Apparatus, method and computer program

Abstract

There is provided an apparatus, method and computer program for an apparatus for a user equipment to: encrypt a digital asset using a first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to the first network function; and providing an identification of the encrypted digital asset to the first entity.

Description

Technical Field

[0001] Examples described herein relate generally to apparatus, methods and computer programs, and more particularly (but not exclusively) to apparatus, methods and computer programs for apparatus. Background Art

[0002] A communication system may be viewed as a facility that enables communication sessions between two or more entities (such as communication devices, base stations, and / or other nodes) by providing carrier waves between the various entities involved in the communication path.

[0003] The communication system may be a wireless communication system. Examples of wireless systems include public land mobile networks (PLMNs) based on radio standards such as those provided by the Third Generation Partnership Project (3GPP), satellite-based communication systems, and different wireless local area networks such as wireless local area networks (WLANs). Wireless systems can typically be divided into cells and are therefore often referred to as cellular systems.

[0004] Communication systems and associated devices typically operate according to a given standard or specification that specifies what the various entities associated with the system are allowed to do and how it should be implemented. The communication protocols and / or parameters that should be used for the connection are also typically defined therein. Examples include the so-called fifth generation (5G) standards. Summary of the invention

[0005] According to a first aspect, a device for a user device is provided, the device comprising components for performing the following: encrypting a digital asset using a first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; and providing an identification of the encrypted digital asset to a first entity.

[0006] Means for providing identification of the encrypted digital asset may include means for providing a first identifier and at least one document identifier to the first entity, the at least one document identifier for identifying a document included in the encrypted digital asset.

[0007] The first identifier may include a subscriber identifier.

[0008] The first identifier may comprise a global public subscriber identifier.

[0009] The apparatus may include means for generating the first identifier by: inputting the authentication key to a second key derivation function; and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier.

[0010] The means for combining may comprise means for combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0011] The apparatus may include means for, prior to the inputting, determining that a flag has been set to indicate that the first identifier is to be generated by inputting an authentication key into a first key derivation function.

[0012] The apparatus may include means for generating the first key by inputting the third key into a first key derivation function.

[0013] The means for generating may further comprise means for inputting a random value and / or a counter value to the first key derivation function.

[0014] The means for providing the identification may include means for providing the identification with the session establishment request.

[0015] The identification may include the index.

[0016] The index may include a random value, a counter value, and / or a key.

[0017] According to a second aspect, a device for a first network function is provided, the device comprising components for performing the following items: receiving an encrypted digital asset and an index for the encrypted digital asset; receiving a request for the encrypted digital asset from a first entity; and providing the encrypted digital asset and the index to the first entity.

[0018] The apparatus may include means for determining that the first entity is authorized to receive the encrypted digital asset prior to providing the encrypted digital asset to the first entity.

[0019] The index may include a random value, a counter value, and / or a key.

[0020] According to a third aspect, a device for a first entity is provided, the device comprising components for performing the following items: receiving an identification of an encrypted digital asset from a user device; obtaining the encrypted digital asset from a first network function; receiving an index for the encrypted digital asset from the user device, or the first network function; using the index and identification of the encrypted digital asset to obtain a first decryption key from an authentication function; and decrypting the encrypted digital asset.

[0021] The index may include a random value, a counter value, and / or a key.

[0022] According to a fourth aspect, a device for authentication function is provided, which includes components for performing the following items: receiving a request for a first decryption key for decrypting an encrypted digital asset from a first entity, the request including an index of the encrypted digital asset; obtaining a decryption key using the index; and providing the decryption key to the first entity.

[0023] The means for obtaining the decryption key may include means for generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0024] The means for obtaining the decryption key may include means for retrieving a previously generated decryption key using the received value of the index and an identification of the encrypted digital asset.

[0025] The index may include a random value, a counter value, and / or a key.

[0026] According to a fifth aspect, a device for a user device is provided, the device comprising: at least one processor; and at least one memory, the at least one memory comprising code, which, when executed by the at least one processor, causes the device to perform: encrypting a digital asset using a first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; and providing an identification of the encrypted digital asset to a first entity.

[0027] Providing identification of the encrypted digital asset may include providing the first identifier and at least one document identifier to the first entity, the at least one document identifier for identifying a document included in the encrypted digital asset.

[0028] The first identifier may include a subscriber identifier.

[0029] The first identifier may comprise a global public subscriber identifier.

[0030] The apparatus may be caused to generate the first identifier by: inputting the authentication key to a second key derivation function; and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier.

[0031] The combining may include combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0032] The apparatus may be caused to perform, prior to the inputting, determining that a flag has been set to indicate that the first identifier is to be generated by inputting the authentication key into the first key derivation function.

[0033] The apparatus may be caused to perform: generating the first key by inputting the third key into a first key derivation function.

[0034] Generating the first key may further include inputting a random value and / or a counter value into a first key derivation function.

[0035] Providing the identification may include providing the identification with the session establishment request.

[0036] The identification may include the index.

[0037] The index may include a random value, a counter value, and / or a key.

[0038] According to a sixth aspect, a device for a first network function is provided, the device comprising: at least one processor; and at least one memory, the at least one memory comprising code, which, when executed by the at least one processor, causes the device to perform: receiving an encrypted digital asset and an index for the encrypted digital asset; receiving a request for the encrypted digital asset from a first entity; and providing the encrypted digital asset and the index to the first entity.

[0039] The apparatus may be caused to perform, prior to providing the encrypted digital asset to the first entity, determining that the first entity is authorized to receive the encrypted digital asset.

[0040] The index may include a random value, a counter value, and / or a key.

[0041] According to a seventh aspect, a device for a first entity is provided, the device comprising: at least one processor; and at least one memory, the at least one memory comprising code, which, when executed by the at least one processor, causes the device to perform: receiving an identification of an encrypted digital asset from a user device; obtaining the encrypted digital asset from a first network function; receiving an index for the encrypted digital asset from the user device or the first network function; obtaining a first decryption key from an authentication function using the index and identification of the encrypted digital asset; and decrypting the encrypted digital asset.

[0042] The index may include a random value, a counter value, and / or a key.

[0043] According to an eighth aspect, a device for authentication function is provided, the device comprising: at least one processor; and at least one memory, comprising code, which, when executed by the at least one processor, causes the device to perform: receiving a request for a first decryption key for decrypting an encrypted digital asset from a first entity, the request comprising an index of the encrypted digital asset; obtaining a decryption key using the index; and providing the decryption key to the first entity.

[0044] Obtaining the decryption key may include generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0045] Obtaining the decryption key may include using the received value of the index and an identification of the encrypted digital asset to retrieve a previously generated decryption key.

[0046] The index may include a random value, a counter value, and / or a key.

[0047] According to a ninth aspect, a method for an apparatus for a user device is provided, the method comprising: encrypting a digital asset using a first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; and providing an identifier of the encrypted digital asset to a first entity.

[0048] Providing identification of the encrypted digital asset may include providing the first identifier and at least one document identifier to the first entity, the at least one document identifier for identifying a document included in the encrypted digital asset.

[0049] The first identifier may include a subscriber identifier.

[0050] The first identifier may comprise a global public subscriber identifier.

[0051] The method may include generating the first identifier by: inputting an authentication key into a second key derivation function; and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier.

[0052] Combining may include combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0053] The method may comprise, prior to the inputting, determining that a flag has been set to indicate that the first identifier is to be generated by inputting an authentication key into a first key derivation function.

[0054] The method may include generating a first key by inputting a third key into a first key derivation function.

[0055] Generating the first key may further include inputting a random value and / or a counter value into a first key derivation function.

[0056] Providing the identification may include providing the identification with the session establishment request.

[0057] The identification may include the index.

[0058] The index may include a random value, a counter value, and / or a key.

[0059] According to a tenth aspect, a method for an apparatus for a first network function is provided, the method comprising: receiving an encrypted digital asset and an index for the encrypted digital asset; receiving a request for the encrypted digital asset from a first entity; and providing the encrypted digital asset and the index to the first entity.

[0060] The method may include, prior to providing the encrypted digital asset to the first entity, determining that the first entity is authorized to receive the encrypted digital asset.

[0061] The index may include a random value, a counter value, and / or a key.

[0062] According to an eleventh aspect, a method for an apparatus for a first entity is provided, the method comprising: receiving an identification of an encrypted digital asset from a user device; obtaining the encrypted digital asset from a first network function; receiving an index for the encrypted digital asset from the user device, or the first network function; obtaining a first decryption key from an authentication function using the index and identification of the encrypted digital asset; and decrypting the encrypted digital asset.

[0063] The index may include a random value, a counter value, and / or a key.

[0064] According to a twelfth aspect, a method for an apparatus for authentication function is provided, the method comprising: receiving a request for a first decryption key for decrypting an encrypted digital asset from a first entity, the request comprising an index of the encrypted digital asset; obtaining a decryption key using the index; and providing the decryption key to the first entity.

[0065] Obtaining the decryption key may include generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0066] Obtaining the decryption key may include using the received value of the index and an identification of the encrypted digital asset to retrieve a previously generated decryption key.

[0067] The index may include a random value, a counter value, and / or a key.

[0068] According to the thirteenth aspect, a device for a user device is provided, the device comprising: an encryption circuit system for encrypting a digital asset using a first key to form an encrypted digital asset; a circuit system for providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; and a circuit system for providing an identification of the encrypted digital asset to a first entity.

[0069] Providing circuitry for providing identification of an encrypted digital asset may include providing circuitry for providing a first identifier and at least one document identifier to a first entity, the at least one document identifier for identifying a document included in the encrypted digital asset.

[0070] The first identifier may include a subscriber identifier.

[0071] The first identifier may comprise a global public subscriber identifier.

[0072] The apparatus may include generating circuitry for generating the first identifier by: inputting an authentication key to a second key derivation function; and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier.

[0073] The combining may include combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0074] The apparatus may comprise determining circuitry for determining, prior to the inputting, that a flag has been set to indicate that the first identifier is to be generated by inputting an authentication key into a first key derivation function.

[0075] The apparatus may include generating circuitry for generating a first key by inputting a third key into a first key derivation function.

[0076] The generation circuitry for generating the first key may further comprise circuitry for inputting a random value and / or a counter value to the first key derivation function.

[0077] The providing circuitry for providing the identification may include providing circuitry for providing the identification with the session establishment request.

[0078] The identification may include the index.

[0079] The index may include a random value, a counter value, and / or a key.

[0080] According to a fourteenth aspect, a device for a first network function is provided, the device comprising: a receiving circuit system for receiving an encrypted digital asset and an index for the encrypted digital asset; a receiving circuit system for receiving a request for an encrypted digital asset from a first entity; and a providing circuit system for providing the encrypted digital asset and the index to the first entity.

[0081] The apparatus may include determination circuitry for determining that the first entity is authorized to receive the encrypted digital asset prior to providing the encrypted digital asset to the first entity.

[0082] The index may include a random value, a counter value, and / or a key.

[0083] According to a fifteenth aspect, a device for a first entity is provided, the device comprising: a receiving circuit system for receiving an identifier of an encrypted digital asset from a user device; a receiving circuit system for acquiring the encrypted digital asset from a first network function; a receiving circuit system for receiving an index for the encrypted digital asset from the user device or the first network function; an acquisition circuit system for acquiring a first decryption key from an authentication function using the index and identifier of the encrypted digital asset; and a decryption circuit system for decrypting the encrypted digital asset.

[0084] The index may include a random value, a counter value, and / or a key.

[0085] According to the sixteenth aspect, a device for authentication function is provided, which includes: a receiving circuit system for receiving a request for a first decryption key for decrypting an encrypted digital asset from a first entity, the request including an index of the encrypted digital asset; an obtaining circuit system for obtaining the decryption key using the index; and a providing circuit system for providing the decryption key to the first entity.

[0086] Obtaining circuitry for obtaining the decryption key may include using circuitry for generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0087] Obtaining circuitry for obtaining the decryption key may include using circuitry for retrieving a previously generated decryption key using the received value of the index and an identification of the encrypted digital asset.

[0088] The index may include a random value, a counter value, and / or a key.

[0089] According to the seventeenth aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing a device of a user equipment to execute: encrypting a digital asset using a first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; and providing an identification of the encrypted digital asset to a first entity.

[0090] Providing identification of the encrypted digital asset may include providing the first identifier and at least one document identifier to the first entity, the at least one document identifier for identifying a document included in the encrypted digital asset.

[0091] The first identifier may include a subscriber identifier.

[0092] The first identifier may comprise a global public subscriber identifier.

[0093] The apparatus may be caused to perform: generating the first identifier by: inputting the authentication key to a second key derivation function; and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier.

[0094] Combining may include combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0095] The apparatus may be caused to perform, prior to the inputting, determining that a flag has been set to indicate that the first identifier is to be generated by inputting the authentication key into the first key derivation function.

[0096] The apparatus may be caused to perform: generating the first key by inputting the third key into a first key derivation function.

[0097] Generating the first key may further include inputting a random value and / or a counter value into a first key derivation function.

[0098] Providing the identification may include providing the identification with the session establishment request.

[0099] The identification may include the index.

[0100] The index may include a random value, a counter value, and / or a key.

[0101] According to the eighteenth aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing a device for a first network function to perform: receiving an encrypted digital asset and an index for the encrypted digital asset; receiving a request for the encrypted digital asset from a first entity; and providing the encrypted digital asset and the index to the first entity.

[0102] The apparatus may be caused to perform, prior to providing the encrypted digital asset to the first entity, determining that the first entity is authorized to receive the encrypted digital asset.

[0103] The index may include a random value, a counter value, and / or a key.

[0104] According to the nineteenth aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing an apparatus for a first entity to execute: receiving an identification of an encrypted digital asset from a user device; obtaining the encrypted digital asset from a first network function; receiving an index for the encrypted digital asset from the user device or the first network function; obtaining a first decryption key from an authentication function using the index and identification of the encrypted digital asset; and decrypting the encrypted digital asset.

[0105] The index may include a random value, a counter value, and / or a key.

[0106] According to the twentieth aspect, a non-transitory computer-readable medium is provided, comprising program instructions for causing a device for an authentication function to execute: receiving a request for a first decryption key for decrypting an encrypted digital asset from a first entity, the request comprising an index of the encrypted digital asset; obtaining a decryption key using the index; and providing the decryption key to the first entity.

[0107] Obtaining the decryption key may include generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0108] Obtaining the decryption key may include using the received value of the index and an identification of the encrypted digital asset to retrieve a previously generated decryption key.

[0109] The index may include a random value, a counter value, and / or a key.

[0110] According to a twenty-first aspect, there is provided a computer program product stored on a medium, which medium can cause an apparatus to perform any of the methods described herein.

[0111] According to a twenty-second aspect, there is provided an electronic device which may include an apparatus as described herein.

[0112] According to a twenty-third aspect, there is provided a chipset which may include an apparatus as described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0113] Some examples will now be described by way of illustration only, with reference to the accompanying drawings, in which:

[0114] Figure 1 An example representation of a 5G system is shown;

[0115] Figure 2 An example representation of a network device is shown;

[0116] Figure 3 An example representation of a user device is shown;

[0117] Figures 4 to 7 Example signaling is shown; and

[0118] Figures 8 to 11 Example operations that may be performed by the apparatus described herein are shown. DETAILED DESCRIPTION

[0119] Described below are example operations related to promoting security that may be performed when a user's virtual reality data is stored in a network system.

[0120] Below, some examples are explained with reference to devices that are generally capable of communicating via wireless cellular systems and mobile communication systems that serve such mobile communication devices. For the sake of brevity and clarity, such examples are described below with reference to 5G wireless communication systems. However, it should be understood that such examples are not limited to 5G wireless communication systems and can, for example, be applied to other wireless communication systems (e.g., current sixth generation (6G) proposals, IEEE 802.11, etc.).

[0121] Before describing the examples in detail, refer to Figures 1 to 3 Briefly explain some aspects of 5G wireless communication systems.

[0122] Figure 1 An example representation of a 5G system (5GS) 100 is shown. The 5GS may include a user equipment (UE) 102 (which may also be referred to as a communication device or terminal), a 5G access network (AN) (which may be a 5G radio access network (RAN) or any other type of 5G AN, such as a non-3GPP interworking function (N3IWF) / trusted non-3GPP gateway function (TNGF) for non-trusted / trusted non-3GPP access or a wired access gateway function (W-AGF) for wired access) 104, a 5G core (5GC) 106, one or more application functions (AFs) 108, and one or more data networks (DNs) 110. The UE may subscribe to receive at least one service from the AF. In order to help facilitate efficient delivery of user traffic for a service to the UE, the network may classify user traffic (e.g., Internet Protocol (IP) flows) into different service data flows (SDFs) with different quality of service (QoS) categories based on the type of service provided by the SDF. Different QoS rules may be applied to each SDF.

[0123] Figure 2An example of a control device for a communication system is shown, which is coupled to and / or used to control a station of an access system, such as a RAN node (e.g., a base station, gNB), a central unit of a cloud architecture or a node of a core network (such as an access and mobility management function (AMF) or a user plane function (UPF)), a scheduling entity (such as a spectrum management entity), or a server or host, such as a device hosting a network storage function (NRF), a network data analysis function (NWDAF), an AMF, a session management function (SMF), a unified data management / unified data repository (UDM / UDR), etc. The control device can be integrated with a node or module of the core network or RAN or external to it. In some examples, the base station includes a separate control device unit or module. In other examples, the control device can be other network elements, such as a radio network controller or a spectrum controller. The control device 200 can be arranged to provide control of communications in a service area of ​​the system. The device 200 includes at least one memory 201, at least one data processing unit 202, 203, and an input / output interface 204. Via the interface, the control device can be coupled to a receiver and a transmitter of the device. The receiver and / or transmitter may be implemented as a radio front end or a remote radio head. For example, the control device 200 or the processor 201 may be configured to execute appropriate software code to provide the control functionality. References herein to "code" are understood to refer to software code and vice versa.

[0124] An example wireless communication device will now be referred to Figure 3 is described in more detail, Figure 3A schematic partial cross-sectional view of a communication device 300 is shown. Such a communication device is generally referred to as a user equipment (UE) or terminal. Suitable mobile communication devices can be provided by any device capable of sending and receiving radio signals. Non-limiting examples include a mobile station (MS) or mobile device, such as a mobile phone or so-called "smart phone", a computer provided with a wireless interface card or other wireless interface facilities (e.g., a universal serial bus (USB) dongle), a personal data assistant (PDA) or a tablet computer provided with wireless communication capabilities, or a virtual reality device, an augmented reality device, a mixed reality device or other extended reality device, such as a virtual reality headset, or any combination of these, etc. The mobile communication device can provide, for example, communication of data for carrying communications (such as voice, e-mail (email), text messages, multimedia and extended reality media, etc.). Therefore, users can be supplied with a variety of services via their communication devices. Non-limiting examples of these services include two-way or multi-way calls, data communications or multimedia services, or simply access to a data communication network system (such as the Internet). Users can also be provided with broadcast or multicast data. Non-limiting examples of content include downloads, television and radio programs, videos, advertisements, various alarms and other information.

[0125] A wireless communication device may be, for example, a mobile device, i.e., a device that is not fixed to a particular location, or it may be a stationary device. A wireless device may communicate using human interaction, or may communicate without human interaction. As described herein, the term UE or "user" (more informally) may be used to refer to any type of wireless communication device.

[0126] The wireless device 300 may receive signals over the air or radio interface 307 via appropriate means for receiving, and may transmit signals via appropriate means for transmitting radio signals. Figure 3 In the wireless device, the transceiver arrangement is schematically represented by a block 306. The transceiver arrangement 306 may be provided, for example, by a radio part and an associated antenna arrangement. The antenna arrangement may be configured internally or externally to the wireless device.

[0127] The wireless device is typically provided with at least one data processing entity 301, at least one memory 302 and other possible components 303 for use in software code and hardware assistance in performing the tasks it is designed to perform, including control of access and communication with access systems and other communication devices. Data processing, storage and other related control means may be provided in appropriate circuit boards and / or chipsets. This feature is represented by reference numeral 304. The user may control the operation of the wireless device through an appropriate user interface, such as a keyboard 305, voice commands, a touch-sensitive screen or pad, a combination thereof, etc. A display or virtual reality headset / glasses 308, speakers and microphones may also be provided. In addition, the wireless communication device may include appropriate connectors (wired and / or wireless) to other devices and / or for connecting external accessories (e.g., hands-free devices) thereto.

[0128] 3GPP has released multiple versions (Rel) for defining operational communication protocols related to communication networks. Currently, goals and work related to Release 18 (Rel. 18) and Rel. 19 are being developed.

[0129] One of the study areas for Rel is contained in 3GPP TR 22.856, which involves feasibility studies on localized mobile Metaverse services.

[0130] In the context of telecommunications, Metaverse involves a highly interactive three-dimensional virtual domain where real-world conditions can be simulated by combining multiple Internet functions. It is a series of digitally enhanced worlds, realities, and business models. In Metaverse, people can use personal avatars to perform various activities, whether working or playing in an immersive digital environment. The term "Metaverse" covers a variety of location-independent service experiences, from workplace tools to games and community platforms. It generally refers to shared and immersive digital service experiences (i.e., mobile metaverse services) that people can experience by using extended reality (XR) devices.

[0131] To help facilitate such an environment, 3GPP TR 22.856 discusses the use of digital assets and digital asset containers.

[0132] Under the current 3GPP specification, a digital asset can be considered to be anything that is digitally stored and can be used to realize value. Examples of digital assets may include digital images (e.g., an avatar that digitally represents a user), cryptocurrencies, tokens (such as non-fungible tokens (NFTs)), purchased items, user identifiers (e.g., driver's license information and / or passport information), credit card information, etc.

[0133] Digital assets may be included in a digital asset container (DAC). Under current 3GPP specifications, a digital asset container may be considered a virtual container in which a user stores their digital assets. The digital asset container may be arranged to also allow for evidence that the data contained therein is associated with a specific user without leaking information (an element of proving identity without leaking personal data). When some of the information stored in the digital asset container (e.g., digital assets) has been authenticated upstream and encrypted, this information may be verified (such as an identifier).

[0134] To ensure a seamless user experience across virtual reality services, network operators can supply digital asset management services that allow users to verify certain information (such as IDs). These services support multiple user identities, each of which represents different aspects of the user's life, such as their professional role and private life. Therefore, each user identity can store its own set of information in an associated digital asset container, and the information can be managed differently based on the security requirements of the service. Since several different use cases for Metaverse have been considered, each use case can be associated with a different level of security for storage and / or access to digital access. For example, compared to information associated with virtual games, information associated with virtual banks requires a higher level of security in mobile communications due to the sensitive nature of the information.

[0135] For telecommunications applications, it is assumed that 5G systems (and beyond 5G) will support users to manage, store, and update information associated with users (e.g., to securely manage at least one digital asset included in a digital asset container), and will support the acquisition of such information from authorized third parties (or to authorized third parties via a request from an application platform). 5G systems may also be able to deploy mechanisms for verifying the authenticity of information in digital asset containers (or the like) associated with users, and prevent spoofing attacks on customers' digital asset containers.

[0136] For example, according to the use cases defined in Metaverse (3GPP TR 22.856), a digital asset container (DAC) (such as a digital wallet) can be maintained in the 5GC. In this "wallet", a user can store any information related to the user, such as credit card information, user identifiers, receipts, etc. More precisely, the 5G system can allow users to securely store and update information (digital assets) in the digital asset container, as well as authorize third parties to obtain information from the digital asset container associated with the user. In addition, preferably, only authorized third parties can obtain information from the DAC.

[0137] However, in 5G these concepts have not yet been defined, so these requirements cannot be implemented using current network mechanisms.

[0138] The following aims to address at least one of the above-mentioned problems in 3GPP systems (including 5G and above) by providing at least one mechanism for facilitating storage and management of digital assets.

[0139] Specifically, a new network function (NF), labeled as Digital Asset Container (DAC) NF in this article, is introduced below, which cooperates to achieve secure storage of information and authorization to obtain information.

[0140] There are many different ways that can be implemented in such a new DAC NF to facilitate DAC management. These at least refer to Figures 4 to 7 is shown.

[0141] The first example mechanism is about Figure 4 In this first example, the DAC Key Identity (DAC-KID) and the Metaverse Key (K Metaverse ) is generated using a plurality of user-specific parameter values ​​associated with the UE. For example, these user-specific parameter values ​​may include a key authentication server function (K AUSF ), Subscription Permanent Identifier (SUPI) and / or values ​​of other fixed parameters stored at the UE and / or Authentication Server Function (AUSF).

[0142] AUSF can store keys, DAC-KID and K at the Authentication and Key Management for Applications (AKMA) Anchor Function (AAnF). Metaverse DAC-KID and K Metaverse Generation may be controlled by using a "Metaverse Key Flag," which may hold a value indicating, for example, true or false. The value of the flag may be configured by an Operations and Management (OAM) entity and / or an operator.

[0143] The content that the UE wants to store in the 5GS is referred to herein as DAC content (and may correspond to digital assets included in the DAC). The DAC content may be stored by the UE using K Metaverse The DAC-KID is encrypted and sent to the DAC NF for storage along with the DAC-KID.

[0144] The UE connects to the Metaverse AF and provides the DAC-KID to the Metaverse AF. The Metaverse AF can be considered as an application function (AF) that interacts with the 3GPP core network to provide at least one service to the users / clients of the Metaverse AF. When the Metaverse AF subsequently signals an information request to the DAC NF using the DAC-KID, the encrypted DAC content will be shared with the Metaverse AF. In addition, the Metaverse AF can use the DAC-KID to obtain KMetaverse from the AAnF to decrypt the DAC content.

[0145] In this example, the 5GS has control of both key generation and DAC storage, albeit at different entities. By default, the DAC NF does not obtain keys from the anchor function.

[0146] This process refers to Figure 4 was explained.

[0147] Figure 4 Signaling that may be performed between UE 401, AUSF 402, AAnF and / or UDM 403, DAC NF 404, and MetaverseAF 405 is shown.

[0148] During 4001, it is assumed that the Metaverse Key Flag is set to true to indicate that the DAC-KID and K Metaverse will be generated. If the Metaverse key flag has been set to false, K Metaverse and DAC-KID is not generated.

[0149] During 4002, UE 401 and AUSF 402 exchange signaling. The signaling may be used to perform an authentication operation (eg, a primary authentication operation) between UE 401 and AUSF 402. The authentication operation may result in each of UE 401 and AUSF 402 generating an authentication key KAUSF.

[0150] During 4003, each of UE 401 and AUSF 402 generates a DAC key ID (DAC-KID) and a Metaverse key (K Metaverse ). These keys may be generated based on the value of at least one parameter stored at the UE and the AUSF for the UE's subscriber. For example, these keys may be generated at the UE and the AUSF using K AUSF , SUPI and / or other parameters are generated.

[0151] exist Figure 4In the example, at least one of the following parameters may be used to AUSF Get K Metaverse The input S in the key derivation function is formed when:

[0152] -fc=0xwx;

[0153] -P0="METAVERSE";

[0154] -L0 = length of "METAVERSE"; (i.e. 0x00 0x09)

[0155] -P1=SUPI;

[0156] - L1 = length of SUPI.

[0157] In addition, when deriving K Metaverse When the input key KEY to the key derivation function can be K AUSF .

[0158] In addition, DAC-KID can AUSF , SUPI, and an indication of the DAC key to be generated are input into a key derivation function that outputs a DAC-ID. The DAC-KID may then be generated to reflect two function parts: a username part (comprising the DAC-ID generated by the key derivation function and a routing indicator (RID), the routing indicator being an identifier obtained from the signaling from the UDM to the AUSF and currently defined in TS 33.535) and a realm part (e.g., a home network identifier or some other domain identifier indicating the home domain of the UE 401).

[0159] When from K AUSF When deriving a DAC key ID (DAC-KID), at least one of the following parameters may be used to form the input S to the key derivation function:

[0160] -fc=0xxy;

[0161] -P0="DAC";

[0162] -L0 = length of "DAC"; (i.e. 0x00 0x03)

[0163] -P1=SUPI;

[0164] - L1 = length of SUPI.

[0165] In addition, when deriving the DAC-KID, the input key KEY to the key derivation function can be K AUSF .

[0166] During 4004, AUSF 402 exchanges signaling with AAnF 403. The signaling may include DAC-KID and K Metaverse The signaling may include an anchor key registration request from the AUSF 402 to the AAnF 403 , and an anchor key response from the AAnF 403 to the AUSF 402 .

[0167] During 4005, the UE determines to use K Metaverse Encrypt the DAC contents and perform the encryption.

[0168] During 4006, UE 401 signals DAC NF 404. The signaling may include encrypted DAC content. The signaling may include DAC-KID. The signaling may include a request to store the encrypted DAC content. The signaling may be performed in any of a number of different ways (e.g., via non-access stratum (NAS) signaling, and / or via a user plane (e.g., via an application function)).

[0169] During 4007, the DAC NF 404 stores the encrypted DAC content using the DAC-KID.

[0170] During 4008, the DAC NF 404 signals to the UE 401. The signaling may include an indication that the request to store the encrypted DAC content has been successful.

[0171] During 4009, the Metaverse key flag is set to false. The Metaverse key flag may be set to false in response to execution of 4008. In other words, in response to DAC NF 404 signaling to UE 401 an indication that the request to store encrypted DAC content has been successful, the Metaverse key flag may be set to false.

[0172] During 4010, UE 401 signals Metaverse AF 405. The signaling may include a request to establish a session. The signaling may include a DAC-KID.

[0173] During 4011, Metaverse AF 405 and DAC NF 404 exchange signaling. The signaling may be used to establish that Metaverse AF 405 is authorized to obtain DAC information about UE from DAC NF 404. The signaling may be used to establish that Metaverse AF 405 is authorized to obtain DAC information about UE 401 from DAC NF 404. The signaling may include Metaverse AF 405 signaling a DAC-KID to DAC NF 404.

[0174] Assuming that Metaverse AF 405 is authorized to obtain data related to UE 401, the signaling can enable Metaverse AF 405 to obtain the encrypted DAC content stored in DAC NF 404 after DAC NF 404 has been able to determine that the provided DAC-KID from Metaverse 405 is stored in DAC NF 404 together with the associated encrypted DAC content.

[0175] During 4012, Metaverse AF 405 and AAnF 403 exchange signaling. The signaling enables Metaverse AF 405 to obtain K from AAnF 403 after Metaverse AF 405 signals DAC-KID to AAnF 403. Metaverse Metaverse AF 405 can use the obtained K Metaverse Metaverse AF 405 may use the decrypted DAC content for any service provided by Metaverse AF 405 to UE 401 (e.g., for obtaining at least one of the following: user identity documents, avatars for gaming applications, etc.).

[0176] During 4013, UE 401 and AUSF 402 exchange signaling to re-authenticate each other.

[0177] Since the Metaverse Key Flag is currently set to FALSE, during 4014, UE 401 and AUSF 402 abandon generating Metaverse keys and / or DAC-KID.

[0178] In other words, when the Metaverse Key Flag is disabled, a new DAC-KID or key K Metaverse will not be generated. This flag can be dynamically enabled or disabled based on the user's requirement to upload all new documents in DAC. When the "Metaverse Key Flag" is enabled, a new DAC-KID or key K will be generated for each re-authentication. Metaverse will be generated. This flag is a configuration parameter that can be enabled or disabled dynamically.

[0179] exist Figure 4 In the first example, since the first AKMA-based key is used, there is no freshness, so the DAC-KID will be the same.

[0180] Figure 5 A second example mechanism is shown, where the key "freshness" is relative to Figure 4In this context, key "freshness" relates to the novelty of a key, with more recently generated keys being considered "fresher" than earlier generated keys. In other words, more recently generated keys are fresher than older generated keys.

[0181] exist Figure 5 In the example of , new encryption keys at the UE and the network are generated based on the long-term key (K) and the value of a random number or counter. The long-term key (K) can be regarded as a symmetric key for a specific user. In 3GPP, long-term keys are defined in TS 33.501 and are symmetric keys stored in the Universal Subscriber Identity Module (USIM) and / or UDM for a specific user. The long-term key is stored in a secure environment and is used after the primary authentication to derive all key hierarchies.

[0182] The UE encrypts the DAC content using the generated new encryption key and stores the encrypted DAC content using 5GC (e.g., via DAC NF). The AF can then use the network open function to obtain the encrypted DAC content from the DAC NF using the Metaverse UE context. For example, the Metaverse UE context can be based on an identifier, such as a Global Public User Identifier (GPSI), a tag ID (= passport), a document ID (1 or 2...), etc. Since the content will be encrypted, the AF can obtain a decryption key (e.g., from the AUSF) to decrypt the DAC content. In addition, the DAC NF can store user documents (e.g., DAC content) in a manner that maintains a mapping between the document identifier / TAG ID and the document information so that the information can be used to obtain at least one specific document / DAC content.

[0183] These procedures refer to Figure 5 is shown.

[0184] Figure 5 Signaling that may be performed between UE 501, authentication function 502, DAC NF 503, network opening function (NEF) 504, and Metaverse AF 505 is shown.

[0185] During 5001, UE 501 and AUSF 502 perform a primary authentication mechanism for mutual authentication. It will be appreciated that any primary authentication mechanism may be used (similar to any other references to primary authentication herein). Example primary authentication mechanisms mentioned in 3GPP TS 33.501 include 5G Authentication and Key Agreement (AKA) and / or Extensible Authentication Protocol (EAP) AKA.

[0186] During 5002, UE 501 generates K Metaverse This can be done by passing the long-term key Klong , a counter value (or a random value), and a subscriber-specific parameter (e.g., SUPI) are input into a key derivation function, which uses these inputs to output K Metaverse .

[0187] For example, when k long Get K Metaverse At least one of the following parameters may be used to form the input S to the KDF:

[0188] -fc=0xwx;

[0189] -P0="METAVERSE";

[0190] -L0 = length of "METAVERSE"; (i.e. 0x00 0x09)

[0191] -P1=SUPI;

[0192] - L1 = length of SUPI.

[0193] - P2 = COUNTER value or RAND;

[0194] - L1 = length of Counter or length of RAND.

[0195] To derive K Metaverse The input key KEY can be K long The initial value of P2 may be zero, and the value of P2 may be changed for each subsequent K Metaverse The generation of is changed (e.g., incremented by one).

[0196] In the case where the 5G network is configured to generate K Metaverse Afterwards, the UE can determine the generated K Metaverse For example, when the UE subscribes to the DAC service, the network may signal an indication to the UE to generate K Metaverse The indication may be sent to the UE via a UE Parameter Update (UPU) command procedure and / or a UE Configuration Update (UCU) command procedure.

[0197] During 5003, UE 501 uses the generated K Metaverse To encrypt DAC content.

[0198] During 5004, UE 501 sends a signal to DAC NF. The signaling may include a request to store the encrypted DAC content. The signaling may include the encrypted DAC content. The signaling may include the value of P2 mentioned above (e.g., for deriving K Metaverse counter or random value).

[0199] During 5005, the DAC NF 503 stores the received encrypted DAC content and the received P2 value.

[0200] During 5006, the DAC NF 503 signals to the UE 501. The signaling may indicate that the encrypted DAC content has been successfully stored.

[0201] During 5007, UE 501 signals to Metaverse AF 505. The signaling may include a session establishment request.

[0202] During 5008, Metaverse AF 505 signals DAC NF 503. The signaling may include a request for encrypted DAC information. The signaling may include an indication of a user identifier (e.g., a GPSI, such as a phone number), an indication of a tag ID (e.g., indicating a type of document, such as a passport), and / or a document number (e.g., when multiple documents of the same type are stored for a user, then a value (e.g., 1 or 2) may be used to distinguish them). The request for encrypted DAC information may include information identifying the encrypted DAC. The information identifying the encrypted DAC may be received from the UE (e.g., during the request of 5007 or during some other time).

[0203] During 5009, the DAC NF 503 signals the Metaverse AF 505. The signaling may include the encrypted DAC information associated with the tag ID and / or document number indicated during 5008. The signaling may include the encrypted DAC information used to derive the K Metaverse The P1 value (e.g., a counter value or a RAND value) of

[0204] During 5010, Metaverse AF 505 signals Authentication Function 502 to request K Metaverse The signaling may include the P1 value received during 5009. The signaling may include an identifier of the subscriber (eg, GPSI).

[0205] During 5011, the authentication function generates K Metaverse This operation may be similar to the operation performed during 5002. The authentication function may convert the GPSI to the SUPI by signaling a request for the SUPI to the unified data management entity including the GPSI.

[0206] During 5012, the authentication function 502 signals to the Metaverse AF 505. The signaling may include K Metaverse .

[0207] During 5013, Metaverse AF 505 uses the received K of 5012 Metaverse to decrypt the encrypted DAC received during 5009. Metaverse AF 505 may use the decrypted DAC content for any service provided by Metaverse AF 505 to UE 501 (e.g., for obtaining at least one of the following: user identity documents, avatars for gaming applications, etc.).

[0208] Figure 6 Another (third) example mechanism for facilitating storage and / or retrieval of digital assets in a 3GPP system is shown.

[0209] Figure 6 The signaling that can be performed between UE 601, radio access network (RAN) 602, authentication function 603, DAC NF 604, user plane function (UPF) 605, external AF 606, and Metaverse AF 607 is shown. External AF 606 and Metaverse AF 607 can be located outside the 5G network (e.g., over the Internet). RAN 602, authentication function 603, DACNF 604, and UPF 605 can be located in 5GS.

[0210] During 6001, the DAC NF 604 maintains a plurality of digital documents (eg, digital assets) stored in a digital asset container (DAC), wherein each digital document is associated with a list of authorized Metaverse AFs that are allowed to obtain information from the DAC.

[0211] During 6002, UE 601 and authentication function 603 perform primary authentication. During 6002, UE 601 and authentication function 603 may each generate K AUSF and K Metaverse . K Metaverse You can follow the above Figure 4 and Figure 5 A description of any one of the items is generated.

[0212] During 6003, the authentication function 603 signals to the DAC NF 604. This signaling may provide the DAC NF 604 with the generated K Metaverse .

[0213] During 6004, UE 601 signals to RAN 602. The signaling may send an encrypted digital file (e.g., using K Metaverse as a digital document encrypted with an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document.

[0214] During 6005, RAN 602 signals to UPF 605. The signaling may send an encrypted digital document (e.g., using K Metaverse as a digital document encrypted with an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document.

[0215] During 6006, UPF 605 signals External AF 606. The signaling may send an encrypted digital document (e.g., using K Metaverse as a digital document encrypted with an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document.

[0216] During 6007, the external AF 606 signals the DAC NF 604. The signaling may send an encrypted digital document (e.g., using K Metaverse as a digital document encrypted with an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document.

[0217] During 6008, the DAC NF 604 uses the previously received K Metaverse Decrypts a digital document sent to it. The DACNF can use the document details (label, number, etc.) input into a key derivation function known only to the DAC-NF to generate a new key, encrypt the digital document using that new key, and securely store the newly encrypted digital document. The use of this new key means that K Metaverse Can be deleted by DAC NF 604 after the operation of 6008.

[0218] During 6009, the DAC NF 604 signals a response signal to the external AF 606. The response may include an indication that the encrypted digital document has been stored by the DAC NF.

[0219] During 6010, the external AF 606 sends a signal to the UE 601. The signaling confirms that the digital document has been sent.

[0220] During 6011, Metaverse AF 607 signals DAC NF 604. The signaling may request at least one digital document. The signaling may identify at least one digital document by providing document details (e.g., label, number, etc.). The signaling may include a public key (or an indication thereof) of Metaverse AF 607. The signaling may be provided directly or indirectly (e.g., via NEF).

[0221] During 6012, the DAC NF 604 authenticates the Metaverse AF 607 authorization for the stored digital document(s) corresponding to at least one of the requested digital documents, regenerates a new key using the document details (e.g., label, number, etc.), uses it to decrypt the stored digital document, and then encrypts the decrypted stored digital document using the public key of the Metaverse AF.

[0222] During 6013, DAC NF 604 signals Metaverse AF 607. The signaling may include digital document(s) encrypted using Metaverse AF 607's public key.

[0223] During 6014, Metaverse AF 607 decrypts the received digital document(s) using the Metaverse AF's private key. Metaverse AF 607 may use the decrypted DAC content for any service provided by Metaverse AF 607 to UE 601 (e.g., for obtaining at least one of: a user identity document, an avatar for a gaming application, etc.).

[0224] exist Figure 6 In the example, a key is created for each document, each document is tagged with a name (e.g., tag=PersonalCard1) and a document number, and the document data (e.g., card number and other credit / debit card details) is encrypted using the key.

[0225] After the digital document is encrypted at the DAC-NF using the key, the key used at the DAC-NF does not have to be stored at the DAC-NF as it can be regenerated at any time using the document details (e.g., label, number, etc.) and a predefined KDF known only to the DAC-NF.

[0226] Figure 7 Another (fourth) example mechanism for facilitating storage and / or retrieval of digital asset data is shown.

[0227] Figure 7 The signaling that can be performed between UE 701, radio access network (RAN) 702, authentication function 703, DAC NF 704, user plane function (UPF) 705, external AF 706, and Metaverse AF 707 is shown. External AF 706 and Metaverse AF 707 can be located outside the 5G network (e.g., on the Internet). RAN 702, authentication function 703, DACNF 704, and UPF 705 can be located in 5GS.

[0228] During 7001, UE 701 and authentication function 703 perform primary authentication. During this process, K AUSF and DAC-KID can be generated by each device.

[0229] During 7002, the UE 701 generates a unique key, which is used to encrypt a digital document. Key generation may be performed by the UE to obtain a new key for each document. The UE may perform key generation to obtain the same key for multiple documents stored in the 5G-DAC NF.

[0230] During 7003, UE 701 signals to external AF 706. The signaling may send an encrypted digital document (e.g., a digital document encrypted using a unique key as an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document. The signaling may include a DAC-KID.

[0231] During 7004, the external AF 706 signals the DAC NF 704. The signaling may send an encrypted digital document (e.g., a digital document encrypted using a unique key as an encryption key) and a list of authorized application functions, tag identifiers, and document numbers for each digital document. The signaling may include a DAC-KID.

[0232] During 7005, the DAC NF 704 stores the encrypted digital document(s) received during 7004 using detailed information tags including a tag and a document number for each encrypted digital document.

[0233] During 7006, the DAC NF 704 signals the external AF 706. The signaling may indicate that the encrypted digital document(s) of 7004 have been successfully stored in the DAC NF 704.

[0234] During 7007, the external AF 706 signals to the UE 701. The signaling may indicate that the encrypted digital document(s) of 7003 have been successfully stored in the DAC NF 704.

[0235] During 7008, the UE securely shares the unique key corresponding to the document with the detail tag and document number with the Metaverse AF 707 in accordance with any security procedures. The Metaverse AF 707 may be provided with an indication of the tag(s) and document number(s) of the digital document(s) stored at the DAC NF 704.

[0236] During 7009, Metaverse AF 707 signals DAC NF 704. The signaling may include a request to obtain at least one digital document associated with a specific document tag and a document number. The signaling may include the specific document tag and the document number. The signaling may include a DAC-KID.

[0237] During 7010, DAC NF 704 signals Metaverse AF 707. The signaling may include at least one digital file requested during 7009.

[0238] During 7011, Metaverse AF 707 decrypts at least one digital document received during 7010 using a unique key previously received from the UE. Metaverse AF 707 may use the decrypted DAC content for any service provided by Metaverse AF 707 to UE 701 (e.g., for obtaining at least one of the following: a user identity document, an avatar for a gaming application, etc.).

[0239] use Figure 7 In this way, 5GC cannot determine the unencrypted form of the content of the digital document.

[0240] In addition, if UE 701 updates (e.g., updates to a new value) a unique key associated with the digital document, the UE may re-encrypt the DAC content using the updated unique key, send the re-encrypted content to the DAC-NF and share the new key with the Metaverse AF.

[0241] Figures 8 to 11 It shows that it can be Figure 4 and / or operations performed by at least one of the devices in 5. Therefore, it is understood that the features found below can find functional equivalents in at least one of the above features with respect to these figures. In addition, it is understood that Figure 4 Features of and / or 5 may be used to illustrate how the presently described technology can be implemented in a technical system.

[0242] Figure 8 Operations that may be performed by an apparatus for a user device are shown. The apparatus for a user device may include a user device. The apparatus for a user device may include an entity authorized to perform functions on behalf of the user device (eg, a client application deployed remotely from the user device).

[0243] During 801, the device encrypts a digital asset using a first key to form an encrypted digital asset. The first key may include K Metaverse .

[0244] During 802, the device provides an encrypted digital asset and an index for the encrypted digital asset to a first network function. The first network function may be a DAC network function. The first network function may be Figures 9 to 11 As further described below, the index may include a counter value, a random value, and / or a key identifier (eg, DAC-KID).

[0245] During 803, the apparatus provides an identification of the encrypted digital asset to a first entity. The first entity may include a metaverse application function. The first entity may include a trusted application function, an untrusted application function, and / or a network function. The first entity may be Figures 9 to 11 The first entity of any of the items. The digital asset may include DAC content.

[0246] Providing identification of the encrypted digital asset may include providing a first identifier and at least one document identifier to the first entity for identifying a document included in the encrypted digital asset.

[0247] The first identifier may comprise a subscriber identifier.The first identifier may comprise a global public subscriber identifier.

[0248] The apparatus may generate the first identifier by inputting the authentication key into a second key derivation function, and combining an output of the second key derivation function with an identifier of a user of the user device to form the first identifier. The first identifier may include a key identifier, such as a DAC-KID.

[0249] The combining may include combining the output of the second key derivation function with an identifier of the user and an identifier of the administrative domain with which the user is registered.

[0250] The apparatus may, prior to the inputting, determine that a flag has been set to indicate that the first identifier is to be generated by inputting an authentication key into a first key derivation function.

[0251] The device may generate the first key by inputting the third key into the first key derivation function. The third key may include a key derived and / or determined during the main authentication process (e.g., K AUSF ) and / or a key derived and / or determined prior to the main authentication process (e.g., a long-term key as above).

[0252] Generating may further comprise inputting a random value and / or a counter value into the first key derivation function.

[0253] Providing the identification may include providing the identification with the session establishment request.

[0254] The identification may include an index.

[0255] Fig. 9 Operations that may be performed by an apparatus for a first network function are shown. The first network function may be Figure 8 and / or Figure 10 to Figure 11 The first network function may include a DAC NF.

[0256] During 901, the device receives an encrypted digital asset and an index for the encrypted digital asset. The digital asset and index may be as described above with respect to Figure 8 described.

[0257] During 902, the device receives a request for an encrypted digital asset from a first entity. The first entity may be as described in relation to Figure 8 and / or Figure 10 to Figure 11 Any one of the items described in .

[0258] During 903, the device provides the encrypted digital asset and the index to the first entity.

[0259] Prior to providing the encrypted digital asset to the first entity, the device may determine that the first entity is authorized to receive the encrypted digital asset.

[0260] Fig.10 Operations that may be performed by an apparatus for a first entity are shown. The first entity may be Figures 8 to 9 and / or a first entity of any one of 11. The first entity may include a metaverse AF. The first entity may include a metaverse application function. The first entity may include a trusted application function, an untrusted application function and / or a network function.

[0261] During 1001, the apparatus receives an identification of an encrypted digital asset from a user device. The digital asset may be as described above with respect to Figure 8 The user equipment may be as described above with respect to Figure 8 described.

[0262] During 1002, the device obtains an encrypted digital asset from a first network function. The first network function may be as described above with respect to Figures 8 to 9 Any one of the items described in .

[0263] During 1003, the apparatus receives an index of digital assets for encryption from a user device or a first network function. The index may be as described above with respect to Figure 8 described.

[0264] During 1004, the device uses the index and identification of the encrypted digital asset to obtain a first decryption key from an authentication function. The authentication function may be as described below with respect to Fig.11 described.

[0265] During 1005, the device decrypts the encrypted digital asset.

[0266] Fig.11 The operations that may be performed by the device for the authentication function are shown. The authentication function may be as described in relation to Fig.10 The authentication function may include a method for communicating with Figure 8 The entity that performs primary authentication on a user equipment device.

[0267] During 1101, the apparatus receives a request from a first entity for a first decryption key for decrypting an encrypted digital asset, the request including an index for the encrypted digital asset. The first entity may Fig.10 The digital index and digital assets may be as described in Figures 8 to 10 Any one of the above.

[0268] During 1102, the device obtains a decryption key using the index.

[0269] During 1103, the device provides a decryption key to the first entity.

[0270] Obtaining the decryption key may include generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

[0271] Obtaining the decryption key may include retrieving a previously generated decryption key using the received value of the index and an identification of the encrypted digital asset.

[0272] exist Figures 8 to 11 In the above examples, the index may include a random value, a counter value, a key, and / or a key identifier (eg, DAC-KID).

[0273] It should be understood that the references to various network functions (e.g., AMF, SMF, etc.) above may include devices that perform at least some functions associated with those network functions. In addition, the device including the network function may include a virtual network function instance of the network function.

[0274] The foregoing description has provided a complete and informative description of some examples by way of non-limiting examples. However, various modifications and adaptations may become apparent to those skilled in the relevant art when read in conjunction with the accompanying drawings and claims. However, all such and similar teaching modifications will still fall within the scope of the examples described herein.

[0275] In the above, as examples of access architectures to which the technology can be applied, different examples are described using radio access architectures based on Long Term Evolution Advanced (Long Term Evolution (LTE) Advanced, LTE-A) or New Radio (NR, 5G), but there is no need to limit the examples to such architectures. By appropriately adjusting the parameters and procedures, the examples can also be applied to other types of communication networks with suitable components. Some examples of other options for suitable systems are Universal Mobile Telecommunications System (UMTS) Radio Access Network (UTRAN), Wireless Local Area Network (WLAN or Wi-Fi), Worldwide Interoperability for Microwave Access (WiMAX), Personal Communications Service (PCS), Wideband Code Division Multiple Access (WCDMA), systems using Ultra-Wideband (UWB) technology, sensor networks, mobile ad hoc networks (MANET) Internet Protocol Multimedia Subsystem (IMS), and anticipated 6G systems or any combination thereof.

[0276] As described herein, various examples are described in the detailed description. In general, some examples may be implemented in hardware or dedicated circuits, software code, logic, or any combination thereof. For example, some examples may be implemented in hardware, while other examples may be implemented in firmware or software code, which may be executed by a controller, microprocessor, or other computing device, although the examples are not limited thereto. Although various examples may be shown and described in block diagrams, flow charts, or using other graphical representations, it is fully understood that, as non-limiting examples, these boxes, devices, systems, techniques, or methods described herein may be implemented in hardware, software code, firmware code, dedicated circuits or logic, general hardware or controllers or other computing devices, or combinations thereof.

[0277] These examples may be implemented by computer software code stored in a memory and executable by at least one data processor of the entity involved, or by hardware, or by a combination of software code and hardware.

[0278] The memory referred to herein may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory.

[0279] The (data) processor referred to in this document may be of any type suitable for the local technical environment, and may include, as non-limiting examples, one or more of the following: a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an FPGA, a gate-level circuit, and a processor based on a multi-core processor architecture.

[0280] Furthermore, in this context, it should be noted that any process, e.g. Figure 8 , Fig. 9 , Fig.10 , Fig.11 And / or as described above, it can represent the operation of a computer program deployed by at least one processor included in the device (where the computer program includes instructions for causing the device to perform at least one action, which instructions are represented as software codes stored on at least one memory), or interconnected logic circuits, boxes and functions, or a combination of the operation of a computer program deployed by at least one processor and logic circuits, boxes and functions included in the device. The software code can be stored on a memory, such as a physical medium, such as a memory chip or memory block implemented in a processor, a magnetic medium (such as a hard disk or floppy disk), and an optical medium (such as, for example, a DVD and its data variant CD, etc.).

[0281] The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor may be of any type suitable for the local technical environment and may include, as non-limiting examples, one or more of the following: a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a gate-level circuit, and a processor based on a multi-core processor architecture.

[0282] Additionally or alternatively, some examples may be implemented using a circuit system. The circuit system may be configured to perform one or more of the previously described functions and / or method steps. The circuit system may be provided in a base station and / or a communication device and / or a core network entity.

[0283] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0284] (a) hardware circuit implementation only (e.g., implementation only in analog and / or digital circuitry);

[0285] (b) A combination of hardware circuits and software circuits, such as:

[0286] (i) a combination of analog and / or digital hardware circuits and software / firmware code and

[0287] (ii) any portion of hardware processor(s) (including digital signal processor(s)) with software code, software code and memory(s) that work together to enable an apparatus (such as a communication device or base station) to perform the various functions previously described; and

[0288] (c) Hardware circuits and / or processor(s), such as microprocessor(s) or portions of microprocessor(s), require software code (e.g., firmware) to operate, but the software code may not be present when the software code is not required for operation.

[0289] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used herein, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware code. The term circuitry also covers, for example, an integrated device.

[0290] Implementations of the present disclosure may be practiced in various components, such as integrated circuit modules. The design of integrated circuits is generally a highly automated process. Complex and powerful software tools are available to convert a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate.

[0291] As used herein, “at least one of: ” and “at least one of ” and similar expressions, where a list of two or more elements is connected by “and” or “or”, mean at least any one element, or at least two or more elements, or at least all elements.

[0292] As used herein, the term "non-transitory" is a limitation on the medium itself (ie, tangible, not a signal), not on data storage persistence (eg, RAM vs. ROM).

[0293] The scope of protection sought by various examples of the present disclosure is defined by the independent claims. Examples and features described in this specification that do not belong to the scope of the independent claims (if any) should be interpreted as examples that help understand the present disclosure.

[0294] The foregoing description has provided a complete and informative description of example implementations of the present disclosure by way of non-limiting examples. However, various modifications and adaptations may become apparent to those skilled in the relevant art when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications taught by the present disclosure will still fall within the scope of the examples described herein. In fact, there is another implementation including a combination of one or more examples with any of the other examples described herein.

Claims

1. An apparatus for a user equipment, the apparatus comprising means for performing the following: encrypting the digital asset using the first key to form an encrypted digital asset; providing the encrypted digital asset and an index for the encrypted digital asset to a first network function; as well as An identification of the encrypted digital asset is provided to the first entity.

2. The apparatus of claim 1, wherein the means for providing the identification of the encrypted digital asset comprises: Means for providing the first identifier and at least one document identifier to the first entity, the at least one document identifier for identifying a document included in the encrypted digital asset. The apparatus of claim 2 , wherein the first identifier comprises a subscriber identifier. The apparatus of claim 3 , wherein the first identifier comprises a global public subscriber identifier.

5. The apparatus according to any one of claims 2 to 3, comprising means for generating the first identifier by: inputting the authentication key into a second key derivation function; and An output of the second key derivation function is combined with an identifier of a user of the user device to form the first identifier.

6. The device according to claim 5, wherein the means for combining comprises: Means for combining said output of said second key derivation function with said identifier of said user and an identifier of an administrative domain with which said user is registered.

7. The apparatus according to any one of claims 5 to 6, comprising means for performing the following: Prior to said inputting, a determination flag has been set to indicate that said first identifier is to be generated by inputting said authentication key into said first key derivation function.

8. An apparatus according to any preceding claim, comprising means for performing: The first key is generated by inputting a third key into a first key derivation function.

9. The apparatus according to claim 8, wherein the generating means further comprises: A random value and / or a counter value is input to the first key derivation function.

10. Apparatus according to any preceding claim, wherein said means for providing said identification comprises: Means for providing said identification together with a session establishment request.

11. An apparatus according to any preceding claim, wherein the identification comprises the index.

12. An apparatus for a first network function, the apparatus comprising means for performing: Receiving an encrypted digital asset and an index for the encrypted digital asset; receiving a request for the encrypted digital asset from a first entity; as well as The encrypted digital asset and the index are provided to the first entity.

13. The apparatus of claim 12, comprising means for performing: Prior to providing the encrypted digital asset to the first entity, it is determined that the first entity is authorized to receive the encrypted digital asset.

14. An apparatus for a first entity, the apparatus comprising means for performing: receiving an identification of an encrypted digital asset from a user device; obtaining the encrypted digital asset from the first network function; receiving, from the user device or the first network function, an index for the encrypted digital asset; obtaining a first decryption key from an authentication function using the index of the encrypted digital asset and the identification; as well as Decrypting the encrypted digital asset.

15. An apparatus for authentication functionality, the apparatus comprising means for performing the following: receiving a request from a first entity for a first decryption key for decrypting an encrypted digital asset, the request including an index for the encrypted digital asset; using the index to obtain the decryption key; and The decryption key is provided to the first entity.

16. The apparatus of claim 15, wherein the means for obtaining the decryption key comprises: Means for generating the decryption key using the received value of the index and an identification of the encrypted digital asset.

17. The apparatus of claim 15, wherein the means for obtaining the decryption key comprises: Means for obtaining a previously generated decryption key using the received value of the index and the identification of the encrypted digital asset.

18. An apparatus according to any preceding claim, wherein the index comprises a random value, a counter value and / or a key.

Images