Communication network node, user equipment, communication network and method

Abstract

The present invention relates generally to a communication network node having circuitry configured to request a home mobile service provider to allow roaming mobile service for a passenger located in a mobile service area of a roaming mobile service provider.

Description

Technical Field

[0001] This disclosure relates overall to communication network nodes, user equipment, communication networks, and methods. Background Technology

[0002] Generally, distributed ledgers are known to be distributed across multiple nodes, such as entities that record digital transactions, like electronic devices and servers. Distributed ledgers can be based on known blockchain technologies, such as the known cryptocurrency Bitcoin, but they can also be based on well-known projects like Ethereum. Generally, distributed ledgers can also be implemented using technologies other than blockchain. Examples of distributed ledger projects not based on blockchain include BigchainDB and IOTA. For example, IOTA is a cryptocurrency that uses chained lists.

[0003] Furthermore, Mobility as a Service (MaaS) is known, where users or passengers utilize Mobility as a Service without owning, for example, a vehicle. Mobility as a Service can combine public (e.g., trains, buses, etc.) and private (e.g., car-sharing, bicycle-sharing, etc.) transportation services from relevant operators or providers.

[0004] Known MaaS solutions typically involve a central and unified gateway through which trips or journeys are planned and subscribed, allowing users to pay with a single account.

[0005] While technologies exist for providing distributed ledgers and mobile-as-a-service, it is generally desirable to provide communication network nodes, user equipment, communication networks, and methods for providing mobile-as-a-service. Summary of the Invention

[0006] According to a first aspect, the present invention provides a communication network node including a circuit configured to request a home mobile service provider to allow roaming mobile services for passengers located in the mobile service area of ​​a roaming mobile service provider.

[0007] According to a second aspect, the present invention provides a method for controlling a communication network node, the method comprising: requesting a home mobile service provider to allow roaming mobile services for a passenger located in the mobile service area of ​​a roaming mobile service provider.

[0008] According to a third aspect, the present invention provides a communication network node including circuitry configured to request a decentralized database to provide a passenger's credentials, wherein the credentials are generated based on a passenger's distributed identifier, wherein the distributed identifier is generated based on a user equipment's request to the decentralized database, so as to allow the passenger to use mobile services of a roaming mobile service provider.

[0009] According to a fourth aspect, the present invention provides a user equipment including circuitry configured to: publish the generation of a decentralized identifier for a passenger; and receive credentials for the passenger to allow the passenger to use mobile services of a roaming mobile service provider, wherein the credentials are based on a request from the home mobile service provider to a decentralized database and generated based on the decentralized identifier.

[0010] According to a fifth aspect, the present invention provides a communication network for providing a distributed ledger, the communication network comprising a plurality of network nodes for authenticating passengers to a roaming mobile service provider, the network nodes comprising circuitry configured to: provide a decentralized identifier of the passenger in a decentralized database based on a request from a user equipment; provide the passenger's credentials in the decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and send the credentials to the user equipment to allow the passenger to use the roaming mobile service provider's mobile services.

[0011] According to a sixth aspect, the present invention provides a method for controlling a communication network for providing a distributed ledger, the communication network including multiple network nodes for authenticating passengers to a roaming mobile service provider, the method comprising: providing a decentralized identifier of a passenger in a decentralized database based on a request from a user device; providing credentials of the passenger in a decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and sending the credentials to the user device to allow the passenger to use the mobile services of the roaming mobile service provider.

[0012] According to a seventh aspect, the present invention provides a user equipment including circuitry configured to: send a passenger's credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a passenger's distributed identifier; receive a token, wherein the token is based on encryption of the distributed identifier; and decrypt the token to a roaming mobile service provider to verify the passenger, thereby allowing the passenger to use the roaming mobile service provider's mobile services.

[0013] According to an eighth aspect, the present invention provides a communication network for providing a distributed ledger, the communication network comprising a plurality of network nodes for authenticating passengers to a roaming mobile service provider, the network nodes comprising circuitry configured to: provide a token, wherein the token is based on an encryption of a passenger’s distributed identifier; and decrypt the token to authenticate the passenger to the roaming mobile service provider to allow the passenger to use the roaming mobile service provider’s mobile services.

[0014] According to a ninth aspect, the present invention provides a communication network node comprising circuitry configured to allow a passenger to use the mobile services of a roaming mobile service provider based on the passenger's credentials and based on a mutual agreement between the roaming mobile service provider and the home mobile service provider, wherein the credentials are generated based on a request from the home mobile service provider to a decentralized database and based on the passenger's distributed identifier.

[0015] According to a tenth aspect, the present invention provides a communication network node comprising circuitry configured to: store a plurality of credentials for a passenger, wherein the plurality of credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a distributed identifier of the passenger; and send at least one of the plurality of credentials to a user equipment to allow the passenger to use the mobile services of a roaming mobile service provider.

[0016] According to the eleventh aspect, the present invention provides a method for controlling a communication network node, the method comprising: storing a plurality of credentials of a passenger, wherein the plurality of credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a distributed identifier of the passenger; and sending at least one of the plurality of credentials to a user equipment to allow the passenger to use the mobile services of a roaming mobile service provider.

[0017] Further aspects are illustrated in the following description and figures. Attached Figure Description

[0018] The embodiments are explained by way of example with reference to the accompanying drawings, wherein:

[0019] Figure 1 It describes the well-known OAuth protocol;

[0020] Figure 2 A method for providing roaming mobile services according to this disclosure is described;

[0021] Figure 3 The method for authenticating passengers to use mobile services provided by roaming mobile service providers is described.

[0022] Figure 4 Another implementation of the method for authenticating passengers is described;

[0023] Figure 5 A method for authorizing passengers using a single mobile service credential and mutual agreement is described;

[0024] Figure 6 It describes a method for authorizing passengers in the case of multiple credentials;

[0025] Figure 7It explains the general structure of a blockchain;

[0026] Figure 8 This explains the input and output of the hash function in a blockchain.

[0027] Figure 9 An example illustrates the process of PBFT;

[0028] Figure 10 The implementation methods of a general-purpose computer are described; and

[0029] Figure 11 The implementation methods for user equipment and network nodes are described. Detailed Implementation

[0030] Provide a reference Figure 2 Before providing a detailed description of the implementation methods, a general overview will be given.

[0031] As mentioned at the beginning, Mobile as a Service is well-known. Roaming mobile services are typically provided by a single mobile service provider. However, it has been recognized that there is a desire to increase the flexibility of roaming mobile services by distributing mobile services across multiple ledgers.

[0032] There is a growing recognition that passengers in foreign mobile service areas where service subscriptions may not be available are looking to improve their convenience. In such cases, passengers often need to purchase separate tickets, which can be time-consuming and expensive.

[0033] Therefore, it has been recognized that there is a general desire to provide mobile-as-a-service roaming.

[0034] It has been further recognized that decentralized identifiers and self-sovereign identities can further enhance security, for example, the security of personal data in such roaming services.

[0035] In contrast, some implementations may use social login, which could be convenient for users. However, it has been recognized that social login can be too reliant on a single account, such that if a user temporarily or permanently deactivates that account, that user (or passenger) may no longer be able to use the services assigned to that account. Furthermore, users' personal data may be tied to such accounts, and it has been recognized that there is a desire to reduce the amount of personal data sent, because, for example, depending on the country where the roaming service is used, personal data may not be protected by governments, etc.

[0036] Furthermore, in terms of privacy, social networking service providers can indirectly know the user activity of mobile providers' services.

[0037] Therefore, as discussed, it has been recognized that distributed identifiers can reduce reliance on these entities.

[0038] In addition, decentralized identifiers can meet users' requirements for control over digital IDs, privacy, personal data management, and no vendor lock-in.

[0039] Furthermore, distributed identifiers enable the provision of roaming mobile services across countries, borders, regions, and cities by different mobile service providers.

[0040] In the following text, some terminology is defined and can be applied to some implementations (but this disclosure is not limited to the limitations set forth below. The limitations are merely examples provided to enhance the understanding of this disclosure and are given only because the technical field of MaaS and distributed ledgers is highly dynamic and the limitations may change in the future).

[0041] The term "distributed ledger" can be found on Wikipedia, which defines it as: "A distributed ledger (also known as a shared ledger, or distributed ledger technology, DLT) is a consensus on the replication, sharing, and synchronization of digital data that is geographically distributed across multiple sites, countries, or institutions. There is no central administrator or centralized data storage."

[0042] The technology of distributed ledgers, and its specific example, blockchain, will be discussed further below. More generally, the term distributed ledger is used as a type of database that shares digitally recorded data with multiple nodes in a network. It can consist of a peer-to-peer network. The digitally recorded data can include information to prove its consistency with data previously recorded on the same database.

[0043] Distributed ledgers can be public, accessible to anyone; however, in principle, they can also be private, accessible only to authorized users. This authorized group of entities, nodes, personnel, operators, providers, etc., can be referred to as a "consortium," which will be explained further below. Access permissions for each hierarchical user on the ledger can also be differentiated.

[0044] Distributed ledgers can use known mechanisms, such as those known from the blockchain technology used in Bitcoin. These mechanisms include discovery methods, consensus mechanisms, and mechanisms for maintaining data consistency. The consensus mechanism ensures that all nodes, or more than a certain number of nodes, that have a copy of the distributed ledger—typically electronic devices—reach a consensus on the contents of the distributed ledger. There are many consensus mechanisms, including the so-called proof-of-work mechanism, which is a kind of cryptographic puzzle that ensures, for example, that older blocks on the blockchain cannot be (easily) altered. Because of this, proof-of-work is used in the mining process of the Bitcoin blockchain.

[0045] In a distributed ledger or blockchain, the confirmation process (called mining) in which participating nodes reach consensus on data updates on the blockchain can ensure the irreversibility of a sequence of transactions recorded on the blockchain by including previously recorded data in the confirmation data. This mining process implements a distributed timestamp server for new transaction blocks. In Bitcoin (and thus, in some implementations), the mining process is based on the SHA-256 hash function. Blockchain nodes participating in the mining process search for a hash output with predefined properties, while the input to the hash function depends on the current block of the blockchain and the new transaction block to be added to the blockchain.

[0046] The proof-of-work computations based on hash functions may be useless on their own unless they are needed to achieve the irreversibility of the distributed ledger.

[0047] Furthermore, it is commonly known to use blockchain to store various types of data. For example, images, videos, measurements, and text files can be recorded on the blockchain in the form of transactions.

[0048] The term "Mobility as a Service (MaaS)" can also be found on Wikipedia, which defines it as: "Mobility as a Service (MaaS) describes a shift from personally owned transportation to mobility solutions consumed as a service. This is achieved by combining transportation services from public and private transportation providers through a unified gateway that creates and manages trips, which users can pay for with a single account. Users can pay per trip or for prioritized distances on a monthly basis. The key concept behind MaaS is providing mobility solutions to travelers based on their travel needs."

[0049] The term "mobility service provider" can be a general term encompassing any type of service provider as a service (MaaS). In some implementations, it is typically a transportation organization such as a railway company, bus / coach, tram and taxi, car sharing, bike sharing, bicycle sharing, etc. Some mobility service providers may not provide actual transportation but may only offer booking / arrangement services, similar to travel agencies or online booking websites.

[0050] The term “passenger” can refer to a person who has entered into a service contract with a home mobile service provider or a customer of a home mobile service provider (as defined below).

[0051] "Mobile service provider" (also known as "MaaS service provider") can be a superordinate term of the terms "home mobile service provider" and "roaming mobile service provider" (as defined below), and can refer to operators, societies, companies, etc., that provide transportation services in specific transportation service areas (e.g., towns, countries, regions, air routes, waterways).

[0052] The term "home mobile service provider" can refer to a mobile service provider located or operating in a fixed area (e.g., a country, a city), and can be a mobile service provider with whom the passenger has a contract such as a pass, ticket, or subscription. In some implementations, the passenger may also be multiple service providers.

[0053] The term "roaming mobile service provider" can refer to any other mobile service provider with which the passenger has no direct contract, subscription, etc. Therefore, the passenger can use the mobile services of the roaming mobile service provider, but the purchase of passes, tickets, or the use of the roaming mobile service provider's mobile services can be processed through the home mobile service provider.

[0054] The term "user" can refer to a passenger who intends to use a roaming mobile service provider. The term "user" can also refer to a passenger's terminal device (e.g., a smartphone).

[0055] The term "user agent" can refer to software, applications, etc., running on a passenger's terminal device (or user equipment), configured to handle DIDs (see below), credentials (see below), etc. For example, a MaaS application (e.g., from a Mobile-as-a-Service provider) can act as a user agent.

[0056] A Distributed Identifier (DID) resolver can refer to a server (or any other information system) that retrieves DID documents that respond to verification via DIDs (see below) and the like.

[0057] Credentials can refer to evidence of status, rights, memberships, etc., supported by the issuer, MaaS provider, etc. For example, a user can use credentials (e.g., to a roaming mobile service provider) to prove MaaS subscription membership (e.g., membership with a home mobile service provider).

[0058] In some implementations, the term "public-key cryptography" is understood as also defined in Wikipedia (https: / / en.wikipedia.org / wiki / Public-key_cryptography): "Public-key cryptography, or asymmetric cryptography, is any cryptographic system that uses a pair of keys: a public key that can be widely distributed and a private key known only to its owner. This enables two functions: authentication, where the public key verifies the holder of the paired private key that sent the message; and encryption, where only the holder of the paired private key can decrypt a message encrypted with the public key." Among these, "the two most well-known uses of public-key cryptography are..." Public-key encryption encrypts a message using the recipient's public key. No one without a matching private key can decrypt the message; therefore, they are assumed to be the owner of the key and associated with the public key. This is to ensure confidentiality. Digital signatures, on the other hand, involve signing a message using the sender's private key and verifying it by anyone with access to the sender's public key. This verification proves that the sender has access to the private key and is therefore likely the person associated with the public key. This also ensures that the message has not been tampered with, because the signature is mathematically bound to the message originally signed with it, and verification will fail for almost any other message, no matter how similar it is to the original message.

[0059] The term "personal data" in some implementations may be understood in the following sense (see example https: / / gdpr-info.eu / art-4-gdpr / ): "(1) 'Personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person means a natural person who can be directly or indirectly identified, particularly a natural person who can be identified by reference to one or more factors relating to that natural person's physical, physiological, genetic, mental, economic, cultural or social identity;"

[0060] In some implementations, the abbreviation AAA may refer to "Authentication, Authorization and Accounting" in a computer network or network service, as it is often referred to as the security framework of information and communication technology (ICT).

[0061] Authentication can refer to verifying whether a user (or, in the context of this disclosure, a passenger) is a legitimate user of a network, network service, or system. For example, when a user / passenger intends to use a MaaS service, the MaaS service provider (e.g., a mobile service provider, a transportation operator) can verify the user / passenger's identity and the status of their service subscription.

[0062] Authorization can refer to checking which (or which) specific services an authenticated user / passenger is permitted to use. For example, a MaaS service provider can check a user's contract type, service type, etc., and determine the services the user / passenger is allowed to use. For instance, a user / passenger may be allowed to use train services but not taxi services; therefore, train services may be permitted while taxi services may be denied.

[0063] Billing can refer to records that document a user's / passenger's behavior and / or the services they use (e.g., the duration of their service use, the frequency of their service use, etc.). For example, if a passenger uses a MaaS service, such as booking or riding, records of that service can be stored.

[0064] In some implementations, an authorization framework such as OAuth, OAuth 2.0, etc. can be used, as can be found in Internet Engineering Task Force (IETF) Request for Comments (RFC) 6749.

[0065] This authorization framework can be used in third-party applications. For example, an application on a terminal device (e.g., a smartphone) can reuse a social networking service (SNS) account for access to a third-party server. The authorization server can then perform authorization on behalf of the third party and provide a token, thereby allowing the (client) application to access protected data using the provided token, as will be referenced. Figure 1 As discussed further, Figure 1 A simplified version of the OAuth 2.0 protocol is described. For more details, please see the following domain: https: / / tools.ietf.org / html / rfc6749.

[0066] exist Figure 1 The upper part depicts the connection of end user 1 using client application 2, where the client application accesses authorization server 3.

[0067] exist Figure 1 The lower part depicts authorization method 4. The client application 5 (which may be the same as client application 2) requests permission from the resource owner 7 (e.g., end user 1) to reuse the account at point 6.

[0068] At point 8, the resource owner 7 allows reuse, which enables the client application 5 to provide authorization to the authorization server 10 that stores the SNS account at point 9.

[0069] At point 11, the authorizing server sends an access token to access third-party server 12, which is a resource server storing protected data.

[0070] At point 13, client application 5 uses the received access token to request protected data from third-party server 12.

[0071] At point 14, the third-party server 12 sends the requested data to the client application 5.

[0072] For such a method, such as Figure 1 As mentioned above, it can also be called social login (see also https: / / en.wikipedia.org / wiki(Social_login)). Social login can use a public SNS account to grant authorization to third-party services.

[0073] Some implementations involve a communication network node with a circuit configured to request a home mobile service provider to allow roaming mobile service for a passenger located in the mobile service area of ​​a roaming mobile service provider.

[0074] Communication network nodes can be computers, servers, terminal devices, etc. Furthermore, multiple such components can be envisioned (e.g., several servers, which may also be coupled to terminal devices, etc.).

[0075] A request can be issued in response to the detection of a passenger in the mobile service area of ​​a roaming mobile service provider.

[0076] Now refer to Figure 2 To be further explained.

[0077] Figure 2 A roaming mobile service method 20 according to this disclosure is described.

[0078] At point 22, the home mobile service provider 21 sends roaming service assistance information to the passenger 23 to prepare for roaming service. In this embodiment, the assistance information includes the name of the roaming mobile service provider 24 and the mobile service area of ​​the roaming mobile service provider 24.

[0079] In order to detect roaming mobile service, at point 26, the sensor 25 (e.g., GNSS sensor) of passenger 23's mobile phone detects that passenger 23 has entered a predetermined area (e.g., through a geofence).

[0080] In addition, at point 27, passenger 23 selects roaming mobile services through the user interface of a mobile phone, where the corresponding application is displayed on the mobile phone's user interface.

[0081] At point 28, the application on the mobile phone requests roaming mobile service from the roaming mobile service provider 24.

[0082] In order to verify / authorize the user's use of the roaming mobile service provider 24, at point 29, the roaming mobile service provider 24 sends a request to the home mobile service provider 21 to verify the passenger 23's service subscription with the home mobile service provider 21.

[0083] Therefore, the home mobile service provider 21 checks whether the passenger 23's user account exists, thereby checking authentication at point 30.

[0084] In addition, the home mobile service provider 21 checks the permitted services in the roaming mobile service, thereby checking the authorization at 31.

[0085] At 32, the home mobile service provider 21 sends the passenger 23's permission to move to the roaming mobile service provider 24.

[0086] At point 33, the roaming mobile service provider 24 sends roaming acceptance information to passenger 23, so that at point 34, the roaming mobile service provider 24 initiates roaming service based on the received result.

[0087] Detection can be based on at least one of the following: mobile country code (MCC), geofence, external triggers, and booking history.

[0088] For example, the MCC (Multi-Channel Code) can be provided by a mobile phone network and can indicate which country or region a terminal device (e.g., a mobile phone) can be located in. Such a mobile network can send (or broadcast) the MCC, and when the terminal device is in operation, the terminal device can be configured to receive the MCC and identify its country of origin.

[0089] The terminal device can be configured to detect, based on received MCC (Multi-Channel Code) information, that the user (e.g., the owner of the terminal device) is in a country other than the user's home country. A relevant MaaS client application (e.g., an application from the local mobile service provider in the current country) can be launched on the terminal device, and the terminal device can be configured to notify the mobile service provider, thereby requesting roaming mobile services from the local mobile service provider, making the local mobile service provider the user's roaming mobile service provider.

[0090] Geofencing can be based on the location capabilities of the terminal device. In some implementations, the terminal device can use a Global Navigation Satellite System (GNSS), making it configurable to determine the user's location.

[0091] The home mobile service provider can provide a geolocation database to the terminal device, which may include permitted roaming service areas. If the user (or terminal device) is within a permitted roaming service area, the terminal device can trigger the launch of the relevant MaaS application, as described above.

[0092] External triggers can refer to beacon signals, such as Bluetooth beacons, Bluetooth Low Energy (BLE) beacons, Near Field Communication (NFC) signals, etc.

[0093] For example, the trigger point can be set at, for example, a boarding gate, a train station, a national, regional, or area gateway, etc., where the trigger point can be configured to emit one or more beacon signals, without limiting this disclosure to the aforementioned beacon signals (e.g., Wi-Fi signals may also be considered sufficient).

[0094] If the passenger (user) is close enough to the trigger point that the passenger's terminal device can receive the beacon signal, the terminal device can be configured to determine the country, region, area, etc. based on the beacon signal.

[0095] Optionally or additionally, the terminal device can be configured to request further information. For example, the terminal device can send a message requesting a roaming mobile service provider (e.g., SMS). Such an implementation is conceivable when the energy of the received beacon signal is below a predetermined threshold, or when the amount of information in the beacon is limited.

[0096] Booking history can refer to the tracking of a passenger's previous bookings. For example, a roaming mobile service provider can save a passenger's travel records (e.g., international air travel). For instance, a passenger might subscribe to flights, train trips, etc., with a roaming mobile service provider. The roaming mobile service provider can store this booking as a booking record in an application on the passenger's terminal device. At the time / date of the booked trip, the application can activate the roaming mobile service.

[0097] It has been recognized that social login can be applied to MaaS roaming services.

[0098] Therefore, in some implementations, the circuit is also configured to perform social login to the roaming mobile service provider.

[0099] However, in some implementations, social login may not be suitable for MaaS services. For example, social login may rely on an identifier provided by a specific company, allowing that company to (directly or indirectly) know every request a passenger makes to use the MaaS service. Therefore, for privacy reasons, from the perspective of a MaaS service provider, it may be necessary to restrict third-party access to travel records.

[0100] Therefore, it has been recognized that MaaS identifiers can be controlled by individuals or decentralized publishers.

[0101] Therefore, in some implementations, the identifier is a distributed identifier.

[0102] Distributed Identifiers (DIDs) can provide decentralized public key infrastructure (DPKI). For example, the World Wide Web Consortium (W3C) defines DIDs as decentralized, globally unique IDs (see also https: / / w3c-ccg.github.io / DID-primer / and / or https: / / query.prod.cms.rt.microsoft.com / cms / api / am / binary / re2djfy).

[0103] In some implementations, such distributed identifiers are used to verify, identify, authorize, and authenticate passengers to mobile service providers.

[0104] For example, a DID can be used to provide a self-sovereign identity; therefore, in some implementations, the identifier is a self-sovereign identity.

[0105] SSI can be defined as a lifelong portable digital identity that does not rely on any centralized authority. It also meets the requirements of persistence, global resolvability, cryptographic verifiability, and decentralization (see also https: / / w3c-ccg.github.io / DID-primer / ).

[0106] Therefore, while conventional identity can be provided by centralized entities or authorities (e.g., governments) and SNS service providers, such authorities are not required in the case of SSI.

[0107] Public SSI standards, such as Hyperledger Indy, can be used and can be applied to MaaS roaming services according to this disclosure.

[0108] Figure 3 A method 40 is described for authenticating passenger 23 to use mobile services of roaming mobile service provider 24.

[0109] To prepare the Distributed Identifier (DID), user agent 41 (e.g., provided in the passenger's mobile phone application) issues a DID creation request to decentralized system 43 (or decentralized database, such as a blockchain, distributed ledger system) at 42. In this embodiment, the DID is a unique number (in other embodiments, it is the passenger's globally unique address), thus minimizing the information required to authenticate the passenger.

[0110] At position 44, user agent 41 creates the DID, and at position 45, the DID is stored.

[0111] At position 46, the DID document is sent to the DID parser at position 47.

[0112] Then, the home mobile service provider 21 prepares the credentials.

[0113] At point 48, the user agent notifies the home mobile service provider of the DID.

[0114] At point 49, the home mobile service provider 21 requests the issuance of a DID-based credential (in other implementations, the credential issuer may be different from the home mobile service provider 21). The request is sent to the distributed system 43.

[0115] At point 50, the distributed system 43 issues a credential signed with a DID to prove that the passenger is a subscriber to the mobile service of the home mobile service provider 21. Therefore, both the DID and the credential are stored in the distributed system 43.

[0116] In this implementation, the signature is performed by hashing the DID and encrypting it with a continuous public key based on the generated hash.

[0117] At point 51, the credentials are sent to the home mobile service provider 21, and at point 52, the home mobile service provider 21 sends the credentials to the user agent 41.

[0118] Some implementations relate to a communication network node having circuitry configured to request a decentralized database to provide passenger credentials, wherein the credentials are generated based on a passenger's distributed identifier, which is generated based on a user device's request to the decentralized database, in order to allow the passenger to use mobile services from a roaming mobile service provider.

[0119] about Figure 3 The communication network nodes can be controlled by the home mobile service provider 21.

[0120] Some implementations relate to a user equipment having circuitry configured to: publish the generation of a passenger's decentralized identifier; and receive a credential from the passenger allowing the passenger to use mobile services provided by a roaming mobile service provider, wherein the credential is generated based on a request from the home mobile service provider to a decentralized database and based on the decentralized identifier.

[0121] User devices (e.g., smartphones, smartwatches, etc.) can be configured to run applications, thereby providing... Figure 3 The user agent 41 function.

[0122] Some implementations relate to a communication network for providing a distributed ledger, the communication network having multiple network nodes for authenticating passengers to roaming mobile service providers, the network nodes having circuits configured to: provide a decentralized identifier for the passenger in a decentralized database based on a request from a user device; provide the passenger's credentials in the decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and send the credentials to the user device to allow the passenger to use the roaming mobile service provider's mobile services.

[0123] For example, regarding Figure 3 The communication network under discussion may include multiple servers, computers, user equipment, etc.

[0124] Some implementations relate to a method for controlling a communication network for providing a distributed ledger, the communication network having multiple network nodes for authenticating passengers to a roaming mobile service provider, the method comprising: providing a decentralized identifier of the passenger in a decentralized database based on a request from a user device; providing the passenger's credentials in a decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and sending the credentials to the user device to allow the passenger to use the mobile services of the roaming mobile service provider, as discussed herein.

[0125] It should be noted that the embodiments of this disclosure generally also involve methods performed by corresponding circuits, controls, network nodes, etc., and those skilled in the art can provide corresponding methods for each of these embodiments.

[0126] Figure 4 Another method 60 for authenticating passengers using DID-based credentials is described. Method 60 can be used in... Figure 3 Method 40 is executed after it, or it can be considered an independent method.

[0127] At point 61, user agent 41 detects entry into the mobile service area of ​​roaming mobile service provider 24, thereby initiating roaming.

[0128] At point 62, user agent 41 sends credentials to roaming mobile service provider 24, which triggers the authentication process.

[0129] The roaming mobile service provider sends the DID-signed credentials to the DID resolver 47 (server).

[0130] DID parser 47 sends the DID document to the roaming mobile service provider. In addition to the unique DID, at 63, the DID document includes the user's public key used to encrypt the DID to generate a token. The terminal used for validity checks by the roaming mobile service provider may store the DID and public key after the initial processing (i.e., the first execution of such method 60). If the DID and public key are stored, the re-execution of this process can be omitted in later stages of executing method 60, without limiting the scope of this disclosure. The stored data (i.e., the DID and / or public key) may be valid for a predetermined period (e.g., one day). Generally, the DID and public key may be valid for different or the same period. Therefore, offline operation (e.g., operation without a network connection) is possible, which can be envisioned when the remaining processes do not necessarily require a network connection.

[0131] As is generally known in public-key cryptography, the private key is necessary to decrypt the token. The private key is stored in user agent 41.

[0132] At point 64, the token (or challenge token) is sent to user agent 41, and at point 65, the user agent decrypts the token with the private key.

[0133] Then, at point 66, the decryption result is sent to the roaming mobile service provider 24, so that at point 67, the roaming mobile service provider can identify the user as a verified user using the mobile service of the roaming mobile service provider 24, because the decrypted token is the same as the token he generated.

[0134] Therefore, some implementations relate to a communication network node having circuitry configured to: receive a passenger's credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and a distributed identifier based on the passenger; receive the distributed identifier in response to sending the credentials to the database; and verify the passenger based on the distributed identifier to allow the passenger to use the mobile services of the roaming mobile service provider.

[0135] For example, such network nodes can be controlled by roaming mobile service providers, as referenced. Figure 4 As stated above.

[0136] In some implementations, verification is token-based, as described herein.

[0137] In some implementations, as described herein, tokens are generated using public-key encryption based on distributed identifiers.

[0138] It should be noted that this disclosure is not limited to public-key cryptography, as those skilled in the art can conceive of any other kind of symmetric or asymmetric cryptography.

[0139] Some implementations relate to a method for controlling a node in a communication network, the method comprising: receiving a passenger’s credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and a distributed identifier based on the passenger; receiving the distributed identifier in response to sending the credentials to the database; and verifying the passenger based on the distributed identifier to allow the passenger to use the mobile services of a roaming mobile service provider.

[0140] Some implementations relate to a user equipment having circuitry configured to: send a passenger’s credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and based on the passenger’s distributed identifier; receive a token, wherein the token is based on encryption of the distributed identifier; and decrypt the token for verifying the passenger with a roaming mobile service provider to allow the passenger to use the roaming mobile service provider’s mobile services.

[0141] Such user devices can be implemented, for example, through smartphones that act as user agents, as discussed in the context of... Figure 4 The subject of discussion.

[0142] Some implementations relate to a communication network for providing a distributed ledger, the network having multiple network nodes for authenticating passengers to a roaming mobile service provider, each network node having a circuit configured to: provide a token, wherein the token is encrypted based on a distributed identifier of the passenger; and decrypt the token for authenticating the passenger to the roaming mobile service provider to allow the passenger to use the roaming mobile service provider's mobile services, as discussed herein, and also concerning... Figure 4 of.

[0143] In some implementations, the distributed ledger is based on blockchain, as described in this article.

[0144] Some implementations relate to a method for controlling a communication network for providing a distributed ledger, the communication network including multiple network nodes for authenticating passengers to a roaming mobile service provider, the method comprising: providing a token, wherein the token is based on an encryption of a passenger's distributed identifier; and decrypting the token for authenticating the passenger to the roaming mobile service provider to allow the passenger to use the roaming mobile service provider's mobile services, as discussed herein.

[0145] In some implementations, a single authentication may be deemed insufficient to allow passengers to use roaming mobile services.

[0146] Therefore, for safety and / or security reasons, passenger authorization is also envisioned. This could be compared to passport control at an airport. Checking a passport might suffice to verify a passenger's identity. However, authorizing a traveler to enter the country might require a valid visa.

[0147] Similarly, according to this disclosure, in some embodiments, authorization is performed.

[0148] In some implementations, a mutual agreement exists between the home mobile service provider and the roaming mobile service provider to allow passengers to use the roaming mobile service provider's mobile services. This mutual agreement may include requiring the passenger to present credentials from the home mobile service provider to prove they have a mobile service subscription. In this implementation, the passenger already possesses a DID (Digital ID).

[0149] Credentials may include the following information: issuer (home mobile service provider), service provider (roaming mobile service provider or transportation service provider), service information (e.g., permitted services (e.g., public transportation in regions 1 to 3)), and validity information (e.g., timestamp of the issuance date, validity period, expiration date, PKI (Public Key Infrastructure) information (e.g., signature)).

[0150] Figure 5 A method 70 for authorizing passengers with a single mobile service credential under a mutual agreement is described.

[0151] At point 71, the home mobile service provider 21 issues and sends a certificate of home mobile service to the user agent 41. This certificate can be used by the roaming mobile service provider under a mutual agreement.

[0152] At point 72, user agent 41 (e.g., a mobile service application on a smartphone) detects entry into a roaming mobile service area (i.e., the mobile service area of ​​a mobile service provider that is not the passenger's home mobile service provider 21) and initiates roaming.

[0153] At point 73, user agent 41 sends credentials to roaming mobile service provider 24.

[0154] At point 74, as mentioned above, passenger authentication is performed.

[0155] At point 75, grant the authorization as follows:

[0156] First, the roaming mobile service provider 24 verifies the credential and its validity based on the electronic signature from the home mobile service provider 21. Second, the roaming mobile service provider 24 reads the service terms provided in the credential. Third, the roaming mobile service provider 24 allows the passenger to use the roaming mobile service provider's mobile services according to the terms in the credential.

[0157] Therefore, some implementations relate to a communication network node including circuitry configured to allow a passenger to use the roaming mobile service provider's mobile services based on a passenger's credentials and a mutual agreement between the roaming mobile service provider and the home mobile service provider, wherein the credentials are generated based on the home mobile service provider's request to a decentralized database and based on the passenger's distributed identifier, as per [reference to...]. Figure 5 The subject of discussion.

[0158] In some implementations, network nodes can be controlled by the roaming mobile service provider.

[0159] Some implementations relate to a method for controlling a node in a communication network, the method comprising: allowing the passenger to use the mobile services of the roaming mobile service provider based on the passenger's credentials and based on a mutual agreement between the roaming mobile service provider and the home mobile service provider, wherein the credentials are generated based on a request from the home mobile service provider to a decentralized database and based on the passenger's distributed identifier, as discussed herein.

[0160] However, the present invention is not limited to the present invention. Figure 5 The authorization is based on the assumption that there are mutual credentials, and therefore a mutual mobility service agreement. Each credential can be based on a specific request.

[0161] For example, service levels, terms, and conditions can differ between different mobile service providers. For instance, a passenger might be able to use all services offered by their home mobile service provider but not all services offered by a roaming mobile service provider. Furthermore, different transportation operators might be assigned to a roaming mobile service provider (e.g., taxis and trains), and a passenger might only be allowed to use one of them. Therefore, different operators might require separate credentials.

[0162] For example, transport operator A (railway company) may need certificate A for railway use, while transport operator B (taxi company) may need certificate B for taxi use.

[0163] The credentials may include the following information: issuer (e.g., home mobile service provider), service provider (e.g., roaming mobile service provider, transportation operator), service information (e.g., service type (e.g., taxi, railway), service allowance (e.g., taxi rides up to ten times, train rides up to four times per ticket)), and validity information (e.g., timestamp of the issuance date, validity period, expiry date, PKI information (e.g., electronic signature)).

[0164] Figure 6Methods for further explaining the multiple credentials used to authorize passengers are described 80.

[0165] Based on a passenger's request to use the mobile services of a roaming mobile service provider issued to the home mobile service provider, the home mobile service provider sends credentials for roaming mobile service provider A 24a and roaming mobile service provider B 24b to user agent 41.

[0166] At point 82, the user agent sends the credentials to the identity center at point 83 (e.g., a server, a storage device), where they are stored.

[0167] At point 84, as described herein, roaming detection is performed by user agent 41. The result of the roaming detection is that the passenger intends to use the mobile services of roaming mobile service provider A 24a.

[0168] At point 85, based on roaming detection, user agent 41 requests the corresponding credentials from identity center 83. At point 86, identity center 83 sends credential A to user agent 41. At point 87, user agent 41 displays / sends the relevant credentials to roaming mobile service provider A 24a for passenger authentication; the passenger authentication is sent at point 88.

[0169] For authorization, at location 89, the roaming mobile service provider A 24a verifies credentials using a distributed system (e.g., blockchain). Additionally, the roaming mobile service provider A 24a checks the allowance for the mobile service. In some implementations, allowance history (or changes in remaining allowance) can be recorded in a user agent, distributed ledger, decentralized system, etc. For example, the user agent can have a secure storage that may not be easily written to / updated without access or permission. The user agent can be configured to check the remaining allowance if a user (or passenger) requests a allowance-based mobile service (or transportation service). Furthermore, this mechanism can be applied to related services, such as recording travel mileage, CO2 emission estimates based on the type of mobile service (e.g., train, airplane, etc.).

[0170] At point 90, roaming service is accepted, and passengers can activate roaming service.

[0171] Therefore, some implementations relate to a communication network node including circuitry configured to: store multiple credentials for a passenger, wherein the multiple credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a distributed identifier of the passenger; and send at least one of the multiple credentials to a user equipment to allow the passenger to use the mobile services of the roaming mobile service provider.

[0172] Network nodes can be configured or controlled by the identity center, such as regarding Figure 6 The subject of discussion.

[0173] Some implementations relate to a method for controlling a node in a communication network, the method comprising: storing multiple credentials of a passenger, wherein the multiple credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a decentralized identifier of the passenger; and sending at least one of the multiple credentials to a user equipment to allow the passenger to use mobile services of a roaming mobile service provider, as discussed herein.

[0174] This method can be executed by a server, computer, etc., as shown in the reference. Figure 6 The identity center discussed in the text.

[0175] The following will refer to Figure 7 Explain blockchain and its general data structure. In this implementation of blockchain, key features include network / topology, consensus algorithm, flash memory functionality, participant authentication, scalability / block structure, and performance.

[0176] Figure 7 The typical structure of blockchain 100 is shown. Blockchain 100 comprises a chain of multiple data blocks 101a, 101b, and 101c, where block 101b is the current block (block #N), block 101a is the previous block (block #N1), and block 101c is the future or successor block (block #N+1). Each block includes the hash function result of the previous block, a main data structure, the input values ​​of the hash function, and the hash function result of the current block, wherein the hash function result of the current block (101b) is always used as the input of the next block (101c).

[0177] In addition, each block contains a "one-time-used number," a one-time random number processed by the secure blockchain to prevent replay attacks. For example, if an attacker copies previously sent data and reuses the copied data to spoof, the receiver can detect the spoofed communication because the next data must use a different "never-used number." This random number is sometimes referred to as a "nonce" in cryptocurrencies.

[0178] Additionally, timestamps can be inserted into each of blocks 101a, 101b, and 101c. Blockchain 100 is an example of a distributed ledger, which, for example, can be used to provide MaaS in some implementations.

[0179] Figure 8 An example of using Figure 7 The inputs and outputs of the hash function of Blockchain 100.

[0180] Typically, a hash function is any function that can map input data to output data using a specific algorithm. The size of the input data can be large and varied, while the output data can be compact and can have a fixed size. In some blockchain implementations, the known (and well-known) algorithms used for hashing are the Secure Hash Algorithms (SHA) designed by the U.S. National Security Agency (NSA) (e.g., SHA-2, SHA-256).

[0181] The input to the hash function is the previous hash output, the number used once, and the data body in the current block (e.g., ...). Figure 7 (Block 101b in the dataset). The output of a hash function is a unique response to the input value. If someone attempts to tamper with the data body, the output of the hash function will not be consistent.

[0182] The distributed ledger (blockchain) implementations in this disclosure can implement consensus protocols or algorithms. For example, in some implementations, Byzantine Fault Tolerance (BFT) is used for the consensus protocol, which is resilient to database spoofing and hardware failures.

[0183] In some implementations, the well-known consensus algorithm is known as Practical Byzantine Fault Tolerance (PBFT).

[0184] In some implementations, a permissioned blockchain is used, and a relatively small number of permissioned blockchain nodes are responsible for consensus (block verification).

[0185] Figure 9 The PBFT process 110 is illustrated as an example.

[0186] At point 111, the group leader node (also known as a non-validating peer) requests other nodes to validate the blockchain. At point 112, each requested node (validating peer) checks the validity of the blockchain using a hash function and indicates its result to the other nodes at point 113. At point 114, a node receives validity results from multiple other peers and checks the consensus of the blockchain, provided that more valid results are received than a pre-defined standard. If consensus exists, at point 115, the node writes to / finalizes the blockchain. The group leader peer checks the overall progress of validity checks among the other nodes and completes the blockchain process at point 116.

[0187] For resilience, in some implementations, the total number of nodes is greater than 3f+1, where f is the number of allowed failed nodes. For example, if f=1, there are a total of 4 nodes; if f=3, there are a total of 10 nodes, and so on.

[0188] In some implementations, as described herein, PBFT has a permissioned blockchain for mobile services blockchain, providing at least in part the following features:

[0189] Regarding security, in some implementations, PBFT offers a small risk of a 51% attack, which is common for cryptocurrencies because the permissions of the peers responsible for consensus must be trusted. Regarding privacy, end users cannot access the entire blockchain because only the mobile service provider processes it on the (peer) nodes (due to the permissioned nature of the blockchain, end users may not have permission to access the blockchain). Regarding performance, in some implementations, consensus processing time is very short due to the small number of high-performance peers. Regarding flexibility, in some implementations, the block size and format of the blockchain can be flexible compared to public blockchains.

[0190] In the following text, see references Figure 10 An implementation of the general-purpose computer 130 is described. The computer 130 can be implemented such that it can essentially function as any type of network device, such as a network node, identification hub, part of a decentralized database, base station or new wireless base station, transmitting and receiving point, or communication device, such as user equipment, (end)terminal device, etc. The computer has components 131 to 141, which can form circuitry, such as the circuitry of any of the network devices and communication devices described herein.

[0191] The implementation of the methods described herein can be performed using software, firmware, programs, etc., which can be installed on computer 130, and the computer is then configured to suit the specific implementation.

[0192] Computer 130 has a CPU 131 (Central Processing Unit) which can, for example, execute various types of processes and methods as described herein, based on programs stored in read-only memory (ROM) 132, stored in memory 137 and loaded into random access memory (RAM) 133, or stored on a medium 140 that can be inserted into a corresponding drive 139, etc.

[0193] CPU 131, ROM 132, and RAM 133 are connected to bus 141, which in turn is connected to input / output interface 134. The number of CPUs, memory, and storage devices is merely exemplary, and those skilled in the art will understand that when computer 130 is used as a base station or user equipment (terminal), computer 130 can be adjusted and configured accordingly to meet specific requirements.

[0194] Several components are connected to the input / output interface 134: input 135, output 136, memory 137, communication interface 138, and driver 139. Media 140 (optical disc, digital video disc, compact memory, etc.) can be inserted into the driver.

[0195] As a supplement to or alternative to memory 137, the hardware can have secure memory for storing credentials. Dedicated software with access rights to secure memory can mitigate its vulnerabilities. For example, the process of reading / writing / updating credentials can be protected by software (execution) (the same software or different software). Therefore, the risk of tampering with credentials (or any other content in the secure memory) can be eliminated, such as through malware, accidental updates / deletions (through software errors, defects, or bugs), etc. Such secure hardware / software can be referred to as a Trusted Execution Environment (TEE) or a root of trust.

[0196] Entering 135 can be a pointing device (mouse, chart, etc.), keyboard, microphone, camera, touch screen, etc.

[0197] Output 136 can include a display (LCD, CRT, LED, etc.), a speaker, etc.

[0198] The memory 137 may include a hard disk, a solid-state drive, etc.

[0199] The communication interface 138 is suitable for communication via, for example, a local area network (LAN), a wireless local area network (WLAN), a mobile telecommunications system (GSM, UMTS, LTE, NR, etc.), Bluetooth, infrared, etc.

[0200] It should be noted that the above description pertains only to the instance configuration of computer 130. Optional configurations can be implemented using additional or other sensors, storage devices, interfaces, etc. For example, communication interface 138 can support radio access technologies other than UMTS, LTE, and NR.

[0201] When computer 130 is used as a base station, communication interface 138 may also have a corresponding air interface (providing, for example, E-UTRA protocol OFDMA (downlink) and SC-FDMA (uplink)) and network interface (such as implementing protocols such as S1-AP, GTP-U, S1-MME, X2-AP, etc.). Furthermore, computer 130 may have one or more antennas and / or antenna arrays. This disclosure is not limited to any particularity of such protocols.

[0202] refer to Figure 11 Implementations of user equipment UE 150 and eNB 155 (or NR eNB / gNB) and communication path 154 between UE 150 and eNB 155 for implementing embodiments of this disclosure are discussed. UE 150 is an example of a communication device, and eNB is an example of a base station (e.g., a network node), which limits this disclosure in this respect.

[0203] UE 150 has a transmitter 151, a receiver 152 and a controller 153. Generally speaking, the technical functions of the transmitter 151, receiver 152 and controller 153 are known to those skilled in the art, and therefore, a more detailed description of them is omitted.

[0204] The eNB 155 has a transmitter 156, a receiver 157 and a controller 158, the functions of which are generally known to those skilled in the art, and therefore a more detailed description of them is omitted.

[0205] Communication path 154 has an uplink path 154a from UE 150 to eNB 155 and a downlink path 154b from eNB 155 to UE 150.

[0206] During operation, the controller 153 of UE150 controls the reception of downlink signals at receiver 152 via downlink path 154b, and the controller 153 controls the transmission of uplink signals via transmitter 151 via uplink path 154A.

[0207] Similarly, during operation, the controller 158 of the eNB 155 controls the transmitter 156 to transmit downlink signals through downlink path 154b, and the controller 158 controls the receiver 157 to receive uplink signals through uplink path 154a.

[0208] When executed on a computer and / or processor, the methods described herein are also implemented in some embodiments as computer program diagrams that cause the computer and / or processor to perform the methods. In some embodiments, a non-transitory computer-readable recording medium is also provided, wherein a computer program product is stored, which, when executed by a processor such as the processor described above, causes the methods described herein to be performed.

[0209] It should be understood that the embodiments describe a method having an exemplary sequence of method steps. However, the specific order of the method steps given is for illustrative purposes only and should not be construed as binding. For example, Figure 2 In the implementation method, the order of 22 and 26 can be interchanged. Furthermore, Figure 3 The order of 45 and 46 in the implementation can be changed. Furthermore, Figure 6 The order of steps 82 and 84 in the implementation can also be interchanged. Other variations in the order of method steps may be obvious to those skilled in the art.

[0210] Please note that the division of UE150 into units 151 to 153 is for illustrative purposes only, and this disclosure is not limited to any particular functional division within a specific unit. For example, control of XY can be implemented by a corresponding programming processor, field-programmable gate array (FPGA), etc.

[0211] Unless otherwise stated, all units and entities described in this specification can be implemented as integrated circuit logic, such as on a chip, and unless otherwise stated, the functions provided by these units and entities can be implemented by software.

[0212] With respect to the embodiments disclosed above, which are implemented at least in part using software-controlled data processing devices, it should be understood that providing such software-controlled computer programs and providing such computer programs through transmission, storage or other media is contemplated as an aspect of this disclosure.

[0213] Note that this technology can also be configured as described below.

[0214] (1) A communication network node including a circuit configured to request a home mobile service provider to allow roaming mobile services for passengers located in the mobile service area of ​​a roaming mobile service provider.

[0215] (2) A communication network node as described in (1), wherein the request is based on the detection of a passenger in the mobile service area of ​​a roaming mobile service provider.

[0216] (3) A communication network node as described in (2), wherein detection is based on at least one of mobile country code, geofence, external trigger and booking history.

[0217] (4)(1) to (3) of any one of the communication network nodes, the circuit is further configured to: perform social login to the roaming mobile service provider.

[0218] (5)(1) to (4) any of the communication network nodes, wherein roaming mobile services are allowed based on an identifier.

[0219] (6) A communication network node as described in (5), wherein the identifier is a distributed identifier.

[0220] (7) A communication network node in either (5) or (6), wherein the identifier is a self-sovereign identity.

[0221] (8) A method for controlling a communication network node, the method comprising: requesting a home mobile service provider to allow roaming mobile services for a passenger located in the mobile service area of ​​a roaming mobile service provider.

[0222] (9) The method as described in (8) further includes: performing social login to the roaming mobile service provider.

[0223] (10) A communication network node including circuitry configured to request a decentralized database to provide a passenger’s credentials, wherein the credentials are generated based on a passenger’s distributed identifier, wherein the distributed identifier is generated based on a user equipment’s request to the decentralized database in order to allow the passenger to use the mobile services of a roaming mobile service provider.

[0224] (11) The communication network node as described in (10), wherein the decentralized database is based on a distributed ledger.

[0225] (12) The communication network node as described in (11), wherein the distributed ledger is a blockchain.

[0226] (13) A user equipment comprising circuitry configured to: publish the generation of a decentralized identifier of a passenger; and receive credentials of the passenger to allow the passenger to use mobile services of a roaming mobile service provider, wherein the credentials are based on a request from the home mobile service provider to a decentralized database and generated based on the decentralized identifier.

[0227] (14) The user equipment as described in (13), wherein the decentralized database is based on a distributed ledger.

[0228] (15) The user equipment as described in (14), wherein the distributed ledger is a blockchain.

[0229] (16) A communication network for providing a distributed ledger, the communication network comprising a plurality of network nodes for authenticating passengers to a roaming mobile service provider, the network nodes comprising circuitry configured to: provide a decentralized identifier of the passenger in a decentralized database based on a request from a user device; provide a credential of the passenger in the decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and send the credential to the user device to allow the passenger to use the mobile services of the roaming mobile service provider.

[0230] (17) The communication network as described in (16), wherein the decentralized database is based on a distributed ledger.

[0231] (18) The communication network as described in (17), wherein the distributed ledger is a blockchain.

[0232] (19) A method for controlling a communication network for providing a distributed ledger, the communication network including a plurality of network nodes for authenticating passengers to a roaming mobile service provider, the method comprising: providing a decentralized identifier of a passenger in a decentralized database based on a request from a user device; providing credentials of the passenger in a decentralized database based on a request from a home mobile service provider and based on the decentralized identifier; and sending the credentials to the user device to allow the passenger to use the mobile services of the roaming mobile service provider.

[0233] (20) A communication network node comprising a circuit configured to: receive a passenger’s credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and a distributed identifier based on the passenger; receive the distributed identifier in response to sending the credentials to the database; and verify the passenger based on the distributed identifier to allow the passenger to use the mobile services of a roaming mobile service provider.

[0234] (21) A communication network node as described in (20), wherein authentication is based on a token.

[0235] (22) The communication network node according to (21), wherein the token is encrypted based on the public key of the distributed identifier.

[0236] (23) A user equipment comprising circuitry configured to: send a passenger’s credentials, wherein the credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a passenger’s distributed identifier; receive a token, wherein the token is based on encryption of the distributed identifier; and decrypt the token to verify the passenger with a roaming mobile service provider to allow the passenger to use the roaming mobile service provider’s mobile services.

[0237] (24) The user equipment as described in (23), wherein the encryption is public key encryption.

[0238] (25) A communication network for providing a distributed ledger, the communication network including a plurality of network nodes for authenticating passengers to a roaming mobile service provider, the network nodes including circuitry configured to: provide a token, wherein the token is based on an encryption of a passenger’s distributed identifier; and decrypt the token to authenticate the passenger to the roaming mobile service provider to allow the passenger to use the roaming mobile service provider’s mobile services.

[0239] (26) The communication network as described in (25), wherein the distributed ledger is based on blockchain.

[0240] (27) A communication network node comprising a circuit configured to allow a passenger to use the mobile services of a roaming mobile service provider based on the passenger’s credentials and based on a mutual agreement between the roaming mobile service provider and the home mobile service provider, wherein the credentials are generated based on a request from the home mobile service provider to a decentralized database and based on the passenger’s distributed identifier.

[0241] (28) A method for controlling a node in a communication network, the method comprising: allowing a passenger to use a roaming mobile service provider’s mobile service based on the passenger’s credentials and based on a mutual agreement between the roaming mobile service provider and the home mobile service provider, wherein the credentials are generated based on a request from the home mobile service provider to a decentralized database and based on the passenger’s distributed identifier.

[0242] (29) A communication network node including circuitry configured to: store a plurality of credentials of a passenger, wherein the plurality of credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a decentralized identifier of the passenger; and send at least one of the plurality of credentials to a user equipment to allow the passenger to use the mobile services of a roaming mobile service provider.

[0243] (30) A method for controlling a node of a communication network, the method comprising: storing a plurality of credentials of a passenger, wherein the plurality of credentials are generated based on a request from a home mobile service provider to a decentralized database and based on a decentralized identifier of the passenger; and sending at least one of the plurality of credentials to a user equipment to allow the passenger to use mobile services of a roaming mobile service provider.

Claims

1. A communication network node, the communication network node comprising circuitry configured to: In response to a passenger's selection of roaming mobile services, the request is made to the home mobile service provider to allow roaming mobile services for passengers located within the roaming mobile service provider's mobile service area. in, The request is based on the detection of the passenger in the mobile service area of ​​the roaming mobile service provider. The detection is based on at least one of the following: mobile country code, geofence, and external triggers, and booking history. The detection based on the booking history is based on the travel date and time booked by the passenger. Among these, roaming mobile services are allowed to be based on decentralized identifiers or self-sovereign identities.

2. The communication network node according to claim 1, wherein the circuit is further configured as follows: Perform social login to the roaming mobile service provider.

3. A method for controlling a communication network node, the method comprising: In response to a passenger's selection of roaming mobile services, the request is made to the home mobile service provider to allow roaming mobile services for passengers located within the roaming mobile service provider's mobile service area. The request is based on the detection of the passenger within the mobile service area of ​​the roaming mobile service provider. The detection is based on at least one of the following: mobile country code, geofence, and external triggers, and booking history. The detection based on the booking history is based on the travel date and time booked by the passenger. Among these, roaming mobile services are allowed to be based on decentralized identifiers or self-sovereign identities.

4. The method according to claim 3, wherein the method further comprises: Perform social login to the roaming mobile service provider.

Images