Method, apparatus and computer program

Abstract

A method and apparatus for communication, the method may include initiating, by a network function instance, an authentication process to authenticate a digital asset based on a request to authenticate a digital asset for the network function instance of a core domain of a mobile communication system, and based on a configuration of the network function instance; and responding, by the network function instance, to the request based on a result of the authentication process.

Description

Technical Field

[0001] The present application relates to a method, an apparatus and a computer program, and in particular but not limited to a method, an apparatus and a computer program for digital asset authentication in a mobile communication system. Background Art

[0002] The user's digital assets may include, for example, digital representations of user information and / or user documents, such as a passport, social security number, avatar, driver's license, insurance policy, etc. These digital assets may be stored in the user's digital asset container (DAC) via one or more instances of a network function of the core domain of the mobile communication system (hereinafter referred to as a digital asset container network function (DAC-NF)). Summary of the invention

[0003] A method includes: based on a request for authenticating a digital asset by a network function instance for a core domain of a mobile communication system, and based on the configuration of the network function instance, the network function instance initiates an authentication process to authenticate the digital asset; and the network function instance responds to the request based on the result of the authentication process.

[0004] The authentication process may include: calling one or more application programming interfaces that the network function instance is configured to use for digital asset authentication.

[0005] The authentication process may include: calling one or more application programming interfaces where the network function is configured to obtain one or more application programming interfaces for digital asset authentication.

[0006] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more digital certificate authorities.

[0007] The request may include a digital image, and the authentication process may include creating a digital representation of at least a portion of the image, and comparing the digital representation to an authentication reference.

[0008] The method may include receiving a message sent by a management function instance of an operation, administration, and maintenance system of a mobile communication system, wherein the message configures the network function instance to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0009] The method may include receiving a message sent by a management function instance of an operation, administration, and maintenance system of a mobile communication system, wherein the message configures the network function instance for one or more digital asset authentication processes of a digital asset authentication service.

[0010] The method may include: sending, by a network function instance, a request to a network repository function instance to create one or more resource profiling services provided by the network function instance; wherein the one or more resources indicate one or more types of digital assets to which the network function instance provides digital asset authentication services, and one or more digital asset authentication processes are used by the network function instance for the digital asset authentication services.

[0011] The request to authenticate the digital asset may include the digital asset; and the method may include storing, by the network function instance, the digital asset and an authentication status of the digital asset based on a result of an authentication process to authenticate the digital asset.

[0012] A method includes: receiving a request for digital asset authentication from a user device by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; determining a network function instance of the core domain of the mobile communication system that opens services related to digital asset authentication; sending a request by the application function instance to the determined network function instance of the mobile communication system for providing the service; and sending a message by the application function instance to the user device based on a response to the request to provide the service to the determined network function instance.

[0013] The determining may include sending a request for a network repository function of a core domain of the mobile communication system to provide information to the application function instance, the information being about one or more network function instances of the core domain of the service of the open digital asset.

[0014] The method may include formulating a request for the determined network function instance of the mobile communication system to provide a service based on information provided by the network repository function instance regarding one or more authentication procedures used by the determined network function instance.

[0015] Services may include authenticating digital assets.

[0016] The service may include providing an indication of an authentication status recorded by the network function instance for the digital asset.

[0017] The request for the service provided by the application function instance may be sent via the network open function of the core domain of the mobile communication system.

[0018] A method includes: creating, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system; receiving, by the network repository function instance, a request for information provided by an application function instance, the information being about one or more network function instances of a core domain that expose one or more digital asset authentication services; and sending, by the network repository function instance, a response to the request based on the resources.

[0019] Resources created by a network repository function instance may indicate one or more digital asset authentication procedures that are used by one or more network function instances that expose one or more digital asset authentication services; and responses from application function instances may indicate one or more digital asset authentication procedures.

[0020] Creating resources can be based on one or more requests by one or more network function instances of a core domain that exposes one or more digital asset authentication services.

[0021] A method includes: a management function instance of an operation, management and maintenance system of a mobile communication system sends a message, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0022] The method may further include: sending a message by the management function instance, the message configuring the network function instance for one or more digital asset authentication processes of the digital asset authentication service.

[0023] Configuring a network function instance for one or more digital asset authentication processes may include one or more of the following: specifying one or more application programming interfaces for the network function instance for digital asset authentication; or specifying one or more application programming interfaces for the network function instance for obtaining one or more application programming interfaces for digital asset authentication.

[0024] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more certificate authorities.

[0025] A method comprises: sending a request for an application function instance from a user device via a mobile wireless access network of a mobile communication system, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request involves authenticating a digital asset; and receiving authentication status information of the digital asset in response to the request at the user device.

[0026] A device includes components for: based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset, and based on the configuration of the network function instance, initiating an authentication process by the network function instance to authenticate the digital asset; and responding to the request by the network function instance based on the result of the authentication process.

[0027] The authentication process may include: calling one or more application programming interfaces of the network function instance configured for digital asset authentication.

[0028] The authentication process may include: calling one or more application programming interfaces where the network function is configured to obtain one or more application programming interfaces for digital asset authentication.

[0029] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more digital certificate authorities.

[0030] The request may include a digital image, and the authentication process may include creating a digital representation of at least a portion of the image, and comparing the digital representation to an authentication reference.

[0031] The device may include a component for receiving a message sent by a management function instance of an operation, administration, and maintenance system of a mobile communication system, wherein the message configures the network function instance to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0032] The apparatus may include means for receiving a message sent by a management function instance of an operation, administration and maintenance system of a mobile communication system, wherein the message configures the network function instance for one or more digital asset authentication processes of a digital asset authentication service.

[0033] The device may include a component for sending, by a network function instance, a request for a network repository function instance to create one or more resource profiling services provided by the network function instance; wherein the one or more resources indicate one or more types of digital assets for which the network function instance provides digital asset authentication services, and wherein one or more digital asset authentication processes are used by the network function instance for the digital asset authentication services.

[0034] The request to authenticate the digital asset may include the digital asset; and the apparatus may include a component for storing the digital asset and an authentication status of the digital asset based on a result of an authentication process to authenticate the digital asset by the network function instance.

[0035] A device includes components for the following items: receiving a request for digital asset authentication from a user device by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; determining a network function instance of the core domain of the mobile communication system that opens services related to digital asset authentication; sending a request by the application function instance for the determined network function instance of the mobile communication system to provide the service; and sending a message by the application function instance to the user device based on a response to the request for the determined network function instance to provide the service.

[0036] The determining may include sending a request for a network repository function of a core domain of the mobile communication system to provide information to the application function instance regarding one or more network function instances of the core domain of the service of the open digital asset.

[0037] The apparatus may include means for formulating a request to provide a service to the determined network function instance of the mobile communication system based on information provided by the network repository function instance regarding one or more authentication procedures used by the determined network function instance.

[0038] The service may include authenticating the digital asset.

[0039] The service may include providing an indication of the authentication status of the network function instance with respect to the digital asset record.

[0040] The request for service provided by the application function instance may be sent via a network open function of a core domain of the mobile communication system.

[0041] A device includes components for: creating, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system; receiving, by the network repository function instance, a request for information provided by an application function instance, the information being about one or more network function instances of a core domain that expose one or more digital asset authentication services; and sending, by the network repository function instance, a response to the request based on the resources.

[0042] Resources created by a network repository function instance may indicate one or more digital asset authentication processes, one or more digital asset authentication processes used by one or more network function instances that expose one or more digital asset authentication services; and responses from application function instances may indicate one or more digital asset authentication processes.

[0043] Creating resources can be based on one or more requests to open one or more network function instances of the core domain of one or more digital asset authentication services.

[0044] A device includes components for the following items: a management function instance of an operation, management and maintenance system of a mobile communication system sends a message, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0045] The apparatus may further include means for sending, by the management function instance, a message that configures the network function instance for one or more digital asset authentication processes of the digital asset authentication service.

[0046] Configuring a network function instance for one or more digital asset authentication processes may include one or more of the following: specifying one or more application programming interfaces for the network function instance for digital asset authentication; or specifying one or more application programming interfaces for the network function instance for obtaining one or more application programming interfaces for digital asset authentication.

[0047] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more certificate authorities.

[0048] An apparatus, comprising means for: sending, via a mobile radio access network of a mobile communication system, a request for an application function instance, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request relates to authentication of a digital asset; and

[0049] Authentication status information of the digital asset is received in response to the request.

[0050] A device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to execute: based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset, and based on a configuration of the network function instance, initiating an authentication process by the network function instance to authenticate the digital asset; and responding to the request by the network function instance based on a result of the authentication process.

[0051] The authentication process may include calling one or more application programming interfaces that the network function instance is configured to use for digital asset authentication.

[0052] The authentication process may include calling one or more application programming interfaces where the network function is configured to obtain one or more application programming interfaces for digital asset authentication.

[0053] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more digital certificate authorities.

[0054] The request may include a digital image, and the authentication process may include creating a digital representation of at least a portion of the image, and comparing the digital representation to an authentication reference.

[0055] At least one memory and computer program code may be configured, together with at least one processor, to cause the apparatus to: receive a message sent by a management function instance of an operation, management and maintenance system of a mobile communication system, wherein the message configures the network function instance to create one or more resources for one or more user profiles of one or more users, wherein the user profiles indicate one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0056] At least one memory and computer program code can be configured to, together with at least one processor, cause the device to: receive a message sent by a management function instance of an operation, management and maintenance system of a mobile communication system, wherein the message configures the network function instance for one or more digital asset authentication processes for a digital asset authentication service.

[0057] At least one memory and computer program code may be configured, together with at least one processor, such that the apparatus: a network function instance sends a request for a network repository function instance to create one or more resource profiling services provided by the network function instance; wherein the one or more resources indicate one or more types of digital assets for which the network function instance provides digital asset authentication services, and one or more digital asset authentication processes are used by the network function instance for the digital asset authentication services.

[0058] The request to authenticate a digital asset may include a digital asset; and at least one memory and computer program code may be configured to, together with at least one processor, cause the device to: based on the results of an authentication process for authenticating the digital asset, store the digital asset and the authentication status of the digital asset by a network function instance.

[0059] A device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to perform: receiving a request for digital asset authentication from a user device by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; determining a network function instance of the core domain of the mobile communication system, which network function instance exposes services related to digital asset authentication; sending a request for a determined network function instance of the mobile communication system to provide a service; and sending a message to the user device by the application function instance based on a response to the request for a determined network function instance to provide a service.

[0060] The determining may include sending a request for a network repository function of a core domain of the mobile communication system to provide information to the application function instance regarding one or more network function instances of the core domain of the service of the open digital asset.

[0061] At least one memory and computer program code may be configured, together with at least one processor, to cause the apparatus to: formulate a request for a determined network function instance of a mobile communication system to provide a service based on information provided by the network repository function instance about one or more authentication processes used by the determined network function instance.

[0062] The service may include authenticating the digital asset.

[0063] The service may include providing an indication of an authentication status recorded by the network function instance for the digital asset.

[0064] The request for service provided by the application function instance may be sent via a network open function of a core domain of the mobile communication system.

[0065] A device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to perform: creating, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system; receiving, by the network repository function instance, a request for an application function instance to provide information about one or more network function instances of a core domain that expose one or more digital asset authentication services; and sending, by the network repository function instance, a response to the request based on resources.

[0066] Resources created by a network repository function instance may indicate one or more digital asset authentication processes, one or more digital asset authentication processes used by one or more network function instances that expose one or more digital asset authentication services; and responses from application function instances may indicate one or more digital asset authentication processes.

[0067] Creating resources can be based on one or more requests to open one or more network function instances of the core domain of one or more digital asset authentication services.

[0068] A device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to execute: a management function instance of an operation, management, and maintenance system of a mobile communication system sends a message, wherein the message configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0069] The at least one memory and the computer program code may be configured to, together with the at least one processor, cause the apparatus to: send, by the management function instance, a message that configures the network function instance for one or more digital asset authentication processes of the digital asset authentication service.

[0070] Configuring a network function instance for one or more digital asset authentication processes may include one or more of the following: specifying one or more application programming interfaces for the network function instance for digital asset authentication; or specifying one or more application programming interfaces for the network function instance for obtaining one or more application programming interfaces for digital asset authentication.

[0071] The one or more application programming interfaces for digital asset authentication may include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more certificate authorities.

[0072] A device comprises: at least one processor; and at least one memory comprising computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to perform: sending a request for an application function instance via a mobile wireless access network of a mobile communication system, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request involves authentication of a digital asset; and receiving authentication status information of the digital asset in response to the request.

[0073] A device includes: an initiating circuit system for authenticating a digital asset based on a request for a network function instance of a core domain of a mobile communication system, and based on the configuration of the network function instance, initiating an authentication process by the network function instance to authenticate the digital asset; and a responding circuit system for responding to the request by the network function instance based on the result of the authentication process.

[0074] A device includes: a receiving circuit system for receiving a request for digital asset authentication from a user device by an application function instance, the application function instance being configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; a determining circuit system for determining a network function instance of a core domain of a mobile communication system that opens services related to digital asset authentication; a sending circuit system for sending a request for a service provided by a determined network function instance of the mobile communication system by the application function instance; and a sending circuit system for sending a message to the user device by the application function instance based on a response to the request for a service provided by the determined network function instance.

[0075] A device includes: a creating circuit system for creating, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system; a receiving circuit system for receiving, by the network repository function instance, a request for information provided by an application function instance, the information being about one or more network function instances of a core domain that expose one or more digital asset authentication services; and a sending circuit system for sending, by the network repository function instance, a response to the request based on resources.

[0076] A device includes: a sending circuit system, which is used for a management function instance of an operation, management and maintenance system of a mobile communication system to send a message, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0077] A device includes: a sending circuit system for sending a request for an application function instance via a mobile wireless access network of a mobile communication system, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request is related to authentication of a digital asset; and a receiving circuit system for receiving authentication status information of the digital asset in response to the request.

[0078] The computer readable medium includes program instructions stored thereon for executing:

[0079] Based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset and based on the configuration of the network function instance, the network function instance initiates an authentication process to authenticate the digital asset; and the network function instance responds to the request based on a result of the authentication process.

[0080] The computer readable medium includes program instructions stored thereon for executing:

[0081] An application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system receives a request for authentication of a digital asset from a user device; determines a network function instance of the core domain of the mobile communication system that opens services related to digital asset authentication; sends a request for a service provided by the determined network function instance of the mobile communication system; and based on a response to the request for a service provided by the determined network function instance, sends a message to the user device.

[0082] A computer readable medium including program instructions stored thereon for executing:

[0083] A network repository function instance creates a resource profiling service provided by a network function instance of a core domain of a mobile communication system; the network repository function instance receives a request for information provided by an application function instance, the information being about one or more network function instances of a core domain that expose one or more digital asset authentication services; and the network repository function instance sends a response to the request based on the resources.

[0084] A computer readable medium including program instructions stored thereon for executing:

[0085] A message is sent by a management function instance of an operation, management and maintenance system of a mobile communication system, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profiles indicate one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0086] A computer readable medium including program instructions stored thereon for executing:

[0087] sending, from a user equipment via a mobile radio access network of a mobile communication system, a request for an application function instance, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request involves authentication of a digital asset; and

[0088] Authentication status information of the digital asset is received at the user device in response to the request.

[0089] A non-transitory computer-readable medium, including program instructions stored thereon, for executing: based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset, and based on the configuration of the network function instance, the network function instance initiates an authentication process to authenticate the digital asset; and the network function instance responds to the request based on the result of the authentication process.

[0090] A non-transitory computer-readable medium includes program instructions stored thereon, for executing: receiving a request for digital asset authentication from a user device by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; determining a network function instance of the core domain of the mobile communication system that opens services related to digital asset authentication; sending a request by the application function instance for the determined network function instance of the mobile communication system to provide the service; and sending a message by the application function instance to the user device based on a response to the request for the determined network function instance to provide the service.

[0091] A non-transitory computer-readable medium including program instructions stored thereon for performing: creating, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system;

[0092] A network repository function instance receives a request for an application function instance to provide information about one or more network function instances that expose a core domain of one or more digital asset authentication services; and the network repository function instance sends a response to the request based on the resources.

[0093] A non-transitory computer-readable medium, including program instructions stored thereon, for executing: a management function instance of an operation, management and maintenance system of a mobile communication system sends a message, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0094] A non-transitory computer-readable medium, comprising program instructions stored thereon, for executing: sending, from a user equipment via a mobile radio access network of a mobile communication system, a request for an application function instance, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request involves authentication of a digital asset;

[0095] Authentication status information of the digital asset is received at the user device in response to the request.

[0096] A computer program including computer executable code, which, when executed on at least one processor, is configured to cause the device to at least: based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset and based on the configuration of the network function instance, initiate an authentication process by the network function instance to authenticate the digital asset; and respond to the request by the network function instance based on the result of the authentication process.

[0097] A computer program including computer executable code, which, when executed on at least one processor, is configured to cause a device to at least: receive a request for digital asset authentication from a user device by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system; determine a network function instance of the core domain of the mobile communication system, which network function instance exposes services related to digital asset authentication; send a request by the application function instance for the determined network function instance of the mobile communication system to provide the service; and send a message by the application function instance to the user device based on a response to the request for the determined network function instance to provide the service.

[0098] A computer program including computer executable code, which, when executed on at least one processor, is configured to cause a device to at least: create, by a network repository function instance, a resource profiling service provided by a network function instance of a core domain of a mobile communication system; receive, by the network repository function instance, a request for an application function instance to provide information about one or more network function instances of a core domain that expose one or more digital asset authentication services; and send, by the network repository function instance, a response to the request based on resources.

[0099] A computer program comprising computer executable code, which, when executed on at least one processor, is configured to cause a device to at least: send a message by a management function instance of an operation, management and maintenance system of a mobile communication system, which configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

[0100] A computer program comprising computer executable code, which, when executed on at least one processor, is configured to cause a user device to at least: send a request for an application function instance via a mobile wireless access network of a mobile communication system, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request is related to authentication of a digital asset; and receive authentication status information of the digital asset in response to the request.

[0101] In the above, many different embodiments have been described. It should be understood that further embodiments may be provided by combining any two or more of the above embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] Embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0103] Figure 1 shows a system representation according to some example embodiments;

[0104] Figure 2 shows a control device representation according to some example embodiments;

[0105] Figure 3 shows a representation of an apparatus according to some example embodiments;

[0106] Figure 4 shows example operational representations of OAM-MF, DAC-NF and NRF according to some example embodiments;

[0107] Figure 5 shows example operational representations of a DAC-NF, NRF, AF, and UE according to some example embodiments;

[0108] Figure 6 shows an example operational representation of a DAC-NF according to some example embodiments; and

[0109] Figure 7 shows an example operational representation of a DAC-NF according to some example embodiments; DETAILED DESCRIPTION

[0110] Figure 1A schematic representation of some elements of the 3GPP 5G mobile communication system (5GS) is shown. The 5GS includes a 5G radio access network (5GRAN) or next generation radio access network (NG-RAN) for enabling wireless access between terminals or user equipment (UE) and the 5G core network (5GC) of the 5GS. The 5GC adopts an open and modular service platform: a service-based architecture (SBA). The SBA provides a cloud-native service framework, where mobile core network functions (authentication, mobility management, etc.) are supported by network function (NF) instances, which are self-sufficient software applications that can run on hardware hosted on cloud infrastructure. The services exposed by one NF instance (service producer) to another NF instance (service consumer) are described using application programming interface (API) specifications, which identify accessible service data sets and indicate authorized operations on these service data. The NF instances of the core domain are interconnected on a logical shared infrastructure including the CN domain message bus 108. The NF instances provide services via the CN domain message bus 108, and any other authorized NF instances can access these services through APIs (application programming interfaces), which are called service-based interfaces (SBIs). One of the network functions includes a Network Repository Function (NRF) that all network function instances can access to discover services available in the core domain and retrieve information for interacting with network function instances that support the services.

[0111] The services exposed by the network functions of the core domain can also be exposed to the application functions (AF) of the AF domain through the network exposure function (NEF) of the core domain, through the CN domain message bus 108, the inter-domain message bus 104 and the AF domain message bus 106. NEF exposes the security API to the AF. The management of 5GS is implemented through the management function (MF) of the operation, administration and maintenance (OAM) system. The MF instance of the OAM system can configure one or more NF instances via the OAM domain message bus 102, the inter-domain message bus 104 and the CN domain message bus 108.

[0112] The core domains of 5GS include Figure 1 one or more instances of other network functions not shown in the diagram, such as a Network Slice Selection Function (NSSF), a Policy Control Function (PCF), a Unified Data Management (UDM), and an Authentication Server Function (AUSF); and Figure 1 One or more instances of the network functions shown in , including the network functions described above and one or more instances of the access and mobility management function (AMF) and the session management function (SMF).

[0113] 5G-RAN may include one or more gNodeBs (GNBs) or one or more gNodeB (GNB) distributed unit functions connected to one or more gNodeB (GNB) centralized unit functions. The gNB is part of the user plane and provides access between the UE and one or more data networks (DNs) via one or more user plane function (UPF) instances.

[0114] Figure 2 Explained Figure 1 An example of a control device 200 for executing one or more functions is described. Figure 1 The functions shown may run on their own control devices, or may share a control device with one or more other functions. The control device may include at least one random access memory (RAM) 211a, at least one read-only memory (ROM) 211b, at least one processor 212, 213, and an input / output interface 214. At least one processor 212, 213 may be coupled to the RAM 211a and the ROM 211b. At least one processor 212, 213 may be configured to execute appropriate software code 215. For example, the software code 215 may allow one or more steps to be performed to perform one or more aspects of the present invention. The software code 215 may be stored in the ROM 211b.

[0115] Figure 3 The terminal 300 (eg Figure 1 The terminal 300 may be provided by any device capable of sending and receiving radio signals. Non-limiting examples include user equipment, a mobile station (MS) or a mobile device (such as a mobile phone or a so-called "smart phone"), a computer equipped with a wireless interface card or other wireless interface facilities (such as a USB dongle), a personal data assistant (PDA) or tablet computer equipped with wireless communication capabilities, a machine type communication (MTC) device, an Internet of Things (IoT) type communication device, or any combination of these devices. For example, the terminal 300 may provide data communication for bearer communication. The communication may be one or more of voice, electronic mail (email), text message, multimedia, data, machine data, etc.

[0116] The terminal 300 may receive signals over the air or radio interface 307 via appropriate receiving means, and may transmit signals via appropriate radio signal transmitting means. Figure 3 In the embodiment of the present invention, the transceiver arrangement is schematically represented by block 306. For example, the transceiver arrangement 306 may be provided by a radio component and an associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0117] The terminal 300 may be provided with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b and other possible components 303, for performing the tasks it is designed to perform with the assistance of software and hardware, including controlling access to access systems and other communication devices and communication with access systems and other communication devices. At least one processor 301 is coupled to RAM 302b and ROM 302a. At least one processor 301 may be configured to execute appropriate software code 308. For example, software code 308 may allow execution of one or more aspects of the present invention. Software code 308 may be stored in ROM 302a.

[0118] The processor, storage device and other related control means may be provided on an appropriate circuit system board and / or in a chipset. This feature is indicated by reference numeral 304. The device may optionally have a user interface, such as a keypad 305, a touch sensitive screen or touchpad, a combination thereof, etc. Depending on the type of device, one or more of a display, a speaker and a microphone may be optionally provided.

[0119] It should be understood that these devices may include or be coupled to other units or modules, such as radio components or radio heads, for transmission and / or reception. Although the device has been described as one entity, the different modules and memories may be implemented in one or more physical or logical entities.

[0120] Figure 4 Representations of operations at OAM MF, DAC-NF and NRF instances are shown according to some example embodiments.

[0121] Operation 400: The OAM MF instance sends a message to the DAC-NF instance of the core domain of the 5GS, which configures the DAC-NF instance to create a user profile resource for the user. The user profile details can be based on customer relationship management (CRM) information.

[0122] The following uses a document as a digital asset as an example to illustrate an example of a user configuration file.

[0123]

[0124]

[0125] The user profile indicates restrictions on the user's storage of digital assets in the core domain of 5GS and whether authentication services are enabled for the user's digital assets.

[0126] Operation 402: The OAM MF instance sends a message to the DAC-NF instance, which configures the DAC-NF instance in relation to the DAC-NF instance providing a digital asset authentication service. Taking a document as a digital asset as an example, such configuration of the DAC-NF instance may be related to: (i) the document type for which the DAC-NF instance provides authentication services; (ii) the issuing authority to be used for the authentication service; (iii) the authentication type to be used for the authentication service for each document type; and (iv) the resources to be used for the authentication service. For example, the resources to be used for the authentication service may include: (a) one or more APIs for document authentication at one or more issuing authorities; (b) certificate chain information of a digital certificate for authenticating a document signer, or one or more APIs for downloading the certificate chain information; (c) a digital representation of a trusted seal, logo, physical signature, icon, emoticon, etc. for scanned physical document authentication, or configuration of one or more APIs for downloading such digital representations.

[0127] An example of the structure of document authentication information used to configure a DAC-NF instance that provides document authentication services is shown below:

[0128]

[0129]

[0130] For example: a passport issued by the Indian Passport Authority will be classified as a document of type "passport" in this configuration information; and the configuration of the DAC-NF by the OAM-MF for providing authentication services may include configuring the DAC-NF instance to use an API provided by the Indian Passport Authority to authenticate the Indian passport document. The authentication service provided by the DAC-NF instance may include the DAC-NF instance calling the configured API using information about the passport document to be authenticated. The process may include a synchronous response from the Indian Passport Authority, or may include an asynchronous response based on a subscription operation of the DAC-NF instance, indicating a callback URI to be called by the Indian Passport Authority.

[0131] Operation 404: The DAC-NF instance uses the NFRegister API to configure the NRF to create resources for the NF configuration file of the DAC-NF instance. The NF configuration file includes the above document authentication information.

[0132] Figure 5 An operational representation of a DAC-NF instance configured by a UE, an NRF, and an OAM system for authenticating a digital asset of a user associated with the UE is shown in accordance with some example embodiments.

[0133] Operation 500: The UE sends a message to the AF to request that a digital asset (e.g., a digital representation of a passport) be uploaded to the 5GS.

[0134] Operation 502: The AF obtains (via the NEF) information stored by the NRF about the document authentication capability of the DAC-NF instance configured by the OAM system for authenticating the digital assets of the user associated with the UE. This operation may include: (a) the AF uses the NFDiscovery API to discover the DAC-NF instance configured by the OAM system for providing the authentication service of the digital assets for the user associated with the UE; or (b) the AF uses the HTTP GET operation to obtain the document authentication capability from the DAC-NF profile registered by the NRF for the DAC-NF instance configured by the OAM system for providing the authentication service of the digital assets for the user associated with the UE; or (c) the AF uses the NFStatusSubscribe request to subscribe to the status change of the DAC-NF instance configured by the OAM system for providing the authentication service of the digital assets for the user associated with the UE.

[0135] Operation 504: The NRF generates a response (NFDiscover response or GET response or NFStatusNotify) for the AF, which includes the NF profile of the DAC-NF instance configured by the OAM system for providing authentication services for digital assets for users associated with the UE. The NF profile includes information about the document authentication capabilities of the authentication service provided by the DAC-NF instance.

[0136] Operation 506: Based on the NF profile of the DAC-NF instance configured by the OAM system for providing authentication services for digital assets for a user associated with the UE, the AF determines that the DAC-NF instance supports document authentication for the document type identified in the request from the UE. Based on this determination, the AF prepares a document authentication request for the DAC-NF instance. The request includes document details indicated by the NF profile of the DAC-NF instance required by the DAC-NF instance for providing authentication services for the document type identified in the request from the UE.

[0137] For example, the AF may send a message with the following format for the DAC-NF instance (via the NEF).

[0138] Document Type = Passport

[0139] ID number: N234346

[0140] Expiration Date: 10 / 25

[0141] Issue date: 10 / 15

[0142] Issuing authority: Passport Authority of India

[0143] Attachments: <empty>

[0144] Authentication Required = True

[0145] Certification type: Check with the issuing authority

[0146] Alternatively, the AF may send a message to the DAC-NF instance (via the NEF) including a digital image of the document to be authenticated, and the DAC-NF instance may extract the required document information from the digital image using a document reader / image processing tool.

[0147] Operation 508: Based on the document details provided by the AF (or based on the document details extracted from the document image provided by the AF), the DAC-NF instance initiates the authentication process according to the above document authentication information provided by the OAM MF ( Figure 4 Operation 402).

[0148] For example, if the document indicated by the AF in the request belongs to a type for which the DAC-NF instance has been configured by the OAM-MF to use offline authentication, the DAC-NF instance sends a message including details of the document to be authenticated to the OAM / Operator function of the 5G system, and the OAM / Operator function contacts the authority that issued the document through an out-of-band mechanism. The OAM / Operator function updates the DAC-NF instance based on the information received by the OAM / Operator function, and the DAC-NF instance registers the authentication status (true or false) of the document accordingly.

[0149] On the other hand, if the document indicated by the AF in the request belongs to the type for which the OAM MF specifies the API to be used by the authority that issued the document, the DAC-NF instance calls the API specified by the OAM-MF and waits for an authentication response based on the information about the document provided by the DAC-NF instance to the authority. The response can be a synchronous response or an asynchronous response based on the callback URI provided by the DAC-NF instance. Figure 6 , the DAC-NF instance may send an authenticatePassportInformation request to authenticate the digital representation of the passport document to the authentication service of the issuing authority (operation 600). The request includes the details of the passport document to be authenticated and may include a callback URI for an asynchronous response. Based on the request, the DAC-NF instance receives a response (synchronous or asynchronous) indicating the authentication check result of the issuing authority authentication service (operation 602). The DAC-NF instance updates the resources created by the DAC-NF instance for the document based on the response from the issuing authority (operation 604). For example, in the case of a positive response, the update may be to add "authentication = true".

[0150] Figure 7 A representation of another example of a process for an authentication service provided by a DAC-NF instance is shown. The OAM-MF has provided the DAC-NF instance with information about a certificate chain for a digital asset (e.g., a digital representation of an insurance document), and one or more APIs of certificate authorities involved in the certificate chain. Alternatively, the OAM-MF has provided the DAC-NF with one or more APIs for downloading information about the certificate chain for the digital asset, and the DAC-NF instance uses the one or more APIs to download one or more APIs of certificate authorities involved in the certificate chain. The DAC-NF instance uses an API (e.g., an API for obtaining a public key certificate according to the ITU X.509 standard format) to verify a series of digital certificates of the certificate chain back to a root certificate authority (CA).

[0151] The DAC-NF instance sends (operation 700) a request for information from an intermediate CA so that the DAC-NF instance can verify the first certificate in the certificate chain; and receives information in response. Based on the information, the DAC-NF checks the first certificate in the certificate chain. If the check is successful, the DAC-NF instance sends a request for information from the next CA in the chain (the root CA in this example) so that the DAC-NF instance can verify the certificate of the intermediate CA. Based on the information, the DAC-NF checks the certificate of the intermediate CA. The DAC-NF instance updates the resources that the DAC-NF created for the document based on the results of checking the certificate chain. For example, in the case where a series of positive checks return to the root CA, the update can be to add "authentication = true".

[0152] According to another example of the authentication process of the authentication service provided by the DAC-NF instance, the request message of the AF to the DAC-NF instance may include an image of the document to be authenticated. The DAC-NF instance has been configured by the OAM-MF to use an image processing mechanism to extract information required to provide the authentication service from the image. For example, the DAC-NF instance may create a digital representation of one or more features of the received image, such as a seal / logo / emoticon / physical signature, and compare the digital representation with one or more digital representations already stored by the DAC-NF or downloaded by the DAC-NF instance using one or more APIs specified by the OAM-MF.

[0153] Figure 5 Operation 510: The DAC NF instance sends a message to the AF (via the NEF) indicating the authentication status of the digital asset (document).

[0154] Operation 512: Based on the information provided by the DAC-NF, the AF sends a message indicating the authentication status of the digital asset (document) to the UE.

[0155] The above description involves the AF requesting the DAC-NF instance to authenticate the digital asset received from the UE. The DAC-NF instance may also provide services, including providing an indication of the authentication status currently recorded by the DAC-NF instance for the digital asset; and before requesting the DAC-NF instance to authenticate the digital asset, the AF may first call an API for requesting the DAC-NF for the indication of the authentication status currently recorded by the DAC-NF instance for the digital asset.

[0156] It should be noted that although some embodiments have been described in relation to 5GS, similar principles may also be relevant and applicable to other mobile communication systems. Therefore, although some embodiments are described above by way of example with reference to certain example architectures of wireless networks, technologies and standards, the present embodiments may be applied to any other suitable form of communication system other than the communication system illustrated and described herein.

[0157] It is also noted herein that while the above describes exemplifying embodiments, there are several variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0158] As used herein, “at least one of: ” and “at least one of ” and similar words, where a list of two or more elements is connected by “and” or “or”, refer to at least any one element, or at least any two or more elements, or at least all the elements.

[0159] In general, various embodiments may be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the disclosure may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device, but the disclosure is not limited thereto. Although various aspects of the disclosure may be illustrated and described using block diagrams, flow charts, or using some other graphical representation, it is well known that the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof (as non-limiting examples).

[0160] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0161] (a) hardware circuitry implementation only (e.g., implementation only in analog and / or digital circuitry) and

[0162] (b) a combination of hardware circuitry and software, such as (where applicable):

[0163] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0164] (ii) hardware processors and software (including digital signal processors), any portion of software and memory, which work together to enable a device such as a mobile phone or server to perform various functions, and (c) hardware circuit systems and / or processors, such as microprocessors or portions of microprocessors, that require software (such as firmware) to operate, but where the software is not required for operation, the software may be absent.

[0165] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation that is merely a hardware circuitry or processor (or multiple processors) or a portion of a hardware circuitry or processor and its (or their) accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit system or processor integrated circuit system of a mobile device, or a similar integrated circuit system in a server, cellular network device, or other computing or network device.

[0166] The embodiments of the present disclosure may be implemented by computer software executable by a data processor (e.g., a processor entity) of a mobile device, or may be implemented by hardware, or by a combination of software and hardware. Computer software or programs, also referred to as program products, include software routines, applets, and / or macros, which may be stored in any device-readable data storage medium, and which include program instructions for performing specific tasks. A computer program product may include one or more computer executable components that are configured to perform an embodiment when the program is run. One or more computer executable components may be at least one software code or a portion thereof.

[0167] Also in this regard, it is noted that any block of the logic flow in the accompanying drawings may represent program steps, or interconnected logic circuit systems, blocks and functions, or a combination of program steps and logic circuit systems, blocks and functions. The software may be stored on such physical media, such as memory chips or memory blocks implemented within a processor, magnetic media (such as hard disks or floppy disks), and optical media (such as DVDs and their data variants CDs). Physical media are non-transitory media.

[0168] As used herein, the term "non-transitory" is a restriction to the medium itself (ie, tangible, not a signal), not to the persistence of data storage (eg, RAM vs. ROM).

[0169] The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based storage devices, magnetic storage devices and systems, optical storage devices and systems, fixed memory, and removable memory. The data processor may be of any type suitable for the local technical environment and may include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit system (ASIC), an FPGA, a gate-level circuit system, and a processor based on a multi-core processor architecture, as non-limiting examples.

[0170] Embodiments of the present disclosure may be implemented in various components such as integrated circuit system modules. The design of integrated circuit systems is generally a highly automated process. Complex and powerful software tools are available to convert logic-level designs into semiconductor circuit system designs for etching and forming on semiconductor substrates.

[0171] The independent claims set out the scope of protection sought by various embodiments of the present disclosure. Embodiments and features described in this specification that do not fall within the scope of the independent claims (if any) should be interpreted as examples that help understand the various embodiments of the present disclosure.

[0172] The above description has provided a comprehensive and informative description of example embodiments of the present disclosure by way of non-limiting examples. However, in view of the above description, various modifications and adaptations may become apparent to those skilled in the relevant art when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications to the teachings of the present disclosure will still fall within the scope of the present invention as defined in the appended claims. In fact, there are also embodiments including combinations of one or more embodiments with any other embodiments previously discussed.

Claims

1. A device for communication, comprising: at least one processor; as well as at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform: Based on a request for a network function instance of a core domain of a mobile communication system to authenticate a digital asset and based on a configuration of the network function instance, the network function instance initiates an authentication process to authenticate the digital asset; as well as The request is responded to by the network function instance based on the result of the authentication process.

2. The apparatus according to claim 1, wherein the authentication process comprises: One or more application programming interfaces of the network function instance configured for digital asset authentication are called.

3. The apparatus according to claim 2, wherein the authentication process comprises: The calling network function is configured to obtain one or more application programming interfaces of one or more application programming interfaces for digital asset authentication.

4. An apparatus according to claim 3, wherein the one or more application programming interfaces for digital asset authentication include one or more of the following items: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more digital certificate authorities.

5. The apparatus of claim 1 , wherein the request comprises a digital image, and the authentication process comprises: A digital representation of at least a portion of the image is created and the digital representation is compared to an authentication reference.

6. The apparatus of claim 1, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to: Receive a message sent by a management function instance of the operation, management and maintenance system of the mobile communication system, wherein the message configures the network function instance to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

7. The apparatus of claim 1, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to: A message sent by a management function instance of an operation, administration and maintenance system of the mobile communication system is received, wherein the message configures the network function instance for one or more digital asset authentication processes of the digital asset authentication service.

8. The apparatus of claim 1, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to: The network function instance sends a request to the network repository function instance to create one or more resource profiling services provided by the network function instance; wherein, The one or more resources indicate one or more types of digital assets for which the network function instance provides digital asset authentication services, and one or more digital asset authentication processes are used by the network function instance for the digital asset authentication services.

9. An apparatus according to claim 1, wherein the request for authentication of a digital asset includes the digital asset; and wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to: based on the result of the authentication process for authenticating the digital asset, store the digital asset and the authentication status of the digital asset by the network function instance.

10. An apparatus for communication, comprising: at least one processor; as well as at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform: Receiving, by an application function instance configured to consume one or more services of one or more network functions of a core domain of a mobile communication system, a request for digital asset authentication from a user device; Determining a network function instance of the core domain of the mobile communication system, the network function instance opening a service related to the digital asset authentication; Sending, by the application function instance, a request for the determined network function instance of the mobile communication system to provide the service; as well as Based on a response to the request for providing the service to the determined network function instance, the application function instance sends a message to the user equipment.

11. The apparatus of claim 10, wherein the determining comprises: A request is sent for a network repository function of a core domain of the mobile communication system to provide information to the application function instance, the information being about one or more network function instances of the core domain that expose the service of the digital asset.

12. The apparatus of claim 11, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to: The request for the determined network function instance of the mobile communication system to provide the service is formulated based on information provided by the network repository function instance regarding one or more authentication procedures used by the determined network function instance.

13. The apparatus of claim 10, wherein the service comprises: Authenticating the digital asset.

14. The apparatus of claim 10, wherein the service comprises: Providing an indication of the authentication status recorded by the network function instance for the digital asset. 15 . The apparatus according to claim 10 , wherein the request for the application function instance to provide the service is sent via a network open function of the core domain of the mobile communication system.

16. An apparatus for communication, comprising: at least one processor; as well as at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform: creating, by the network repository function instance, a resource profiling service provided by the network function instance of the core domain of the mobile communication system; Receiving, by the network repository function instance, a request from an application function instance to provide information about one or more network function instances of the core domain that expose one or more digital asset authentication services; as well as A response to the request is sent by the network repository function instance based on the resource.

17. An apparatus according to claim 16, wherein the resources created by the network repository function instance indicate one or more digital asset authentication processes, the one or more digital asset authentication processes are used by the one or more network function instances that open the one or more digital asset authentication services; and the response of the application function instance indicates the one or more digital asset authentication processes.

18. The apparatus of claim 16, wherein the resource is created based on one or more requests for the one or more network function instances of the core domain to open the one or more digital asset authentication services.

19. An apparatus for communication, comprising: at least one processor; as well as at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform: A message is sent by a management function instance of an operation, management and maintenance system of a mobile communication system, wherein the message configures a network function instance of a core domain of the mobile communication system to create one or more resources for one or more user profiles of one or more users, wherein the user profile indicates one or more types of digital assets for which the network function instance provides digital asset authentication services.

20. The apparatus of claim 19, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus to: A message is sent by the management function instance, wherein the message configures the network function instance for one or more digital asset authentication processes of the digital asset authentication service.

21. An apparatus according to claim 20, wherein configuring the network function instance for one or more digital asset authentication processes comprises one or more of the following items: specifying one or more application programming interfaces for the network function instance for digital asset authentication; or specifying one or more application programming interfaces for the network function instance for obtaining one or more application programming interfaces for digital asset authentication.

22. An apparatus according to claim 21, wherein the one or more application programming interfaces for digital asset authentication include one or more of the following: one or more application programming interfaces for interacting with one or more document issuing authorities; or one or more application programming interfaces for interacting with one or more certificate authorities.

23. An apparatus for communication, comprising: at least one processor; as well as at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform: sending, via a mobile radio access network of a mobile communication system, a request for an application function instance, the application function instance being configured to consume one or more services of one or more network function instances of a core domain of the mobile communication system, wherein the request involves authentication of a digital asset; as well as Authentication status information of the digital asset is received in response to the request.

Images