Apparatus, method and computer program

Abstract

The present disclosure relates to a method comprising: receiving (700) a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, the service providing data obtained from an untrusted application function connected to the network open function, the request includes an identifier associated with a network open function, an identifier associated with a network function service consumer, and an identifier associated with an untrusted application function; determining (702) to provide an access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and the attribute associated with the untrusted application function; and providing (704) an access token to a network function service consumer, the access token comprising: an identifier associated with the untrusted application function included in the request.

Description

Technical Field

[0001] The present disclosure relates to an apparatus, method and computer program for a wireless communication system, and in particular to an apparatus for providing an access token to a network function service consumer of the wireless communication system, the access token authorizing access to services provided by a network open function of the wireless communication system. Background Art

[0002] A communication system can be viewed as a facility that enables communication sessions between two or more entities (eg, communication devices, base stations, and / or other nodes) by providing carrier waves between the entities involved in the communication path.

[0003] The communication system may be a wireless communication system. Examples of wireless systems include public land mobile networks (PLMNs) operating based on radio standards (e.g., those provided by 3GPP), satellite-based communication systems, and different wireless local area networks (e.g., wireless local area networks (WLANs)). Wireless systems can generally be divided into cells and are therefore generally referred to as cellular systems.

[0004] Communication systems and related equipment usually operate in accordance with a given standard or specification, which specifies what the various entities related to the system are allowed to do and how it should be achieved. Communication protocols and / or parameters used for the connection are usually also defined. An example of a standard is the so-called 5G standard. Summary of the invention

[0005] According to one aspect, a device is provided, comprising at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, causes the device to at least: receive a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; determine to provide the access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and an attribute associated with the untrusted application function, the attribute being included in a configuration file of the network open function, the configuration file of the network open function being stored in a network repository function; and provide the access token to the network function service consumer, the access token including: the identifier associated with the untrusted application function included in the request.

[0006] The application function may be an untrusted application function (i.e., the network open function may require an access token from a network function service consumer to provide services that provide data received from the untrusted application function to the network function service consumer.

[0007] At least one memory may store instructions, which, when executed by at least one processor, cause the device to at least: receive a registration request from a network open function to register a profile of the network open function, wherein the profile of the network open function includes: attributes associated with an untrusted application function.

[0008] The attribute associated with the untrusted application function may include: an identifier associated with the untrusted application function; and an identifier associated with the network function that is allowed to access the service, corresponding to the identifier associated with the untrusted application function.

[0009] An identifier associated with a network function that is allowed to access the service may include: an identifier of a network function type of the network function that is allowed to access the service; an identifier of a network function instance of the network function that is allowed to access the service; an identifier of a network function domain of the network function that is allowed to access the service; or an identifier of single network slice selection assistance information that identifies a network slice of the network function that is allowed to access the service.

[0010] The identifier associated with the untrusted application function may include: an identifier of the untrusted application function; an identifier of an application supported by the untrusted application function; or an identifier of an event related to the untrusted application function.

[0011] The identifier associated with the network open function may include: an identifier of a network function instance of the network open function.

[0012] The determination may include: determining that an identifier associated with the network function service consumer included in the request matches an attribute associated with the untrusted application function included in a configuration file of the network open function; determining that an identifier associated with the untrusted application function included in the request matches an attribute associated with the untrusted application function included in the configuration file of the network open function; and determining to provide an access token request.

[0013] The at least one memory may store instructions that, when executed by the at least one processor, cause the apparatus to at least: generate an access token comprising: an identifier associated with the untrusted application function included in the request.

[0014] The means may be a network storage repository function.

[0015] According to one aspect, a device is provided, comprising components for the following items: receiving a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; determining to provide the access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and attributes associated with the untrusted application function, the attributes being included in a configuration file of the network open function, the configuration file of the network open function being stored in a network repository function; and providing the access token to the network function service consumer, the access token including: the identifier associated with the untrusted application function included in the request.

[0016] According to one aspect, a device is provided, which includes a circuit system configured to: receive a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, the service providing data received from an untrusted application function connected to the network open function, wherein the request includes: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; determine to provide the access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and attributes associated with the untrusted application function, the attributes being included in a configuration file of the network open function, the configuration file of the network open function being stored in a network repository function; and provide the access token to the network function service consumer, the access token including: the identifier associated with the untrusted application function included in the request.

[0017] According to one aspect, a method is provided, comprising: receiving a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, the service providing data received from an untrusted application function connected to the network open function, wherein the request comprises: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; determining to provide the access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and an attribute associated with the untrusted application function, the attribute being included in a configuration file of the network open function, the configuration file of the network open function being stored in a network repository function; and providing the access token to the network function service consumer, the access token comprising: the identifier associated with the untrusted application function included in the request.

[0018] The application function may be an untrusted application function (i.e., the network open function may require an access token from a network function service consumer to provide services that provide data received from the untrusted application function to the network function service consumer.

[0019] The method may include receiving a registration request from a network open function to register a profile of the network open function, the profile of the network open function including: attributes associated with the untrusted application function.

[0020] The attribute associated with the untrusted application function may include: an identifier associated with the untrusted application function; and an identifier associated with the network function that is allowed to access the service, corresponding to the identifier associated with the untrusted application function.

[0021] An identifier associated with a network function that is allowed to access the service may include: an identifier of a network function type of the network function that is allowed to access the service; an identifier of a network function instance of the network function that is allowed to access the service; an identifier of a network function domain of the network function that is allowed to access the service; or an identifier of single network slice selection assistance information that identifies a network slice of the network function that is allowed to access the service.

[0022] The identifier associated with the untrusted application function may include: an identifier of the untrusted application function; an identifier of an application supported by the untrusted application function; or an identifier of an event related to the untrusted application function.

[0023] The identifier associated with the network exposure function may include an identifier of a network function instance of the network exposure function.

[0024] The determination may include: determining that an identifier associated with the network function service consumer included in the request matches an attribute associated with the untrusted application function included in a configuration file of the network open function; determining that an identifier associated with the untrusted application function included in the request matches an attribute associated with the untrusted application function included in the configuration file of the network open function; and determining to provide an access token request.

[0025] The method may include generating an access token including an identifier associated with the untrusted application functionality included in the request.

[0026] The method may be performed by a network repository function.

[0027] According to one aspect, a computer program is provided, comprising computer executable code, which, when executed on at least one processor, is configured to: receive a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request comprises: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; determine to provide the access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and an attribute associated with the untrusted application function, the attribute being included in a configuration file of the network open function, the configuration file of the network open function being stored in a network repository function; and provide the access token to the network function service consumer, the access token comprising: the identifier associated with the untrusted application function included in the request.

[0028] According to one aspect, a device is provided, comprising at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, causes the device to at least: receive a request for a service provided by a network open function from a network function service consumer, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including an identifier associated with the untrusted application function; based on the access token, determine to allow the request; and provide the service to the network function service consumer.

[0029] At least one memory may store instructions that, when executed by at least one processor, cause the apparatus to at least: identify an untrusted application function based on an identifier associated with the untrusted application function included in an access token; provide a request to the untrusted application function to provide data from the untrusted application function; receive data from the untrusted application function; and provide service of the data received from the untrusted application function to a network function service consumer.

[0030] At least one memory stores instructions, which when executed by at least one processor cause the device to at least: provide a registration request to a network repository function to register a configuration file of a network open function, the configuration file of the network open function including: attributes associated with an untrusted application function.

[0031] The device may have a network opening function.

[0032] According to one aspect, an apparatus is provided, comprising components for: receiving a request for a service provided by a network open function from a network function service consumer, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including: an identifier associated with the untrusted application function; based on the access token, determining to allow the request; and providing the service to the network function service consumer.

[0033] According to one aspect, a device is provided, which includes a circuit system configured to: receive a request for a service provided by a network open function from a network function service consumer, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, and the access token includes: an identifier associated with the untrusted application function; based on the access token, determine to allow the request; and provide the service to the network function service consumer.

[0034] According to one aspect, a method is provided, comprising: receiving a request for a service provided by a network open function from a network function service consumer, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including: an identifier associated with the untrusted application function; based on the access token, determining that the request is allowed; and providing the data received from the untrusted application function to the network function service consumer.

[0035] The method may include: identifying an untrusted application function based on an identifier associated with the untrusted application function included in an access token; providing a request to the untrusted application function to provide data from the untrusted application function; receiving data from the untrusted application function; and providing a service of the data received from the untrusted application function to a network function service consumer.

[0036] The method may include providing a registration request to a network repository function to register a configuration file of a network open function, the configuration file of the network open function including: attributes associated with the untrusted application function.

[0037] The method is performed by a network opening function.

[0038] According to one aspect, a computer program is provided, comprising computer executable code, which when executed on at least one processor is configured to: receive a request for a service provided by a network open function from a network function service consumer, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including: an identifier associated with the untrusted application function; based on the access token, determine to allow the request; and provide the data obtained from the untrusted application function to the network function service consumer.

[0039] According to one aspect, a device is provided, comprising at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, causes the device to perform at least the following items: generate a request for an access token, the access token authorizing access to a service provided by a network open function, wherein the service provides data received from an untrusted application function connected to the network open function, wherein the request includes an identifier associated with the network open function, an identifier associated with a network function service consumer, and an identifier associated with the untrusted application function; provide the request to a network repository function; and receive the access token from the network repository function, the access token including: an identifier associated with the untrusted application function included in the request.

[0040] The request may cause the network repository function to determine to provide an access token based on an identifier associated with the network open function, an identifier associated with a network function service consumer, an identifier associated with the untrusted application function, and attributes associated with the untrusted application function, the attributes being included in a configuration file of the network open function, the configuration file of the network open function being stored in the network repository function.

[0041] The identifier associated with the application function may include: an identifier of the untrusted application function; an identifier of an application of the untrusted application function; or an identifier of an event of the untrusted application function.

[0042] At least one memory may store instructions that, when executed by at least one processor, cause the apparatus to include at least: generating a request to be provided by a network open function for a service that provides data received from an untrusted application function connected to the network open function, wherein the request includes an access token that includes an identifier associated with the untrusted application function; providing the request to the network open function; and receiving the service from the network open function.

[0043] The device may be a network function service consumer.

[0044] According to one aspect, an apparatus is provided, comprising components for: generating a request for an access token, the access token authorizing access to a service provided by a network open function, wherein the service provides data received from an untrusted application function connected to the network open function, wherein the request includes an identifier associated with the network open function, an identifier associated with a network function service consumer, and an identifier associated with the untrusted application function; providing the request to a network repository function; and receiving the access token from the network repository function, the access token including: an identifier associated with the untrusted application function included in the request.

[0045] According to one aspect, a device is provided that includes a circuit system configured to: generate a request for an access token that authorizes access to a service provided by a network open function, wherein the service provides data received from an untrusted application function connected to the network open function, wherein the request includes an identifier associated with the network open function, an identifier associated with a network function service consumer, and an identifier associated with the untrusted application function; provide the request to a network repository function; and receive the access token from the network repository function, the access token including: an identifier associated with the untrusted application function included in the request.

[0046] According to one aspect, a method is provided, comprising: generating a request for an access token that authorizes access to a service provided by a network open function, wherein the service provides data received from an untrusted application function connected to the network open function, wherein the request includes an identifier associated with the network open function, an identifier associated with a network function service consumer, and an identifier associated with the untrusted application function; providing the request to a network repository function; and receiving the access token from the network repository function, the access token including: the identifier associated with the untrusted application function included in the request.

[0047] The request may cause the network repository function to determine to provide an access token based on an identifier associated with the network open function, an identifier associated with a network function service consumer, an identifier associated with the untrusted application function, and attributes associated with the untrusted application function, the attributes being included in a configuration file of the network open function, the configuration file of the network open function being stored in the network repository function.

[0048] The identifier associated with the application function may include: an identifier of an untrusted application function; an identifier of an application of the untrusted application function; or an identifier of an event of the untrusted application function.

[0049] The method may include generating a request for a service provided by a network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including an identifier associated with the untrusted application function; providing the request to the network open function; and receiving the data obtained from the untrusted application function from the network open function.

[0050] The method may be executed by a network function service consumer.

[0051] According to one aspect, a computer program is provided, comprising computer executable code, which when executed on at least one processor is configured to: generate a request for an access token, the access token authorizing access to a service provided by a network open function, wherein the service provides data received from an untrusted application function connected to the network open function, wherein the request includes an identifier associated with the network open function, an identifier associated with a network function service consumer, and an identifier associated with the untrusted application function; provide the request to a network repository function; and receive the access token from the network repository function, the access token including: the identifier associated with the untrusted application function included in the request.

[0052] According to one aspect, a computer-readable medium is provided, comprising program instructions stored thereon for executing at least one of the above methods.

[0053] According to one aspect, a non-transitory computer-readable medium is provided, comprising program instructions stored thereon for executing at least one of the above methods.

[0054] According to one aspect, a non-volatile tangible storage medium is provided, comprising program instructions stored thereon for executing at least one of the above methods.

[0055] A number of different aspects have been described above. It will be appreciated that further aspects may be provided by combining any two or more of the above aspects.

[0056] Various other aspects are also described in the following detailed description and appended claims.

[0057] List of abbreviations

[0058] AF: Application Function

[0059] AMF: Access and Mobility Management Function

[0060] API: Application Programming Interface

[0061] BS: Base Station

[0062] CU: Centralized Unit

[0063] DL: Downlink

[0064] DU: Distributed Unit

[0065] gNB: gNodeB

[0066] GSM: Global System for Mobile Communications

[0067] HSS: Home Subscriber Server

[0068] IE: Information Element

[0069] IoT: Internet of Things

[0070] LMF: Location Management Function

[0071] LPP: Location Positioning Protocol

[0072] LTE: Long Term Evolution

[0073] MAC: Media Access Control

[0074] ML: Machine Learning

[0075] MS: Mobile Station

[0076] MTC: Machine Type Communication

[0077] NEF: Network Exposure Function

[0078] NF: Network Function

[0079] NFc: Network Function Consumer

[0080] NFp: Network Function Producer

[0081] NR: New Radio

[0082] NRF: Network Repository Function

[0083] NWDAF: Network Data Analysis Function

[0084] PDU: Packet Data Unit

[0085] RAM: Random Access Memory

[0086] (R)AN: (Radio) Access Network

[0087] ROM: Read Only Memory

[0088] SBA: Service Based Architecture

[0089] SINR: Signal to Interference and Noise Ratio

[0090] SMF: Session Management Function

[0091] S-NSSAI: Single Network Slice Selection Auxiliary Information

[0092] TR: Technical Report

[0093] TS: Technical Specification

[0094] UE: User Equipment

[0095] UMTS: Universal Mobile Telecommunications System

[0096] 3GPP: Third Generation Partnership Project

[0097] 5G: Fifth Generation

[0098] 5GC: 5G Core Network

[0099] 5GS: 5G System BRIEF DESCRIPTION OF THE DRAWINGS

[0100] Embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0101] Figure 1 A schematic diagram of a 5G system is shown;

[0102] Figure 2 shows a schematic diagram of the control device;

[0103] Figure 3 A schematic diagram of a user equipment is shown;

[0104] Figure 4 A signaling diagram illustrating a process of providing an access token to a network function service consumer, the access token using data from an application function connected to the network open function to authorize access to services provided by the network open function;

[0105] Figure 5 A signaling diagram showing a process of providing a network function service consumer with an access token that authorizes access to services provided by the network open function using data from a specific application function connected to the network open function;

[0106] Figure 6 A signaling diagram illustrating a process of providing a network function service consumer with an access token that authorizes access to services provided by the network function using data from a specific application supported by an application function connected to the network function;

[0107] Figure 7 A method of providing a network function service consumer with an access token authorizing access to services provided by a network open function is shown, wherein the method is performed by a network repository function;

[0108] Figure 8 A method of providing a network function service consumer with an access token authorizing access to services provided by a network open function is shown, wherein the method is performed by the network open function;

[0109] Fig. 9 A method of providing an access token authorizing access to a service provided by a network open function to a network function service consumer is shown, wherein the method is performed by the network function service consumer; and

[0110] Fig.10 A schematic diagram of a non-volatile storage medium storing instructions that, when executed by a processor, allow the processor to perform Figure 7 , Figure 8 and Fig. 9 One or more steps in a method. DETAILED DESCRIPTION

[0111] In some of the following embodiments, reference is made to a communication device capable of communicating via a wireless communication system (e.g., a cellular system or a mobile communication system) serving the communication device. Figure 1 , Figure 2 and Figure 3 Some general principles of a wireless communication system, an access system of the wireless communication system, and a communication device are briefly explained to help understand the technology on which the examples are based. In the following description, the terms communication device and user equipment are interchangeable.

[0112] Figure 1 A schematic diagram of a communication network is shown. The communication network may include a public land mobile network (PLMN). The PLMN may include: a user equipment (UE), a wireless communication system including a (radio) access network ((R)AN), a core network (5GC), one or more application functions (AF), and one or more data networks (DN).

[0113] 5G(R)AN may include one or more base stations. A base station may be an evolved NodeB (eNB) or a gNodeB (gNB). A gNB may include a distributed unit connected to one or more centralized units.

[0114] 5GC may include access and mobility management function (AMF), session management function (SMF), authentication server function (AUSF), user data management (UDM), user plane function (UPF), network exposure function (NEF), unified data repository (UDR), application function (AF), network repository function (NRF), and / or network data analysis function (NWDAF). AF is a control plane function that provides (i.e., supports) application services. For example, AF may be an application function hosted on an application server connected to 5GC. AF may provide application services (such as video streaming services) to UE via 5GC that connects UE to the application server hosting AF.

[0115] 5GC may be based on a service-based architecture (SBA) centered around network function (NF) services. NF may be a NF service producer (NFp). NF may be a NF service consumer (NFc). In the following description, the terms NFc and client may be interchangeable. NFp may register its NF profile with NRF. The profile of NFp may include information about NFp and services provided by NFp. NFc may discover NFp via NRF. NFp may require an access token (e.g., JSON Web Token) from NFc before it can provide services to NFc. The access token may be provided to NFc by NRF or an OAuth2 authorization server.

[0116] In some embodiments, the NWDAF may be an NFc and the NEF may be an NFp. The NEF may provide a service that provides data received from an untrusted AF of the NEF connected to the 5GC. The NEF may require an access token from the NWDAF (e.g., NFp) to provide services to the NWDAF.

[0117] The NWDAF may provide a request to the NRF or OAuth2 authorization server for an access token that authorizes access to services provided by the NEF. The NRF or OAuth2 authorization server may authorize access to services provided by the NEF based on the NEF authorization policy. The NRF or OAuth2 authorization server may provide the access token to the NWDAF.

[0118] Figure 2 Shows the control Figure 1 2. The control device 200 may include at least one random access memory (RAM) 211a, at least one read-only memory (ROM) 211b, at least one processor 212, 213, and an input / output interface 214. At least one processor 212, 213 may be coupled to the RAM 211a and the ROM 211b. At least one processor 212, 213 may be configured to execute appropriate software code 215. The software code 215 may, for example, allow one or more steps to be performed to perform one or more aspects of the present invention. The software code 215 may be stored in the ROM 211b. The control device 200 may be interconnected with another control device 200 that controls another function of a 5G (R) AN or 5GC. In some embodiments, each (R) AN includes a control device 200. In an alternative embodiment, two or more (R) ANs may share a control device.

[0119] Figure 3 An example of a UE 300 is shown, for example Figure 1 UE 300 is a communication device capable of (or configured to) send and receive radio signals. Non-limiting examples include a mobile station (MS) or mobile device, such as a mobile phone or so-called "smartphone", a computer provided with a wireless interface card or other wireless interface facility (e.g., a USB dongle), a personal data assistant (PDA) or tablet provided with wireless communication capabilities, a machine type communication (MTC) device, a cellular Internet of Things (CIoT) device, or any combination of these devices or similar devices. UE 300 can provide, for example, data communications for bearer communications. The communication can be one or more of voice, electronic mail (email), text messaging, multimedia, data, machine data, etc.

[0120] The UE 300 may receive signals over the air or radio interface 307 via appropriate means for receiving, and may transmit signals via appropriate means for transmitting radio signals. Figure 3 In the mobile device, the transceiver arrangement is schematically designated by block 306. The transceiver arrangement 306 may be provided, for example, by a radio component and an associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0121] UE 300 may be provided with at least one processor 301, at least one memory ROM 302a, at least one RAM 302b, and other possible components 303 for software and hardware assistance to perform the tasks it is designed to perform, including controlling access and communication to access systems and other communication devices. At least one processor 301 is coupled to RAM 302b and ROM 302a. At least one processor 301 may be configured to execute appropriate software code 308. Software code 308 may, for example, allow execution of one or more aspects of the present invention. Software code 308 may be stored in ROM 302a.

[0122] The processor, memory and other related control devices may be arranged on an appropriate circuit board and / or in a chip set. This feature is indicated by reference numeral 304. The device may optionally have a user interface, such as a keyboard 305, a touch screen or touch pad, a combination thereof, etc. Depending on the type of device, one or more of a display, a speaker and a microphone may be optionally provided.

[0123] There is a limitation in the existing solution for authorizing UE to access services provided by NEF for AF connected to NEF, that is, NRF or OAuth2 authorization server may authorize access to services provided by NEF for all AFs connected to NEF. NRF or OAuth2 authorization server may not be able to authorize access to services provided by NEF for a specific AF connected to NEF, for a specific application supported by AF connected to NEF, or for a specific event related to AF connected to NEF.

[0124] Figure 4 Shown is the process of providing an access token to the Nfc, which authorizes access to a service provided by the NEF, which provides data received from an AF connected to the NEF.

[0125] In step 0, the NEF may send a registration request to the NRF to register the profile of the NEF. The profile of the NEF may include attributes associated with all AFs connected to the NEF. The AF may be an untrusted AF. The AF may include AF1 and AF2 (not shown).

[0126] In step 1, NFc may send a request to NRF to discover AFs connected to NEF.

[0127] In step 2, the NFc may send a request to the NRF for an access token that authorizes access to the service provided by the NEF that provides the data received from the AF. Figure 4 As shown, a request for an access token authorizing access to a service provided by the NEF that provides data from the AF may be a Nnfr_AccessToken_Get request.

[0128] In step 3, the NRF may authorize the NFc to access the service provided by the NEF, which provides the data received from the AF, based on the NEF authorization policy.

[0129] In step 4, the NRF may provide the NFc with a response to the request for an access token that authorizes access to a service provided by the NEF that provides data from the AF. The response includes the access token to the NFc. The response may also include a validity time associated with the access token to the NFc. The validity time associated with the access token to the NFc indicates the time during which the access token to the NFc is valid. For example, the validity time associated with the access token to the NFc indicates that the access token to the NFc is valid for N seconds, N minutes, N hours, or N days, where N is an integer.

[0130] The response including the access token might be something like Figure 4 Nnrf_Access_Token_Get response shown.

[0131] In step 5, the NFc may provide to the NEF a request for a service provided by the NEF, which provides the data received from the AF. The request may include an access token.

[0132] In step 6, the NEF may determine whether to allow the request based on the access token.

[0133] In step 7, the NEF may send a service request to the AF for a service provided by the AF (eg, made and opened by the AF), wherein the service provided by the AF obtains data and provides the data to the NEF.

[0134] One limitation of the above process is that NRF can authorize NFc to access services provided by NEF for all AFs (i.e. AF1 and AF2) connected to NEF. Therefore, NRF cannot authorize NFc to access services provided by NEF for a specific AF. Therefore, NRF needs to Figure 4The described process authorizes NFc to access services provided by NEF at a finer granularity. Specifically, NRF is required to authorize NFc to access services provided by NEF for a specific untrusted AF connected to NEF, for a specific application of an untrusted AF connected to NEF, or for a specific event related to an untrusted AF connected to NEF.

[0135] According to one aspect of the present disclosure, a NEF is provided that authorizes access to a service provided by the NEF, wherein the service provides data obtained from a specific untrusted AF connected to the NEF, wherein the data obtained from the specific untrusted AF is data received from the specific untrusted AF, data received from a specific application of the untrusted AF connected to the NEF, or data associated with a specific event related to the untrusted AF connected to the NEF.

[0136] According to one or more aspects of the present disclosure, the NEF may send a registration request to the NRF to register a profile of the NEF. The profile of the NEF may include attributes associated with an untrusted AF connected to the NEF.

[0137] It should be understood that the profile of the NEF may correspond to the data type "NefInfo" described in Section 6.1.6.2.48 of 3GPP TS29.510v18.3.0. That is, the attributes included in the profile of the NEF may include attributes included in the data type "NefInfo". The attributes associated with the AF may correspond to the data type "afEeData" or the data type "pfdData" described in Sections 6.1.6.2.50 and 6.1.6.2.49 of 3GPP TS29.510v18.3.0.

[0138] Attributes associated with an untrusted AF may include identifiers associated with the untrusted AF. Identifiers associated with an untrusted AF may include identifiers of the untrusted AF (generally referred to as "Aflds"), identifiers of applications supported by the untrusted AF (generally referred to herein as "applds"), or identifiers of events related to the untrusted AF (generally referred to herein as "afEvents").

[0139] It should be understood that although this disclosure refers to "attributes," the term "attribute" is interchangeable with "information" or "information element."

[0140] Advantageously, the attributes associated with the untrusted AF may include identifiers associated with the NFs that are allowed to access services provided by the NEF. The identifiers associated with the NFs that are allowed to access services provided by the NEF may correspond to the identifiers associated with the untrusted AF. For example, each identifier associated with the NFs that are allowed to access services provided by the NEF corresponds to one or more identifiers associated with the AF.

[0141] The identifier associated with the NF that is allowed to access the service provided by the NEF that provides data received from the untrusted AF may include an identifier of the NF type of the NF that is allowed to access the service provided by the NEF (generally referred to as "allowedNFtypes" in this document), an identifier of the NF instance of the NF that is allowed to access the service provided by the NEF (generally referred to as "allowedNFInstances" in this document), an identifier of the NF domain of the NF that is allowed to access the service provided by the NEF (generally referred to as "allowedNFDomains" in this document), or an identifier of the single network slice selection assistance information (S-NSSAI) that identifies the network slice of the NF that is allowed to access the service provided by the NEF (generally referred to as "allowedNssais").

[0142] The NFc may use attributes associated with the untrusted AF included in the configuration file of the NEF to determine whether the NRF will provide the NFc with an access token that authorizes access to a service provided by the NEF, which provides data received from a specific untrusted AF connected to the NEF, data received from a specific application supported by the untrusted AF connected to the NEF, or data received from a specific event related to the untrusted AF connected to the NEF.

[0143] Attributes associated with an untrusted AF in the profile of the NEF may be used by the NRF to determine whether to provide an access token to the NFc that authorizes access to a service provided by the NEF that provides data received from a specific untrusted AF connected to the NEF, data received from a specific application supported by the untrusted AF connected to the NEF, or data received from a specific event related to the untrusted AF connected to the NEF.

[0144] As described above, the configuration file of the NEF may be a data type called "NefInfo." The attributes associated with the AF may be a data type called "afEeData" or a data type called "PfdData."

[0145] The data type "NefInfo" can be defined as follows.

[0146]

[0147]

[0148] The data type "afEeData" can be defined as follows.

[0149]

[0150]

[0151] The underlined attribute may be added to TS29.510v18.3.0 (section 6.1.6.2.50).

[0152] The data type "PfdData" can be as follows.

[0153]

[0154]

[0155] The underlined attribute may be added to TS29.510v18.3.0 (section 6.1.6.2.49).

[0156] According to one or more aspects of the present disclosure, NFc may send a request to NRF to discover an untrusted AF connected to NEF. NRF may send a profile of NEF to NFc. The profile of NEF may include attributes associated with all untrusted AFs connected to NEF. The attributes associated with the untrusted AF may include an identifier associated with the untrusted AF. The identifier associated with the untrusted AF may include an identifier of the untrusted AF (e.g., "AfIds"), an identifier of an application supported by the AF (e.g., "appIds"), or an identifier of an event associated with the untrusted AF (e.g., "afEvents"). In this way, NFc may obtain an identifier associated with the untrusted AF.

[0157] According to one or more aspects of the present disclosure, the NFc may send a request for an access token that authorizes access to a service provided by the NEF that provides data received from an untrusted AF connected to the NEF. The request includes an identifier associated with the untrusted AF.

[0158] The request for an access token authorizing access to a service provided by the NEF, which provides data received from an untrusted AF connected to the NEF to the NFc, may be of data type "AccessTokenReq" as described in 3GPP TS 29.510 v18.3.0 (Section 6.3.5.2.2).

[0159] The data type "AccessTokenReq" may be as follows.

[0160]

[0161]

[0162]

[0163]

[0164]

[0165] The underlined attribute may be added to TS29.510v18.3.0 (section 6.3.5.2.2).

[0166] As described above, the NFc may receive a response to a request for an access token that authorizes access to a service provided by the NEF that provides data received from an untrusted AF connected to the NEF. The response includes the access token. The access token may include an identifier associated with the untrusted AF, the identifier included in the request for the access token that authorizes access to a service provided by the NEF that provides data received from an untrusted AF connected to the NEF.

[0167] The response including the access token may be of data type "AccessTokenClaims" in 3GPP TS 29.510 v18.3.0 (section 6.3.5.2.4).

[0168] The data type "AccessTokenClaims" can be as follows.

[0169]

[0170]

[0171]

[0172] The underlined attribute may be added to TS29.510v18.3.0 (section 6.3.5.2.4).

[0173] Figure 5 Shown is the process of providing an access token to the Nfc that authorizes access to a service provided by the NEF that provides data received from a specific untrusted AF connected to the NEF.

[0174] In step 0, the NEF may send a registration request to an authorized server (e.g., NRF) to register a profile of the NEF. The profile of the NEF may include attributes associated with all untrusted AFs connected to the NEF. The untrusted AFs may include untrusted AF1 and untrusted AF2 (not shown).

[0175] The attributes associated with the untrusted AF may include an identifier associated with the untrusted AF. The identifier associated with the untrusted AF may include an identifier of the untrusted AF (eg, "afIds").

[0176] The attributes associated with the untrusted AF may include identifiers associated with the NFs that are allowed to access services provided by the NEF. The identifiers associated with the NFs that are allowed to access services provided by the NEF may be mapped with identifiers associated with the untrusted AFs. For example, each identifier associated with the NFs that are allowed to access services provided by the NEF is mapped to one or more identifiers associated with the untrusted AFs.

[0177] The identifiers associated with the NFs allowed to access the services provided by the NEF may include an identifier of the NF type of the NF allowed to access the services provided by the NEF (e.g., "allowedNFtypes"), an identifier of the NF instance of the NF allowed to access the services provided by the NEF (e.g., "allowedNFInstances"), an identifier of the NF domain of the NF allowed to access the services provided by the NEF (e.g., "allowedNFDomains"), or an identifier of single network slice selection assistance information (S-NSSAI) identifying the network slice of the NF allowed to access the services provided by the NEF (e.g., "allowedNssais").

[0178] In step 1, NFc may send a request to an authorized server (e.g., NRF) to discover an untrusted AF connected to NEF. The request may include an identifier associated with NEF and an identifier associated with NFc. The identifier associated with NEF may include an identifier of a NF instance of NEF. The identifier associated with NFc may include an identifier of a NF instance of NFc. NRF may provide NFc with a configuration file of NEF.

[0179] In step 2, NFc may send a request for an access token to an authorization server (e.g., NRF) that authorizes access to a service provided by the NEF that provides data obtained from one of the untrusted AFs discovered in step 1 (e.g., untrusted AF1). The request may include an identifier associated with the NEF and an identifier associated with the NFc. The identifier associated with the NEF may include an identifier of a NF instance of the NEF. The identifier associated with the NFc may include an identifier of a NF instance of the NFc, an identifier of a NF type of the NFc, an identifier of a NF domain of the NFc, or an identifier of a NF slice of the NFc. The request may also include an identifier associated with the untrusted AF. The identifier associated with the untrusted AF may include an identifier of the untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF. The request may be a Nnrf_Access_Token_Get_Request.

[0180] In some embodiments, the NF may be a NWDAF, and the NF type of the NFc may indicate that the NF is a NWDAF. More generally, the NFc may be any NF of a wireless communication system (e.g., a core network of a wireless communication system), and the NF type of the NF may indicate that the NF is a NWDAF. Figure 1 NSSF, NRF, PCF, UDM, UDR, AUSF, AMF, SMF, NWDAF as shown, or Figure 1 Another NF not shown in FIG.

[0181] The identifier of the untrusted AF may identify a specific untrusted AF. The identifier of the application supported by the untrusted AF may identify a specific application supported by the untrusted AF; the identifier of the event related to the AF may identify a specific event related to the untrusted AF.

[0182] For example, the NFc may send a request to the NRF for an access token that authorizes access to a service provided by the NEF, where the service provides data obtained from the untrusted AF1.

[0183] The data obtained from the untrusted AF may include, for example, UE data related to observed service experience or other data.

[0184] In step 3, the authorization server (e.g., NRF) may use the identifier associated with the NEF, the identifier associated with the NFc, the identifier associated with the untrusted application function, and the configuration file of the NEF stored at the authorization server (e.g., NRF) to authorize the NFc to access the service provided by the NEF. The authorization server (e.g., NRF) may retrieve the configuration file of the NEF stored at the authorization server (e.g., NF), and use the identifier associated with the NEF, the identifier associated with the NFc, and the identifier associated with the untrusted application function to determine whether the NFc is authorized to access the service of the NEF, which provides data obtained from the untrusted application function identified by the identifier associated with the untrusted application function. When the identifier associated with the NEF, the identifier associated with the NFc, and the identifier associated with the untrusted application function match the attributes of the configuration file of the NEF, the authorization server (e.g., NRF) determines that the NFc is authorized to access the service of the NEF, which provides data obtained from the untrusted application function identified by the identifier associated with the untrusted application function.

[0185] For example, the NRF may authorize the NFc to access services provided by the NEF using an identifier associated with the untrusted AF1.

[0186] In step 4, the NRF may provide an access token to the NFc in response to the request for the access token. The access token includes an identifier associated with the untrusted AF, wherein the identifier associated with the untrusted AF is an identifier of the untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF. The response may also include a validity time associated with the access token. The response may be Nnrf_Access_Token_Get_Response

[0187] For example, the access token includes an identifier of the untrusted AF1.

[0188] In step 5, NFc may provide a request for a service provided by the NEF to the NEF. The request for a service (generally referred to herein as a service request) includes an access token. The service provided by the NEF provides data obtained from an untrusted AF connected to the NEF. The data obtained from the untrusted AF may be data received from the untrusted AF, data received from a specific application supported by a specific untrusted AF connected to the NEF, or data related to a specific event related to the untrusted AF.

[0189] In step 6, the NEF may determine based on the access token that the service request is allowed, thereby allowing the NEF to provide the data obtained from the untrusted AF to the NFc.

[0190] The NEF may determine whether to allow a service request based on an access token by determining that an identifier of an untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the AF contained in the access token matches an identifier of an untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF stored at the NEF.

[0191] In this way, the NEF may determine that a particular untrusted AF connected to the NEF, a particular application supported by the untrusted AF connected to the NEF, or a particular event related to the untrusted AF connected to the NEF is identified in the access token.

[0192] For example, the NEF may determine that the untrusted AF1 is identified in the access token. The NEF may determine that the untrusted AF2 is not identified in the access token.

[0193] In step 7, the NEF may send a service request to a specific untrusted AF connected to the NEF, the service request being for a service provided by the specific untrusted AF (e.g., a service generated and opened by the specific untrusted AF). The service request may be a Naf_EventExposure service request or other service request. The service requested by the NEF provides data provided by the service of the NEF to the NFc. The data provided by the service of the NEF to the NFc (provided by the untrusted AF to the NEF) may be data received from a specific unsupported AF, data received from a specific application supported by the untrusted AF, data associated with a specific event related to the untrusted AF.

[0194] The NEF may provide the NFc with data from a specific untrusted AF connected to the NEF, data of a specific application supported by the untrusted AF connected to the NEF, or data of a specific event related to the untrusted AF connected to the NEF.

[0195] For example, NEF may send a service request for data to AF1. NEF may provide NFc with a service using data from untrusted AF1. NEF may not send a service request for data to AF2. NEF may not provide NFc with a service using data from AF2.

[0196] Figure 6 The process of providing an access token to the NFc which authorizes access to a service provided by the NEF which provides data from an untrusted AF-supported application connected to the NEF is shown.

[0197] In step 0, the NEF may send a registration request to an authorized server (e.g., NRF) to register a profile of the NEF. The profile of the NEF may include attributes associated with all untrusted AFs connected to the NEF. The untrusted AFs may include untrusted AF1 and untrusted AF2 (not shown).

[0198] Attributes associated with an untrusted AF may include identifiers associated with the untrusted AF. Identifiers associated with an untrusted AF may include identifiers of the untrusted AF (generally referred to and shown herein as "afIds"), identifiers of applications supported by the untrusted AF (generally referred to and shown herein as "appIds"), or identifiers of events related to the untrusted AF (e.g., afeIds).

[0199] The attributes associated with the untrusted AF may include identifiers associated with the NF that is allowed to access the services provided by the NEF. The identifiers associated with the NF that is allowed to access the services provided by the NEF may be mapped with identifiers associated with the untrusted AF. For example, each identifier associated with the NF that is allowed to access the services provided by the NEF is mapped to one or more identifiers associated with the untrusted AF.

[0200] The identifiers associated with the NFs allowed to access the services provided by the NEF may include an identifier of the NF type of the NFs allowed to access the services provided by the NEF (e.g., “allowedNFtypes”), an identifier of the NF instance of the NFs allowed to access the services provided by the NEF (e.g., “allowedNFInstances”), an identifier of the NF domain of the NFs allowed to access the services provided by the NEF (e.g., “allowedNFDomains”), or an identifier of the single network slice selection assistance information (S-NSSAI) identifying the network slice of the NFs allowed to access the services provided by the NEF (e.g., “allowedNssais”).

[0201] In step 1, NFc may send a request to an authorized server (e.g., NRF) to discover an untrusted AF connected to NEF. The request may include an identifier associated with NEF and an identifier associated with NFc. The identifier associated with NEF may include an identifier of a NF instance of NEF. The identifier associated with NFc may include an identifier of a NF instance of NFc. NRF may provide NFc with a configuration file of NEF.

[0202] In step 2, the NFc may send a request for an access token to an authorization server (e.g., NRF), the access token authorizing access to a service provided by the NEF, the service providing data obtained from one of the untrusted AFs (e.g., untrusted AF1) discovered in step 1. The request may include an identifier associated with the NEF and an identifier associated with the NFc. The identifier associated with the NEF may include an identifier of a NF instance of the NEF. The identifier associated with the NFc may include an identifier of a NF instance of the NFc, an identifier of a NF type of the NFc, an identifier of a NF domain of the NFc, or an identifier of a NF slice of the NFc. The request may also include an identifier associated with the untrusted AF. The identifier associated with the untrusted AF may include an identifier of the untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the AF.

[0203] In some embodiments, the NF may be a NWDAF, and the NF type of the NFc may indicate that the NF is a NWDAF. More generally, the NFc may be any NF of a wireless communication system (e.g., a core network of a wireless communication system), and the NF type of the NF may indicate that the NF is a NWDAF. Figure 1 NSSF, NRF, PCF, UDM, UDR, AUSF, AMF, SMF, NWDAF, or Figure 1 Another NF not shown in FIG.

[0204] The identifier of the untrusted AF may identify a specific AF, the identifier of the application supported by the untrusted AF may identify a specific application supported by the untrusted AF, and the identifier of the event related to the untrusted AF may identify a specific event related to the untrusted AF.

[0205] For example, NFc may send a request to NRF for an access token that authorizes access to a service provided by NEF, where the service provides data obtained from app1 supported by AF1.

[0206] In step 3, the authorization server (e.g., NRF) may use the identifier associated with the NEF, the identifier associated with the NFc, the identifier associated with the untrusted application function, and the configuration file of the NEF stored at the authorization server (e.g., NRF) to authorize the NFc to access the service provided by the NEF. The authorization server (e.g., NRF) may retrieve the configuration file of the NEF stored at the authorization server (e.g., NF), and use the identifier associated with the NEF, the identifier associated with the NFc, and the identifier associated with the untrusted application function to determine whether the NFc is authorized to access the service of the NEF, which provides data obtained from the untrusted application function identified by the identifier associated with the untrusted application function. When the identifier associated with the NEF, the identifier associated with the NFc, and the identifier associated with the untrusted application function match the attributes of the configuration file of the NEF, the authorization server (e.g., NRF) determines that the NFc is authorized to access the service of the NEF, which provides data obtained from the untrusted application function identified by the identifier associated with the untrusted application function.

[0207] For example, NRF can authorize NFc to use the data of app1 supported by untrusted AF1 to access the services provided by NEF.

[0208] In step 4, the NRF may provide a response including an access token to the NFc. The access token includes an identifier of the untrusted AF included in the request for the access token, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF. The response may include a validity time associated with the access token.

[0209] For example, the access token includes an identifier of app1 that is not trusted and supported by AF1.

[0210] In step 5, the NFc may provide to the NEF a request for a service provided by the NEF, which provides data received from a specific AF connected to the NEF, data received from a specific application supported by the AF connected to the NEF, or data received from a specific event related to an AP connected to the NEF. The request may include an access token.

[0211] In step 6, the NEF may determine to allow the request for the service.

[0212] The NEF may determine that an identifier of an untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF included in the access token matches an identifier of an untrusted AF, an identifier of an application supported by the untrusted AF, or an identifier of an event related to the untrusted AF stored at the NEF.

[0213] In this way, the NEF may determine that a particular untrusted AF connected to the NEF, a particular application supported by the untrusted AF connected to the NEF, or a particular event related to the untrusted AF connected to the NEF is identified in the access token.

[0214] For example, the NEF may determine that app1 supported by untrusted AF1 is identified in the access token. The NEF may determine that app2 supported by untrusted AF2 is not identified in the access token.

[0215] In step 7, the NEF may send a service request to a specific untrusted AF connected to the NEF to obtain and provide data provided by the NEF service to the NFc. The data provided by the NEF service provided by the untrusted AF to the NEF to the NFc may be data received from a specific untrusted AF, data received from a specific application supported by the untrusted AF, and data associated with a specific event related to the untrusted AF. The service request may be, for example, a Naf_EventExposure service request or other service requests.

[0216] The NEF may provide the NFc with data obtained from a specific untrusted AF connected to the NEF, wherein a specific application supported by the untrusted AF connected to the NEF or a specific event related to the untrusted AF connected to the NEF is identified in the access token.

[0217] For example, NEF may send a service request for data to untrusted AF1 supporting app1. NEF may provide NFc with a service using data from app1 supported by untrusted AF1. NEF may not send a service request for data to untrusted AF2 supporting app2. NEF may not provide NFc with a service using data from app2 supported by untrusted AF2.

[0218] Figure 7 A method of providing an access token to a NFc, the access token authorizing access to services provided by the NEF, wherein the method is performed by an NRF.

[0219] The NRF may receive a request for an access token from the NFc that authorizes access to a service provided by the NEF that provides data received from an untrusted AF connected to the NEF at step 700. The request may include an identifier associated with the NEF, an identifier associated with the NFc, and an identifier associated with the untrusted AF.

[0220] In step 702, the NRF may determine to provide an access token to the NFc based on an identifier associated with the NEF, an identifier associated with the NFc, an identifier associated with the untrusted AF, and an attribute associated with the untrusted AF included in a configuration file of the NEF stored at the NRF.

[0221] In step 704, the NRF may provide the NFc with an access token including the identifier associated with the untrusted AF included in the request.

[0222] Figure 8 A method of providing an access token to a NFc, the access token authorizing access to services provided by the NEF, wherein the method is performed by the NEF.

[0223] In step 800, the NEF may receive a request from the NFc for a service provided by the NEF that provides data received from an untrusted AF connected to the NEF. The request may include an access token that includes an identifier associated with the untrusted AF.

[0224] In step 802, the NEF may determine based on the access token that the request is allowed.

[0225] In step 804, the NEF may provide services to the NFc.

[0226] Fig. 9 A method of providing an access token to a NFc, the access token authorizing access to services provided by the NEF, wherein the method is performed by the NFc.

[0227] In step 900, the NFc may generate a request for an access token that authorizes access to a service provided by the NEF that provides data received from an untrusted AF connected to the NEF. The request includes an identifier associated with the NEF, an identifier associated with the NFc, and an identifier associated with the untrusted AF.

[0228] In step 902, NFc may provide the request to NEF.

[0229] In step 904, the NF may receive an access token from the NEF, the access token including the identifier associated with the untrusted AF included in the request.

[0230] Fig.10 A schematic diagram of a non-volatile storage medium storing instructions that, when executed by a processor, allow the processor to perform Figure 7 , Figure 8 and Fig. 9 One or more steps in a method.

[0231] It is noted that while exemplary embodiments are described above, there are numerous variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0232] It should be understood that although the above concepts are discussed in the context of 5GS, one or more of these concepts may be applicable to other cellular systems.

[0233] Therefore, the embodiments may vary within the scope of the appended claims. In general, some embodiments may be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, but the embodiments are not limited thereto. Although various embodiments may be illustrated and described as block diagrams, flow charts, or using some other graphical representations, it is fully understood that the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuitry or logic, general purpose hardware or controllers or other computing devices, or some combination thereof, as non-limiting examples.

[0234] The embodiments may be implemented by computer software or hardware or a combination of software and hardware stored in a memory and executable by at least one data processor of the entity involved. Furthermore, it should be noted in this regard that any program (e.g. Figure 7 , Figure 8 and Fig. 9 The software may be stored on physical media such as memory chips or memory blocks implemented within a processor, magnetic media such as hard disk or floppy disks, and optical media such as DVDs and their data variants, CDs.

[0235] The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor may be of any type suitable for the local technical environment and may include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit system (ASIC), a gate-level circuit system, and a processor based on a multi-core processor architecture, as non-limiting examples.

[0236] Alternatively or additionally, some embodiments may be implemented using a circuit system. The circuit system may be configured to perform one or more of the previously described functions and / or method steps. The circuit system may be arranged in a base station and / or a user equipment.

[0237] The term "circuitry" as used in this application may refer to one or more or all of the following:

[0238] (a) Pure hardware circuits (e.g. pure analog and / or digital circuits);

[0239] (b) A combination of hardware circuitry and software, such as:

[0240] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0241] (ii) any portion of hardware processor(s) and software (including digital signal processor(s)), software and memory(s) that act together to enable the apparatus (e.g., a communications device or base station) to perform the various functions described above; and

[0242] (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portion(s) of microprocessor(s), require software (e.g., firmware) to operate, but the software may not be present when the software is not required to operate.

[0243] This definition of circuitry applies to all uses of the term "component" in this application, including in any claims. As a further example, as used in this application, the term "circuitry" also covers an implementation of merely a hardware circuitry or processor (or multiple processors) or a portion of a hardware circuitry or processor and its accompanying software and / or firmware. The term "circuitry" also covers, for example, an integrated device.

[0244] The above description has provided a complete and informative description of some embodiments by way of exemplary and non-limiting examples. However, various modifications and adaptations will become apparent to those skilled in the relevant art when the above description is read in conjunction with the accompanying drawings and the appended claims. However, all such and similar teaching modifications will still fall within the scope defined by the appended claims.

Claims

1. A method for implementing a network storage repository function of a communication network, the method comprising: receiving a request for an access token from a network function service consumer, the access token authorizing access to a service provided by a network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; Determining to provide an access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and an attribute associated with the untrusted application function, the attribute being included in a configuration file of the network open function, the configuration file of the network open function being stored in the network repository function; and The access token is provided to the network function service consumer, the access token comprising: the identifier associated with the untrusted application function included in the request.

2. The method according to claim 1, comprising: A registration request is received from the network open function to register the configuration file of the network open function, the configuration file of the network open function including: the attribute associated with the untrusted application function.

3. The method of claim 1 , wherein the attributes associated with the untrusted application functionality include: an identifier associated with the untrusted application function; as well as An identifier associated with a network function that is allowed to access the service that corresponds to the identifier associated with the untrusted application function.

4. The method of claim 3, wherein the identifier associated with the network function that is allowed to access the service comprises: an identifier of a network function type that is allowed to access said network function of said service; an identifier of a network function instance of said network function that is allowed to access said service; an identifier of a network function domain that is allowed to access said network function of said service; or An identifier of a single network slice selection assistance information that identifies the network slice that is allowed to access the network function of the service.

5. The method of claim 3, wherein the identifier associated with the untrusted application function comprises: an identifier of the untrusted application function; an identifier of an application supported by the untrusted application functionality; or An identifier of an event related to the untrusted application functionality.

6. The method of claim 1, wherein the identifier associated with the network opening function comprises: An identifier of the network function instance of the network exposure function.

7. The method of claim 1, wherein the determining comprises: determining, by the network repository function, that the identifier associated with the network function service consumer included in the request matches the attribute associated with the untrusted application function included in the configuration file of the network exposure function; determining, by the network repository function, that the identifier included in the request and associated with the untrusted application function matches the attribute associated with the untrusted application function included in the configuration file of the network exposure function; as well as The access token request is provided as determined by the network repository function.

8. The method according to claim 1, comprising: The access token is generated by the network repository function, the access token comprising: the identifier associated with the untrusted application function included in the request.

9. An apparatus for a communication network, the apparatus comprising: at least one processor; as well as at least one memory storing instructions for network repository functions, wherein when the instructions are executed by the at least one processor, the apparatus is caused to at least perform: receiving a request from a network function service consumer for an access token authorizing access to a service provided by a network open function, the service providing data received from an untrusted application function connected to the network open function, wherein the request includes: an identifier associated with the network open function, an identifier associated with the network function service consumer, and an identifier associated with the untrusted application function; Determining to provide an access token to the network function service consumer based on the identifier associated with the network open function, the identifier associated with the network function service consumer, the identifier associated with the untrusted application function, and an attribute associated with the untrusted application function, the attribute being included in a configuration file of the network open function, the configuration file of the network open function being stored in the network repository function; and The access token is provided to the network function service consumer, the access token comprising an identifier associated with the untrusted application function included in the request.

10. The apparatus according to claim 9, wherein when the instructions are executed by the at least one processor, the apparatus is further caused to execute at least: A registration request is received from the network open function to register the configuration file of the network open function, wherein the configuration file of the network open function includes: The attribute associated with the untrusted application functionality.

11. The apparatus of claim 9, wherein the attributes associated with the untrusted application functionality include: an identifier associated with the untrusted application function; as well as An identifier associated with a network function that is allowed to access the service that corresponds to the identifier associated with the untrusted application function.

12. The apparatus of claim 11, wherein the identifier associated with the network function that is allowed to access the service comprises: an identifier of a network function type that is allowed to access said network function of said service; an identifier of a network function instance of said network function that is allowed to access said service; an identifier of a network function domain that is allowed to access said network function of said service; or An identifier of a single network slice selection assistance information that identifies the network slice that is allowed to access the network function of the service.

13. The apparatus of claim 11 , wherein the identifier associated with the untrusted application function comprises: an identifier of the untrusted application function; an identifier of an application supported by the untrusted application functionality; or An identifier of an event related to the untrusted application functionality.

14. The apparatus of claim 9, wherein the identifier associated with the network opening function comprises: An identifier of the network function instance of the network exposure function.

15. The apparatus of claim 9, wherein the determining comprises: determining that the identifier associated with the network function service consumer included in the request matches the attribute associated with the untrusted application function included in the configuration file of the network open function; determining that the identifier associated with the untrusted application function included in the request matches the attribute associated with the untrusted application function included in the configuration file of the network exposure function; as well as Determine the access token request.

16. The apparatus according to claim 9, wherein when the instructions are executed by the at least one processor, the apparatus is further caused to execute at least: Generate the access token, the access token comprising: The identifier associated with the untrusted application function is included in the request.

17. A computer program comprising computer executable codes, which, when executed by at least one processor of a device of a communication network, cause the device to perform the method according to any one of claims 1 to 8.

18. A method for opening a network function of a communication network, the method comprising: receiving, from a network function service consumer, a request for a service provided by the network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token including an identifier associated with the untrusted application function; as well as Based on the access token, determining that the request is allowed; as well as The data obtained from the untrusted application function is provided to the network function service consumer.

19. The method according to claim 18, further comprising: identifying the untrusted application function based on an identifier associated with the untrusted application function included in the access token; providing, to the untrusted application function, a request to provide data from the untrusted application function; receiving data from the untrusted application function; as well as The service of the data received from the untrusted application function is provided to the network function service consumer.

20. The method of claim 17, further comprising: A registration request is provided to a network repository function to register a configuration file of the network opening function, the configuration file of the network opening function including: attributes associated with the untrusted application function.

21. An apparatus for a communication network, the apparatus comprising: at least one processor; as well as At least one memory storing instructions for network open functions, wherein when the instructions are executed by the at least one processor, the device is caused to at least perform: receiving a request from a network function service consumer for a service provided by the network open function, wherein the service provides data obtained from an untrusted application function connected to the network open function, wherein the request includes an access token, the access token including: an identifier associated with the untrusted application function; and Based on the access token, determining that the request is allowed; and The data obtained from the untrusted application function is provided to the network function service consumer.

22. The apparatus according to claim 21, wherein when the instructions are executed by the at least one processor, the apparatus is caused to at least perform: identifying the untrusted application function based on an identifier associated with the untrusted application function included in the access token; providing, to the untrusted application function, a request to provide data from the untrusted application function; receiving data from the untrusted application function; as well as The service of the data received from the untrusted application function is provided to the network function service consumer.

23. The apparatus according to claim 21, wherein when the instructions are executed by the at least one processor, the apparatus is caused to at least perform: Providing a registration request to a network repository function to register a configuration file of the network open function, wherein the configuration file of the network open function includes: Attributes associated with the untrusted application functionality.

24. A computer program comprising computer executable code which, when executed by at least one processor of a device of a communication network, causes the device to perform the method according to any one of claims 18 to 20.

Images