Data minimization in network function-to-network function communications

Abstract

Embodiments of the present disclosure relate to data minimization in network function-to-network function communications. There are provided measures for data minimization in network function-to-network function communications. Such measures exemplarily comprise sending, at a first network function entity configured for communication with a second network function entity, a discovery message to a network repository function entity, receiving, from the network repository function entity, a response message comprising a first encryption key of the second network function entity, and encrypting data into encrypted data by using the first encryption key, and sending a service request with the encrypted data to the second network function entity.

Description

Technical Field

[0001] Various example embodiments relate to data minimization in network function to network function communications. More specifically, various example embodiments illustratively relate to measures (including methods, apparatus, and computer program products) for implementing data minimization in network function to network function communications. Background Art

[0002] This specification relates generally to data security and data minimization.

[0003] The 3rd Generation Partnership Project (3GPP) defines the fifth generation (5G) core network functions (NFs) and the associated application programming interfaces (APIs) that each NF must provide so that communication between NFs via service-based interfaces (SBIs) is efficient.

[0004] 3GPP also defines the OAuth framework so that it can ensure that the NF is authorized to receive services and process messages / information.

[0005] 3GPP also defines Transport Layer Security (TLS) over Hypertext Transfer Protocol version 2 (HTTP / 2) to encrypt and securely transmit messages to avoid eavesdropping.

[0006] The 3GPP standard also ensures that NFs handle the minimum data set they want to process by defining a JavaScript Object Notation (JSON) structure for message content.

[0007] In order to provide flexibility in sending vendor-specific information on certain interfaces, 3GPP defines vendor-specific attributes (VSA) in its messages. Such vendor-specific attributes include, for example, "VendorSpecificFeature" (in TS29.510) and "OperatorSpecificDataContainer" (in TS29.505).

[0008] In defining the method for sending vendor-specific information between two NFs, the 3GPP standard breaks the key privacy principle of data minimization, which is to avoid NFs from excessively collecting and processing data other than that defined in its standard. This is true for NFs that do not intend to send vendor-specific information between two NFs.

[0009] While the vendor specific information is provided only as an example, more generally, when defining methods for issuing arbitrary information elements (IEs) between two NFs, the data minimization principle / requirement may not be met, at least for NFs that do not intend to issue the corresponding IEs between the two NFs.

[0010] Therefore, the issue arises that the data minimization principle / requirement may be weakened, which may lead to a weakening of data security.

[0011] Therefore, there is a need to provide data minimization in network function to network function communication. Summary of the invention

[0012] Various example embodiments are directed to addressing at least some of the above-mentioned challenges and / or problems and disadvantages.

[0013] Various aspects of example embodiments are set out in the accompanying claims.

[0014] According to an exemplary aspect, a device of a first network function entity configured for communication with a second network function entity is provided, the device including a sending circuit system configured to send a discovery message to a network repository function entity, a receiving circuit system configured to receive a response message including a first encryption key of the second network function entity from the network repository function entity, an encryption circuit system configured to encrypt data into encrypted data using the first encryption key, and a sending circuit system configured to send a service request with the encrypted data to the second network function entity.

[0015] According to an exemplary aspect, a device of a second network function entity configured for communication with a first network function entity is provided, the device comprising a generating circuit system configured to generate a registration message including a first encryption key, a sending circuit system configured to send the above-mentioned registration message to a network repository function entity, a receiving circuit system configured to receive a service request having encrypted data encrypted using the first encryption key from an intermediate network entity, and a decryption circuit system configured to decrypt the above-mentioned encrypted data using a first decryption key.

[0016] According to an exemplary aspect, an apparatus is provided, the apparatus comprising a receiving circuit system configured to receive a registration message including a first encryption key from a second network function entity and a storage circuit system configured to store the first encryption key of the second network function entity.

[0017] According to an exemplary aspect, a device of a first network function entity configured for communication with a second network function entity is provided, the device comprising at least one processor, at least one memory comprising computer program code, and at least one interface configured for communication with at least another device, the at least one processor together with the at least one memory and the computer program code being configured to cause the device to execute: sending a discovery message to a network repository function entity, receiving a response message including a first encryption key of the second network function entity from the network repository function entity, encrypting data into encrypted data using the first encryption key, and sending a service request with the encrypted data to the second network function entity.

[0018] According to an exemplary aspect, a device of a second network function entity configured for communication with a first network function entity is provided, the device comprising at least one processor, at least one memory comprising computer program code, and at least one interface configured for communication with at least another device, the at least one processor together with the at least one memory and the computer program code being configured to cause the device to execute: generating a registration message comprising a first encryption key, sending the registration message to a network repository function entity, receiving a service request having encrypted data encrypted using the first encryption key from an intermediate network entity, and decrypting the encrypted data using a first decryption key.

[0019] According to an exemplary aspect, an apparatus is provided, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, wherein the at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: receiving a registration message including a first encryption key from a second network function entity, and storing the first encryption key of the second network function entity.

[0020] According to an exemplary aspect, a method of a first network function entity configured for communication with a second network function entity is provided, the method comprising: sending a discovery message to a network repository function entity, receiving a response message including a first encryption key of the second network function entity from the network repository function entity, encrypting data into encrypted data using the first encryption key, and sending a service request with the encrypted data to the second network function entity.

[0021] According to an exemplary aspect, a method of a second network function entity configured for communication with a first network function entity is provided, the method comprising: generating a registration message including a first encryption key, sending the above-mentioned registration message to a network repository function entity, receiving a service request having encrypted data encrypted using the first encryption key from an intermediate network entity, and decrypting the above-mentioned encrypted data using a first decryption key.

[0022] According to an exemplary aspect, a method is provided, the method comprising: receiving a registration message including a first encryption key from a second network functional entity, and storing the first encryption key of the second network functional entity.

[0023] According to an exemplary aspect, a computer program product is provided, which includes a computer executable computer program code. When the program is run on a computer (for example, a computer of an apparatus according to any one of the above-mentioned apparatus-related exemplary aspects of the present disclosure), the computer program code is configured to cause the computer to execute a method according to any one of the above-mentioned method-related exemplary aspects of the present disclosure.

[0024] Such a computer program product may include (or be embodied in) a (tangible) computer-readable (storage) medium or the like having computer-executable computer program code stored thereon, and / or the program may be directly loadable into the internal memory of a computer or its processor.

[0025] Any of the above aspects can effectively improve data minimization, thereby solving at least part of the problems and disadvantages associated with the prior art.

[0026] By way of example embodiments, data minimization in network function to network function communications is provided. More specifically, by way of example embodiments, measures and mechanisms for achieving data minimization in network function to network function communications are provided.

[0027]

[0013] Accordingly, improvements are achieved through methods, apparatus, and computer program products that enable / implement data minimization in network function to network function communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In the following, the present disclosure will be described in more detail by way of non-limiting examples with reference to the accompanying drawings, in which

[0029] Figure 1 is a block diagram illustrating an apparatus according to an example embodiment;

[0030] Figure 2 is a block diagram illustrating an apparatus according to an example embodiment;

[0031] Figure 3 is a block diagram illustrating an apparatus according to an example embodiment;

[0032] Figure 4 is a block diagram illustrating an apparatus according to an example embodiment;

[0033] Figure 5 is a block diagram illustrating an apparatus according to an example embodiment;

[0034] Figure 6 is a schematic diagram of a process according to an example embodiment;

[0035] Figure 7 is a schematic diagram of a process according to an example embodiment;

[0036] Figure 8 is a schematic diagram of a process according to an example embodiment;

[0037] Fig. 9 A schematic diagram of a signaling sequence is shown;

[0038] Fig.10 A schematic diagram of a signaling sequence is shown;

[0039] Fig.11 A schematic diagram showing a signaling sequence according to an example embodiment;

[0040] Fig.12 A schematic diagram showing a signaling sequence according to an example embodiment;

[0041] Fig.13 A schematic diagram showing a signaling sequence according to an example embodiment; and

[0042] Fig.14 is a block diagram that optionally illustrates an apparatus according to an example embodiment. DETAILED DESCRIPTION

[0043] The present disclosure is described herein with reference to specific non-limiting examples and embodiments that are presently considered to be conceivable. It will be appreciated by those skilled in the art that the present disclosure is by no means limited to these examples and can be applied more broadly.

[0044] It should be noted that the following description of the present disclosure and its embodiments mainly refers to specifications used as non-limiting examples of certain exemplary network configurations and deployments. That is, the present disclosure and its embodiments are mainly described in conjunction with 3GPP specifications used as non-limiting examples of certain exemplary network configurations and deployments. Therefore, the description of the example embodiments given herein specifically refers to terms directly related thereto. Such terms are only used in the context of the non-limiting examples presented and naturally do not limit the present disclosure in any way. On the contrary, any other communication or communication-related system deployment, etc., may also be utilized as long as it meets the features described herein.

[0045] In the following, various embodiments and implementations of the present disclosure and aspects or embodiments thereof are described using several variants and / or alternatives. It should generally be noted that, depending on certain requirements and constraints, all described variants and / or alternatives may be provided individually or in any possible combination (also including combinations of individual features of various variants and / or alternatives).

[0046] As used herein, “at least one of the following:” and “at least one of” and similar expressions (wherein a list of two or more elements is connected by “and” or “or”) refer to at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

[0047] According to example embodiments, generally speaking, measures and mechanisms are provided for (enabling / realizing) data minimization in network function to network function communications.

[0048] As mentioned above, when defining methods for issuing arbitrary IEs between two NFs, the data minimization principle / requirement may not be met, at least for NFs that do not intend to issue the corresponding IEs between the two NFs. That is, 3GPP has not implemented a framework to achieve the privacy principles of data minimization and data protection, i.e., to avoid excessive collection and processing of data by NFs other than those defined in their standards when vendor-specific information (which may be private data) or more general arbitrary IEs as mentioned above appear in messages, especially in messages sent via NFs.

[0049] Furthermore, the privacy protection rules applied to NF senders (e.g., NF consumers) and NF receivers (e.g., NF producers) are not strictly enforced in NF intermediate entities (e.g., policies are not properly configured in NF intermediates or their different vendor solutions). Generally, any network function in the 3GPP core network can become a NF consumer or a NF producer. When a NF requests a service / data from another NF, it becomes a NF consumer. In this case, the other NF that provides the service / data becomes a NF producer.

[0050] Fig. 9 A schematic diagram of a signal sequence is shown and in particular the above-mentioned problem is explained in a general manner.

[0051] For example, if an NF sender (e.g., NF consumer) sends a message to an NF receiver (e.g., NF producer) via an NF intermediary through the SBI interface, the NF intermediary (which is also authorized to view the content of the message) can process the message, which can be called a necessity according to the standard.

[0052] If the NF sender (e.g., NF consumer) wants to send some proprietary / personal information to the NF receiver (e.g., NF producer), the NF sender (e.g., NF consumer) can achieve this by sending the proprietary / personal information via VSA.

[0053] In general, only NF senders (e.g., NF consumers) and NF receivers (e.g., NF producers) are (intentionally) authorized to process such personal data (i.e., proprietary / personal information), which are also authorized to be processed by NF intermediaries.

[0054] That is, the supplier (e.g., NF sender (NF consumer)) cannot force the NF intermediary to stop processing the proprietary / personal information in the VSA. Therefore, there is a risk in the privacy assurance and engineering process (PEAP). The risk is that the data is minimized and the linkability of the data is reduced to a certain extent. Linkability means that all data (events or records or logs) belonging to the same data subject can be linked together or all data can be linked to an individual.

[0055] Since TLS is only hop-by-hop, this measure cannot protect the data at the intermediate NF. In other words, the intermediate NF has full access to the data.

[0056] Fig.10 A schematic diagram of a signal sequence is shown and in particular the above-mentioned problem is explained in a specific manner.

[0057] refer to Fig.10 , describes a real use case in a 3GPP scenario that requires the improvements proposed in this paper.

[0058] like Fig.10 As shown, the operator may be using a Home Subscriber Server (HSS) of a first provider and a Unified Data Manager (UDM) of the (same) first provider. Therefore, the HSS and UDM can legally handle user data in both the fourth generation (4G) and 5G.

[0059] For example, to optimize the process, UDM reads 4G subscription privacy data (such as International Mobile Equipment Identity (IMEI), user status information, etc.) and 5G data before sending it to HSS.

[0060] This data is also processed by an intermediate NF, which in this example is a Service Communication Proxy (SCP).

[0061] In this example, the SCP is from a different, second vendor and is legally responsible for handling the messages / logs.

[0062] According to the 3GPP standard, this flow defines and assumes that the SCP can only process / view 5G subscription data. This assumption is incorrect because the SCP can actually also view the 4G data that the UDM is sending (to the HSS).

[0063] So SCP can analyze logs / packets that SCP can write.

[0064] This violates the privacy principle of data minimization at the SCP.

[0065] In addition, SCP is now able to link 4G and 5G data and thereby collect more personal data, which has also been strongly opposed by most privacy regulators.

[0066] In addition to the above (i.e., intermediate NF access to complete data), the NF sender / consumer (i.e., UDM) also has privacy protection such that if the NF sender / consumer (i.e., UDM) writes any logs, the NF sender / consumer (i.e., UDD) can encrypt the data considering the privacy policy available in the NF sender / consumer (i.e., UDR).

[0067] However, since the complete data is also at the intermediate NF (i.e., SCP), it is unaware of the privacy rules, so the intermediate NF (i.e., SCP) will write the log in plain text. For example, assume that the NF sender / consumer (i.e., UDM) sends a message X to the NF receiver / producer (i.e., HSS), which includes, for example, the IMSI in a vendor-specific IE. Since the NF sender / consumer (i.e., UDM) and the NF receiver / producer (i.e., HSS) know the vendor-specific IE, they can apply the privacy rules and encrypt the IMSI when writing the log. However, if the communication is conducted through the intermediate NF (i.e., SCP), the intermediate NF (i.e., SCP) will write the log with the IMSI in plain text.

[0068] Special reference above Fig.10 The described intermediate NF issues related to the use case involving HSS and UDM of a (same) first vendor and SCP of a (different) second vendor may arise in any intermediate NF communication, for example:

[0069] -Any SCP communication,

[0070] -Network Exposure Function (NEF) -> UDM -> Access and Mobility Management Function (AMF)

[0071] communication,

[0072] -NEF->UDM->Session Management Function (SMF) communication,

[0073] - Application Function (AF) -> NEF -> AMF communication,

[0074] -AF->NEF->UDM->AMF communication,

[0075] - SEPP-plmn1->Roaming Hub->SEPP-plmn2 communication (SEPP: Security Edge Protection Proxy; PLMN: Public Land Mobile Network).

[0076] In view of this, in short, according to an example embodiment, there is provided a method for encrypting an IE (or VSA) containing certain data (private data) by an NF sender / consumer using an encryption key of an NF receiver / producer (e.g., a public key in the case of asymmetric encryption, a "common" key in the case of symmetric encryption), and transmitting the encrypted IE (or VSA) to the NF receiver / producer via an intermediate NF.

[0077] Fig.11 A schematic diagram showing a signaling sequence according to an example embodiment is shown.

[0078] exist Fig.11 In step 1, according to an example embodiment, the NF receiver / producer generates a public-private key pair (in the case of asymmetric encryption). In the case of symmetric encryption, the NF receiver / producer can generate a "universal" key (which can be used for encryption and decryption). When a "first encryption key" is mentioned in the following, this refers to the public key of the public-private key pair (in the case of asymmetric encryption) or the "universal" key (in the case of symmetric encryption). In addition, when a "first decryption key" is mentioned in the following, this refers to the private key of the public-private key pair (in the case of asymmetric encryption) or the "universal" key (in the case of symmetric encryption, in which case the "first encryption key" and the "first decryption key" are the same). The NF receiver / producer can publish its "first encryption key" (i.e., public key or universal key) to the Network Repository Function (NRF) when registering its NFProfile.

[0079] exist Fig.11 In step 2 of , according to an example embodiment, the NF sender / consumer discovers the NFProfile of the NF receiver / producer from the NRF before communicating with the NF receiver / producer. In this process, the NF sender / consumer also obtains the first encryption key of the NF receiver / producer.

[0080] exist Fig.11In step 3 of , according to an example embodiment, the NF sender / consumer encrypts the IE or VSA containing some data (private data) using the first encryption key of the NF receiver / producer and sends it to the intermediate NF. Since the NF sender / consumer knows that the IE / VSA is private data, it will be encrypted when writing to the log. The NF sender / consumer can also include another IE / client header to indicate which IEs are encrypted in the message.

[0081] exist Fig.11 In step 4 of , according to the example embodiment, although the NF intermediary can process the message, it cannot decode the specific IE or VSA containing the private information because it is encrypted and can only be decoded by the NF receiver / producer (at least not by the NF intermediary) because the NF receiver / producer has the corresponding first decryption key. Therefore, the NF intermediary cannot write the log with the VSA / specific IE in plain text.

[0082] Example embodiments are described in more detail below.

[0083] Figure 1 1 is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a first network node or entity 10, such as an NF consumer entity (configured for communication with a second network function entity), which first network node or entity includes a sending circuit system 11, a receiving circuit system 12, and an encryption circuit system 13. The sending circuit system 11 sends a discovery message to a network repository function entity. The receiving circuit system 12 receives a response message including a first encryption key of the second network function entity from the network repository function entity. The encryption circuit system 13 encrypts data into encrypted data using the first encryption key. The sending circuit system 11 (or an additional sending circuit system) sends a service request with the encrypted data to the second network function entity. Figure 6 is a schematic diagram of a process according to an example embodiment. Figure 1 The device can perform Figure 6 method, but not limited to this method. Figure 6 The method can be Figure 1 The present invention is performed by a device, but is not limited to being performed by the device.

[0084] like Figure 6 As shown, the process according to the exemplary embodiment includes an operation of sending a discovery message to a network repository functional entity (S61), an operation of receiving a response message including a first encryption key of the second network functional entity from the network repository functional entity (S62), an operation of encrypting data into encrypted data using the first encryption key (S63), and an operation of sending a service request with the encrypted data to the second network functional entity (S64).

[0085] In addition to the encrypted data, the service request may also include a header identifying the encrypted data.

[0086] In one embodiment, Figure 1 At least some of the functions of the apparatus shown may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be regarded as depicting an operational entity comprising one or more physically separate devices for performing at least some of the processes described.

[0087] According to another exemplary embodiment, the above-mentioned response message includes a certificate related to the above-mentioned first encryption key.

[0088] According to another exemplary embodiment, the encrypted data is at least one encrypted information element in the service request, wherein the service request comprises header information identifying the at least one encrypted information element.

[0089] According to a further exemplary embodiment, the at least one encrypted information element comprises vendor specific information and / or operator specific information. Optionally, the at least one encrypted information element comprises any other information element available in the service request.

[0090] Figure 2 is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a second network node or entity 20, such as an NF producer entity (configured for communication with a first network function entity), which includes a generation circuit system 21, a sending circuit system 22, a receiving circuit system 23, and a decryption circuit system 24. The generation circuit system 21 generates a registration message including a first encryption key. The sending circuit system 22 sends the above registration message to the network repository function entity. The receiving circuit system 23 receives a service request with encrypted data from an intermediate network entity, and the encrypted data is encrypted using the first encryption key. The decryption circuit system 24 decrypts the above encrypted data using the first decryption key. Figure 7 is a schematic diagram of a process according to an example embodiment. Figure 2 The device can perform Figure 7 method, but not limited to this method. Figure 7 The method can be Figure 2 The present invention is performed by a device, but is not limited to being performed by the device.

[0091] like Figure 7As shown, the process according to the exemplary embodiment includes an operation of generating a registration message including a first encryption key (S71), an operation of sending the above registration message to a network repository functional entity (S72), an operation of receiving a service request having encrypted data encrypted using the first encryption key from an intermediate network entity (S73), and an operation of decrypting the above encrypted data using a first decryption key (S74).

[0092] In addition to the encrypted data, the service request may also include a header identifying the encrypted data.

[0093] Figure 3 is a block diagram illustrating an apparatus according to an example embodiment. Specifically, Figure 3 Pictured Figure 2 A variation of the device shown. Figure 3 The apparatus may further include a creation circuit system 31 and / or a determination circuit system 32 .

[0094] In one embodiment, Figure 2 (or Figure 3 ) At least some of the functions of the apparatus shown in the figure can be shared between two physically separate devices forming an operational entity. Therefore, the apparatus can be regarded as depicting an operational entity including one or more physically separate devices for performing at least some of the processes described.

[0095] according to Figure 7 A variation of the process shown, giving exemplary additional operations, which are themselves independent of each other. According to this variation, the exemplary method according to the exemplary embodiment may include an operation of creating the above-mentioned first encryption key, wherein the above-mentioned first encryption key is equal to the above-mentioned first decryption key. This particularly reflects the case of the above-mentioned symmetric encryption.

[0096] Alternatively, according to Figure 7 A variation of the process shown, giving exemplary additional operations, which are themselves independent of each other. According to this variation, the exemplary method according to the exemplary embodiment may include the operation of creating the above-mentioned first encryption key and the above-mentioned first decryption key. This particularly reflects the situation of the above-mentioned asymmetric encryption. In addition, according to another variation, the exemplary method according to the exemplary embodiment may include the operation of creating a certificate related to the above-mentioned first encryption key. In addition, according to another exemplary embodiment, the above-mentioned registration message includes the above-mentioned certificate.

[0097] According to another exemplary embodiment, the encrypted data is at least one encrypted information element in the service request, wherein the service request includes header information identifying the at least one encrypted information element, and exemplary additional operations inherently independent of each other are given, and exemplary details of the decryption operation (S74) are given, which are inherently independent of each other. According to this variant, the exemplary method according to the exemplary embodiment may include an operation of determining the at least one encrypted information element using the header information. In addition, this exemplary decryption operation (S74) according to the exemplary embodiment may include an operation of decrypting the at least one encrypted information element using the first decryption key.

[0098] According to a further exemplary embodiment, the at least one encrypted information element comprises vendor specific information and / or operator specific information. Optionally, the at least one encrypted information element comprises any other information element available in the service request.

[0099] Alternatively, according to Figure 7 A variation of the process shown, giving exemplary additional operations, which are themselves independent of each other. According to this variation, the exemplary method according to the exemplary embodiment may include an operation of creating the above-mentioned first decryption key using the private key of the public key private key pair. Alternatively, the above-mentioned first decryption key may be the same symmetric key (i.e., the same as the first encryption key).

[0100] Figure 4 is a block diagram illustrating an apparatus according to an example embodiment. The apparatus may be a network repository function node or entity 40 including a receiving circuit system 41 and a storage circuit system 42. The receiving circuit system 41 receives a registration message including a first encryption key from a second network function entity. The storage circuit system 42 stores the first encryption key of the second network function entity. Figure 8 is a schematic diagram of a process according to an example embodiment. Figure 4 The device can perform Figure 8 method, but not limited to this method. Figure 8 The method can be Figure 4 The present invention is performed by a device, but is not limited to being performed by the device.

[0101] like Figure 8 As shown, the process according to the exemplary embodiment includes an operation of receiving a registration message including a first encryption key from a second network function entity (S81), and an operation of storing the first encryption key of the second network function entity (S82).

[0102] Figure 5 is a block diagram illustrating an apparatus according to an example embodiment. Specifically, Figure 5 Pictured Figure 4A variation of the device shown. Figure 5 The device may further include a transmitting circuit system 51.

[0103] In one embodiment, Figure 4 (or Figure 5 ) At least some of the functions of the apparatus shown in the figure can be shared between two physically separate devices forming an operational entity. Therefore, the apparatus can be regarded as depicting an operational entity including one or more physically separate devices for performing at least some of the processes described.

[0104] according to Figure 8 A variation of the process shown, giving exemplary additional operations, which are themselves independent of each other. According to this variation, the exemplary method according to the exemplary embodiment may include an operation of receiving a discovery message from a first network function entity, and an operation of sending a response message including the first encryption key of the second network function entity to the first network function entity.

[0105] According to a further exemplary embodiment, the above-mentioned registration message comprises a certificate related to the above-mentioned first encryption key.

[0106] Furthermore, according to another exemplary embodiment, the above-mentioned response message includes the above-mentioned certificate.

[0107] The example embodiments summarized and specified above are explained below in more specific terms.

[0108] Fig.12 A schematic diagram of a signaling sequence according to an example embodiment is shown, and in particular a specific scenario is illustrated, where the NF receiver / producer will generate nfService.pubKey (first encryption key) and nfService.privKey (first decryption key) locally, and publish only nfService.pubKey (first encryption key) to the NRF ( together with its registration Fig.12 Step 1).

[0109] The structure of NF service registration can be as follows:

[0110] NFService:

[0111] description:>

[0112] Information about a given NF service instance; it is part of the NFProfile of the NF instance type: object

[0113] required:

[0114] -serviceInstanceId . .

[0117] properties:

[0118] serviceInstanceId:

[0119] type:string

[0120] serviceName:

[0121] $ref:'# / components / schemas / ServiceName' . .

[0124] pubKey:

[0125] type:string

[0126] According to an exemplary embodiment, the substructure

[0127] pubKey:

[0128] type:string

[0129] is added to the possible existing structures.

[0130] According to an example embodiment, the NF sender / consumer discovers the NF receiver / producer to receive messages from the NRF. The NF sender / consumer also obtains the nfService.pubKey (first encryption key) details and other required details ( Fig.12 Step 2).

[0131] According to an example embodiment, when some IEs (e.g., VSAs) are issued containing private data (e.g., data “X”) that the NF sender / consumer does not want other NFs (such as NF intermediaries) to decode, the NF sender / consumer encrypts the corresponding data (i.e., data “X”) with nfService.pubKey (the first encryption key), thereby generating, for example, “Encr-X”.

[0132] According to an example embodiment, the NF sender / consumer sends the following information in a message to the NF receiver / producer: Fig.12 Step 3) of the protocol, so that only the NF receiver / producer can decode / decrypt:

[0133] - a new header, such as "EncryptedIEs" which contains a list of all IEs and / or attributes encrypted in the message,

[0134] - All IEs in the request / message (pointed in the header) are encrypted using the first encryption key of the NF receiver / producer.

[0135] The structure of the request / message may be as follows (covering both VSA and well-known IEs, such as "mmeHost"):

[0136]

[0137]

[0138] According to an exemplary embodiment, the substructure

[0139]

[0140]

[0141] is added to the possible existing structures.

[0142] Fig.13 A schematic diagram of a signaling sequence according to an exemplary embodiment is shown, and in particular, the signaling sequence based on the above reference Fig.10 The specific scenario discussed (involving UDM, SCP and HSS) is where the UDM makes a request to the HSS, namely invoking the Nhss_UECM_SNDeregistration service operation (TS23.632), where for example mmeDetails may need to be transmitted as VSA.

[0143] for Fig.13 For the use case shown, the structure of the Nhss_UECM_SNDeregistration request / message may be as follows:

[0144]

[0145]

[0146]

[0147]

[0148] According to an exemplary embodiment, the substructure

[0149]

[0150]

[0151]

[0152] }

[0153] is added to the possible existing structures.

[0154] As described above, the above processes and functions can be implemented by corresponding functional elements, processors, etc.

[0155] In the exemplary description of the above network entity, only the units related to understanding the principles of the present disclosure are described using functional blocks. The network entity may include other units required for its corresponding operation. However, the description of these units is omitted in this specification. The arrangement of the functional blocks of the device should not be interpreted as limiting the present disclosure, and the functions may be performed by one block or further split into sub-blocks.

[0156] When it is stated in the foregoing description that the device (i.e., a network node or entity (or some other component)) is configured to perform some functions, this should be interpreted as being equivalent to the following description, that is, (i.e., at least one) processor or corresponding circuit system (possibly in cooperation with computer program code stored in the memory of the corresponding device) is configured to cause the device to perform at least the above functions. In addition, such functions should be interpreted as being equivalently achievable by circuit systems or components specially configured for performing the corresponding functions (i.e., the expression "a unit configured to..." is interpreted as being equivalent to expressions such as "components for...").

[0157] exist Fig.14 In FIG. 1 , an alternative diagram of an apparatus according to an example embodiment is depicted. Fig.14 As shown, according to an exemplary embodiment, the device (first network function entity) 10' (corresponding to the first network function entity 10) includes a processor 1411, a memory 1412, and an interface 1413, which are connected via a bus 1414, etc. In addition, according to an exemplary embodiment, the device (second network function entity) 20' (corresponding to the second network function entity 20) includes a processor 1421, a memory 1422, and an interface 1423, which are connected via a bus 1424, etc. In addition, according to an exemplary embodiment, the device (network repository function entity) 40' (corresponding to the network repository function entity 40) includes a processor 1441, a memory 1442, and an interface 1443, which are connected via a bus 1444, etc. These devices can be connected via links 1401 and 1402, respectively.

[0158] The processor 1411 / 1421 / 1441 and / or the interface 1413 / 1423 / 1443 may also include a modem, etc., to facilitate communication on a (hardwired or wireless) link, respectively. The interface 1413 / 1423 / 1443 may include a suitable transceiver coupled to one or more antennas or communication components for (hardwired or wireless) communication with (multiple) linked or connected devices, respectively. The interface 1413 / 1423 / 1443 is typically configured to communicate with at least one other device (i.e., its interface).

[0159] The memory 1412 / 1422 / 1442 may store a corresponding program assumed to include program instructions or computer program codes that, when executed by a corresponding processor, enable a corresponding electronic device or apparatus to operate according to example embodiments.

[0160] Generally speaking, the corresponding devices / apparatuses (and / or parts thereof) may represent components for performing corresponding operations and / or exhibiting corresponding functions, and / or the corresponding devices (and / or parts thereof) may have functions for performing corresponding operations and / or exhibiting corresponding functions.

[0161] When it is stated in the subsequent description that a processor (or some other component) is configured to perform a certain function, this should be interpreted as equivalent to the following description, that is, at least one processor (possibly in cooperation with computer program code stored in the memory of the corresponding device) is configured to cause the device to perform at least the above-mentioned function. In addition, such functions should be interpreted as being equivalently achievable by components specially configured for performing the corresponding functions (i.e., the expression "a processor configured to [cause the device] to perform xxx" is interpreted as being equivalent to expressions such as "components for xxx").

[0162] According to an exemplary embodiment, an apparatus representing a first network function entity 10 (configured for communication with a second network function entity) comprises at least one processor 1411, at least one memory 1412 including computer program code, and at least one interface 1413 configured for communication with at least another apparatus. The processor (i.e., at least one processor 1411, together with at least one memory 1412 and computer program code) is configured to perform: sending a discovery message to a network repository function entity (therefore, the apparatus comprises corresponding means for sending), receiving a response message including a first encryption key of the second network function entity from the network repository function entity (therefore, the apparatus comprises corresponding means for receiving), encrypting data into encrypted data using the first encryption key (therefore, the apparatus comprises corresponding means for encrypting), and sending a service request with the encrypted data to the second network function entity.

[0163] According to an exemplary embodiment, an apparatus representing a second network function entity 20 (configured for communication with a first network function entity) comprises at least one processor 1421, at least one memory 1422 comprising computer program code, and at least one interface 1423 configured for communication with at least another apparatus. The processor (i.e., at least one processor 1421, together with at least one memory 1422 and computer program code) is configured to perform: generating a registration message comprising a first encryption key (therefore, the apparatus comprises corresponding components for generating), sending the above registration message to a network repository function entity (therefore, the apparatus comprises corresponding components for sending), receiving a service request having encrypted data encrypted using the first encryption key from an intermediate network entity (therefore, the apparatus comprises corresponding components for receiving), and decrypting the above encrypted data using a first decryption key (therefore, the apparatus comprises corresponding components for decrypting).

[0164] According to an example embodiment, a device representing a network repository functional entity 40 includes at least one processor 1441, at least one memory 1442 including computer program code, and at least one interface 1443 configured for communication with at least another device. The processor (i.e., at least one processor 1441, together with at least one memory 1442 and computer program code) is configured to perform: receiving a registration message including a first encryption key from a second network functional entity (therefore, the device includes a corresponding component for receiving), and storing the above-mentioned first encryption key of the above-mentioned second network functional entity (therefore, the device includes a corresponding component for storing).

[0165] For more details on the operability / functionality of individual devices, please refer to the above and Figures 1 to 13 Any relevant description.

[0166] For the purposes of the present disclosure as described above, it should be noted that

[0167] - the method steps that may be implemented as software code portions and executed using a processor at a network server or network entity (as an example of a device, apparatus and / or its modules, or as an example of an entity including apparatus and / or modules) are independent of the software code and may be specified using any known or future developed programming language as long as the functionality defined by the method steps is preserved;

[0168] - generally, any method step is suitable for being implemented as software or by hardware without changing the idea of ​​the embodiment and its modification in terms of the implemented functions;

[0169] - the method steps and / or devices, units or parts that may be implemented as hardware components on the above-defined apparatus or any (multiple) modules thereof (e.g., devices that perform the functions of the apparatus according to the above-described embodiments) are hardware-independent and may be implemented using any known or future-developed hardware technology or any mixture of these technologies, such as MOS (Metal Oxide Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BibMOS (Bipolar CMOS), ECL (Emitter Coupled Logic), TTL (Transistor Transistor Logic), etc., using, for example, ASIC (Application Specific IC (Integrated Circuit)) components, FPGA (Field Programmable Gate Array) components, CPLD (Complex Programmable Logic Device) components or DSP (Digital Signal Processor) components;

[0170] - devices, units or components (e.g., any of the network entities or network registers defined above, or their corresponding units / components) may be implemented as individual devices, units or components, but this does not exclude that they are implemented in a distributed manner throughout the system, as long as the functionality of the devices, units and components is preserved;

[0171] - Apparatuses such as user equipment and network entities / network registers may be represented by semiconductor chips, chipsets, or (hardware) modules comprising such chips or chipsets; however, this does not exclude the possibility of implementing the functionality of an apparatus or module as software in a (software) module rather than hardware implementation, such as a computer program or computer program product comprising executable software code portions for execution / running on a processor;

[0172] - For example, a device may be considered as one apparatus or as an assembly of more than one apparatus, whether they function in conjunction with each other or function independently of each other but in the same apparatus housing.

[0173] In general, it should be noted that if only the above functions of the corresponding parts are suitable for performing, the corresponding functional blocks or elements according to the above aspects can be implemented in any known manner of hardware and / or software, respectively. The above method steps can be implemented in individual functional blocks or by individual devices, or one or more method steps can be implemented by a single functional block or a single device.

[0174] Generally, any method step is suitable for implementation as software or by hardware without changing the idea of ​​the present disclosure. Devices and components can be implemented as individual devices, but this does not exclude that they are implemented in a distributed manner throughout the system, as long as the functionality of the device is preserved. These and similar principles are considered to be known to those skilled in the art.

[0175] Software in the sense of this specification comprises software code, which itself comprises code means or parts or a computer program or computer program product for performing corresponding functions, as well as software (or computer program, computer program product) embodied on a tangible medium (such as a computer-readable (storage) medium) on which corresponding data structures or code means / parts are stored, or embodied in a signal or a chip, possibly during its processing.

[0176] The present disclosure also covers any conceivable combination of the above method steps and operations, and any conceivable combination of the above nodes, devices, modules or elements, as long as the concepts of the above methods and structural arrangements are applicable.

[0177] In view of the above situation, measures for data minimization in network function to network function communication are provided. Such measures exemplarily include: at a first network function entity configured for communication with a second network function entity, sending a discovery message to a network repository function entity, receiving a response message including a first encryption key of the second network function entity from the network repository function entity, encrypting data into encrypted data using the first encryption key, and sending a service request with the encrypted data to the second network function entity.

[0178] Although the present disclosure is described above with reference to the examples according to the accompanying drawings, it should be understood that the present disclosure is not limited thereto. Instead, it is obvious to those skilled in the art that the present disclosure can be modified in various ways without departing from the scope of the inventive concept disclosed herein.

[0179] List of abbreviations

[0180] 3GPP: Third Generation Partnership

[0181] 4G: Fourth Generation

[0182] 5G: Fifth Generation

[0183] AF: Application Function

[0184] AMF: Access and Mobility Management Function

[0185] API: Application Programming Interface

[0186] HSS: Home Subscriber Server

[0187] HTTP / 2: Hypertext Transfer Protocol Version 2

[0188] IE: Information Element

[0189] IMEI: International Mobile Equipment Identity

[0190] JSON: JavaScript Object Notation

[0191] NEF: Network Exposure Function

[0192] NF: Network Function

[0193] NRF: Network Repository Function

[0194] PEAP: Privacy Assurance and Engineering Process

[0195] PLMN: Public Land Mobile Network

[0196] SBI: Service Based Interface

[0197] SCP: Service Communication Proxy

[0198] SEPP: Security Edge Protection Proxy

[0199] SMF: Session Management Function

[0200] TLS: Transport Layer Security

[0201] UDM: Unified Data Manager, Unified Data Management Service

[0202] UDR: Unified Data Repository

[0203] VSA: Vendor Specific Attributes

Claims

1. An apparatus of a first network function entity configured for communication with a second network function entity, the apparatus comprising: at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another device, The at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: Send a discovery message to the network repository functional entity, receiving a response message including a first encryption key of the second network function entity from the network repository function entity, encrypting the data into encrypted data using the first encryption key, and Sending a service request with the encrypted data to the second network function entity.

2. The device according to claim 1, wherein: The response message includes a certificate associated with the first encryption key.

3. The device according to claim 1, wherein: The encrypted data is at least one encrypted information element in the service request, wherein the service request comprises header information identifying the at least one encrypted information element.

4. The device according to claim 3, wherein: The at least one encrypted information element comprises vendor specific information and / or operator specific information.

5. An apparatus of a second network function entity configured for communication with a first network function entity, the apparatus comprising: at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another device, The at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: generating a registration message including a first encryption key, sending the registration message to the network repository function entity, receiving a service request having encrypted data from an intermediate network entity, the encrypted data being encrypted using the first encryption key, and The encrypted data is decrypted using a first decryption key.

6. The device according to claim 5, wherein: The at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: creating the first encryption key, wherein the first encryption key is equal to the first decryption key, or The first encryption key and the first decryption key, and optionally a certificate associated with the first encryption key, are created, wherein optionally the registration message includes the certificate.

7. The device according to claim 5, wherein: The encrypted data is at least one encrypted information element in the service request, wherein the service request comprises header information identifying the at least one encrypted information element, and wherein the at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: determining the at least one encrypted information element using the header information, and with respect to the decryption, the at least one processor, together with the at least one memory and the computer program code, being configured to cause the apparatus to perform: The at least one encrypted information element is decrypted using the first decryption key.

8. The device according to claim 7, wherein: The at least one encrypted information element comprises vendor specific information and / or operator specific information.

9. An apparatus for communication, the apparatus comprising: at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another device, The at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: receiving a registration message including the first encryption key from the second network function entity, and The first encryption key of the second network function entity is stored.

10. The device according to claim 9, wherein: The at least one processor, together with the at least one memory and the computer program code, is configured to cause the apparatus to perform: receiving a discovery message from the first network function entity, and A response message including the first encryption key of the second network function entity is sent to the first network function entity.

11. The device according to claim 10, wherein: The response message includes the certificate.

12. The device according to claim 9, wherein: The registration message includes a certificate associated with the first encryption key.

13. A method of a first network function entity configured for communication with a second network function entity, the method comprising: Send a discovery message to the network repository functional entity, receiving a response message including a first encryption key of the second network function entity from the network repository function entity, encrypting the data into encrypted data using the first encryption key, and Sending a service request with the encrypted data to the second network function entity.

14. The method according to claim 13, wherein: The response message includes a certificate associated with the first encryption key.

15. The method according to claim 13, wherein: The encrypted data is at least one encrypted information element in the service request, wherein the service request comprises header information identifying the at least one encrypted information element.

16. The method according to claim 15, wherein: The at least one encrypted information element comprises vendor specific information and / or operator specific information.

17. A method of a second network function entity configured for communication with a first network function entity, the method comprising: generating a registration message including a first encryption key, sending the registration message to the network repository function entity, receiving a service request having encrypted data from an intermediate network entity, the encrypted data being encrypted using the first encryption key, and The encrypted data is decrypted using a first decryption key.

18. The method according to claim 17, further comprising: creating the first encryption key, wherein the first encryption key is equal to the first decryption key, or The first encryption key and the first decryption key, and optionally a certificate associated with the first encryption key, are created, wherein optionally the registration message includes the certificate.

19. The method according to claim 17, wherein: The encrypted data is at least one encrypted information element in the service request, wherein the service request comprises header information identifying the at least one encrypted information element, and wherein the method further comprises: determining the at least one encrypted information element using the header information, and with respect to the decryption, the method further comprising: The at least one encrypted information element is decrypted using the first decryption key.

20. The method according to claim 19, wherein: The at least one encrypted information element includes: vendor specific information and / or operator specific information.

21. A communication method, the method comprising: receiving a registration message including the first encryption key from the second network function entity, and The first encryption key of the second network function entity is stored.

22. The method according to claim 21, further comprising: receiving a discovery message from the first network function entity, and A response message including the first encryption key of the second network function entity is sent to the first network function entity.

23. The method according to claim 22, wherein: The response message includes the certificate.

24. The method according to claim 21, wherein: The registration message includes a certificate associated with the first encryption key.

25. A computer program product comprising computer executable computer program code, which, when the program is run on a computer, is configured to cause the computer to perform the method according to any one of claims 13 to 16, 17 to 20 or 21 to 24.

26. A computer program product according to claim 25, wherein the computer program product comprises a computer readable medium having the computer executable computer program code stored thereon, and / or wherein the program is directly loadable into an internal memory of the computer or its processor.

Images