 210, 260, 312, 410, an access token error may be indicated by a protocol or application error of a rejected access token, some other examples are described below in conjunction with HTTP application errors.

[0048] A response 210, 260, 312, 410 indicating an access token error may have one of the 4XX or 5XX status codes, such as "400 Bad Request" 408 or "403 Forbidden." The access token error may be specified in a problem details object "ProblemDetails" of the HTTP error response message payload.

[0049] The SCP may include an access token error attribute in the response 210, 260, 312, 410 indicating an access token error, which indicates details about the access token error. In an example embodiment, the access token error attribute is included in a "ProblemDetails" object. Table 1 illustrates an example of how the access token error attribute may be defined:

[0050] Table 1.

[0051]

[0052] Field "P" defines whether the attribute is mandatory "M", optional "O" or conditional "C". Cardinality defines the number of allowed occurrences of the corresponding data type. SCP may copy the "AccessTokenErr" attribute received from NRF and the Server header content received from NRF to ProblemDetails attributes accessTokenErr and Server, respectively.

[0053] The SCP may include an indication of an access token rejection error in the response 210, 260, 312, 410 indicating an access token error. Thus, an access token error may be indicated by a protocol or application error of a rejected access token. In an example embodiment, the rejected access token is included as a new HTTP application error value in an existing cause attribute in the "ProblemDetails" object. The SCP may include ACCESS_TOKEN_DENIED as a new cause when a service request is rejected due to rejection of an access token request from an NRF with an AccessTokenErr attribute.

[0054] Table 2 illustrates an example of how an access token rejected error may be defined:

[0055] Table 2.

[0056]

[0057] The SCP may include in the response 210, 260, 312, 410 an indication of the identity of the NRF that rejected the access token request. To this end, a new attribute may be defined, such as an attribute in the "ProblemDetails" object. Such a new attribute may be called, for example, "nrfId". The attribute may indicate the identity of the NRF that rejected the access token request and will be set to the value in the "Server" header received from the NRF. In the event that the NRF does not indicate a "Server" header, the attribute is not included. The SCP may add a "Server" header indicating its own address in the response to the NFc. For example, such an attribute may be defined as described in Table 3.

[0058] Table 3.

[0059]

[0060] The SCP may include in the response 210, 260, 312, 410 information further specifying the denial of the access token request based on the response to the access token request received from the NRF.

[0061] In an example embodiment, the SCP includes the target network function instance identifier or target network function set discovered and selected by the SCP in the response 210, 260, 312, 410. As an example implementation, the ProblemDetails object may be extended with a new accessTokenReq attribute encoding the Access Token Request parameters.

[0062] Reference again Figure 4In the event that the access token request is unsuccessful, the NRF may respond with a 400 Bad Request 408 with an access token error information element. In response to this message, the SCP sends a 400 Bad Request response 410 to the NF service consumer, which may include a ProblemDetails object in the HTTP response payload with at least some of the following:

[0063] - a "reason" attribute, which is set to "ACCESS_TOKEN_DENIED"; and

[0064] - New AccessTokenErr attribute that can be generated based on the AccessTokenErr object received from NRF;

[0065] - Set to the nrfId attribute of the Server header content received from NRF.

[0066] In the response 210, 260, 312, 410, the SCP may set the Server header to the SCP identity (or fully qualified domain name (FQDN)). As already noted, the response may also include additional information about the rejected NF access token request in a ProblemDetails object, a new accessTokenError attribute, or another new attribute in ProblemDetails. For example, such information may include the target NF instance ID or target NF set discovered and selected by the SCP, and for which the access token is requested.

[0067] Appendix 1 illustrates an example of the attributes of the ProblemDetails object, including new attributes accessTokenErr, nrfId, target NF instance ID, and target NF set. An example definition of the AccessTokenErr attribute is also provided, which also indicates other error (cause) information that may apply. At least some of these attributes may be applied in responses 210, 260, 312, 410.

[0068] Subsequent service access control 270, 314, 412 and related error handling at the NFc after receiving the response 210, 260 may be implementation specific and depend on other error information contained in the response. This may include one or more of retrying the request (using another SCP), issuing an alarm, logging an error, or incrementing an associated counter, wherein logging an error may include updating an error log based on at least some of the received error information. For example, the NFc may retry the request using modified headers 3gpp-Sbi-Discovery and 3gpp-Sbi-Client-Credentials, issue an alarm, and / or increment an associated counter indicating an OAuth failure.

[0069] The NFc may be configured to receive information and message elements specifying an access token error as described above and apply them in blocks 270, 314, 412. For example, the NFc may be configured to process a new cause "ACCESS_TOKEN_DENIED" with an "AccessTokenErr" attribute. The NFc may then use the attribute information in subsequent NF service access control actions and / or determine other NF service access control actions.

[0070] At least some of the embodiments described above may also be applicable to indirect communication without delegated discovery. For example, this may be when NFc only selects a NF set but delegates the discovery and selection of NFp from the NF set to SCP, or when NFc sends subsequent service requests (for existing resources) and delegates the reselection of alternative NF service producers to SCP, if SCP cannot send the request to the target NF indicated in the request URI or 3gpp-Sbi-Target-apiRoot header in the service request 200, 250. This may also be applicable to the scenario where SCP handles the redirection when NFp redirects to another NFp.

[0071] If an attribute is defined as ProblemDetails in the API error response, some service operations will not return an HTTP error response containing a ProblemDetails object, but instead define their own HTTP response payload for the error response. At least some of the embodiments described above may also apply to such operations. An example of such an operation is the Nsmf_PDUSession Create SM Context service operation. If such an attribute does not exist, a new error attribute may be defined to provide access token error information for NFc. This may be performed similarly as defined above for ProblemDetails. For example, for the Nsmf_PDUSession Create SM Context service operation, the "Error" attribute in SmContextCreateError may be extended to include additional access token error information.

[0072] As a possible alternative to the above, a new HTTP custom header, such as 3gpp-Sbi-Scp-Error, may be defined to be returned by the SCP to the HTTP client (of NFc) for errors generated by the SCP. The header may include similar information about access token errors as described above for the ProblemDetails element. For example, the header may be defined as a string encoding the ProblemDetails structure. Thus, the new protocol information as described above may thus be conveyed in this new HTTP custom header. This header may even be returned by the SCP for any service request (i.e., any service operation), and not necessarily only for service operations that do not return HTTP error responses containing ProblemDetails objects but define their own HTTP response payload for error responses.

[0073] Figure 5 An example device capable of supporting at least some embodiments of the present invention is described. Illustrated is an apparatus 500, which may, for example, include a physical node running an NFc, SCP, and / or NRF in applicable parts. The apparatus may be configured to perform Figure 2a , 2b method or an embodiment thereof.

[0074] The device 500 includes a processor 510, which may include, for example, a single-core or multi-core processor, wherein a single-core processor includes one processing core and a multi-core processor includes more than one processing core. In general, the processor 510 may include a control device. The processor 510 may include more than one processor. The processor 510 may be a control device. The processor 510 may include at least one application-specific integrated circuit ASIC. The processor 510 may include at least one field-programmable gate array FPGA. The processor 510 may be a component for performing method steps in the device 500, such as receiving, transmitting and / or providing. The processor 510 may be configured at least in part by computer instructions to perform actions.

[0075] The processor may include circuitry, or be configured as one or more circuitry, one or more of which is configured to perform the stages of the method according to the embodiments described herein. As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) hardware circuitry implementations only, such as implementations in analog and / or digital circuitry only, and (b) combinations of hardware circuitry and software, such as, as applicable: (i) a combination of analog and / or digital hardware circuitry and software / firmware and (ii) any portion of a hardware processor, and software (including a digital signal processor, software, and memory) that work together to enable a device (e.g., a server) to perform various functions) and (c) hardware circuitry and / or processors, such as microprocessors or portions of microprocessors, that require software (e.g., firmware) to operate, but the software may not be present when it is not required to operate.

[0076] The definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also encompasses implementations of only hardware circuitry or a processor (or multiple processors) or portions of hardware circuitry or processors and their accompanying software and / or firmware. The term circuitry also encompasses, for example and if applicable to a particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, a cellular network device, or other computing or network device.

[0077] Device 500 may include memory 520. Memory 520 may include random access memory and / or permanent memory. Memory 520 may include at least one RAM chip. For example, memory 520 may include solid-state, magnetic, optical and / or holographic memory. Memory 520 may be at least partially accessible to processor 510. Memory 520 may be at least partially included in processor 510. Memory 520 may be a means for storing information. Memory 520 may include computer instructions that processor 510 is configured to execute. When computer instructions configured to cause processor 510 to perform certain actions are stored in memory 520, and device 500 is configured to run under the direction of processor 510 using computer instructions from memory 520, processor 510 and / or at least one of its processing cores may be considered to be configured to perform the specific action. Memory 520 may be at least partially included in processor 510. Memory 520 may be at least partially located outside device 500, but accessible by device 500.

[0078] Device 500 may include a transmitter 530. Device 500 may include a receiver 540. Transmitter 530 and receiver 540 may be configured to transmit and receive information, respectively, according to at least one cellular or non-cellular standard. Transmitter 530 may include more than one transmitter. Receiver 540 may include more than one receiver. Transmitter 530 and / or receiver 540 may be configured to operate according to a suitable message protocol.

[0079] The device 500 may include a user interface UI 550. The UI 550 may include at least one of a display, a keyboard, and a touch screen. The user can operate the device 500 via the UI 560, for example, to configure operating parameters, such as SCP service request handling related parameters.

[0080] The processor 510 may be equipped with a transmitter arranged to output information from the processor 510 to other devices included in the device 500 via electrical leads inside the device 500. Such a transmitter may include a serial bus transmitter arranged to output information to the memory 520 for storage therein, for example, via at least one electrical lead. Alternatively, for a serial bus, the transmitter may include a parallel bus transmitter. Similarly, the processor 510 may include a receiver arranged to receive information in the processor 510 from other devices included in the device 500 via electrical leads inside the device 500. Such a receiver may include a serial bus receiver arranged to receive information from the receiver 540, for example, via at least one electrical lead, for processing in the processor 510. Alternatively, for a serial bus, the receiver may include a parallel bus receiver. The device 500 may include Figure 5 In some embodiments, the device 500 lacks at least one of the devices described above.

[0081] The processor 510, the memory 520, the transmitter 530, the receiver 540 and / or the UI 560 may be interconnected in a variety of different ways through electrical leads inside the device 500. For example, each of the above-mentioned devices may be individually connected to a main bus inside the device 500 to allow the devices to exchange information. However, as will be appreciated by those skilled in the art, this is just one example, and depending on the embodiment, various ways of interconnecting at least two of the above-mentioned devices may be selected without departing from the scope of the present invention.

[0082] It should be understood that the disclosed embodiments of the present invention are not limited to the specific structures, process steps or materials disclosed herein, but are extended to equivalents that will be recognized by those skilled in the relevant art. It should also be understood that the terms used herein are only used for the purpose of describing specific embodiments and are not intended to be limiting.

[0083] Reference to one embodiment or embodiments in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Thus, the phrases "in one embodiment" or "in an embodiment" throughout this specification do not necessarily all refer to the same embodiment. Where terms such as approximately or substantially are used to reference values, the exact value is also disclosed.

[0084] As used herein, for convenience, multiple items, structural elements, constituent elements and / or materials may be presented in a common list. However, these lists should be understood as if each member in the list is individually identified as a separate, unique member. Therefore, any individual member in such a list should not be interpreted as the de facto equivalent of any other member in the same list based solely on its performance in a common group, without an indication to the contrary. In addition, various embodiments and examples of the present invention and alternatives to its various components may be referred to herein. It should be understood that such embodiments, examples and alternatives should not be interpreted as de facto equivalents to each other, but should be regarded as independent and autonomous representations of the present invention.

[0085] In addition, the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments. In the foregoing description, many specific details, such as examples of lengths, widths, shapes, etc., are provided to provide a thorough understanding of embodiments of the present invention. However, those skilled in the relevant art will recognize that the present invention may be practiced without one or more of the specific details or by other methods, components, materials, etc. In other examples, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the present invention.

[0086] Although the foregoing examples illustrate the principles of the present invention in one or more specific applications, it is obvious to those skilled in the art that the details of the form, usage and implementation can be modified in many ways without exercising creativity and without departing from the principles and concepts of the present invention. Therefore, the present invention is not intended to be limited except by the following claims.

[0087] The verbs "comprise" and "include" in this document are used as open limitations, neither excluding nor requiring the presence of unrecited features. Unless explicitly stated otherwise, the features recited in the dependent claims are mutually freely combinable. Furthermore, it should be understood that the use of "a" or "an" in this document, i.e. the singular, does not exclude the plural.

[0088] Appendix 1: ProblemDetails extended with additional properties

[0089]

[0090]

[0091] accessTokenErr can be defined as follows:

[0092]

Claims

1. An apparatus for communication, comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code configured to use the at least one processing core to cause the apparatus to at least: receiving, from a network function consumer, a service request for a service produced by a network function producer; transmitting, based on the received service request, to a network repository function, an access token request for an access token authorizing access to the service produced by the network function producer; as well as in response to an error in obtaining the access token from the network repository function based on the service request, transmitting a response to the service request to the network function consumer, wherein the response indicates an access token error; The device is further caused to detect the access token error before transmitting the access token request for the access token to the network repository function, and transmit the response indicating the access token error in response to failing to generate the access token request to the network repository function based on the service request.

2. The apparatus of claim 1 , wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to: receiving a response to the access token request from the network repository function, wherein the response indicates a denial of the access token request; and In response to the received response to the access token request, transmitting the response indicating the access token error to the network capability consumer.

3. The apparatus of claim 2, wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to include in the response indicating the access token error the identity of the network repository function that denied the access token request.

4. An apparatus according to claim 2 or 3, wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to include in the response indicating the access token error information further specifying the rejection of the access token request based on the response to the access token request received from the network repository function.

5. The apparatus of any one of claims 1-3, wherein the at least one memory and the computer program code are configured to use the at least one processing core to enable the apparatus performing network function discovery using the network repository function in response to the service request from the network function consumer; and After performing the network function discovery, the error in obtaining the access token is detected.

6. An apparatus according to any one of claims 1-3, wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to include in the response indicating the access token error an access token error attribute indicating details about the access token error based on an access token error attribute from the network repository function.

7. The apparatus of any one of claims 1-3, wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to include an indication of an access token rejected error in the response indicating the access token error.

8. The apparatus of any of claims 1-3, wherein the at least one memory and the computer program code are configured to, using the at least one processing core, cause the apparatus to include an indication of a missing access token information element in the response indicating the access token error.

9. The apparatus of any one of claims 1-3, the at least one memory and the computer program code being configured to use the at least one processing core to cause the apparatus to specify, in the response indicating the access token error, the access token error in a problem details object of a hypertext transfer protocol error response message payload.

10. An apparatus according to any one of claims 1-3, wherein the at least one memory and the computer program code are configured to use the at least one processing core to cause the apparatus to include an identifier of a target network function instance or a target network function set discovered and selected by the apparatus in the response indicating the access token error.

11. The apparatus according to any one of claims 1-3, wherein the network function producer is a network function service producer, and the network function consumer is a network function service consumer, and the apparatus is configured to operate as a service communication agent of a service-based architecture system.

12. An apparatus for communication, comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code configured to use the at least one processing core to cause the apparatus to at least: transmitting a service request for a service generated by a network function producer to a service communication agent; receiving a response to the service request from the service communication agent, wherein the response indicates an access token error, wherein the response includes information specifying a denial of the access token request for an access token from a network repository function, the access token authorizing access to the service produced by the network function producer; as well as controlling network function service access based on the access token error indicated in the response, including retransmitting a service request through another service communication agent; The device is also configured to receive the response indicating the access token error from the service communication agent, wherein the response is detected by the service communication agent before the access token request for the access token is transmitted to the network repository function, and is transmitted in response to a failure to generate an access token request to the network repository function based on the service request.

13. The apparatus of claim 12, wherein the response indicating the access token error comprises an indication of an access token rejected error in a problem-details object of a hypertext transfer protocol error response message payload.

14. A method for communication, comprising: receiving, by the service communication agent, from a network function consumer a service request for a service generated by a network function producer; transmitting, based on the received service request, to a network repository function, an access token request for an access token authorizing access to the service produced by the network function producer; as well as in response to an error in obtaining the access token from the network repository function based on the service request, transmitting a response to the service request to the network function consumer, wherein the response indicates an access token error; The method further comprises: The service communication agent detects the access token error prior to transmitting the access token request for the access token to the network repository function, and transmits the response indicating the access token error in response to a failure to generate an access token request to the network repository function based on the service request.

15. The method according to claim 14, comprising: transmitting an access token request for the access token to the network repository function, the access token authorizing access to the service produced by the network function producer; receiving a response to the access token request from the network repository function, wherein the response indicates a denial of the access token request; as well as In response to the received response to the access token request, transmitting the response indicating the access token error to the network capability consumer.

16. The method of claim 15, wherein the response indicating the access token error includes an identity of the network repository function that denied the access token request.

17. The method of claim 15 or 16, wherein the response indicating the access token error includes information further specifying the rejection of the access token request based on the response to the access token request received from the network repository function.

18. The method according to any one of claims 14 to 16, comprising: performing network function discovery using the network repository function in response to the service request from the network function consumer, and detecting the error in obtaining the access token after performing the network function discovery.

19. The method of any of claims 14-16, wherein the response indicating the access token error comprises an access token error attribute indicating details about the access token error based on an access token error attribute from the network repository function.

20. The method of any of claims 14-16, wherein the response indicating the access token error comprises an indication of an access token rejected error.

21. The method of any one of claims 14-16, wherein the response indicating the access token error includes an identifier of a target network function instance or target network function set discovered and selected by the serving communication agent.

22. The method of claim 14, wherein the response indicating the access token error comprises an indication of a missing access token information element.

23. The method of any of claims 14-16, wherein the response indicating the access token error specifies the access token error in a problem-details object of a hypertext transfer protocol error response message payload.

24. A method for communication, comprising: transmitting, by a network function consumer, a service request for a service generated by a network function producer to a service communication agent; receiving a response to the service request from the service communication agent, wherein the response indicates an access token error, wherein the response includes information specifying a denial of the access token request for an access token from a network repository function, the access token authorizing access to the service produced by the network function producer; as well as controlling network function service access based on the access token error indicated in the response, including retransmitting a service request through another service communication agent; The method further comprises: The response indicating the access token error is received from the service communication agent, wherein the response is detected by the service communication agent before the access token request for the access token is transmitted to the network repository function, and is transmitted in response to a failure to generate an access token request to the network repository function based on the service request.

25. The method of claim 24, wherein the response indicating the access token error comprises an indication of an access token rejected error in a problem-details object of a hypertext transfer protocol error response message payload.

26. A non-transitory computer-readable storage medium having stored thereon a set of computer-readable instructions that, when executed by at least one processor, cause a device to at least: receiving, from a network function consumer, a service request for a service produced by a network function producer; transmitting, based on the received service request, to a network repository function, an access token request for an access token authorizing access to the service produced by the network function producer; as well as in response to an error in obtaining the access token from the network repository function based on the service request, transmitting a response to the service request to the network function consumer, wherein the response indicates an access token error; The device is further caused to detect the access token error before transmitting the access token request for the access token to the network repository function, and transmit the response indicating the access token error in response to failing to generate the access token request to the network repository function based on the service request.

27. A non-transitory computer-readable storage medium having stored thereon a set of computer-readable instructions that, when executed by at least one processor, cause a device to at least: transmitting a service request for a service generated by a network function producer to a service communication agent; receiving a response to the service request from the service communication agent, wherein the response indicates an access token error, wherein the response includes information specifying a denial of the access token request for an access token from a network repository function, the access token authorizing access to the service produced by the network function producer; as well as controlling network function service access based on the access token error indicated in the response, including retransmitting a service request through another service communication agent; The device is also configured to receive the response indicating the access token error from the service communication agent, wherein the response is detected by the service communication agent before the access token request for the access token is transmitted to the network repository function, and is transmitted in response to a failure to generate an access token request to the network repository function based on the service request.

Images