Network repository function failure handling

Abstract

The embodiment of the invention relates to network repository function fault handling. Based on determining (S211) that each of the one or more NRFs of the mobile communications network system has become unavailable, a handover (S213) is performed to an NRF unavailable state in which verification of the NF service consumer based on an access token of the service request to the NF service producer is relaxed. A service request is sent (S215) to the NF service producer, the service request comprising at least an indication of an NRF unavailable state. Upon receipt (S221) of the service request, the service request is processed (S223) based on the indication of the NRF unavailable state.

Description

Technical Field

[0001] At least some example embodiments relate to NRF (Network Repository Function) fault handling. Background Art

[0002] Currently in the 5G core network, NRF plays a central role in the discovery and registration of various 5G service endpoints. This enables a collaborative mechanism for 5G peers to provision their services and also for consumers to get the services they need. Failure of NRF is a very serious failure in the network and causes the entire network operation to fail and cause a complete outage.

[0003] List of abbreviations

[0004] 5G Fifth Generation

[0005] 5GC 5G Core

[0006] AF Application Function

[0007] API Application Programming Interface

[0008] AUSF authentication server function

[0009] CCA Client Credentials Assertion

[0010] FQDN Fully Qualified Domain Name

[0011] ID Identifier

[0012] JSON JavaScript Object Notation

[0013] NF Network Function

[0014] NRF Network Repository Features

[0015] OAUTH Open Authorization

[0016] PLMN Public Land Mobile Network

[0017] SBI Service-Based Interface

[0018] SCP Service Communication Proxy

[0019] SEPP Security Edge Protection Proxy

[0020] TLS Transport Layer Security

[0021] TMO trunking mode operation

[0022] UDM Unified Data Management

[0023] UE User Equipment

[0024] Reference List

[0025] 3GPP TS 33.501 Version 18.2.0, Chapter 13.3.0 and Chapter 13.3.8 Summary of the invention

[0026] At least some example embodiments provide a mechanism for a network for a mobile communication network system (e.g., for a 5G core network) to continue its operation with a degree of safety if a complete NRF failure or NRF endpoints of certain NFs in the network are unavailable.

[0027] According to at least some example embodiments, methods, apparatus and non-transitory computer-readable storage media are provided as defined in the accompanying claims.

[0028] According to at least some example embodiments, a mechanism is provided for failing over to communication model A if the NRF is unavailable.

[0029] At least some example embodiments provide solutions to the problem of NRF unavailability for multiple PLMN scenarios.

[0030] Hereinafter, illustrative examples and example embodiments will be described with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A signaling diagram illustrating a call flow for OAUTH-based communication between a producer and a consumer in a 5GC according to an illustrative example is shown.

[0032] Figure 2 A flow chart illustrating a process for NRF fault handling according to at least some example embodiments is shown.

[0033] Figure 3 A signaling diagram illustrating a call flow between a producer and a consumer if an NRF fails according to at least some example embodiments is shown.

[0034] Figure 4 A signaling diagram illustrating a call flow in case of a consumer-side NRF failure in an inter-PLMN scenario according to at least some example embodiments is shown.

[0035] Figure 5 A signaling diagram illustrating a call flow in case of producer-side NRF failure in an inter-PLMN scenario according to at least some example embodiments is shown.

[0036] Figure 6 A schematic block diagram illustrating a configuration of a control unit in which at least some example embodiments may be implemented is shown. DETAILED DESCRIPTION

[0037] In this application, the terms "consumer" and "NF service consumer" and the terms "producer" and "NF service producer" are used interchangeably.

[0038] First, refer to Figure 1 , illustrating a call flow for OAUTH-based communication between producers and consumers in 5GC according to an illustrative example.

[0039] In step S101a, a consumer of a service (NF service consumer) (also referred to as a service consumer (NF service consumer)) in a network of a mobile communication network system (eg, in 5GC) performs TLS authentication and NF registration with an NRF of the network.

[0040] In step S101b, a service producer (NF service producer) (also referred to as a service producer (NF service producer)) in a network of a mobile communication network system (eg, in 5GC) performs TLS authentication and NF registration with an NRF.

[0041] The Network Function (NF) Repository Function (NRF) is a network entity in the 5G Core Network (5GC) that supports the following functions:

[0042] - Maintain NF profiles of available NF instances and their supported services;

[0043] - Allow other NF instances to subscribe to and get notified about the registration of new NF instances of a type in NRF;

[0044] -Supports service discovery functionality. It receives NF discovery requests from NF instances and provides information on available NF instances that meet certain conditions (e.g., support a given service).

[0045] In step S102, the consumer performs NF discovery based on the demand from the NRF. In other words, the consumer discovers a suitable producer, such as a producer of a service required by the consumer.

[0046] In step S103, the consumer requests an OAUTH token (also called an "access token") to be issued to the desired producer. The NRF provides the access token signed with its private key.

[0047] In step S104, the consumer sends a service request to the producer using the OAUTH token provided by the NRF. The producer verifies the provided OAUTH token using the NRF public key and checks the expiration for authorization. If the producer determines that the access token is correct and has not expired, the producer provides the service to the consumer.

[0048] The above mechanism can be applied in Model B communication (which is direct communication between consumers and producers using NRF interaction), Model C communication (which is indirect communication without delegated discovery), and Model D communication (which is indirect communication with delegated discovery).

[0049] It should be noted that Figure 1 The process shown in is common to all sessions from the same AF to the UE.

[0050] There are mechanisms that focus on improving the availability of NRFs by creating multiple redundant NRF instances and various NFs that can access multiple NRFs if a subset fails. However, these mechanisms cannot address complete NRF failures.

[0051] Now, refer to Figure 2 , illustrating processes 1 and 2 for NRF fault handling according to at least some example embodiments.

[0052] Process 1 can be performed by a service consumer (NF consumer) (also referred to as a service consumer (NF service consumer)) in a network of a mobile communication network system (e.g., in 5GC). The consumer may have performed TLS authentication and NF registration with the NRF of the network earlier.

[0053] Alternatively, in an indirect communication method such as Model C and Model D communication, process 1 may be performed by a service communication agent (eg, SCP) of the NF service consumer.

[0054] Process 1 may be initiated when a consumer initiates NF discovery for discovering a suitable producer of a service.

[0055] In step S211, it is determined that each of the one or more network repository functions NRF of the mobile communication network system has become unavailable. Then, the process 1 proceeds to step S213.

[0056] In step S213, based on the determination, switching to an NRF unavailable state is performed in which authentication of the NF service consumer based on the access token of the service request to the NF service producer is disabled or at least relaxed. Then, process 1 proceeds to step S215.

[0057] The access token for verification is obtained from one or more NRFs. That is, nominally, the access token for verification is obtained from one or more NRFs. However, in the NRF unavailable state, the NF service consumer or SCP cannot obtain the OAUTH access token (access token for verification) from the NRF. The NF service consumer or SCP can use the previously received OAUTH access token (if available, even if expired).

[0058] A service request is a request for a service to be provided by a NF service producer. A NF service consumer is a consumer of a service to be provided by a NF service producer.

[0059] In step S215, a service request is sent to the NF service producer. The service request includes at least an indication of the NRF unavailable state. Then, process 1 ends.

[0060] According to at least some example embodiments, the above steps S211 and S213 correspond to the steps described in more detail later. Figure 3 Step S301 of the embodiment, and step S215 corresponds to Figure 3 Step S303.

[0061] In addition, according to at least some example embodiments, the above steps S211 and S213 correspond to the steps described in more detail later. Figure 4 Step S402 of the embodiment, and step S215 corresponds to Figure 4 Step S403.

[0062] Furthermore, according to at least some example embodiments, the above step S211 corresponds to the step described in more detail later. Figure 5 Step S504, and step S215 corresponds to Figure 5 Step S505.

[0063] According to at least some example embodiments, if an access token for a service request to the NF service producer has been obtained from one or more NRFs before each of the one or more NRFs becomes unavailable, the service request sent in S215 also includes the access token, wherein the access token has expired.

[0064] According to at least some example embodiments, in an NRF unavailable state, a static authorization model based on local configuration is adopted.

[0065] According to at least some example embodiments, a NF service producer is identified based on a local configuration.

[0066] According to at least some example embodiments, step S215 includes routing the service request via a service communication proxy (eg, SCP) to be used for indirect communication between the NF service consumer and the NF service producer.

[0067] According to at least some example embodiments, the service request sent in S215 also includes a client credential assertion CCA token associated with the NF service consumer, wherein the CCA token is to be used for authentication of the NF service consumer.

[0068] According to at least some example embodiments, the service request sent in S215 further includes an identifier of each of the one or more NRFs.

[0069] According to at least some example embodiments, an operation update message is periodically sent to each of the one or more NRFs, and if a reply message is not continuously received within a predetermined time period in response to the operation update message, it is determined in S211 that each of the one or more NRFs has become unavailable.

[0070] According to at least some example embodiments, a notification that each of the one or more NRFs has become unavailable is received, and based on the notification, it is determined in S211 that each of the one or more NRFs has become unavailable.

[0071] According to at least some example embodiments, one or more NRFs are part of a mobile network of a mobile communication network system where a NF service producer is located.

[0072] According to at least some example embodiments, in response to a request for an access token sent (by an NF service consumer or a service communication agent (e.g., SCP) to be used for indirect communication between the NF service consumer and the NF service producer) to the NRF of the mobile network in which the NF service consumer is located or another NRF, a notification is received from the NRF of the mobile network of the mobile communication network system in which the NF service consumer is located.

[0073] According to at least some example embodiments, in step S215, if the NF service producer and the NF service consumer are located in the same mobile network of the mobile communication network system, a service request is sent to the NF service producer.

[0074] According to at least some example embodiments, in step S215, if the NF service producer and the NF service consumer are located in different mobile networks of the mobile communication network system, a service request is sent to the mobile network where the NF service producer is located.

[0075] According to at least some example embodiments, before each of the one or more NRFs becomes unavailable, at least one of the NF service consumers or a service communication agent (e.g., SCP) to be used for indirect communication between the NF service consumer and the NF service producer has been registered in the one or more NRFs.

[0076] According to at least some example embodiments, before each of the one or more NRFs becomes unavailable, at least one of the NF service consumer or the service communication agent has performed a Transport Layer Security (TLS) authentication with the one or more NRFs.

[0077] Process 2 can be performed by a service producer (NF service producer) (also referred to as a service producer (NF service producer)) in a network of a mobile communication network system (e.g., in a 5GC). The producer may have performed TLS authentication and NF registration with the NRF earlier. For example, the NF service producer includes the AUSF / UDM of the PLMN.

[0078] Alternatively, in an indirect communication method (such as Model C and Model D communication), process 2 may be performed by a service communication agent (eg, SCP) of the NF service producer.

[0079] According to at least some example embodiments, process 2 is performed at least in part by a security edge protection proxy (SEPP) of a public land mobile network (PLMN).

[0080] In step S221, a service request is received that includes at least an indication of an NRF unavailable status, the indication of the NRF unavailable status indicating that each of one or more NRFs of the mobile communication network system has become unavailable, and verification of the NF service consumer based on an access token of the service request to the NF service producer is disabled or at least relaxed.

[0081] The access token for verification is obtained from one or more NRFs. That is, nominally, the access token for verification is obtained from one or more NRFs. However, in the NRF unavailable state, the NF service consumer or SCP cannot obtain the OAUTH access token (access token for verification) from the NRF. The NF service consumer or SCP can use the previously received OAUTH access token (if available, even if expired).

[0082] The service request is a request for a service to be provided by the NF service producer, and the NF service consumer is a consumer of the service to be provided by the NF service producer. Then, the process 2 proceeds to step S223.

[0083] In step S223, the service request is processed based on the indication of the NRF unavailable state. Then, process 2 ends.

[0084] According to at least some example embodiments, steps S221 and S223 of process 2 correspond to Figure 3 Step S303.

[0085] According to at least some example embodiments, S221 corresponds to Figure 4 S403, and S223 corresponds to Figure 4 S404 and S404a or S405.

[0086] According to at least some example embodiments, S221 corresponds to Figure 4S405, and S223 corresponds to Figure 4 S406.

[0087] According to at least some example embodiments, S221 corresponds to Figure 5 S505, and S223 corresponds to Figure 5 S506 and S506a or S507.

[0088] According to at least some example embodiments, S221 corresponds to Figure 5 S507, and S223 corresponds to Figure 5 S508.

[0089] According to at least some example embodiments, the service request received in S221 also includes an access token that has expired.

[0090] According to at least some example embodiments, the service request received in S221 further includes a client credential assertion CCA token associated with the NF service consumer, wherein the CCA token is to be used for authentication of the NF service consumer.

[0091] According to at least some example embodiments, the service request received in S221 further includes an identifier of each of the one or more NRFs.

[0092] According to at least some example embodiments, the service request is processed in S223 based on the indication of the NRF unavailable state and at least one of an access token, a CCA token, or an identifier of each of the one or more NRFs.

[0093] According to at least some example embodiments, it is determined that each of the one or more NRFs has become unavailable.

[0094] According to at least some example embodiments, an operation update message is periodically sent to each of the one or more NRFs, and if a reply message is not continuously received within a predetermined time period in response to the operation update message, it is determined that each of the one or more NRFs has become unavailable.

[0095] According to at least some example embodiments, based on the determination, switching to an NRF unavailable state is performed.

[0096] According to at least some example embodiments, when the NF service producer receives a service request, it is in an NRF unavailable state.

[0097] According to at least some example embodiments, in an NRF unavailable state, a static authorization model based on local configuration is adopted.

[0098] According to at least some example embodiments, the processing in S223 includes performing authorization of the NF service consumer based on the local configuration.

[0099] According to at least some example embodiments, if the service request received in S221 also includes a CCA token associated with the NF service consumer, authorization of the NF service consumer is performed based on the local configuration and the CCA token.

[0100] According to at least some example embodiments, the processing in S223 includes forwarding the service request to a NF service producer, such as an authentication server function.

[0101] According to at least some example embodiments, the processing in S223 includes returning an error message.

[0102] According to at least some example embodiments, if the service request further includes an access token that has expired, the processing in S223 includes accepting the access token that has expired.

[0103] According to at least some example embodiments, if the service request further includes an identifier of each of the one or more NRFs, the process in S223 further includes checking whether each of the one or more NRFs is available based on the identifier.

[0104] According to at least some example embodiments, if it is checked that at least one of the one or more NRFs specified in the service request is available, an error message is returned in response to the service request.

[0105] According to at least some example embodiments, if each of the one or more NRFs specified in the service request is checked to be unavailable, the service request is forwarded to a NF service producer, such as an authentication server function.

[0106] According to at least some example embodiments, if each of the one or more NRFs specified in the service request is checked to be unavailable, authorization of the NF service consumer is performed, for example, based on a local configuration.

[0107] According to at least some example embodiments, the checking includes periodically sending an operation update message to each of the one or more NRFs specified in the service request, wherein if a reply message is not continuously received within a predetermined time period in response to the operation update message, it is determined that each of the one or more NRFs specified in the service request is unavailable.

[0108] According to at least some example embodiments, a mechanism is provided to failover to Model A communication when NRF is unavailable. Model A communication is communication between NF service consumers and NF service producers without NRF interaction.

[0109] In a network, simply failing over from Model B, C, or D to Model A is not a simple solution. When failing over to Model A, consumers can fall back to local configuration to access producers, however, consumers are no longer able to provide OAUTH related tokens as part of service requests. This can result in failures from producers that no longer get tokens or get expired tokens from consumers. This can result in service outages.

[0110] In the following, reference will be made to Figure 3 Describes a single PLMN scenario, illustrating the call flow between the producer and consumer if the NRF fails. In the single PLMN scenario, the NF service consumer and the NF service producer are located in a single PLMN.

[0111] If there is a complete network outage of the NRF, each NF detects and determines that all configured NRFs are unavailable and puts itself into the "NRF Unavailable" state. Figure 3 , where both the producer and the consumer detect an NRF failure and place themselves in an “NRF unavailable” state.

[0112] NRF failure may be detected, for example, by detecting that NF heartbeat messages to each of one or more NRFs fail continuously (e.g., exceed a threshold). Each NF that has previously registered with the NRF should periodically contact the NRF (heartbeat) by invoking the NFUpdate service operation to indicate that the NF is still operational. If a reply message to such regularly sent operation update messages is not received continuously within a predetermined time period, it may be determined by the NF that the NRF has become unavailable.

[0113] In the NRF Unavailable state, each of the NFs reverts to a configuration-based authorization model for the peer, such as the static authorization model defined in 3GPP TS 33.501. Figure 3 This is illustrated in step S302 for the NF service consumer. The NF service consumer adopts Model A communication.

[0114] At this point, OAUTH token validation is disabled or at least relaxed. Additionally, a Client Credentials Assertion (CCA) token issued by the consumer can be used as a verifier of the self-declaration made by the consumer. TLS connectivity also acts as an additional level of security.

[0115] The consumer relies on local configuration to identify the producer to connect to, as in Model A (S302). In step S303, the NF service consumer sends a service request to the NF service producer. The service request can also be routed via the SCP associated with the NF service consumer or the SCP associated with the NF service producer (if available).

[0116] In the service request at S303 , the consumer may send the last OAUTH token (even if expired) to the producer.

[0117] The consumer adds an indication to the service request that it is in an "NRF Unavailable" state. To support this, a new custom header may be introduced, or an existing custom header may be enhanced. Alternatively, the indication may be added in each message / JSON.

[0118] An example of the new client header format is:

[0119] 3gpp-Sbi-NRF-Down-Info which contains the list of NRF instance ids / fqdns that NFc cannot reach.

[0120] For example:

[0121] 3gpp-Sbi-NRF-Down-Info: NRFDownList=NRFInstanceId1,NFInstanceId2..

[0122] This indication is used to verify the relaxation of OAUTH authentication, allowing an expired token claim to be made by the consumer if the producer still has NRF connectivity and the consumer does not.

[0123] In other words, in S303 , the producer checks the “NRF not available” indication, and authorizes and accepts the expired OAUTH token via the local configuration and the CAA token.

[0124] If model D communicates, it can also be adopted by SCP Figure 3 The process shown in .

[0125] Now, refer to Figure 4 Describes the inter-PLMN scenario and illustrates the call flow if the NRF fails on the consumer side. Figure 4 In the inter-PLMN scenario, the NF service consumer (NF C ) is located in PLMN1 of the mobile communication network system, and the NF service producer (NF P )(exist Figure 4 The AUSF / UDM in the scenario is located in PLMN2 of the mobile communication network system.

[0126] In S401 , the NF service consumer of PLMN1 registers in NRF1 and NRF2 of PLMN1 .

[0127] In S402, the NF service consumer sends a heartbeat message to each of NRF1 and NRF2. If the heartbeat message to each of NRF1 and NRF2 fails, the NF service consumer moves to Model A communication, using an expired access token (if available). According to at least some example embodiments, step S402 corresponds to Figure 3 S301 and S302 in.

[0128] In S403, the NF service consumer sends a service request to the NF service producer (using the local configuration identifier), and in the service request, for example, "3gpp-Sbi-NRF-Down-Info" is used to indicate the "NRF unavailable" state. The service request may also include an (expired) access token and an unavailable NRF list (NRFDownList) NRF1, NRF2.

[0129] The NF service producer is located in PLMN2, and the NRF of PLMN2 is available. The SEPP of PLMN2 receives the service request issued by the NF service consumer. In step S404, based on the operator policy and agreement, considering that the token is not available or the expired token is available, even if there is a custom header, the SEPP may reject the service request, as illustrated by S404a, where the SEPP returns an error.

[0130] Alternatively, based on operator policies and agreements, the SEPP forwards the service request to the AUSF / UDM of PLMN2, as illustrated by S405.

[0131] exist Figure 4 In the scenario illustrated in FIG, at least one of the AUSF or the UDM is shown as the NF service producer. However, the NF service producer is not limited to the AUSF or the UDM, and the NF service producer may be any network function that provides services in the PLMN2. In other words, different NF service producers are called based on different use cases.

[0132] In S406 , the AUSF / UDM may perform authorization of the NF service consumer even if the token has expired or is unavailable but the custom indication exists.

[0133] In addition, SEPP, AUSF / UDM or NF P The unavailable NRF list specified in the custom header (i.e., checking whether the available NRF IDs in the custom header are actually closed) may be verified before providing services (e.g., whether the heartbeat successfully reaches the NRF or via implementation means).

[0134] In steps S407a, b, the AUSF / UDM sends a response to the NF service consumer via the SEPP of PLMN2.

[0135] Figure 5 The figure shows the call flow if the NRF on the producer side fails in the inter-PLMN scenario. C ) is located in PLMN1 of the mobile communication network system, and the NF service producer (NF P )(exist Figure 5 The AUSF / UDM in the scenario is located in PLMN2 of the mobile communication network system.

[0136] In S501 , the NF service consumer of PLMN1 registers in NRF1 and NRF2 of PLMN1 .

[0137] According to S502, the NF service producer (in Figure 5 The AUSF / UDM in the scenario of NF Service Producer sends a heartbeat message to each of one or more NRFs (in this case NRF3 of PLMN2). If the heartbeat message sent to NRF3 fails, the NF Service Producer moves to Model A communication, using the expired access token if available.

[0138] In S503, NRF2 receives the access token request from the NF service consumer and forwards the access token request to NRF3 of PLMN2. If the access token API fails, NRF2 of PLMN1 determines that NRF3 in PLMN2 is not available and provides an error indication to the NF service consumer (S504). The error indication includes an identifier of the unavailable NRF3 in PLMN2. The NF service consumer moves to Model A communication, using an expired token if available.

[0139] In S505, the NF service consumer sends a service request to the NF service producer (using the local configuration identifier), indicating the "NRF unavailable" state in the service request, for example, using "3gpp-Sbi-NRF-Down-Info". The service request may also include an (expired) access token and an unavailable NRF list (NRFDownList) NRF3.

[0140] The SEPP of PLMN2 receives the service request issued by the NF service consumer. In step S506, based on operator policies and protocols, considering that the token is not available or an expired token is available, even if there is a custom header, the SEPP may reject the service request, as illustrated by S506a, where the SEPP returns an error.

[0141] Alternatively, based on operator policies and agreements, the SEPP forwards the service request to the AUSF / UDM of PLMN2, as illustrated by S507.

[0142] In S508, the AUSF / UDM may perform authorization of the NF service consumer even if the token has expired or is unavailable but the custom indication exists.

[0143] In addition, SEPP, AUSF / UDM or NF P A list of unavailable NRFs specified in a custom header can be verified before providing services. In other words, SEPP, AUSF / UDM or NF P It is possible to check whether the NRFID available in the custom header is actually closed (e.g., whether the heartbeat successfully reaches the NRF or via the implementation).

[0144] SEPP, AUSF / UDM or NF P The requested service can be provided to the NFc or the service request can be denied based on the information available in the custom header.

[0145] In steps S509a, b, the AUSF / UDM sends a response to the NF service consumer via the SEPP of PLMN2.

[0146] Reference now Figure 6 , illustrates a simplified block diagram of control units 610, 620 suitable for use in practicing at least some example embodiments. According to an implementation example, Figure 2 Process 1 is implemented by the control unit 610, and Figure 2 Process 2 is implemented by the control unit 620.

[0147] The control units 610 , 620 each include processing resources (eg, processing circuits) 611 , 621 , memory resources (eg, memory circuits) 612 , 622 , and interfaces (eg, interface circuits) 613 , 623 , which are coupled via wired or wireless connections 614 , 624 .

[0148] According to an example implementation, the memory resources 612, 622 are of any type suitable for the local technical environment and are implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The processing resources 611, 621 are of any type suitable for the local technical environment and include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture, as non-limiting examples.

[0149] According to an implementation example, the memory resources 612, 622 include one or more non-transitory computer-readable storage media, which store one or more programs that, when executed by the processing resources 611, 621, enable the control units 610, 620 to act as NF service consumers or SCPs associated with NF consumers, and NF service producers or SCPs associated with NF service producers or SEPP or AUSF / UDM, as described above.

[0150] According to at least some example embodiments, the NF service consumer (or an SCP associated with the NF service consumer) is hardware including software, or is simply software executable by at least one processor of one or more computers (e.g., a distributed computing system or a cloud computing system).

[0151] According to at least some example embodiments, the NF service producer (or SCP associated with the NF service producer or SEPP) is hardware including software, or is simply software executable by at least one processor of one or more computers (e.g., a distributed computing system or a cloud computing system).

[0152] In one embodiment, the apparatus for performing at least some of the described embodiments comprises at least one processor and at least one memory, the at least one memory comprising instructions, which when executed by the at least one processor causes the apparatus to perform functions according to any of the described embodiments. According to one aspect, when the at least one processor executes the instructions, the instructions cause the apparatus to perform functions according to any of the described embodiments. According to another embodiment, the apparatus for performing at least some of the embodiments comprises at least one processor and at least one memory, the at least one memory comprising instructions, wherein the at least one processor and the instructions perform at least some of the functions according to any of the described embodiments. Thus, at least one processor, memory and instructions form a processing unit for performing at least some of the described embodiments. According to yet another embodiment, the apparatus for performing at least some of the embodiments comprises a circuit comprising at least one processor and at least one memory instruction. When activated, the circuit causes the apparatus to perform at least some of the functions according to any of the described embodiments.

[0153] The control units 610 , 620 may be communicatively coupled to each other via a connection 630 .

[0154] According to an example, the control unit 610 is executed Figure 2 A device (eg, a device for consuming a service) or a device included in executing the process 1 Figure 2In a device (eg, a device for consuming services) of process 1. For example, the control unit 610 may be a NF service consumer or SCP or may be included in a NF service consumer or SCP.

[0155] According to an example, the control unit 620 is executed Figure 2 A device of process 2 (eg, a device for providing a service) or a device included in executing Figure 2 In a device (eg, a device for providing a service) of process 2. For example, the control unit 220 may be a NF service producer, an SCP, or a SEPP or may be included in a NF service producer, an SCP, or a SEPP.

[0156] Furthermore, as used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0157] (a) hardware circuit implementation only (such as implementation in analog and / or digital circuits only) and

[0158] (b) a combination of hardware circuitry and software such as (where applicable):

[0159] (i) a combination of analog and / or digital hardware circuits and software / firmware and

[0160] (ii) hardware processor(s) with software (including(s)

[0161] any part of a digital signal processor), software and memory(s) that work together to enable a device such as a mobile phone or server to perform various functions) and

[0162] (c) Hardware circuits and / or processor(s), such as microprocessor(s) or portions of microprocessor(s), that require software (e.g., firmware) for operation, but the software may not be present when not required for operation.

[0163] This definition of circuitry applies to all uses of the term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. For example and if applicable to a particular claim element, the term circuitry also covers a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0164] The term "non-transitory" as used herein is a limitation of the medium itself (ie, tangible, not a signal), not a limitation on data storage persistence (eg, RAM vs. ROM).

[0165] It is worth noting that, as used herein, “at least one of: ” and “at least one of ” and similar expressions mean at least any one of the elements or at least any two or more of the elements or at least all of the elements, where the list of two or more elements is connected by “and” or “or”.

[0166] According to one aspect, an apparatus is provided, for example including an NF service consumer or an SCP. The apparatus includes a component for determining that each of one or more network repository functions NRFs of a mobile communication network system has become unavailable, a component for switching to an NRF unavailable state based on the determination, in which the verification of the network function NF service consumer based on an access token of a service request to an NF service producer is relaxed, wherein the access token used for verification is to be obtained from one or more NRFs, wherein the service request is a request for a service to be provided by the NF service producer, and wherein the NF service consumer is a consumer of the service to be provided by the NF service producer, and a component for sending a service request to the NF service producer, the service request including at least an indication of the NRF unavailable state.

[0167] According to at least some example embodiments, if an access token for a service request to a NF service producer has been obtained from one or more NRFs before each of the one or more NRFs became unavailable, the service request also includes the access token, wherein the access token has expired.

[0168] According to at least some example embodiments, the apparatus further comprises means for employing a static authorization model based on a local configuration in an NRF unavailable state.

[0169] According to at least some example embodiments, the apparatus further comprises means for identifying the NF service producer based on the local configuration.

[0170] According to at least some example embodiments, the service request also includes a client credential assertion CCA token associated with the NF service consumer, wherein the CCA token is to be used for authentication of the NF service consumer.

[0171] According to at least some example embodiments, the service request further includes an identifier of each of the one or more NRFs.

[0172] According to at least some example embodiments, the apparatus further comprises means for receiving a notification that each of the one or more NRFs has become unavailable, wherein it is determined based on the notification that each of the one or more NRFs has become unavailable.

[0173] According to at least some example embodiments, one or more NRFs are part of a mobile network of a mobile communication network system where a NF service producer is located.

[0174] According to at least some example embodiments, a notification is received from an NRF of a mobile network of a mobile communication network system where an NF service consumer is located in response to a request for an access token sent to an NRF of the mobile network where the NF service consumer is located or another NRF.

[0175] According to at least some example embodiments, the means for sending includes means for sending a service request to the NF service producer if the NF service producer and the NF service consumer are located in the same mobile network of the mobile communication network system.

[0176] According to at least some example embodiments, the means for sending includes means for sending the service request to the mobile network where the NF service producer is located if the NF service producer and the NF service consumer are located in different mobile networks of the mobile communication network system.

[0177] According to at least some example embodiments, before each of the one or more NRFs becomes unavailable, at least one of the NF service consumer or the SCP has been registered with the one or more NRFs.

[0178] According to at least some example embodiments, at least one of the NF service consumer or the SCP has performed a Transport Layer Security (TLS) authentication to the one or more NRFs before each of the one or more NRFs becomes unavailable.

[0179] According to another aspect, a device is provided, for example, including an NF service producer, an SCP or a SEPP. The device includes a component for receiving a service request, the service request including at least an indication of an unavailable state of a network repository function NRF, wherein the indication of the unavailable state of the NRF indicates that each of one or more NRFs of the mobile communication network system has become unavailable, and the verification of the network function NF service consumer based on the access token of the service request to the NF service producer is relaxed, wherein the access token used for verification is to be obtained from one or more NRFs, wherein the service request is a request for a service to be provided by the NF service producer, and wherein the NF service consumer is a consumer of the service to be provided by the NF service producer, and a component for processing the service request based on the indication of the unavailable state of the NRF.

[0180] According to at least some example embodiments, the service request further includes at least one of the following:

[0181] An access token that has expired,

[0182] The client credentials associated with the NF Service Consumer assert a CCA token, where the CCA token is to be used for authentication of the NF Service Consumer, or

[0183] an identifier of each of the one or more NRFs, and

[0184] The service request is processed based on the indication of the NRF unavailable status and at least one of the access token, the CCA token, or an identifier of each of the one or more NRFs.

[0185] According to at least some example embodiments, the apparatus further includes means for determining that each of the one or more NRFs has become unavailable.

[0186] According to at least some example embodiments, the apparatus further comprises a component for periodically sending an operation update message to each of the one or more NRFs, wherein if a reply message is not continuously received within a predetermined time period in response to the operation update message, it is determined that each of the one or more NRFs has become unavailable.

[0187] According to at least some example embodiments, the apparatus further comprises means for switching to the NRF unavailable state based on the determination.

[0188] According to at least some example embodiments, the NF service producer is in an NRF unavailable state.

[0189] According to at least some example embodiments, the apparatus further comprises means for employing a static authorization model based on a local configuration in an NRF unavailable state.

[0190] According to at least some example embodiments, means for processing includes means for performing authorization of the NF service consumer based on a local configuration.

[0191] According to at least some example embodiments, if the service request also includes a CCA token associated with the NF service consumer, authorization of the NF service consumer is performed based on the local configuration and the CCA token.

[0192] According to at least some example embodiments, means for processing includes means for forwarding the service request to the NF service producer.

[0193] According to at least some example embodiments, means for processing includes means for returning an error message.

[0194] According to at least some example embodiments, means for processing includes means for accepting the expired access token if the service request also includes the expired access token.

[0195] According to at least some example embodiments, a component for processing includes: a component for the following operations: if the service request also includes an identifier of each of the one or more NRFs, checking whether each of the one or more NRFs is available based on the identifier; a component for the following operations: if it is checked that at least one of the one or more NRFs specified in the service request is available, returning an error message in response to the service request; a component for the following operations: if it is checked that each of the one or more NRFs specified in the service request is not available, forwarding the service request to the NF service producer; or a component for the following operations: if it is checked that each of the one or more NRFs specified in the service request is not available, performing authorization of the NF service consumer.

[0196] According to at least some example embodiments, the component for checking includes a component for periodically sending an operation update message to each of the one or more NRFs specified in the service request, wherein if a reply message is not continuously received within a predetermined time period in response to the operation update message, it is determined that each of the one or more NRFs specified in the service request is unavailable.

[0197] It should be understood that the above description is illustrative and should not be interpreted as limiting. Various modifications and applications may occur to those skilled in the art without departing from the true spirit and scope as defined in the appended claims.

Claims

1. A method for communication, comprising: determining that each of the one or more network repository functions NRF of the mobile communication network system has become unavailable; Based on the determination, switching to an NRF Unavailable state in which authentication of the network function NF service consumer based on the access token of the service request to the NF service producer is relaxed, wherein the service request is a request for a service to be provided by the NF service producer, and wherein the NF service consumer is a consumer of the service to be provided by the NF service producer; as well as Sending the service request to the NF service producer, the service request including at least an indication of the unavailable state of the NRF.

2. The method according to claim 1, wherein if the access token for the service request to the NF service producer has been acquired from the one or more NRFs before each of the one or more NRFs becomes unavailable, the service request further includes the access token, The access token has expired.

3. The method according to claim 1, further comprising: In the NRF unavailable state, a static authorization model based on local configuration is adopted.

4. The method according to claim 3, further comprising: The NF service producer is identified based on the local configuration.

5. The method according to claim 1, wherein The service request also includes: The client credentials associated with the NF service consumer assert a CCA token, wherein the CCA token is to be used for authentication of the NF service consumer.

6. The method according to claim 1, wherein The service request also includes: An identifier of each NRF of the one or more NRFs.

7. The method according to claim 1, further comprising: receiving a notification that each of the one or more NRFs has become unavailable, Wherein it is determined based on the notification that each of the one or more NRFs has become unavailable.

8. The method according to claim 1, wherein the method is applicable to the NF service consumer, or a service communication agent to be used for indirect communication between the NF service consumer and the NF service producer.

9. A method for communication, comprising: receiving a service request, the service request comprising at least an indication of an unavailable state of the network repository function NRF, wherein the indication of the NRF unavailable state indicates that each of the one or more NRFs of the mobile communication network system has become unavailable, and authentication of the network function NF service consumer based on an access token of a service request to the NF service producer is relaxed, wherein the service request is a request for a service to be provided by the NF service producer, and wherein the NF service consumer is a consumer of the service to be provided by the NF service producer; and The service request is processed based on the indication of an unavailable status of the NRF.

10. The method according to claim 9, wherein The service request further includes at least one of the following: the access token has expired, a client credential asserting a CCA token associated with the NF service consumer, wherein the CCA token is to be used for authentication of the NF service consumer, or an identifier of each of the one or more NRFs, and The service request is processed based on the indication of the unavailable status of the NRF and at least one of the access token, the CCA token, or the identifier of each of the one or more NRFs.

Images