Application programming interface access in communication network

Abstract

The communication device (16) is configured to invoke an application programming interface (API) (14) to access a service. The communication device (16) transmits a request (18) to invoke the API (14) from the communication device (16) to an API open device (12), the API open device (12) being configured to open the API (14). The communication device (16) also transmits an access token (20) from the communication device (16) to the API open device (12), the access token indicating whether the resource owner (24) agrees (26) the communication device (16) to access the protected resource (22) of the API (14). The API open device (12) may validate the request (18) based on the access token (20), e.g., by validating the request (18) against one or more declarations in the access token (20). Then, depending on the verification, the API open device (12) may accept or reject the request (18).

Description

Technical Field

[0001] The present disclosure relates generally to communication networks, and more particularly to access to application programming interfaces in such networks. Background Art

[0002] The next generation (5G) core network (CN) uses a service-based architecture that utilizes service-based interactions between CN network functions (NFs). In this regard, an NF enables other authorized NFs to access services provided by the NF via a service application programming interface (API). This service API thus serves as an interface through which a component of a communication network (e.g., NF) exposes its services, for example, by abstracting the services from the underlying mechanisms. When a service API is exposed to a higher-level entity for invocation, the service API is referred to as a northbound API.

[0003] In case there are multiple APIs, for example for different services, a so-called Common API Framework (CAPIF) contains common aspects that apply to any of the multiple APIs. CAPIF avoids duplication and inconsistencies between different APIs.

[0004] However, when some resources of the API are protected, challenges exist during calls to the API, for example, via CAPIF. For example, some objects or components of the API (such as the user's location) may be protected from unauthorized access, for example, in order to protect the user's privacy. In these and other cases, access to the protected resources of the API may be allowed only if the owner of the resource agrees. Resource owner consent as a prerequisite for resource access complicates API calls, making it challenging to call the API to access protected resources in an efficient manner from a signaling and processing perspective. Summary of the invention

[0005] Some embodiments herein utilize an access token to indicate whether a resource owner consents to a communication device accessing protected resources of an application programming interface (API), for example, in addition to the access token indicating whether the communication device is authorized to access the API. In this case, the communication device may provide an access token along with its request to access the API. Other embodiments herein incorporate the retrieval of a user consent parameter into the API call process. Either way, if the access token or user consent parameter indicates that the resource owner has not yet consented to the communication device accessing the protected resources, the steps for authorizing the communication device to access the API can be effectively avoided or aborted. By utilizing access tokens or user consent parameters in this manner, some embodiments herein provide a way to call an API to access protected resources in an efficient manner from a signaling and processing perspective.

[0006] More specifically, embodiments herein include a method performed by a communication device configured to call an application programming interface (API) to access a service. The method includes transmitting a request to call the API from the communication device to an API open device configured to open the API. The method also includes transmitting an access token from the communication device to the API open device, the access token indicating whether a resource owner agrees that the communication device can access protected resources of the API.

[0007] In some embodiments, an access token is included in the request.

[0008] In some embodiments, transmitting the request and the access token includes transmitting a message including both the request and the access token to the API open device.

[0009] In some embodiments, transmitting the access token includes transmitting the access token to the API-opening device before or simultaneously with transmitting the request to the API-opening device.

[0010] In some embodiments, the access token includes consent information, which declares that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. In one or more of these embodiments, the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API.

[0011] In some embodiments, the access token is an OAuth 2.0 access token.

[0012] In some embodiments, the API is a northbound API.

[0013] In some embodiments, the communications device is user equipment.

[0014] In some embodiments, the resource owner is a user of the communication device.

[0015] In some embodiments, the communication device is a network device implementing application function AF.

[0016] In some embodiments, the access token also asserts that the communications device is authorized to access the API.

[0017] In some embodiments, the method further comprises performing the steps described above.

[0018] Other embodiments herein include a method performed by a communication device configured to call an application programming interface API to access a service. The method includes transmitting a request for an access token from the communication device to a public API core device. The method also includes receiving an access token in response to the request, the access token indicating whether a resource owner consents to the communication device accessing a protected resource of the API.

[0019] In some embodiments, the access token includes consent information, which declares that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. In one or more of these embodiments, the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API.

[0020] In some embodiments, the access token is an OAuth 2.0 access token.

[0021] In some embodiments, the API is a northbound API.

[0022] In some embodiments, the communications device is user equipment.

[0023] In some embodiments, the resource owner is a user of the communication device.

[0024] In some embodiments, the communication device is a network device implementing application function AF.

[0025] In some embodiments, the access token also asserts that the communications device is authorized to access the API.

[0026] In some embodiments, the method further includes: transmitting an authorization request to the public API core device before transmitting the request for the access token. The method further includes: receiving an authorization code in response to the authorization request before transmitting the request for the access token, the authorization code being a credential representing the authorization of the resource owner. In some embodiments, the request for the access token includes the authorization code.

[0027] In some embodiments, the public API core device implements the CAPIF core functionality.

[0028] In some embodiments, the method further comprises performing the steps described above.

[0029] Other embodiments herein include a method performed by an application programming interface (API) opening device, the API opening device being configured to open the API to a communication device. The method includes receiving a request to call the API from the communication device. The method also includes receiving an access token from the communication device, the access token indicating whether a resource owner agrees that the communication device accesses a protected resource of the API.

[0030] In some embodiments, an access token is included in the request.

[0031] In some embodiments, receiving the request and the access token includes receiving a message from the communication device containing both the request and the access token.

[0032] In some embodiments, receiving the access token includes receiving the access token prior to or concurrently with receiving the request.

[0033] In some embodiments, the access token includes consent information, which declares that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. In one or more of these embodiments, the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API.

[0034] In some embodiments, the access token is an OAuth 2.0 access token.

[0035] In some embodiments, the API is a northbound API.

[0036] In some embodiments, the communications device is user equipment.

[0037] In some embodiments, the resource owner is a user of the communication device.

[0038] In some embodiments, the communication device is a network device implementing application function AF.

[0039] In some embodiments, the access token also asserts that the communications device is authorized to access the API.

[0040] In some embodiments, the access token includes one or more statements, including a statement asserting that the resource owner consents to the communication device accessing the protected resources of the API. The method further includes verifying the request against the one or more statements in the access token. The method further includes allowing or denying the request depending on the verification.

[0041] In some embodiments, the method further comprises: receiving signaling from the public API core device indicating that the resource owner has revoked consent for the communication device to access protected resources of the API.

[0042] Other embodiments herein include a method performed by a public application programming interface API core device. The method includes receiving a request for an access token from a communication device. The method also includes: in response to the request, transmitting an access token indicating whether the resource owner agrees that the communication device accesses a protected resource of the API.

[0043] In some embodiments, the access token includes consent information, which declares that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. In one or more of these embodiments, the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API.

[0044] In some embodiments, the access token is an OAuth 2.0 access token.

[0045] In some embodiments, the API is a northbound API.

[0046] In some embodiments, the communications device is user equipment.

[0047] In some embodiments, the resource owner is a user of the communication device.

[0048] In some embodiments, the communication device is a network device implementing application function AF.

[0049] In some embodiments, the access token also asserts that the communications device is authorized to access the API.

[0050] In some embodiments, the method further includes: receiving an authorization request from the communication device before receiving the request for the access token. The method further includes: transmitting an authorization code to the communication device in response to the authorization request before receiving the request for the access token. In some embodiments, the request for the access token includes an authorization code. In some embodiments, the authorization code is a credential representing the authorization of the resource owner. In one or more of these embodiments, the method further includes: retrieving a user consent parameter from a unified data management (UDM) device in response to receiving the authorization request. In some embodiments, the user consent parameter indicates whether the resource owner has granted consent for the communication device to access protected resources of the API. The method further includes: generating an authorization code based on the user consent parameter.

[0051] In some embodiments, the method further comprises: in response to receiving a request for an access token, retrieving a user consent parameter from a unified data management (UDM) device. In some embodiments, the user consent parameter indicates whether a resource owner has granted consent for the communication device to access protected resources of the API. The method further comprises: generating an access token based on the user consent parameter.

[0052] In some embodiments, the method further comprises: subscribing to updates to the user consent parameters from the unified data management (UDM) device.

[0053] In some embodiments, the method further includes: receiving a notification from a unified data management (UDM) device that the resource owner has revoked the communication device's consent to access the protected resources of the API. The method further includes: based on the notification, transmitting a signaling to an API open device configured to open the API, the signaling indicating that the resource owner has revoked the communication device's consent to access the protected resources of the API.

[0054] Other embodiments herein include a method performed by an application programming interface (API) open device, the API open device being configured to open an API to a communication device. The method includes receiving a request to call the API from the communication device. The method also includes retrieving one or more user consent parameters from a public API core device, the user consent parameters indicating whether a resource owner consents to the communication device accessing a protected resource of the API.

[0055] In some embodiments, in response to transmitting a request for the one or more user consent parameters to the common API core device, the one or more user consent parameters are retrieved from the common API core device.

[0056] In some embodiments, one or more user consent parameters are retrieved from the public API core device along with authorization information indicating whether the communication device is authorized to access the API.

[0057] In some embodiments, after and / or in response to receiving the request, one or more user consent parameters are retrieved.

[0058] In some embodiments, the API is a northbound API.

[0059] In some embodiments, the communications device is user equipment.

[0060] In some embodiments, the resource owner is a user of the communication device.

[0061] In some embodiments, the communication device is a network device implementing application function AF.

[0062] In some embodiments, the method further comprises: allowing or denying the request depending on whether the resource owner consents to the communication device accessing the protected resources of the API.

[0063] Other embodiments herein include a method performed by a public application programming interface (API) core device. The method includes: receiving a request for one or more user consent parameters from an API open device, the user consent parameters indicating whether a resource owner consents to a communication device accessing a protected resource of the API. The method further includes: transmitting the one or more user consent parameters to the API open device in response to the request.

[0064] In some embodiments, the method further comprises: retrieving one or more user consent parameters from a user data management (UDM) device in response to receiving the request.

[0065] In some embodiments, the API is a northbound API.

[0066] In some embodiments, the communications device is user equipment.

[0067] In some embodiments, the resource owner is a user of the communication device.

[0068] In some embodiments, the communication device is a network device implementing application function AF.

[0069] In some embodiments, one or more user consent parameters are transmitted along with authorization information indicating whether the communication device is authorized to access the API.

[0070] The embodiments herein also include corresponding apparatus, computer programs and carriers of those computer programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 is a block diagram of a communication network according to some embodiments that utilize access tokens to indicate resource owner consent.

[0072] Figure 2 is a block diagram of a public API framework architecture according to some embodiments.

[0073] Figure 3 is a call flow diagram of a process for API calling according to some embodiments.

[0074] Figure 4 is a call flow diagram for authenticating an API call request according to some embodiments.

[0075] Figure 5A is a call flow diagram of a process for obtaining an OAuth 2.0 access token that takes into account user consent, according to some embodiments.

[0076] Figure 5B is a call flow diagram of a process for obtaining an OAuth 2.0 access token taking into account user consent according to other embodiments.

[0077] Figure 5C is a call flow diagram of a process for API call request authentication taking into account user consent according to some embodiments using OAuth 2.0 access tokens.

[0078] Figure 5D is a call flow diagram of a process for revoking user consent according to some embodiments using OAuth 2.0 access tokens.

[0079] Figure 6 is a block diagram of a communication network according to some embodiments that do not utilize access tokens to indicate resource owner consent.

[0080] Figure 7is a call flow diagram of a process for API call request authentication that takes into account user consent according to some embodiments in which the API open function retrieves (one or more) user consent parameters from the CAPIF core function.

[0081] Fig. 8A is a logic flow diagram of a method performed by a communication device according to some embodiments of utilizing an access token to indicate resource owner consent.

[0082] Figure 8B is a logic flow diagram of a method performed by an API opening device according to some embodiments of utilizing access tokens to indicate resource owner consent.

[0083] Figure 8C is a logic flow diagram of a method performed by a public API core device according to some embodiments of utilizing access tokens to indicate resource owner consent.

[0084] Fig.9A is a logic flow diagram of a method performed by an API opening device according to some embodiments that do not utilize an access token to indicate resource owner consent.

[0085] Fig. 9B is a logic flow diagram of a method performed by a public API core device according to some embodiments that do not utilize an access token to indicate resource owner consent.

[0086] Fig.10 is a block diagram of a communication device according to some embodiments.

[0087] Fig.11 is a block diagram of an API open device according to some embodiments.

[0088] Fig.12 is a block diagram of a public API core device according to some embodiments.

[0089] Fig.13 is a block diagram of a communication system according to some embodiments.

[0090] Fig.14 is a block diagram of a user equipment according to some embodiments.

[0091] Fig.15 is a block diagram of a network node according to some embodiments.

[0092] Fig.16 is a block diagram of a host according to some embodiments.

[0093] Fig.17 is a block diagram of a virtualization environment according to some embodiments.

[0094] Fig.18is a block diagram of a host communicating with a UE via a network node over a partial wireless connection according to some embodiments. DETAILED DESCRIPTION

[0095] Figure 1 A communication network 10 is shown according to some embodiments, the network taking the form of, for example, a 5G network. The communication network 10 has a service-based architecture that utilizes service-based interactions between entities of the communication network 10. Entities in the communication network 10 thereby provide services to other entities, for example, by opening corresponding application programming interfaces (APIs) for those services.

[0096] As shown in this regard, the communication network 10 includes, for example, an API open device 12 that implements an API open function (AEF). The API open device 12 opens an API 14 for a service provided by the API open device 12. In an embodiment where the API 14 is opened to a higher-level entity, the API 14 may be a so-called northbound API. In any case, via this API 14, other entities in the communication network 10 may access the service.

[0097] Figure 1 For example, one entity is shown as a communication device 16. The communication device 12 may be, for example, a communication apparatus, such as a user device, or may be a network device, such as a network device implementing an application function (AF). As shown, the communication device 16 transmits an API call request 18 to the API open device 12. The API call request 18 is a request to call the API 14 and thereby access a service. Therefore, the communication device 16 may be appropriately referred to as an API caller.

[0098] However, according to some embodiments, the API open device 12 controls access to the API 14 so that only call requests from authorized entities are authorized and allowed. The API open device 12 shown in this regard controls the access of the communication device 16 to the API 14 based on the access token 20 (e.g., OAuth 2.0 token).

[0099] The communication device 16 specifically transmits the access token 20 to the API opening device 12. The access token 20 may be transmitted, for example, together with the API call request 18 or in other ways, for example, the access token 20 may be included in the API call request 18 itself, or in the same message as the API call request 18. In these and other embodiments, the communication device 16 may then transmit the access token 20 to the API opening device 12 before or at the same time as the API call request 18 is transmitted. In any case, the access token 20 may (for example, via a statement) declare that the communication device 16 is authorized to access the API 14. Upon receiving the access token 20, the API opening device 12 verifies or verifies the access token 20 as part of the decision of whether to allow or deny the API call request 18.

[0100] However, according to embodiments herein, the API 14 includes one or more operations that, when invoked, act on a protected resource 22. The protected resource 22 is protected in the sense that acting on the resource is prevented without the consent 26 of the owner 24 of the resource (also referred to as the resource owner 24). For example, the protected resource 22 may be the location of a user, in which case the API 14 is prevented from acting on the location of the user without the user's consent. Thus, even though the access token 20 would otherwise generally authorize the communication device 16 to invoke the API 14, the communication device 16 should still not be able to invoke one or more operations of the API 14 that act on the protected resource 22 unless the owner 24 has consented to the communication device 16 to do so.

[0101] It is worth noting that some embodiments herein utilize the access token 20 to indicate whether the resource owner 24 consents 26 for the communication device 16 to access the protected resources 22 of the API 14, for example, in addition to the access token 20 further indicating whether the communication device 16 is authorized to access the API 14. For example, in one embodiment, the access token 20 includes consent information declaring that the resource owner 24 consents (or does not consent) for the communication device 16 to access the protected resources 22 of the API 14, for example, where the consent information can be a statement of the access token 20. In any case, in embodiments where the access token 20 indicates whether the communication device 16 is authorized to access the API 14, some embodiments further utilize the access token 20 to further indicate whether the resource owner 24 consents 26 for the communication device 16 to access the protected resources 22 of the API 14.

[0102] Note that the resource owner's 24 consent 26 for the communication device 16 to access the protected resource 22 may also be referred to as the resource owner's 24 authorization for the communication device 16 to access the protected resource 22, i.e., resource owner consent may be used interchangeably with resource owner authorization.

[0103] Advantageously, by utilizing the access token 20 in this manner, the steps for authorizing the communication device 16 to access the API 14 can be effectively avoided or aborted if the access token 20 indicates that the resource owner 24 has not consented to the communication device 16 accessing the protected resource 22. By utilizing the access token 20 in this manner, some embodiments herein provide a way to call the API 14 to access the protected resource 22 in an efficient manner from a signaling and processing perspective.

[0104] More specifically, in some embodiments, the communication device 16 obtains the access token 40 from, for example, a public API core device 28 that implements the public API framework (CAPIF) core functionality. As shown in this regard, the communication device 16 transmits a request 30 for the access token 40 to the public API core device 28. The public API core device 28 generates or retrieves the requested access token 40 and transmits the access token 40 back to the communication device 16 so that the communication device 16 can present the access token 20 to the API open device 12.

[0105] In one embodiment, in response to receiving the request 30 for the access token 40, the public API core device 28 generates the access token 40 based on the user consent parameter(s) 32 retrieved from the unified data management (UDM) device 34. In this case, such user consent parameter(s) 32 may indicate whether the resource owner 24 has granted the consent 26 for the communication device 16 to access the protected resources 22 of the API 14. When the user consent parameter(s) 32 are stored in the UDM device 34, this means that the indication of whether the resource owner 24 has granted the consent 26 for the communication device 16 to access the protected resources 22 of the API 14 may be part of the subscriber information in the communication network 10, for example, so as to be stored in the UDM device 34 as part of the subscriber information.

[0106] In other embodiments, the public API core device 28 generates an access token 40 based on an authorization code, which the public API core device 28 generates based on (one or more) user consent parameters 32. In particular, before transmitting the request 30 for the access token 40, the communication device 16 transmits an authorization request (not shown) to the public API core device 28. In response to receiving the authorization request, the public API core device 28 generates an authorization code based on (one or more) user consent parameters 32, so that the authorization code is a credential representing the authorization of the resource owner 24. See, for example, Section 1.2 of OAuth 2.0 RFC 6749. The public API core device 28 transmits the authorization code to the communication device 16. Thereafter, the communication device 16 transmits a request 30 for the access token 40 to the public API core device 28, wherein the request 30 includes the previously received authorization code. The public API core device 28 generates the requested access token 40 accordingly based on the authorization code included in the request 30.

[0107] Figure 1 The embodiments shown in are applicable in the example context where the communication network has a Common API Framework (CAPIF) architecture. The CAPIF architecture, procedures and information flows are specified in 3GPP TS 23.222 v17.5.0. Figure 2 The functional model for CAPIF is depicted, for example, consistent with Section 6.2.0-1 in TS23.222v17.5.0. According to this example context, the communication device 16 corresponds to the API caller 56, the API open device 12 corresponds to the API open function (AEF) 52, and the public API core device 28 corresponds to the CAPIF core function 58.

[0108] According to the security architecture for CAPIF (eg, as specified in 3GPP TS 33.122), the API caller 56 is authorized by an API exposure function (AEF). Figure 3 A high-level mechanism for such authorization is shown, for example, consistent with TS 23.222 v17.5.0 Section 8.16, Figure 8.16.3-1, and TS 33.122 v16.3.0 Section 6.5. According to this process, the API caller 56 may provide authorization information in step 1. If not provided, the AEF 52 extracts the authorization information from the CAPIF Core Function (CCF). The OAuth 2.0 protocol can be used in the first case (the case where the API caller 56 provides authorization information). In this process, the CCF plays the role of an authorization server, the API caller 56 plays the role of a client, and the API caller 56 plays the role of a resource server, where the authorization server, client, and resource server roles are defined in the OAuth 2.0 framework. Figure 4A process in which an OAuth access token is used is shown.

[0109] Some embodiments herein utilize this OAuth access token for user consent purposes in CAPIF, for example, as specified in 3GPP TS 33.501 17.5.0 Annex V. In this case, the Unified Data Management (UDM) / Unified Data Repository (UDR) stores user consent related parameters, which are bound to the Subscription Permanent Identifier (SUPI) / General Public Subscription Identifier (GPSI). The UDM also supports services for retrieving user consent parameters and notifying user consent parameter changes. The network function (NF) that is considered as the implementation point of user consent should support retrieving user consent parameters from the UDM. Because user consent can be revoked in a timely manner, the NF should support subscription to user consent parameter change notifications provided by the UDM. The UDM then notifies the subscriber NF of the user consent revocation. In addition, any implementation point NF can notify other NFs to stop processing data subject to the revoked user consent.

[0110] According to some embodiments herein in the context of CAPIF, CCF may extract user consent information from UDM directly or via another function and include this information in the OAuth 2.0 access token. In this way, the user consent check may be done before or during the API caller authorization. When there is no user consent, those steps regarding authorization may be avoided or aborted. In addition, some embodiments provide for consent information revocation in CCF event subscriptions and notifications, and the event service consumer is AEF52.

[0111] Certain embodiments may provide one or more of the following technical advantages: Some embodiments advantageously optimize the process of checking authorization and user consent for northbound API calls.

[0112] Figures 5A-5D An example of some embodiments in the context of CAPIF is shown for the case where an OAuth access token is used.

[0113] These steps are explained below:

[0114] Step 1: The API caller 56 and the CCF perform an authentication process and establish a secure channel.

[0115] Note: Depending on "Option #1" and "Option #2" (Authorization Code Grant type usage for OAuth protocol), either steps 2a-7a or steps 2b-7b1 are performed.

[0116] Step 2a: API caller 56 requests an OAuth access token from CCF. Here, the request in step 2a illustrates Figure 1 Request 30 for access token 40.

[0117] Step 3a: CCF validates the request.

[0118] Step 4a: CCF extracts user consent parameters from UDM directly or via another function (e.g., NEF). Here, the user consent parameters exemplify Figure 1 (One or more) user consent parameters 32.

[0119] Step 5a: The UDM sends the user consent parameters to the CCF directly or via another function (eg, NEF).

[0120] Step 6a: The CCF agrees the parameter change to the UDM subscriber directly or via another function (eg NEF).

[0121] Note: Step 6a may be performed at any time, such as before step 4a or after step 7a.

[0122] Step 7a: CCF issues an access token containing user consent information, where the access token instantiates Figure 1 The access token in 20. The user consent related information may be or include Figure 1 The information described in the , wherein the user consent related information may be a statement of the access token. In some embodiments, the access token and / or the user consent related information are bound to the API caller 56. For example, when the API caller 56 is a UE, the access token and / or the user consent related information may include a UE identity (ID) that identifies the UE. The CCF sends the issued token to the API caller 56.

[0123] Step 2b: The API caller 56 sends an authorization request to the CCF.

[0124] Step 3b: The CCF extracts the user consent parameters from the UDM directly or via another function (eg, NEF).

[0125] Step 4b: The UDM sends the user consent parameters to the CCF directly or via another function (eg, NEF).

[0126] Step 5b: The CCF agrees the parameter change to the UDM subscriber directly or via another function (eg, NEF).

[0127] Note: Step 5b may be performed at any time, such as before step 3b or after step 6b.

[0128] Step 6b: If the authorization is successful, the CCF creates an authorization code and sends it to the API caller 56.

[0129] Step 7b: The API caller 56 sends the received authorization code to the CCF in an access token request. Here, the access token request in step 7b illustrates Figure 1 Request 30 for access token 40.

[0130] Step 7b1: If the authorization code check succeeds, CCF issues an access token containing user consent related information, where the access token instantiates Figure 1 The CCF sends the issued token to the API caller 56.

[0131] NOTE: Steps 8-11 illustrate the process for the case where user consent has not been revoked prior to the API call request.

[0132] Step 8: The API caller 56 and the AEF 52 perform some authentication and establish a secure channel using TLS.

[0133] Step 9: API caller 56 sends the access token in the northbound API call. Here, the northbound API call is illustrated as Figure 1 The API call request 18 in the northbound API call and the access token included in the northbound API call exemplifies Figure 1 The access token in 20.

[0134] Step 10: AEF 52 verifies the access token and checks the authorization information and user consent related information. If the CCF grants authorization and the user consent information indicates that the user consent has been granted, AEF 52 processes the request.

[0135] Step 11: AEF sends a response.

[0136] NOTE: Steps 12-17 illustrate the process for the case where user consent has been revoked prior to the API call request.

[0137] Step 12: CCF receives notification of user consent withdrawal.

[0138] Step 13: CCF informs AEF of the revocation. (AEF has subscribed to the CCF event disclosure service, which is not depicted in the figure)

[0139] Step 14: The API caller 56 and the AEF perform some authentication and establish a secure channel using TLS.

[0140] Step 15: The API caller 56 sends the access token in the northbound API call.

[0141] Step 16: AEF validates the access token and checks the authorization information and user consent related information. Since the user consent has been revoked, AEF rejects the request.

[0142] Step 17 : AEF sends a rejection to the API caller 56 .

[0143] Note: If the user consent parameter received in steps 5a and 4b indicates no user consent, CCF may not issue a token / authorization code, but a token containing information that no user consent is provided. The process then ends with CCF sending a rejection to the API caller 56.

[0144] For the token generated by the CCF in steps 7a and 7b1, additional authorization information (i.e., user consent information) is a new information element to be specified in the token claim (e.g., defined in the AccessTokenClaims data type in TS29.510). Such authorization information may include an indication of whether the user is granted access to protected resources.

[0145] Figure 6 Other embodiments are shown herein. These embodiments incorporate the retrieval of (one or more) user consent parameters 32 into the API call process, rather than Figure 1 Use the access token as in Figure 6 As shown in this regard, for example, in response to transmitting a request 36 for (one or more) such user consent parameters 32 to the public API core device 28, the API open device 12 retrieves (one or more) user consent parameters 32 from the public API core device 28. The API open device 12 may retrieve (one or more) user consent parameters 32 in this manner, for example, upon or after receiving the API call request 18 from the communication device 16. In these and other embodiments, the (one or more) user consent parameters 32 may be retrieved from the public API core device 28 together with authorization information indicating whether the communication device 16 is authorized to access the API 14. In any case, based on the (one or more) user consent parameters 32, the API open device 12 may allow or deny the API call request 18 depending on whether the resource owner 24 consents 26 to the communication device 16 accessing the protected resources 22 of the API 14.

[0146] Note that in some of the illustrated embodiments, for example, in response to receiving a request 36 for (one or more) user consent parameters 32 from the API open device 12, the public API core device 28 retrieves (one or more) user consent parameters 32 from the UDM device 34.

[0147] Consider an example in the context of CAPIF. In this example, where Auth 2.0 is not used and authorization information is received by AEF from CCF, CCF extracts user consent information from UDM directly or via another function and includes this information in the authorization information sent to AEF. That is, the user consent information extracted by CCF from UDM directly or via another function is added to the authorization information sent from CCF to AEF. Here, the user consent information may correspond to (one or more) user consent parameters 32. Figure 7 Additional details according to one example are shown in which the communication device 16 corresponds to the API caller 56 , the API open device 12 corresponds to the API open function (AEF) 52 , and the public API core device 28 corresponds to the CAPIF core function 58 .

[0148] These steps are explained below:

[0149] Step 1: The API caller 56 and the AEF perform some authentication and establish a secure channel using TLS.

[0150] Step 2: API caller 56 calls the northbound API.

[0151] Step 3: AEF requests authorization and user consent information from CCF.

[0152] Step 4: The CCF extracts the user consent parameters from the UDM directly or via another function (eg, NEF).

[0153] Step 5: UDM sends the user consent parameters to CCF directly or via another function (eg, NEF).

[0154] Step 6: CCF sends authorization and user consent information to AEF. User consent information can be or include Figure 1 Consent information that declares the user's consent (or disagreement) to access protected resources, as described in

[0155] Step 7: AEF uses the authorization information received from CCF to check whether the API caller 56 is authorized to call the API, and also checks whether the user consent information grants consent. If both checks indicate that the API caller 56 is authorized and has user consent, the AEF processes the request.

[0156] Step 8: AEF sends a processing request to the API caller 56.

[0157] In view of the modifications and changes made herein, Fig. 8A A method according to a particular embodiment is depicted. The method is performed by a communication device 16 configured to call an application programming interface API to access a service.

[0158] In some embodiments, the method includes transmitting a request 18 for an access token 40 from the communication device 16 to the public API core device (block 100). The method may also include receiving an access token 20 in response to the request 18, the access token 20 indicating whether the resource owner 24 consents to the communication device 16 accessing the protected resources 22 of the API 14 (block 110).

[0159] In some embodiments, the method alternatively or additionally includes: transmitting a request 18 for calling the API 14 from the communication device 16 to the API opening device 12 configured to open the API 14 (box 120). The method may also include: transmitting an access token 20 from the communication device 16 to the API opening device 12, the access token 20 indicating whether the resource owner 24 agrees that the communication device 16 accesses the protected resources 22 of the API (box 130).

[0160] Figure 8B A method according to another specific embodiment is described. The method is performed by an application programming interface API opening device 12, which is configured to open an API 14 to a communication device 16. The method includes: receiving a request 18 to call the API 14 from the communication device 16 (block 200). The method also includes: receiving an access token 20 from the communication device 16, the access token 20 indicating whether a resource owner 24 agrees that the communication device 16 can access a protected resource 22 of the API 14 (block 210).

[0161] In some embodiments, the method further includes receiving signaling from the public API core device 28 indicating that the resource owner 24 has revoked consent for the communication device 16 to access the protected resources 22 of the API (block 220).

[0162] Figure 8C A method according to other specific embodiments is depicted. The method is performed by a public application programming interface API core device 28. The method includes: receiving a request 30 for an access token 40 from a communication device 16 (box 320). The method also includes: in response to the request 30, transmitting an access token 20, the access token 20 indicating whether the resource owner 24 consents to the communication device 16 accessing the protected resource 22 of the API (box 330).

[0163] In some embodiments, the method further includes receiving an authorization request from the communication device 16 (block 300). In this case, the method further includes transmitting an authorization code to the communication device 16 in response to the authorization request (block 310). In one such embodiment, the request 30 for the access token 40 received in block 320 includes the authorization code.

[0164] Regardless, in some embodiments, the method further includes subscribing to updates to the user consent parameter(s) 32 from the unified data management (UDM) device 34 (block 340 ).

[0165] Alternatively or additionally, in some embodiments, the method includes: receiving a notification from the unified data management (UDM) device 34 that the resource owner 24 has revoked the communication device 16's consent to access the protected resources 22 of the API (block 350). In such a case, the method may further include: based on the notification, transmitting a signaling to the API opening device 12 configured to open the API, the signaling indicating that the resource owner 24 has revoked the communication device 16's consent to access the protected resources 22 of the API (block 360).

[0166] Fig.9A A method according to another specific embodiment is described. The method is performed by an application programming interface API opening device 12, which is configured to open an API 14 to a communication device 16. The method includes: receiving a request 18 to call an API from the communication device 16 (box 400). The method also includes: retrieving one or more user consent parameters 32 from the public API core device 28, the user consent parameters 32 indicating whether the resource owner 24 agrees with the communication device 16 to access the protected resources 22 of the API (box 410).

[0167] In some embodiments, the method further includes allowing or denying the request 18 depending on whether the resource owner 24 consents to the communication device 16 accessing the protected resource 22 of the API (block 420).

[0168] Fig. 9B A method according to other specific embodiments is described. The method is performed by a public application programming interface API core device 28. The method includes: receiving a request 36 for one or more user consent parameters 32 from an API open device 12, wherein the user consent parameters 32 indicate whether the resource owner 24 consents to the communication device 16 accessing the protected resource 22 of the API (box 500). The method also includes: in response to the request, transmitting the one or more user consent parameters 32 to the API open device 12 (box 510).

[0169] In some embodiments, the method further includes retrieving one or more user consent parameters 32 from the user data management (UDM) device 34 in response to receiving the request 36 (block 520).

[0170] The embodiments herein also include corresponding apparatuses. For example, the embodiments herein include a communication device 16 configured to perform any of the steps of any of the embodiments described above for the communication device 16.

[0171] Embodiments also include a communication device 16 comprising a processing circuit and a power supply circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the communication device 16. The power supply circuit is configured to supply power to the communication device 16.

[0172] Embodiments further include a communication device 16 comprising a processing circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the communication device 16. In some embodiments, the communication device 16 further includes a communication circuit.

[0173] The embodiment further comprises a communication device 16 comprising a processing circuit and a memory. The memory comprises instructions executable by the processing circuit to thereby configure the communication device 16 to perform any of the steps of any of the embodiments described above for the communication device 16.

[0174] In addition, embodiments include user equipment (UE). The UE includes an antenna configured to send and receive wireless signals. The UE also includes a radio front-end circuit connected to the antenna and the processing circuit, and is configured to adjust the signal transmitted between the antenna and the processing circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the communication device 16. In some embodiments, the UE also includes an input interface, which is connected to the processing circuit and is configured to allow information to be input into the UE for processing by the processing circuit. The UE may include an output interface, which is connected to the processing circuit and is configured to output information that has been processed by the processing circuit from the UE. The UE may also include a battery, which is connected to the processing circuit and is configured to power the UE.

[0175] The embodiments herein also include an API open device 12 configured to perform any of the steps of any of the embodiments described above for the API open device 12 .

[0176] The embodiment also includes an API open device 12, which includes a processing circuit and a power supply circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the API open device 12. The power supply circuit is configured to supply power to the API open device 12.

[0177] The embodiment further comprises an API open device 12 comprising a processing circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the API open device 12. In some embodiments, the API open device 12 further comprises a communication circuit.

[0178] The embodiment further includes an API open device 12, which includes a processing circuit and a memory. The memory contains instructions that can be executed by the processing circuit, whereby the API open device 12 is configured to perform any of the steps of any of the embodiments described above for the API open device 12.

[0179] The embodiments herein further include a common API core device 28 configured to perform any of the steps of any of the embodiments described above with respect to the common API core device 28 .

[0180] The embodiment also includes a common API core device 28 including a processing circuit and a power supply circuit. The processing circuit is configured to perform any of the steps of any of the embodiments described above for the common API core device 28. The power supply circuit is configured to supply power to the common API core device 28.

[0181] Embodiments further include a common API core device 28 comprising processing circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the common API core device 28. In some embodiments, the common API core device 28 further includes communication circuitry.

[0182] The embodiment further comprises a common API core device 28 comprising processing circuitry and memory. The memory comprises instructions executable by the processing circuitry whereby the common API core device 28 is configured to perform any of the steps of any of the embodiments described above for the common API core device 28.

[0183] More specifically, the above-mentioned device can perform the method and any other processing in this article by implementing any functional component, module, unit or circuit. For example, in one embodiment, the device includes a corresponding circuit module or circuit configured to perform the steps shown in the method diagram. In this regard, the circuit module or circuit may include a circuit module dedicated to performing a certain functional processing and / or one or more microprocessors combined with a memory. For example, the circuit may include one or more microprocessors or microcontrollers, and other digital hardware that may include a digital signal processor (DSP), dedicated digital logic, etc. The processing circuit may be configured to execute the program code stored in the memory, and the memory may include one or more types of memory, such as read-only memory (ROM), random access memory, cache memory, flash memory device, optical storage device, etc. In several embodiments, the program code stored in the memory may include program instructions for executing one or more telecommunications and / or data communication protocols, and instructions for implementing one or more of the technologies described in this article. In an embodiment using a memory, the memory stores program code, which, when executed by one or more processors, implements the technology described in this article.

[0184] For example, Fig.10 10. As shown, the communication device 16 includes a processing circuit 1010 and a communication circuit 1020. The communication circuit 1020 (e.g., a radio circuit) is configured to transmit information to one or more other nodes and / or receive information from one or more other nodes, such as via any communication technology. For example, where the communication device 16 is a wireless communication device such as a user equipment, such communication may occur via one or more antennas internal or external to the communication device 16. Regardless, the processing circuit 1010 is configured to perform (e.g., by executing instructions stored in the memory 1030). Fig.9A In this regard, the processing circuit 1010 may implement certain functional components, units or modules.

[0185] Fig.11 The API open device 12 as implemented according to one or more embodiments is shown. As shown, the API open device 12 includes a processing circuit 1110 and a communication circuit 1120. The communication circuit 1120 is configured to transmit information to one or more other nodes and / or receive information from one or more other nodes via any communication technology. The processing circuit 1110 is configured to perform (e.g., Fig. 9B and / or Fig.10 In this regard, the processing circuit 1110 may implement certain functional components, units or modules.

[0186] Fig.12 1 shows a common API core device 28 as implemented according to one or more embodiments. As shown, the common API core device 28 includes a processing circuit 1210 and a communication circuit 1220. The communication circuit 1220 is configured to transmit information to one or more other nodes and / or receive information from one or more other nodes, such as via any communication technology. The processing circuit 1210 is configured to perform, such as by executing instructions stored in the memory 1230 (e.g., FIG. 9C and / or Fig.10 In this regard, the processing circuit 1210 may implement certain functional components, units or modules.

[0187] Those skilled in the art will also appreciate that the embodiments herein further include corresponding computer programs.

[0188] The computer program includes instructions that, when executed on at least one processor of a device, cause the device to perform any of the above-mentioned corresponding processes. In this regard, the computer program may include one or more code modules corresponding to the above-mentioned components or units.

[0189] The embodiment further includes a carrier embodying such a computer program.Such a carrier may include one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium.

[0190] In this regard, embodiments herein also include a computer program product stored on a non-transitory computer-readable (storage or recording) medium and including instructions that, when executed by a processor of an apparatus, cause the apparatus to perform as described above.

[0191] The embodiments further include a computer program product including program code portions for performing the steps of any of the embodiments herein when a computing device executes the computer program product. This computer program product may be stored on a computer readable recording medium.

[0192] Fig.13 An example of a communication system 1300 is shown in accordance with some embodiments.

[0193] In the example, the communication system 1300 includes a telecommunications network 1302, which includes an access network 1304 such as a radio access network (RAN) and a core network 1306 including one or more core network nodes 1308. The access network 1304 includes one or more access network nodes, such as network nodes 1310a and 1310b (one or more of which may be generally referred to as network nodes 1310), or any other similar third generation partnership project (3GPP) access node or non-3GPP access point. The network node 1310 facilitates direct or indirect connection of user equipment (UE), such as by connecting UE 1312a, 1312b, 1312c, and 1312d (one or more of which may be generally referred to as UE 1312) to the core network 1306 via one or more wireless connections.

[0194] Example wireless communications via wireless connections include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information without using wires, cables, or other material conductors. In addition, in different embodiments, the communication system 1300 may include any number of wired or wireless networks, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals (whether via a wired connection or a wireless connection). The communication system 1300 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar types of systems.

[0195] UE 1312 may be any of a variety of communication devices, including wireless devices that are arranged, configured and / or operable to wirelessly communicate with network node 1310 and other communication devices. Similarly, network node 1310 is arranged, capable, configured and / or operable to communicate directly or indirectly with UE 1312 and / or with other network nodes or devices in telecommunication network 1302 to enable and / or provide network access (such as wireless network access) and / or perform other functions (such as management in telecommunication network 1302).

[0196] In the depicted example, the core network 1306 connects the network node 1310 to one or more hosts, such as the host 1316. These connections may be direct or indirect via one or more intermediate networks or devices. In other examples, the network node may be directly coupled to the host. The core network 1306 includes one or more core network nodes (e.g., core network node 1308) composed of hardware and software components. The features of these components may be substantially similar to those described with respect to the UE, network nodes, and / or hosts, so that their descriptions are generally applicable to the corresponding components of the core network node 1308. The example core network node includes the functions of one or more of a mobile switching center (MSC), a mobility management entity (MME), a home subscriber server (HSS), an access and mobility management function (AMF), a session management function (SMF), an authentication server function (AUSF), a subscription identifier unhiding function (SIDF), a unified data management (UDM), a security edge protection proxy (SEPP), a network open function (NEF), and / or a user plane function (UPF).

[0197] The host 1316 may be owned or controlled by a service provider that is different from the operator or provider of the access network 1304 and / or the telecommunications network 1302, and may be operated by or on behalf of the service provider. The host 1316 may host various applications to provide one or more services. Examples of such applications include live and pre-recorded audio / video content, data collection services (such as retrieving and compiling data about various environmental conditions detected by multiple UEs), analysis functionality, social media, functions for controlling or otherwise interacting with remote devices, functions for alarm and monitoring centers, or any other such functions performed by a server.

[0198] Overall, Fig.13 The communication system 1300 can enable connectivity between UEs, network nodes, and hosts. In this sense, the communication system can be configured to operate according to predefined rules or procedures such as specific standards, including but not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards or any applicable future generation standards (e.g., 6G); Wireless Local Area Network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard (WiFi); and / or any other suitable wireless communication standards, such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC) ZigBee, LiFi, and / or any Low Power Wide Area Network (LPWAN) standards (such as LoRa and Sigfox).

[0199] In some examples, telecommunication network 1302 is a cellular network implementing 3GPP standardized features. Thus, telecommunication network 1302 may support network slicing to provide different logical networks to different devices connected to telecommunication network 1302. For example, telecommunication network 1302 may provide ultra-reliable low-latency communication (URLLC) services to some UEs, enhanced mobile broadband (eMBB) services to other UEs, and / or massive machine type communication (mMTC) / massive IoT services to yet other UEs.

[0200] In some examples, UE 1312 is configured to transmit and / or receive information without direct human interaction. For example, the UE may be designed to transmit information to access network 1304 on a predetermined schedule when triggered by an internal or external event, or in response to a request from access network 1304. In addition, the UE may be configured to operate in a single RAT or multi-RAT or multi-standard mode. For example, the UE may operate using any one of Wi-Fi, NR (new air interface) and LTE, or a combination thereof, i.e., configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Air Interface-Dual Connectivity (EN-DC).

[0201] In an example, the hub 1314 communicates with the access network 1304 to facilitate indirect communication between one or more UEs (e.g., UE 1312c and / or 1312d) and a network node (e.g., network node 1310b). In some examples, the hub 1314 can be any of a controller, a router, a content source and an analysis device, or other communication devices described herein with respect to the UE. For example, the hub 1314 can be a broadband router that enables the UE to access the core network 1306. As another example, the hub 1314 can be a controller that sends commands or instructions to one or more actuators in the UE. The commands or instructions can be received from the UE, the network node 1310, or received through executable code, scripts, processes, or other instructions in the hub 1314. As another example, the hub 1314 can be a data collector that acts as a temporary storage device for UE data, and in some embodiments, analysis or other processing of the data can be performed. As another example, the hub 1314 can be a content source. For example, for a UE that is a VR headset, display, speaker, or other media delivery device, the hub 1314 can retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, and then the hub 1314 provides it to the UE directly and / or after adding additional local content after performing local processing. In yet another example, particularly where one or more of the UEs are low-energy IoT devices, the hub 1314 acts as a proxy server or orchestrator for the UE.

[0202] Hub 1314 may have a constant / persistent or intermittent connection to network node 1310b. Hub 1314 may also allow different communication schemes and / or scheduling between hub 1314 and UE (e.g., UE 1312c and / or 1312d) and hub 1314 and core network 1306. In other examples, hub 1314 is connected to core network 1306 and / or one or more UEs via a wired connection. In addition, hub 1314 may be configured to be connected to an M2M service provider and / or to another UE via a direct connection via access network 1304. In some scenarios, UE may establish a wireless connection with network node 1310, while still being connected via hub 1314 via a wired or wireless connection. In some embodiments, hub 1314 may be a dedicated hub, that is, a hub whose main function is to route communications from UE to network node 1310b or from network node 1310b to UE. In other embodiments, the hub 1314 may be a non-dedicated hub - ie, a device operable to route communications between UEs and network node 1310b, but otherwise capable of operating as a communications start and / or end point for certain data channels.

[0203] Fig.14 UE 1400 according to some embodiments is shown. As used herein, UE refers to a device capable of, configured, arranged and / or operable to wirelessly communicate with a network node and / or other UEs. Examples of UEs include, but are not limited to, smart phones, mobile phones, cellular phones, voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, game consoles or devices, music storage devices, playback appliances, wearable terminal devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded devices (LEEs), laptop mounted devices (LMEs), smart devices, wireless client equipment (CPEs), vehicle mounted or vehicle embedded / integrated wireless devices, etc. Other examples include any UE identified by the Third Generation Partnership Project (3GPP), including narrowband Internet of Things (NB-IoT) UEs, machine type communications (MTC) UEs, and / or enhanced MTC (eMTC) UEs.

[0204] The UE may support device-to-device (D2D) communications, for example, by implementing 3GPP standards for direct link communications, dedicated short range communications (DSRC), vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), or vehicle-to-everything (V2X). In other examples, the UE may not necessarily have a user in the sense of a human user who owns and / or operates the associated device. Instead, the UE may represent a device that is intended to be sold to or operated by a human user, but may not or may not initially be associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, the UE may represent a device that is not intended to be sold to or operated by an end user, but may be associated with or operated for the benefit of a user (e.g., a smart power meter).

[0205] UE 1400 includes processing circuitry 1402, which is operatively coupled to input / output interface 1406, power supply 1408, memory 1410, communication interface 1412, and / or any other components or any combination thereof via bus 1404. Some UEs may utilize Fig.14 All components shown in the UE or a subset of these components. The degree of integration between components may vary from one UE to another UE. In addition, some UEs may include multiple instances of components, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0206] The processing circuit 1402 is configured to process instructions and data, and may be configured to implement any sequential state machine that is operable to execute instructions stored in the memory 1410 as a machine-readable computer program. The processing circuit 1402 may be implemented as: one or more hardware-implemented state machines (e.g., in discrete logic, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), etc.); programmable logic together with appropriate firmware; one or more stored computer programs, general-purpose processors such as microprocessors or digital signal processors (DSPs), together with appropriate software; or any combination of the above. For example, the processing circuit 1402 may include multiple central processing units (CPUs).

[0207] In this example, the input / output interface 1406 may be configured to provide one or more interfaces to an input device, an output device, or one or more input and / or output devices. Examples of output devices include speakers, sound cards, video cards, displays, monitors, printers, actuators, transmitters, smart cards, another output device, or any combination thereof. An input device may allow a user to capture information into the UE 1400. Examples of input devices include touch-sensitive displays or presence-sensitive displays, cameras (e.g., digital cameras, digital video cameras, web cameras, etc.), microphones, sensors, mice, trackballs, directional pads, trackpads, rollers, smart cards, etc. The presence-sensitive display may include a capacitive or resistive touch sensor to sense input from a user. The sensor may be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. The output device may use the same type of interface port as the input device. For example, a universal serial bus (USB) port may be used to provide input devices and output devices.

[0208] In some embodiments, the power supply 1408 is configured as a battery or battery pack. Other types of power supplies may be used, such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a power battery. The power supply 1408 may further include a power circuit for delivering power from the power supply 1408 itself and / or an external power source to various parts of the UE 1400 via an input circuit or interface such as a power cable. The delivered power may be used, for example, for charging the power supply 1408. The power circuit may perform any formatting, conversion, or other modification on the power from the power supply 1408 to make the power suitable for the corresponding components of the UE 1400 to which the power is supplied.

[0209] The memory 1410 may be or be configured to include a memory such as a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic disk, an optical disk, a hard disk, a removable cartridge, a flash drive, etc. In one example, the memory 1410 includes: one or more application programs 1414, such as an operating system, a World Wide Web browser application, a widget, a gadget engine, or other application; and corresponding data 1416. The memory 1410 may store any one of a variety of operating systems or a combination of operating systems for use by the UE 1400.

[0210] The memory 1410 may be configured to include multiple physical drive units, such as a redundant array of independent disks (RAID), flash memory, a USB flash drive, an external hard drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disk (HD-DVD) optical drive, an internal hard drive, a Blu-ray optical drive, a holographic digital data storage (HDDS) optical drive, an external mini dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro-DIMM SDRAM, a smart card memory (such as a tamper-proof module in the form of a universal integrated circuit card (UICC) including one or more subscriber identity modules (SIMs) (such as USIM and / or ISIM)), other memories, or any combination thereof. The UICC may be, for example, an embedded UICC (eUICC), an integrated UICC (iUICC), or a removable UICC commonly referred to as a 'SIM card'. The memory 1410 may allow the UE 1400 to access instructions, applications, etc. stored on a temporary or non-temporary memory medium to offload data or upload data. An article of manufacture, such as an article of manufacture utilizing a communication system, may be tangibly embodied as or in memory 1410 , which may be or may include a device-readable storage medium.

[0211] The processing circuit 1402 may be configured to communicate with an access network or other network using a communication interface 1412. The communication interface 1412 may include one or more communication subsystems and may include or be communicatively coupled to an antenna 1422. The communication interface 1412 may include one or more transceivers for communicating, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or a network node in an access network). Each transceiver may include a transmitter 1418 and / or a receiver 1420 suitable for providing network communications (e.g., optical, electrical, frequency allocation, etc.). In addition, the transmitter 1418 and the receiver 1420 may be coupled to one or more antennas (e.g., antenna 1422) and may share circuit components, software or firmware, or may be implemented separately as an alternative.

[0212] In the illustrated embodiment, the communication functionality of the communication interface 1412 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, near field communication, location-based communication such as using a global positioning system (GPS) to determine location, another similar communication functionality, or any combination thereof. The communication may be implemented according to one or more communication protocols and / or standards, such as IEEE 802.11, code division multiple access (CDMA), wideband code division multiple access (WCDMA), GSM, LTE, new radio (NR), UMTS, WiMax, Ethernet, transmission control protocol / Internet protocol (TCP / IP), synchronous optical networking (SONET), asynchronous transfer mode (ATM), QUIC, hypertext transfer protocol (HTTP), etc.

[0213] Regardless of the type of sensor, the UE may provide an output of the data captured by its sensor via a wireless connection to a network node through its communication interface 1412. The data captured by a sensor of a certain UE may be delivered to a network node via another UE via a wireless connection. The output may be periodic (e.g., every 15 minutes if it reports a sensed temperature), random (e.g., to load balance reports from several sensors), in response to a trigger event (e.g., sending an alarm when moisture is detected), in response to a request (e.g., a user-initiated request), or a continuous stream (e.g., a live video feed of a patient).

[0214] As another example, the UE includes an actuator, motor, or switch associated with a communication interface configured to receive wireless input from a network node via a wireless connection. In response to the received wireless input, the state of the actuator, motor, or switch may change. For example, the UE may include a motor that adjusts a control surface or rotor of a drone in flight based on the received input, or a robotic arm that performs a medical procedure based on the received input.

[0215] When a UE takes the form of an Internet of Things (IoT) device, it can be a device used in one or more application areas, including but not limited to urban wearable technology, extended industrial applications, and healthcare. Non-limiting examples of such IoT devices are devices that are or are embedded in connected refrigerators or freezers, TVs, connected lighting devices, electric meters, robotic vacuum cleaners, voice-controlled smart speakers, home security cameras, motion detectors, thermostats, smoke detectors, door / window sensors, overflow / moisture sensors, electrical door locks, connected doorbells, air conditioning systems such as heat pumps, autonomous vehicles, surveillance systems, weather monitoring devices, vehicle parking monitoring devices, electric vehicle charging stations, smart watches, fitness trackers, head-mounted displays for augmented reality (AR) or virtual reality (VR), wearable devices for tactile enhancement or sensory enhancement, sprinklers, animal or item tracking devices, sensors for monitoring plants or animals, industrial robots, unmanned aerial vehicles (UAVs), and any kind of medical device (such as a heart rate monitor or a remotely controlled surgical robot). A UE in the form of an IoT device includes circuitry and / or software depending on the intended application of the IoT device, plus information about Fig.14 Other components described for UE 1400 shown in .

[0216] As yet another specific example, in an IoT scenario, a UE may represent a machine or other device that performs monitoring and / or measurement and transmits the results of such monitoring and / or measurement to another UE and / or a network node. In this case, the UE may be an M2M device, which may be referred to as an MTC device in the 3GPP context. As a specific example, a UE may implement the 3GPP NB-IoT standard. In other scenarios, a UE may represent a vehicle such as a car, bus, truck, ship, and airplane, or other equipment capable of monitoring and / or reporting its operating status or other functions associated with its operation.

[0217] In practice, any number of UEs may be used together for a single use case. For example, a first UE may be a drone or may be integrated into a drone, and may provide speed information of the drone (obtained by a speed sensor) to a second UE that is a remote controller operating the drone. When a user makes a change from the remote controller, the first UE may adjust the throttle on the drone (e.g., by controlling an actuator) to increase or decrease the speed of the drone. The first and / or second UE may also include more than one of the functionalities described above. For example, the UE may include a sensor and an actuator, and handle the communication of data for both the speed sensor and the actuator.

[0218] Fig.15A network node 1500 according to some embodiments is shown. As used herein, a network node refers to a device capable of, configured, arranged and / or operable to communicate directly or indirectly with a UE and / or with other network nodes or devices in a telecommunications network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and NR Node Bs (gNBs)).

[0219] Base stations may be classified based on the amount of coverage they provide (or in other words, their transmit power level), and therefore, depending on the amount of coverage provided, they may be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station may be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such a remote radio unit may or may not be integrated with an antenna as an antenna-integrated radio. Portions of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0220] Other examples of network nodes include a multi-transmission point (multi-TRP) 5G access node, a multi-standard radio (MSR) device (such as an MSR BS), a network controller (such as a radio network controller (RNC) or a base station controller (BSC)), a base transceiver station (BTS), a transmission point, a transmission node, a multi-cell / multicast coordination entity (MCE), an operation and maintenance (O&M) node, an operation support system (OSS) node, a self-organizing network (SON) node, a positioning node (e.g., an evolved serving mobile location center (E-SMLC)) and / or a minimization of drive tests (MDT).

[0221] The network node 1500 includes a processing circuit 1502, a memory 1504, a communication interface 1506, and a power supply 1508. The network node 1500 may be composed of multiple physically separated components (e.g., a node B component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have its own corresponding components. In certain scenarios where the network node 1500 includes multiple separate components (e.g., BTS and BSC components), one or more of the separate components may be shared between several network nodes. For example, a single RNC may control multiple node Bs. In such scenarios, each unique node B and RNC pair may be considered as a single separate network node in some instances. In some embodiments, the network node 1500 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate memories 1504 for different RATs), and some components may be reused (e.g., the same antenna 1510 may be shared by different RATs). The network node 1500 may also include multiple sets of various illustrated components for different wireless technologies, such as GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-wave, LoRaWAN, radio frequency identification (RFID), or Bluetooth wireless technologies, integrated into the network node 1500. These wireless technologies may be integrated into the same or different chips or chipsets and other components within the network node 1500.

[0222] The processing circuit 1502 may include a combination of one or more of the following: a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software and / or encoded logic that can operate to provide network node 1500 functionality alone or in combination with other network node 1500 components (such as memory 1504).

[0223] In some embodiments, processing circuitry 1502 includes a system on a chip (SOC). In some embodiments, processing circuitry 1502 includes one or more of radio frequency (RF) transceiver circuitry 1512 and baseband processing circuitry 1514. In some embodiments, radio frequency (RF) transceiver circuitry 1512 and baseband processing circuitry 1514 may be on separate chips (or chipsets), boards, or units (such as a radio unit and a digital unit). In alternative embodiments, part or all of RF transceiver circuitry 1512 and baseband processing circuitry 1514 may be on the same chip or chipset, board, or unit.

[0224] The memory 1504 may include any form of volatile or non-volatile computer-readable memory, including, but not limited to: a persistent storage device, a solid-state memory, a remotely mounted memory, a magnetic medium, an optical medium, a random access memory (RAM), a read-only memory (ROM), a mass storage medium (e.g., a hard disk), a removable storage medium (e.g., a flash drive, a compact disk (CD) or a digital video disk (DVD)), and / or any other volatile or non-volatile, non-transitory device-readable and / or computer-executable memory device that stores information, data and / or instructions that can be used by the processing circuit 1502. The memory 1504 may store any suitable instructions, data or information, including computer programs, software, applications (including one or more of logic, rules, codes, tables, etc.) and / or other instructions that can be executed by the processing circuit 1502 and utilized by the network node 1500. The memory 1504 may be used to store any calculations performed by the processing circuit 1502 and / or any data received via the communication interface 1506. In some embodiments, the processing circuit 1502 and the memory 1504 are integrated.

[0225] The communication interface 1506 is used for wired or wireless communication of signaling and / or data between network nodes, access networks and / or UEs. As shown, the communication interface 1506 includes (one or more) ports / (one or more) terminals 1516, for example, to send data to the network and receive data from the network via a wired connection. The communication interface 1506 also includes a radio front-end circuit 1518, which can be coupled to the antenna 1510, or as a part of the antenna 1510 in some embodiments. The radio front-end circuit 1518 includes a filter 1520 and an amplifier 1522. The radio front-end circuit 1518 can be connected to the antenna 1510 and the processing circuit 1502. The radio front-end circuit can be configured to adjust the signal transmitted between the antenna 1510 and the processing circuit 1502. The radio front-end circuit 1518 can receive digital data to be sent to other network nodes or UEs via a wireless connection. The radio front-end circuit 1518 can use a combination of a filter 1520 and / or an amplifier 1522 to convert the digital data into a radio signal with appropriate channel and bandwidth parameters. The radio signal may then be transmitted via antenna 1510. Similarly, when receiving data, antenna 1510 may collect the radio signal, which may then be converted into digital data by radio front end circuit 1518. The digital data may be passed to processing circuit 1502. In other embodiments, the communication interface may include different components and / or different combinations of components.

[0226] In certain alternative embodiments, the network node 1500 does not include a separate radio front end circuit 1518, but rather, the processing circuit 1502 includes the radio front end circuit and is connected to the antenna 1510. Similarly, in some embodiments, all or part of the RF transceiver circuit 1512 is part of the communication interface 1506. In still other embodiments, the communication interface 1506 includes one or more ports or terminals 1516, the radio front end circuit 1518, and the RF transceiver circuit 1512 as part of a radio unit (not shown), and the communication interface 1506 communicates with the baseband processing circuit 1514 as part of a digital unit (not shown).

[0227] Antenna 1510 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals. Antenna 1510 may be coupled to radio front end circuitry 1518 and may be any type of antenna capable of wirelessly transmitting and receiving data and / or signals. In some embodiments, antenna 1510 is separate from network node 1500 and may be connected to network node 1500 via an interface or port.

[0228] Antenna 1510, communication interface 1506 and / or processing circuit 1502 may be configured to perform any receiving operation and / or certain obtaining operations described herein as being performed by a network node. Any information, data and / or signal may be received from a UE, another network node and / or any other network device. Similarly, antenna 1510, communication interface 1506 and / or processing circuit 1502 may be configured to perform any transmitting operation described herein as being performed by a network node. Any information, data and / or signal may be transmitted to a UE, another network node and / or any other network device.

[0229] The power supply 1508 provides power to the various components of the network node 1500 in a form suitable for the respective components (e.g., at the voltage and current levels required by each respective component). The power supply 1508 may further include or be coupled to a power management circuit to power the components of the network node 1500 for performing the functionality described herein. For example, the network node 1500 may be connectable to an external power source (e.g., an electrical grid, an electrical outlet) via an input circuit or interface (such as a cable), whereby the external power source provides power to the power circuit of the power supply 1508. As a further example, the power supply 1508 may include a source of power in the form of a battery or battery pack connected to or integrated in the power circuit. If the external power source fails, the battery may provide backup power.

[0230] Apart from Fig.15Embodiments of the network node 1500 may include additional components in addition to those components shown in Figure 1 to provide certain aspects of the functionality of the network node, including any of the functionality described herein and / or any functionality required to support the subject matter described herein. For example, the network node 1500 may include a user interface device to allow information to be input into the network node 1500 and to allow information to be output from the network node 1500. This may allow a user to perform diagnostics, maintenance, repair, and other management functions for the network node 1500.

[0231] Fig.16 is a block diagram of a host 1600 according to various aspects described herein, and the host 1600 may be Fig.13 1316 of the embodiment of the host. As used herein, the host 1600 can be or include various combinations of hardware and / or software, including a stand-alone server, a blade server, a cloud-implemented server, a distributed server, a virtual machine, a container, or processing resources in a server farm. The host 1600 can provide one or more services to one or more UEs.

[0232] Host 1600 includes processing circuitry 1602, which is operatively coupled to input / output interface 1606, network interface 1608, power supply 1610, and memory 1612 via bus 1604. Other components may be included in other embodiments. The features of these components may be substantially similar to those described with respect to previous figures (such as Figure 14-15 ) so that its description is generally applicable to the corresponding components of the host 1600.

[0233] The memory 1612 may include one or more computer programs, including one or more host applications 1614 and data 1616, which may include user data, such as data generated by the UE for the host 1600 or data generated by the host 1600 for the UE. An embodiment of the host 1600 may utilize only a subset of the components shown or utilize all of the components shown. The host application 1614 may be implemented in a container-based architecture and may provide support for video codecs (e.g., Versatile Video Coding (VVC), High Efficiency Video Coding (HEVC), Advanced Video Coding (AVC), MPEG, VP9) and audio codecs (e.g., FLAC, Advanced Audio Coding (AAC), MPEG, G.711), including transcoding for multiple different categories, types or implementations of UEs (e.g., handsets, desktop computers, wearable display systems, head-up display systems). The host application 1614 may also provide user authentication and permission checks, and may periodically report health, routing, and content availability to a central node (such as a device in a core network or on its edge). Thus, the host 1600 may select and / or indicate to the UE a different host for the over-the-top service. The host application 1614 may support various protocols, such as HTTP Live Streaming (HLS) protocol, Real-Time Messaging Protocol (RTMP), Real-Time Streaming Protocol (RTSP), Dynamic Adaptive Streaming over HTTP (MPEG-DASH), etc.

[0234] Fig.17 1700 is a block diagram showing a virtualized environment 1700 in which the functions implemented by some embodiments can be virtualized. In this context, virtualization means creating a virtual version of a device or apparatus, which may include virtualizing a hardware platform, storage device, and networking resources. As used herein, virtualization can be applied to any device or component thereof described herein, and involves an implementation in which at least a portion of the functionality is implemented as one or more virtual components. Some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines (VMs), which are implemented in one or more virtual environments 1700 taken over by one or more hardware nodes in a hardware computing device such as a network node, UE, core network node, or host. In addition, in embodiments in which a virtual node does not require radio connectivity (e.g., a core network node or host), the node may be fully virtualized.

[0235] Application 1702 (which may alternatively be referred to as a software instance, a virtual appliance, a network function, a virtual node, a virtual network function, etc.) runs in a virtualized environment Q400 to implement some features, functions and / or benefits of some embodiments disclosed herein.

[0236] The hardware 1704 includes processing circuitry, memory storing software and / or instructions executable by the hardware processing circuitry, and / or other hardware devices as described herein, such as network interfaces, input / output interfaces, and the like. The software may be executed by the processing circuitry to instantiate one or more virtualization layers 1706 (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 1708a and 1708b (one or more of which may be generally referred to as VMs 1708), and / or perform any of the functions, features, and / or benefits described with respect to some embodiments described herein. The virtualization layer 1706 may present a virtual operating platform that appears to be networked hardware to the VMs 1708.

[0237] VM 1708 includes virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be run by a corresponding virtualization layer 1706. Different embodiments of instances of virtual appliances 1702 may be implemented on one or more of VMs 1708, and these implementations may be performed in different ways. In some contexts, virtualization of hardware is referred to as network function virtualization (NFV). NFV may be used to consolidate many network device types onto industry standard high-volume server hardware, physical switches, and physical storage devices, which may be located in data centers as well as client devices.

[0238] In the context of NFV, VM 1708 can be a software implementation of a physical machine that runs programs as if they were executing on a physical, non-virtualized machine. Each of VM 1708 and the portion of hardware 1704 that executes the VM (whether it is hardware dedicated to the VM and / or hardware shared by the VM with other VMs) form a separate virtual network element. Still in the context of NFV, a virtual network function is responsible for handling specific network functions running in one or more VMs 1708 on hardware 1704 and corresponds to application 1702.

[0239] The hardware 1704 may be implemented in a standalone network node with general or specialized components. The hardware 1704 may implement some functions via virtualization. Alternatively, the hardware 1704 may be part of a larger hardware cluster (e.g., such as in a data center or CPE) in which many hardware nodes work together and are managed via management and orchestration 1710, which, among other things, oversees the lifecycle management of the application 1702. In some embodiments, the hardware 1704 is coupled to one or more radio units, each of which includes one or more receivers and one or more transmitters that may be coupled to one or more antennas. The radio unit may communicate directly with other hardware nodes via one or more appropriate network interfaces, and may be used in combination with virtual components to provide a virtual node with radio capabilities, such as a radio access node or base station. In some embodiments, some signaling may be provided by using a control system 1712, which may alternatively be used for communication between hardware nodes and radio units.

[0240] Fig.18 A communication diagram showing a host 1802 communicating with a UE 1806 via a network node 1804 over a partially wireless connection according to some embodiments. Fig.18 Describe the UE discussed in the previous paragraph (such as Fig.13 UE 1312a and / or Fig.14 UE 1400), network nodes (such as Fig.13 The network node 1310a and / or Fig.15 network nodes 1500) and hosts (such as Fig.13 Host 1316 and / or Fig.16 Host 1600) according to various embodiments of the example implementation.

[0241] Similar to the host 1600, an embodiment of the host 1802 includes hardware, such as a communication interface, a processing circuit, and a memory. The host 1802 also includes software that is stored in or accessible by the host 1802 and can be executed by the processing circuit. The software includes a host application that can be operable to provide services to a remote user, such as a UE 1806 connected via an over-the-top (OTT) connection 1850 extending between the UE 1806 and the host 1802. During the provision of services to the remote user, the host application can provide user data transmitted using the OTT connection 1850.

[0242] The network node 1804 includes hardware that enables it to communicate with the host 1802 and the UE 1806. The connection 1860 can be direct or through a core network (such as Fig.13The core network 1306 of the present invention) and / or one or more other intermediate networks, such as one or more public, proprietary or managed networks. For example, the intermediate network can be a backbone network or the Internet.

[0243] UE 1806 includes hardware and software, the software is stored in UE 1806 or accessible by UE 1806, and can be executed by the processing circuit of UE. The software includes a client application, such as a World Wide Web browser or an operator-specific "app", which can be operable to provide services to human or non-human users via UE 1806 with the support of host 1802. In host 1802, the executed host application can communicate with the executed client application via an OTT connection 1850 terminated at UE 1806 and host 1802. During the provision of services to the user, the client application of the UE can receive request data from the host application of the host and provide user data in response to the request data. The OTT connection 1850 can transmit both the request data and the user data. The client application of the UE can interact with the user to generate user data, which it provides to the host application via the OTT connection 1850.

[0244] The OTT connection 1850 may extend via a connection 1860 between the host 1802 and the network node 1804 and via a wireless connection 1870 between the network node 1804 and the UE 1806 to provide a connection between the host 1802 and the UE 1806. The connection 1860 and the wireless connection 1870 over which the OTT connection 1850 may be provided have been drawn abstractly to illustrate communication between the host 1802 and the UE 1806 via the network node 1804 without explicit reference to any intermediate devices and the exact routing of messages via these devices.

[0245] As an example of transmitting data via the OTT connection 1850, in step 1808, the host 1802 provides user data, which can be performed by executing a host application. In some embodiments, the user data is associated with a specific human user interacting with the UE 1806. In other embodiments, the user data is associated with the UE 1806, which shares data with the host 1802 without explicit human interaction. In step 1810, the host 1802 initiates a transmission carrying the user data to the UE 1806. The host 1802 may initiate the transmission in response to a request issued by the UE 1806. The request may be caused by human interaction with the UE 1806, or by the operation of a client application executed on the UE 1806. According to the teachings of the embodiments described throughout the present disclosure, the transmission may pass through the network node 1804. Therefore, in step 1812, according to the teachings of the embodiments described throughout the present disclosure, the network node 1804 transmits to the UE 1806 the user data that was carried in the transmission that the host 1802 initiated. In step 1814 , UE 1806 receives the user data carried in the transmission, which may be performed by a client application executing on UE 1806 associated with a host application executed by host 1802 .

[0246] In some examples, UE 1806 executes a client application, which provides user data to host 1802. The user data may be provided in reaction or response to data received from host 1802. Therefore, in step 1816, UE 1806 may provide user data, which may be performed by executing the client application. During the provision of user data, the client application may further consider user input received from the user via the input / output interface of UE 1806. Regardless of the specific manner of providing user data, in step 1818, UE 1806 initiates the transmission of user data to host 1802 via network node 1804. In step 1820, in accordance with the teachings of the embodiments described throughout the present disclosure, network node 1804 receives user data from UE 1806 and initiates the transmission of the received user data to host 1802. In step 1822, host 1802 receives the user data carried in the transmission initiated by UE 1806.

[0247] One or more of the various embodiments improve the performance of OTT services provided to UE 1806 using OTT connection 1850 (where wireless connection 1870 forms the last leg).

[0248] In an example scenario, plant status information may be collected and analyzed by host 1802. As another example, host 1802 may process audio and video data that may have been retrieved from UE for use in creating maps. As another example, host 1802 may collect and analyze real-time data to help control vehicle congestion (e.g., control traffic lights). As another example, host 1802 may store surveillance videos uploaded by UE. As another example, host 1802 may store media content such as video, audio, VR or AR that it can broadcast, multicast or unicast to UE, or control access to media content. As other examples, host 1802 may be used for energy pricing, remote control of non-time-critical electrical loads to balance power generation demand, location services, presentation services (such as compiling charts based on data collected from remote devices, etc.), or any other function of collecting, retrieving, storing, analyzing and / or transmitting data.

[0249] In some examples, a measurement process may be provided for the purpose of monitoring data rate, latency, and other factors to be improved by one or more embodiments. In order to reconfigure the OTT connection 1850 between the host 1802 and the UE 1806 in response to changes in the measurement results, there may also be optional network functionality. The measurement process and / or the network functionality for reconfiguring the OTT connection may be implemented in the software and hardware of the host 1802 and / or the UE 1806. In some embodiments, sensors (not shown) may be deployed in other devices or in association with other devices through which the OTT connection 1850 passes; the sensors may participate in the measurement process by supplying the values ​​of the monitoring quantities exemplified above or supplying the values ​​of other physical quantities (based on these values, the software may calculate or estimate the monitoring quantities). The reconfiguration of the OTT connection 1850 may include message formats, retransmission settings, preferred routing selection, etc.; the reconfiguration does not require direct changes to the operation of the network node 1804. Such processes and functionality may be known and practiced in the art. In certain embodiments, the measurement may involve proprietary UE signaling, which facilitates the host 1802 to measure throughput, propagation time, latency, and the like. The measurements can be achieved because the software causes messages (particularly empty or 'dummy' messages) to be transmitted using the OTT connection 1850 while monitoring propagation times, errors etc.

[0250] Although the computing devices (e.g., UE, network node, host) described herein may include a combination of the hardware components shown, other embodiments may include computing devices with different combinations of components. It is to be understood that these computing devices may include any appropriate combination of hardware and / or software required to perform the tasks, features, functions, and methods disclosed herein. The determination, calculation, acquisition, or similar operations described herein may be performed by a processing circuit, which may process information by, for example, the following operations: converting the obtained information into other information, comparing the obtained information or the converted information with the information stored in the network node, and / or performing one or more operations based on the obtained information or the converted information, and making a determination as a result of the processing. In addition, although the components are depicted as a single box located within a larger box or nested within multiple boxes, in reality, the computing device may include multiple different physical components constituting a single illustrated component, and functionality may be divided between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of these components may be divided between a processing circuit and a communication interface. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware, and computationally intensive functions may be implemented in hardware.

[0251] In some embodiments, some or all of the functionality described herein may be provided by a processing circuit that executes instructions stored in a memory, which in some embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by a processing circuit, such as in a hardwired manner, without executing instructions stored on a separate or discrete device-readable storage medium. In any of those specific embodiments, the processing circuit may be configured to perform the described functionality, regardless of whether instructions stored on a non-transitory computer-readable storage medium are executed. The benefits provided by such functionality are not limited to separate processing circuits or other components of a computing device, but are generally enjoyed by the computing device as a whole and / or by end users and wireless networks.

[0252] It is noteworthy that modifications and other embodiments of the present disclosure will occur to those skilled in the art who benefit from the foregoing description and the teachings presented in the associated drawings. Therefore, it is to be understood that the present disclosure is not limited to the specific embodiments disclosed, and modifications and other embodiments are intended to be included within the scope of the present disclosure. Although specific terms may be employed herein, these terms are used only in a general and descriptive sense and not for limiting purposes.

[0253] Example embodiments of the techniques and apparatus described herein include, but are not limited to, the following examples: Group A implementation Example (API caller - access token implementation example) A1. A method performed by a communication device, the communication device being configured to call an application programming interface API to access a service, the method comprising: Transmitting a request to call an API from the communication device to the API open device, the API open device being configured to open the API; and An access token is transmitted from the communication device to the API opening device, and the access token indicates whether the resource owner agrees that the communication device accesses the protected resources of the API. A2. The method of embodiment A1, wherein an access token is included in the request. A3. The method of embodiment A1, wherein transmitting the request and the access token comprises transmitting a message including both the request and the access token to the API-exposure device. A4. The method of embodiments A1-A3, wherein transmitting the access token comprises transmitting the access token to the API open device before or simultaneously with transmitting the request to the API open device. A5. The method of any of embodiments A1-A4, wherein the access token includes consent information declaring that the resource owner agrees or disagrees with the communication device accessing protected resources of the API. A6. The method of embodiment A5, wherein the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. A7. The method of any of embodiments A1-A6, wherein the access token is an OAuth 2.0 access token. A8. The method of any one of embodiments A1-A7, wherein the API is a northbound API. A9. The method of any one of embodiments A1-A8, wherein the communication device is a user equipment. A10. The method of any of embodiments A1-A9, wherein the resource owner is a user of the communication device. A11. The method of any one of embodiments A1-A10, wherein the communication device is a network device implementing application function AF. A12. The method of any of embodiments A1-A11, wherein the access token further asserts that the communication device is authorized to access the API. A13. The method of any of embodiments A1-A12, further comprising performing the method of any of embodiments AA1-AA10. AA1. A method performed by a communication device, the communication device being configured to call an application programming interface API to access a service, the method comprising: transmitting a request for an access token from the communication device to the public API core device; and In response to the request, an access token is received, the access token indicating whether the resource owner consents to the communication device accessing protected resources of the API. AA2. The method of embodiment AA1, wherein the access token includes consent information declaring that the resource owner agrees or disagrees with the communication device accessing protected resources of the API. AA3. The method of embodiment AA2, wherein the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. AA4. The method of any of embodiments AA1-AA3, wherein the access token is an OAuth 2.0 access token. AA5. The method of any of embodiments AA1-AA4, wherein the API is a northbound API. AA6. The method of any one of embodiments AA1-AA3, wherein the communication device is a user equipment. AA7. The method of any of embodiments AA1-AA6, wherein the resource owner is a user of the communication device. AA8. The method of any of embodiments AA1-AA7, wherein the communication device is a network device implementing an application function AF. AA9. The method of any of embodiments AA1-AA8, wherein the access token further asserts that the communication device is authorized to access the API. AA10. The method of any of embodiments AA1-AA9, further comprising, before transmitting the request for the access token: transmitting an authorization request to the public API core device; and In response to the authorization request, receiving an authorization code, the authorization code being a credential representing the resource owner's authorization; Among other things, the request for an access token includes an authorization code. AA11. The method of any one of embodiments AA1-AA10, wherein the common API core device implements the CAPIF core functionality. AA12. The method of any of embodiments AA1-AA11, further comprising performing the method of any of embodiments A1-A13. Group B Embodiment (AEF—Access Token Embodiment) B1. A method performed by an application programming interface (API) opening device, the API opening device being configured to open an API to a communication device, the method comprising: receiving a request to call an API from a communication device; and An access token is received from the communication device, the access token indicating whether the resource owner consents to the communication device accessing protected resources of the API. B2. The method of embodiment B1, wherein an access token is included in the request. B3. The method of embodiment B1, wherein receiving the request and the access token comprises receiving a message from the communication device containing both the request and the access token. B4. The method of embodiments B1-B3, wherein receiving the access token includes receiving the access token before or simultaneously with receiving the request. B5. The method of any one of embodiments B1-B4, wherein the access token includes consent information declaring that the resource owner agrees or disagrees with the communication device accessing protected resources of the API. B6. The method of embodiment B5, wherein the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. B7. The method of any of embodiments B1-B6, wherein the access token is an OAuth 2.0 access token. B8. The method of any one of embodiments B1-B7, wherein the API is a northbound API. B9. The method of any one of embodiments B1-B8, wherein the communication device is a user equipment. B10. The method of any one of embodiments B1-B9, wherein the resource owner is a user of the communication device. B11. The method of any one of embodiments B1-B10, wherein the communication device is a network device implementing application function AF. B12. The method of any of embodiments B1-B11, wherein the access token further asserts that the communication device is authorized to access the API. B13. The method of any of embodiments B1-B12, wherein the access token includes one or more statements, including a statement asserting that the resource owner consents to the communication device accessing protected resources of the API, wherein the method further comprises: Validating the request against one or more claims in the access token; and Depending on the verification, the request is allowed or denied. B14. The method of any of embodiments B1-B13, further comprising receiving signaling from a public API core device indicating that a resource owner has revoked consent for the communication device to access protected resources of the API. Group C Implementation (CAPIF Core Functionality—Access Token Implementation) C1. A method performed by a public application programming interface API core device, the method comprising: receiving a request for an access token from a communications device; and In response to the request, an access token is transmitted, the access token indicating whether the resource owner consents to the communication device accessing protected resources of the API. C2. The method of embodiment C1, wherein the access token includes consent information declaring that the resource owner agrees or disagrees with the communication device accessing protected resources of the API. C3. The method of embodiment C2, wherein the consent information is a statement declaring that the resource owner agrees or disagrees with the communication device accessing the protected resources of the API. C4. The method of any of embodiments C1-C3, wherein the access token is an OAuth 2.0 access token. C5. The method of any one of embodiments C1-C4, wherein the API is a northbound API. C6. The method of any one of embodiments C1-C5, wherein the communication device is a user equipment. C7. The method of any of embodiments C1-C6, wherein the resource owner is a user of the communication device. C8. The method of any one of embodiments C1-C7, wherein the communication device is a network device implementing application function AF. C9. The method of any of embodiments C1-C8, wherein the access token further asserts that the communication device is authorized to access the API. C10. The method of any of embodiments C1-C9, further comprising, before receiving a request for an access token: receiving an authorization request from a communication device; and In response to the authorization request, transmitting an authorization code to the communication device; Among them, the request for an access token includes an authorization code; The authorization code is a credential that represents the authorization of the resource owner. C11. The method of embodiment C10, further comprising: In response to receiving the authorization request, retrieving a user consent parameter from a unified data management (UDM) device, wherein the user consent parameter indicates whether a resource owner has granted consent for the communication device to access protected resources of the API; and Generates an authorization code based on the user consent parameters. C12. The method of any one of embodiments C1-C9, further comprising: In response to receiving the request for the access token, retrieving a user consent parameter from the unified data management (UDM) device, wherein the user consent parameter indicates whether the resource owner has granted consent for the communication device to access protected resources of the API; and Generates an access token based on the user consent parameters. C13. The method of any of embodiments C1-C12, further comprising subscribing to updates of user consent parameters from a unified data management (UDM) device. C14. The method of any one of embodiments C1-C13, further comprising: receiving a notification from the unified data management (UDM) device that the resource owner has revoked consent for the communication device to access protected resources of the API; and Based on the notification, signaling is transmitted to an API opening device configured to open the API, the signaling indicating that the resource owner has revoked consent for the communication device to access protected resources of the API. Group D Embodiments (AEF—Non-Access Token Embodiments) D1. A method performed by an application programming interface (API) opening device, the API opening device being configured to open an API to a communication device, the method comprising: receiving a request to call an API from a communication device; and One or more user consent parameters are retrieved from the public API core device, the user consent parameters indicating whether the resource owner consents to the communication device accessing protected resources of the API. D2. The method of embodiment D1, wherein, in response to transmitting the request for the one or more user consent parameters to the common API core device, the one or more user consent parameters are retrieved from the common API core device. D3. The method of any of embodiments D1-D2, wherein one or more user consent parameters are retrieved from a public API core device together with authorization information indicating whether the communication device is authorized to access the API. D4. The method of embodiments D1-D3, wherein after and / or in response to receiving the request, one or more user consent parameters are retrieved. D5. The method of any one of embodiments D1-D4, wherein the API is a northbound API. D6. The method of any one of embodiments D1-D5, wherein the communication device is a user equipment. D7. The method of any of embodiments D1-D6, wherein the resource owner is a user of the communication device. D8. The method of any one of embodiments D1-D7, wherein the communication device is a network device implementing application function AF. D9. The method of any one of embodiments D1-D8 further comprises: allowing or denying the request depending on whether the resource owner agrees that the communication device can access the protected resources of the API. Group E Implementation (CAPIF Core Functionality—Non-Access Token Implementation) E1. A method performed by a public application programming interface API core device, the method comprising: receiving a request for one or more user consent parameters from the API opening device, the user consent parameters indicating whether the resource owner consents to the communication device accessing protected resources of the API; and In response to the request, one or more user consent parameters are transmitted to the API opening device. E2. The method of embodiment E1 further comprises: in response to receiving the request, retrieving one or more user consent parameters from a user data management (UDM) device. E3. The method of any of embodiments E1-E2, wherein the API is a northbound API. E4. The method of any one of embodiments E1-E3, wherein the communication device is a user equipment. E5. The method of any of embodiments E1-E4, wherein the resource owner is a user of the communication device. E6. The method of any one of embodiments E1-E5, wherein the communication device is a network device implementing application function AF. E7. The method of any of embodiments E1-E6, wherein one or more user consent parameters are transmitted together with authorization information indicating whether the communication device is authorized to access the API. Group F Example F1. A communication device configured to perform any of the steps of any of the embodiments of Group A. F2. A communication device comprising a processing circuit configured to perform any of the steps of any of the embodiments of Group A. F3. Communication equipment, the communication equipment comprising: communications circuits; and A processing circuit configured to perform any of the steps of any of the embodiments in Group A. F4. Communication equipment, the communication equipment comprising: Processing circuitry configured to perform any of the steps of any of the embodiments in Group A; and A power supply circuit is configured to supply power to the communication device. F5. Communication equipment, the communication equipment comprising: A processing circuit and a memory, the memory containing instructions, the instructions being executable by the processing circuit, whereby the communication device is configured to perform any of the steps of any of the embodiments of Group A. F6. The communication device of any one of embodiments F1-F5, wherein the communication device is a wireless communication apparatus. F7. A user equipment (UE), the UE comprising: an antenna configured to transmit and receive wireless signals; a radio front end circuit connected to the antenna and the processing circuit and configured to condition signals passed between the antenna and the processing circuit; The processing circuit is configured to perform any of the steps of any of the embodiments in Group A; an input interface connected to the processing circuitry and configured to allow information to be input into the UE for processing by the processing circuitry; an output interface connected to the processing circuit and configured to output information from the UE that has been processed by the processing circuit; and A battery is connected to the processing circuit and is configured to supply power to the UE. F8. A computer program comprising instructions which, when executed by at least one processor of a communication device, cause the communication device to perform the steps of any embodiment of Group A. F9. A carrier comprising the computer program of embodiment C7, wherein the carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium. F10. An application programming interface API open device, which is configured to execute any of the steps of any of the embodiments in Group B or Group D. F11. An application programming interface API open device, which includes a processing circuit, and the processing circuit is configured to execute any of the steps of any of the embodiments in Group B or Group D. F12. Application Programming Interface (API) open devices, including: communications circuits; and Processing circuitry configured to perform any of the steps of any of the embodiments in Group B or Group D. F13. Application Programming Interface (API) open devices, including: Processing circuitry configured to perform any of the steps of any of the embodiments of Group B or Group D; A power supply circuit is configured to supply power to the API open device. F14. Application Programming Interface (API) open devices, including: A processing circuit and a memory, the memory containing instructions, which can be executed by the processing circuit, whereby the API open device is configured to perform any of the steps of any of the embodiments in Group B or Group D. F15. The API open device of any one of embodiments F10 to F14, wherein the API open device is a base station. F16. A computer program comprising instructions which, when executed by at least one processor of an application programming interface (API) open device, cause the API open device to implement the steps of any embodiment in Group B or Group D. F17. The computer program of embodiment F16, wherein the API open device is a base station. F18. A carrier comprising the computer program of any one of embodiments F16-F17, wherein the carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium. F19. A public application programming interface API core device, which is configured to perform any of the steps of any of the embodiments in Group C or Group E. F20. A common application programming interface API core device, which includes a processing circuit configured to perform any of the steps of any of the embodiments of Group C or Group E. F21. Public application programming interface API core device, the public API core device includes: communications circuits; and Processing circuitry configured to perform any of the steps of any of the embodiments of Group C or Group E. F22. Public application programming interface API core device, the public API core device includes: Processing circuitry configured to perform any of the steps of any of the embodiments of Group C or Group E; A power supply circuit is configured to supply power to the common API core device. F23. Public application programming interface API core device, the public API core device includes: Processing circuitry and memory, the memory containing instructions executable by the processing circuitry, whereby the common API core device is configured to perform any of the steps of any of the embodiments of Group C or Group E. F24. The public API core device of any one of embodiments F19-F23, wherein the public API core device is a base station. F25. A computer program comprising instructions which, when executed by at least one processor of a common application programming interface API core device, cause the common API core device to perform the steps of any embodiment of group C or group E. F26. The computer program of embodiment F25, wherein the common API core device is a base station. F27. A carrier comprising the computer program of any one of embodiments F25-F26, wherein the carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium. G Group Example G1. A communication system comprising a host computer, comprising: processing circuitry configured to provide user data; and a communication interface configured to forward user data to a cellular network for transmission to a user equipment (UE), The cellular network includes a base station having a radio interface and a processing circuit, wherein the processing circuit of the base station is configured to perform Any of the steps of any of the embodiments in the BE group of embodiments. G2. The communication system of the previous embodiment further includes a base station. G3. The communication system of the previous two embodiments further includes a UE, wherein the UE is configured to communicate with the base station. G4. The communication system of the preceding three embodiments, wherein: The processing circuitry of the host computer is configured to execute a host application, thereby providing user data; and The UE includes a processing circuit configured to execute a client application associated with a host application. G5. A method implemented in a communication system including a host computer, a base station and a user equipment (UE), the method comprising: At the host computer, providing user data; and At a host computer, a transmission carrying user data is initiated to a UE via a cellular network including a base station, wherein the base station performs any of the steps of any of the embodiments of the BE group. G6. The method of the previous embodiment further includes: transmitting user data at the base station. G7. The method of the previous two embodiments, wherein user data is provided on a host computer by executing a host application, and the method further comprises: executing a client application associated with the host application on a UE. G8. A user equipment (UE) configured to communicate with a base station, the UE comprising a processing circuit and a radio interface configured to perform any of the preceding three embodiments. G9. A communication system including a host computer, comprising: processing circuitry configured to provide user data; and a communication interface configured to forward user data to a cellular network for transmission to a user equipment (UE), The UE comprises a radio interface and a processing circuit, and the components of the UE are configured to perform any of the steps of any of the embodiments in Group A. G10. The communication system of the previous embodiment, wherein the cellular network further includes a base station configured to communicate with the UE. G11. The communication system of the previous two embodiments, wherein: The processing circuitry of the host computer is configured to execute a host application, thereby providing user data; and The processing circuitry of the UE is configured to execute a client application associated with a host application. G12. A method implemented in a communication system including a host computer, a base station and a user equipment (UE), the method comprising: At the host computer, providing user data; and At a host computer, a transmission carrying user data is initiated to a UE via a cellular network including a base station, wherein the UE performs any of the steps of any of the embodiments in Group A. G13. The method of the previous embodiment further includes: at the UE, receiving user data from the base station. G14. A communication system including a host computer, comprising: A communication interface configured to receive user data originating from a transmission from a user equipment (UE) to a base station, wherein the UE comprises a radio interface and a processing circuit, and the processing circuit of the UE is configured to perform any of the steps of any of the embodiments in Group A. G15. The communication system of the previous embodiment further includes a UE. G16. The communication system of the previous two embodiments further includes a base station, wherein the base station includes a radio interface configured to communicate with the UE, and a communication interface configured to forward user data carried by the transmission from the UE to the base station to the host computer. G17. The communication system of the preceding three embodiments, wherein: The processing circuitry of the host computer is configured to execute a host application; and The processing circuitry of the UE is configured to execute a client application associated with the host application, thereby providing user data. G18. The communication system of the preceding four embodiments, wherein: The processing circuitry of the host computer is configured to execute the host application, thereby providing the requested data; and The processing circuitry of the UE is configured to execute a client application associated with the host application, thereby providing user data in response to the request data. G19. A method implemented in a communication system including a host computer, a base station and a user equipment (UE), the method comprising: At a host computer, user data transmitted from a UE to a base station is received, wherein the UE performs any of the steps of any of the embodiments in Group A. G20. The method of the previous embodiment further includes: at the UE, providing user data to the base station. G21. The method of the above two embodiments further comprises: At the UE, executing a client application, thereby providing user data to be transmitted; and On the host computer, a host application associated with the client application is executed. G22. The method of the above three embodiments further comprises: On the UE, executing the client application; and At the UE, receiving input data for the client application, the input data being provided at the host computer by executing a host application associated with the client application, Therein, user data to be transmitted is provided by a client application in response to input data. G23. A communication system comprising a host computer, the host computer comprising a communication interface, the communication interface being configured to receive user data originating from a transmission from a user equipment (UE) to a base station, wherein the base station comprises a radio interface and a processing circuit, the processing circuit of the base station being configured to perform any of the steps of any of the embodiments of the BE group. G24. The communication system of the previous embodiment further includes a base station. G25. The communication system of the previous two embodiments further includes a UE, wherein the UE is configured to communicate with the base station. G26. The communication system of the preceding three embodiments, wherein: The processing circuitry of the host computer is configured to execute a host application; The UE is configured to execute a client application associated with a host application, thereby providing user data to be received by the host computer. G27. A method implemented in a communication system including a host computer, a base station and a user equipment (UE), the method comprising: At a host computer, user data originating from a transmission that the base station has received from a UE is received from a base station, wherein the UE performs any of the steps of any of the embodiments in Group A. G28. The method of the previous embodiment further includes: at the base station, receiving user data from the UE. G29. The method of the previous two embodiments further includes: at the base station, initiating transmission of the received user data to the host computer.

Claims

1. A method performed by a communication device (16), the communication device (16) being configured to call an application programming interface API (14) to access a service, the method comprising: transmitting (120) a request (18) to call the API (14) from the communication device (16) to an API opening device (12), the API opening device (12) being configured to open the API (14); and An access token (20) is transmitted (130) from the communication device (16) to the API opening device (12), the access token (20) indicating whether a resource owner (24) agrees (26) that the communication device (16) access a protected resource (22) of the API (14).

2. The method according to claim 1, wherein: The access token (20) is included in the request (18), or wherein transmitting the request (18) and the access token (20) includes transmitting a message including both the request (18) and the access token (20) to the API opening device (12).

3. The method according to claim 1-2, wherein: Transmitting the access token (20) includes transmitting the access token (20) to the API opening device (12) before or simultaneously with transmitting the request (18) to the API opening device (12).

4. The method according to any one of claims 1 to 3, wherein: The access token (20) includes a statement asserting that the resource owner (24) approves (26) or disapproves of the communication device (16) accessing the protected resource (22) of the API (14).

5. The method according to any one of claims 1 to 4, wherein: The access token (20) also asserts that the communication device (16) is authorized to access the API (14).

6. The method according to any one of claims 1 to 5, wherein: The resource owner (24) is a user of the communication device (16).

7. The method according to any one of claims 1 to 6, further comprising: transmitting a request (30) for an access token (40) from the communication device (16) to a public API core device; as well as In response to the request (30), the access token (40) is received.

8. The method of claim 7, further comprising, prior to transmitting the request (30) for the access token (40): transmitting an authorization request to the public API core device; and In response to the authorization request, receiving an authorization code, the authorization code being a certificate representing authorization by the resource owner (24); in, The request (30) for the access token (40) includes the authorization code.

9. A method performed by an application programming interface (API) opening device (12), wherein the API opening device (12) is configured to open an API (14) to a communication device (16), the method comprising: receiving (200) a request (18) to invoke the API (14) from the communication device (16); as well as An access token (20) is received (210) from the communication device (16), the access token (20) indicating whether a resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14).

10. The method according to claim 9, wherein: The access token (20) is included in the request (18), or wherein receiving the request (18) and the access token (20) includes receiving a message from the communication device (16) including both the request (18) and the access token (20).

11. The method according to claims 9-10, wherein: Receiving the access token (20) includes receiving the access token (20) prior to or simultaneously with receiving the request (18).

12. The method according to any one of claims 9 to 11, wherein: The access token (20) includes a statement asserting that the resource owner (24) approves (26) or disapproves of the communication device (16) accessing the protected resource (22) of the API (14).

13. The method according to any one of claims 9 to 12, wherein: The access token (20) also asserts that the communication device (16) is authorized to access the API (14).

14. The method according to any one of claims 9 to 13, wherein: The resource owner (24) is a user of the communication device (16).

15. The method according to any one of claims 9 to 14, wherein: The access token (20) includes one or more claims, including a claim asserting that the resource owner (24) consents (26) to the communication device (16) accessing the protected resource (22) of the API (14), wherein the method further comprises: verifying the request (18) against the one or more claims in the access token (20); and Depending on the verification, the request is allowed or denied (18).

16. The method according to any one of claims 9 to 15, further comprising: Signaling is received from a public API core device indicating that the resource owner (24) has revoked consent (26) for the communication device (16) to access the protected resource (22) of the API (14).

17. A method performed by a public application programming interface (API) core device (28), the method comprising: receiving a request (30) for an access token (40) from a communication device (16); as well as In response to the request (30), an access token (20) is transmitted, the access token (20) indicating whether a resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14).

18. The method according to claim 17, wherein: The access token (20) includes a statement asserting that the resource owner (24) approves (26) or disapproves of the communication device (16) accessing the protected resource (22) of the API (14).

19. The method according to any one of claims 17-18, wherein: The resource owner (24) is a user of the communication device (16).

20. The method according to any one of claims 17 to 19, wherein: The access token (20) also asserts that the communication device (16) is authorized to access the API (14).

21. The method according to any of claims 17-20, further comprising, before receiving the request (30) for the access token (40): receiving an authorization request from the communication device (16); In response to receiving the authorization request, a user consent parameter (32) is retrieved from a unified data management (UDM) device, wherein: The user consent parameter (32) indicates whether the resource owner (24) has granted consent (26) for the communication device (16) to access the protected resource (22) of the API (14); as well as generating an authorization code based on the user consent parameter (32); In response to the authorization request, transmitting the authorization code to the communication device (16); wherein said request (30) for said access token (40) comprises said authorization code; The authorization code is a certificate indicating the authorization of the resource owner (24).

22. The method according to any one of claims 17 to 20, further comprising: in response to receiving the request (30) for the access token (40), retrieving a user consent parameter (32) from a unified data management (UDM) device, wherein the user consent parameter (32) indicates whether the resource owner (24) has granted consent (26) for the communication device (16) to access the protected resource (22) of the API (14); and The access token (40) is generated based on the user consent parameter (32).

23. The method according to any one of claims 17 to 22, further comprising: receiving a notification from a unified data management (UDM) device that the resource owner (24) has revoked consent (26) for the communication device (16) to access the protected resource (22) of the API (14); as well as Based on the notification, signaling is transmitted to an API opening device (12) configured to open the API (14), the signaling indicating that the resource owner (24) has revoked consent (26) for the communication device (16) to access the protected resource (22) of the API (14).

24. A method performed by an application programming interface (API) opening device (12), the API opening device (12) being configured to open an API (14) to a communication device (16), the method comprising: Receiving a request (18) to call the API (14) from the communication device (16); as well as One or more user consent parameters (32) are retrieved from a public API core device (28), the user consent parameters (32) indicating whether a resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14).

25. The method according to claim 24, wherein: In response to transmitting a request (36) for the one or more user consent parameters (32) to the common API core device (28), the one or more user consent parameters (32) are retrieved from the common API core device (28).

26. The method according to any one of claims 24-25, wherein: The one or more user consent parameters (32) are retrieved from the public API core device (28) along with authorization information indicating whether the communication device (16) is authorized to access the API (14).

27. The method according to any one of claims 24 to 26, wherein: After and / or in response to receiving the request (36), the one or more user consent parameters (32) are retrieved.

28. The method according to any one of claims 24 to 27, wherein: The resource owner (24) is a user of the communication device (16).

29. The method according to any one of claims 24-28, further comprising: The request (18) is allowed or denied depending on whether the resource owner (24) consents (26) to the communication device (16) accessing the protected resource (22) of the API (14).

30. A method performed by a public application programming interface API core device (28), the method comprising: receiving a request (36) from the API opening device (12) for one or more user consent parameters (32) indicating whether the resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14); and In response to the request (36), the one or more user consent parameters (32) are transmitted to the API opening device (12).

31. The method of claim 30, further comprising: In response to receiving the request (36), the one or more user consent parameters (32) are retrieved from a user data management (UDM) device (34).

32. The method according to any one of claims 30-31, wherein: The resource owner (24) is a user of the communication device (16).

33. The method according to any one of claims 30 to 32, wherein: The one or more user consent parameters (32) are transmitted along with authorization information indicating whether the communication device (16) is authorized to access the API (14).

34. A communication device (16), the communication device (16) being configured to call an application programming interface API (14) to access a service, the communication device (16) comprising: Communications circuitry (1020); and A processing circuit (1010), wherein the processing circuit (1010) is configured to: Transmitting a request (18) for calling the API (14) from the communication device (16) to an API opening device (12), the API opening device (12) being configured to open the API (14); and An access token (20) is transmitted from the communication device (16) to the API opening device (12), the access token (20) indicating whether a resource owner (24) agrees (26) that the communication device (16) access a protected resource (22) of the API (14).

35. The communication device (16) of claim 34, the processing circuit (1010) being configured to perform the method of any one of claims 2-8.

36. An application programming interface (API) opening device (12), the API opening device (12) being configured to open an API (14) to a communication device (16), the API opening device (12) comprising: Communication circuit (1120); as well as A processing circuit (1110), wherein the processing circuit (1110) is configured to: receiving a request (18) from the communication device (16) to invoke the API (14); and An access token (20) is received from the communication device (16), the access token (20) indicating whether a resource owner (24) has consented (26) to the communication device (16) accessing a protected resource (22) of the API (14).

37. The API opening device (12) according to claim 36, wherein the processing circuit (1110) is configured to execute the method of any one of claims 10-16.

38. A public application programming interface API core device (28), the public API core device (28) comprising: Communication circuit (1220); as well as A processing circuit (1210), wherein the processing circuit (1210) is configured to: receiving a request (30) for an access token (40) from a communication device (16); and In response to the request (30), an access token (20) is transmitted, the access token (20) indicating whether a resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14).

39. The common API core device (28) according to claim 38, the processing circuit (1210) being configured to perform the method of any one of claims 18-23.

40. An application programming interface (API) opening device (12), the API opening device (12) being configured to open an API (14) to a communication device (16), the API opening device (12) comprising: Communication circuit (1120); as well as A processing circuit (1110), wherein the processing circuit (1110) is configured to: receiving a request (18) from the communication device (16) to invoke the API (14); and One or more user consent parameters (32) are retrieved from a public API core device (28), the user consent parameters (32) indicating whether a resource owner (24) consents (26) to the communication device (16) accessing a protected resource (22) of the API (14).

41. The API opening device (12) according to claim 40, wherein the processing circuit (1110) is configured to execute the method of any one of claims 25-29.

42. A computer program comprising instructions which, when executed by at least one processor of a communication device (16), causes the communication device (16) to perform the method of any one of claims 1-8.

43. A computer program comprising instructions, which, when executed by at least one processor of an application programming interface (API) open device (12), causes the API open device (12) to perform the method of any one of claims 9 to 16 or any one of claims 24 to 29.

44. A computer program comprising instructions which, when executed by at least one processor of a common application programming interface API core device (28), causes the common API core device (28) to perform the method of any one of claims 17-23 or any one of claims 30-33.

45. A carrier comprising the computer program of any one of claims 42 to 44, wherein: The carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium.

Images