User authentication exposure

Abstract

The invention relates to user authentication exposure. There is provided an apparatus (200, 300) comprising: means for sending a registration message to an access and mobility management function, the registration message indicating whether the apparatus supports user authentication information sharing; means for receiving a request from an access and mobility management function, the request requesting a user that the device authenticates the device; means for authenticating the user based on the request; means for generating user authentication data; and means for sending user authentication data to the access and mobility management function.

Description

Technical Field

[0001] The present application relates to a method, apparatus and computer program, and in particular but not limited to user authentication exposure. Background Art

[0002] A communication system can be viewed as a facility that enables a communication session between two or more entities (such as user terminals, base stations and / or other nodes) by providing a carrier between the various entities involved in the communication path. A communication system can be provided, for example, by means of a communication network and one or more compatible communication devices. A communication session can include, for example, a communication for carrying data for communication, such as voice, video, email (email), text message, multimedia and / or content data, etc. Non-limiting examples of the services provided include two-way or multi-way calls, data communications or multimedia services, and access to a data network system (such as the Internet). In a wireless communication system, at least a portion of a communication session between at least two stations is conducted over a wireless link. Examples of wireless systems include public land mobile networks (PLMNs), satellite-based communication systems, and different wireless local networks, such as wireless local area networks (WLANs). Some wireless systems can be divided into cells, and are therefore often referred to as cellular systems.

[0003] A user may access the communication system by means of an appropriate communication device or terminal. The communication device of a user may be referred to as user equipment (UE) or user device.

[0004] Communication systems and associated equipment typically operate according to a given standard or specification that specifies what the various entities associated with the system are allowed to do and how it should be implemented. The communication protocols and / or parameters that should be used for the connection are also typically defined. An example of a communication system is UTRAN (3G radio). Other examples of communication systems are the Long Term Evolution (LTE) of the Universal Mobile Telecommunications System (UMTS) radio access technology and the so-called 5G or New Radio (NR) networks. NR is being standardized by the Third Generation Partnership Project (3GPP). Other examples of communication systems include Advanced 5G (NR Rel-18 and above) and 6G.

[0005] A feature of modern communication systems is known as user authentication. 5G systems may support mechanisms for exposing the results of user equipment (UE) authenticating a user to a third party. Summary of the invention

[0006] According to a first aspect, a device is disclosed, comprising: a component for sending a registration message to an access and mobility management function, the registration message indicating whether the device supports user authentication information sharing; a component for receiving a request from the access and mobility management function, the request requesting the device to authenticate a user of the device; a component for authenticating the user based on the request; a component for generating user authentication data; and a component for sending the user authentication data to the access and mobility management function.

[0007] According to some examples, the device includes: means for enabling a user to register identification information in the device for each user of the device.

[0008] According to some examples, the apparatus includes: means for assigning to identification information of each user a username and at least one of: a profile identifier and a PN identifier.

[0009] According to some examples, the apparatus includes means for sending, via an access and mobility management function, to a unified data management node a username for each user of the apparatus and at least one of: a profile identifier and a PN identifier.

[0010] According to some examples, the apparatus includes means for authenticating a user by prompting the user to provide identification information of the user.

[0011] According to some examples, the identification information includes at least one of: facial biometric information; finger recognition information; PIN information.

[0012] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0013] According to some examples, the device periodically sends user authentication data.

[0014] According to a second aspect, a device is provided, comprising at least one processor; and at least one memory storing instructions which, when executed by the at least one processor, cause the device to at least perform: sending a registration message to an access and mobility management function, the registration message indicating whether the device supports user authentication information sharing; receiving a request from the access and mobility management function, the request requesting the device to authenticate a user of the device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0015] According to a third aspect, a device is provided, comprising: a component for receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; a component for receiving a request to invoke user authentication at a user device or a request for user authentication data from at least one application function, at least one network function, or at least one operator and maintenance instance; a component for determining whether a user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, a component for sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and a component for receiving user authentication data from the user device via the access and mobility management function.

[0016] According to some examples, the apparatus further comprises means for receiving and storing a username and at least one of the following for each user of the user device: a profile identifier and a PIN identifier.

[0017] According to some examples, the apparatus includes means for sending a request message to an access and mobility management function to prompt a user equipment to authenticate a user.

[0018] According to some examples, the user authentication data may include at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0019] According to some examples, the apparatus includes means for updating user authentication data and sending the updated user authentication data to at least one of: at least one application function; at least one network function; or at least one operator and maintenance instance.

[0020] According to some examples, the updated user authentication data includes at least one of: authentication type; authentication result, timestamp; user name; an indication of whether multiple PINs are supported by the user device.

[0021] According to a fourth aspect, a device is provided, comprising at least one processor; and at least one memory storing instructions, which, when executed by the at least one processor, causes the device to at least perform: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to invoke user authentication at a user device or a request for user authentication data from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0022] According to a fifth aspect, a device is provided, comprising: a component for receiving a registration message from a user device, the registration message indicating whether the user device supports sharing of user authentication information; a component for receiving a request message from a unified data management node prompting the user device to authenticate a user; a component for receiving user authentication data from the user device; and a component for sending user authentication data to the unified data management node.

[0023] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0024] According to the sixth aspect, a device is provided, comprising at least one processor; and at least one memory, the at least one memory storing instructions, which, when executed by the at least one processor, causes the device to at least perform: receiving a registration message from a user device, the registration message indicating whether the user device supports user authentication information sharing; receiving a request message from a unified data management node prompting the user device to authenticate the user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0025] According to a seventh aspect, a device is provided, comprising: a component for sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and a component for receiving user authentication data from the unified data management node.

[0026] According to the eighth aspect, a device is provided, comprising at least one processor; and at least one memory, wherein the at least one memory stores instructions, which, when executed by the at least one processor, causes the device to at least perform: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0027] According to a ninth aspect, a method is provided, comprising: sending a registration message to an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request from the access and mobility management function, the request requesting the user device to authenticate a user of the user device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0028] According to some examples, the method includes enabling a user to register identification information in a user device for each user of the user device.

[0029] According to some examples, the method includes assigning, to the identification information of each user, a username and at least one of: a profile identifier and a PIN identifier.

[0030] According to some examples, the method includes sending, via the access and mobility management function, to the unified data management node a user name and at least one of: a profile identification and a PIN identification for each user of the user equipment.

[0031] According to some examples, the method includes authenticating the user by prompting the user to provide identification information of the user.

[0032] According to some examples, the identification information includes at least one of: facial biometric information; finger recognition information; PIN information.

[0033] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0034] According to some examples, the method includes periodically sending user authentication data.

[0035] According to the tenth aspect, a method is provided, comprising: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to call user authentication at a user device, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0036] According to some examples, the method includes receiving and storing a username and at least one of the following for each user of the user device: a profile identification and a PIN identification.

[0037] According to some examples, the method includes sending a request message to an access and mobility management function to prompt a user equipment to authenticate a user.

[0038] According to some examples, the user authentication data may include at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0039] According to some examples, the method includes updating user authentication data, and sending the updated user authentication data to at least one of: at least one application function; at least one network function; or at least one operator and maintenance instance.

[0040] According to some examples, the updated user authentication data includes at least one of: authentication type; authentication result, timestamp; user name; an indication of whether multiple PINs are supported by the user device.

[0041] According to the eleventh aspect, a method is provided, comprising: receiving a registration message from a user device, the registration message indicating whether the user device supports user authentication information sharing; receiving a request message from a unified data management node prompting the user device to authenticate the user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0042] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0043] According to a twelfth aspect, a method is provided, comprising: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0044] According to the thirteenth aspect, a computer program is provided, comprising instructions for causing a device to perform at least the following: sending a registration message to an access and mobility management function, the registration message indicating whether the device supports user authentication information sharing; receiving a request from the access and mobility management function, the request requesting the device to authenticate a user of the device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0045] According to some examples, a computer program includes instructions for causing an apparatus to execute instructions for enabling a user to register identification information in a user device for each user of the user device.

[0046] According to some examples, the computer program includes instructions for causing a device to execute instructions for assigning a username and at least one of the following to identification information of each user: a profile identification and a PN identification.

[0047] According to some examples, the computer program includes instructions for causing an apparatus to execute instructions for sending, via an access and mobility management function, to a unified data management node a user name for each user of a user equipment and at least one of: a profile identifier and a PN identifier.

[0048] According to some examples, a computer program includes instructions for causing an apparatus to execute instructions for authenticating a user by prompting the user to provide identification information of the user.

[0049] According to some examples, the identification information includes at least one of: facial biometric information; finger recognition information; PIN information.

[0050] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0051] According to some examples, a computer program includes instructions for causing an apparatus to execute periodic transmission of user authentication data.

[0052] According to the fourteenth aspect, a computer program is provided, comprising instructions for causing an apparatus to execute at least the following: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to invoke user authentication at a user device, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0053] According to some examples, a computer program includes instructions for causing an apparatus to perform receiving and storing a username and at least one of the following for each user of a user device: a profile identification and a PIN identification.

[0054] According to some examples, a computer program includes instructions for causing an apparatus to execute sending a request message to an access and mobility management function to prompt a user equipment to authenticate a user.

[0055] According to some examples, the user authentication data may include at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0056] According to some examples, the computer program includes instructions for causing a device to execute updating user authentication data and sending the updated user authentication data to at least one of: at least one application function; at least one network function; or at least one operator and maintenance instance.

[0057] According to some examples, the updated user authentication data includes at least one of: authentication type; authentication result, timestamp; user name; an indication of whether multiple PINs are supported by the user device.

[0058] According to the fifteenth aspect, a computer program is provided, comprising instructions for causing an apparatus to perform at least the following: receiving a registration message from a user device, the registration message indicating whether the user device supports sharing of user authentication information; receiving a request message from a unified data management node prompting the user device to authenticate a user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0059] According to some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile identifier; PIN identifier.

[0060] According to a sixteenth aspect, a computer program is provided, comprising instructions for causing an apparatus to perform at least the following: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0061] According to the seventeenth aspect, a computer program is provided, comprising instructions stored thereon, for performing at least the following: sending a registration message to an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request from the access and mobility management function, the request requesting the user device to authenticate a user of the user device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0062] According to the eighteenth aspect, a computer program is provided, comprising instructions stored thereon, for performing at least the following: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to invoke user authentication at a user device or a request for user authentication data from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0063] According to the nineteenth aspect, a computer program is provided, comprising instructions stored thereon, for performing at least the following: receiving a registration message from a user device, the registration message indicating whether the user device supports sharing of user authentication information; receiving a request message from a unified data management node prompting the user device to authenticate a user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0064] According to the twentieth aspect, a computer program is provided, comprising instructions stored thereon, for performing at least the following: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0065] According to the twenty-first aspect, a non-volatile computer-readable medium is provided, comprising program instructions, which, when executed by an apparatus, cause the apparatus to perform at least the following: send a registration message to an access and mobility management function, the registration message indicating whether the user equipment supports user authentication information sharing; receive a request from the access and mobility management function, the request requesting the user equipment to authenticate a user of the user equipment; authenticate the user based on the request; generate user authentication data; and send the user authentication data to the access and mobility management function.

[0066] According to the twenty-second aspect, a non-volatile computer-readable medium is provided, comprising program instructions, which, when executed by an apparatus, cause the apparatus to perform at least the following: receive a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receive a request to invoke user authentication at a user device, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determine whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, send a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receive user authentication data from the user device via the access and mobility management function.

[0067] According to the twenty-third aspect, a non-volatile computer-readable medium is provided, comprising program instructions, which, when executed by an apparatus, cause the apparatus to at least perform the following: receive a registration message from a user device, the registration message indicating whether the user device supports sharing of user authentication information; receive a request message from a unified data management node prompting the user device to authenticate the user; receive user authentication data from the user device; and send the user authentication data to the unified data management node.

[0068] According to the twenty-fourth aspect, a non-volatile computer-readable medium is provided, comprising program instructions, which, when executed by an apparatus, cause the apparatus to perform at least the following: send a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receive user authentication data from the unified data management node.

[0069] According to the twenty-fifth aspect, a non-volatile computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: sending a registration message to an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request from the access and mobility management function, the request requesting the user device to authenticate a user of the user device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0070] According to the twenty-sixth aspect, a non-volatile computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to call user authentication at a user device, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0071] According to the twenty-seventh aspect, a non-volatile computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: receiving a registration message from a user device, the registration message indicating whether the user device supports user authentication information sharing; receiving a request message from a unified data management node prompting the user device to authenticate the user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0072] According to the twenty-eighth aspect, a non-volatile computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0073] According to the twenty-ninth aspect, a computer-readable medium is provided, comprising program instructions, which, when executed by a master node device, cause the device to perform at least the following: send a registration message to an access and mobility management function, the registration message indicating whether the user equipment supports user authentication information sharing; receive a request from the access and mobility management function, the request requesting the user equipment to authenticate a user of the user equipment; authenticate the user based on the request; generate user authentication data; and send the user authentication data to the access and mobility management function.

[0074] According to the thirtieth aspect, a computer-readable medium is provided, comprising program instructions, which, when executed by a master node device, cause the device to perform at least the following: receive a registration message from an access and mobility management function, the registration message indicating whether the user equipment supports user authentication information sharing; receive a request to call user authentication at the user equipment, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determine whether the user equipment supports user authentication information sharing; when the user equipment supports user authentication information sharing, send a request to the user equipment via the access and mobility management function, the request requesting authentication of the user at the user equipment; and receive user authentication data from the user equipment via the access and mobility management function.

[0075] According to the thirty-first aspect, a computer-readable medium is provided, comprising program instructions, which, when executed by a master node device, causes the device to perform at least the following: receive a registration message from a user device, the registration message indicating whether the user device supports user authentication information sharing; receive a request message from a unified data management node prompting the user device to authenticate the user; receive user authentication data from the user device; and send the user authentication data to the unified data management node.

[0076] According to the thirty-second aspect, a computer-readable medium is provided, comprising program instructions, which, when executed by a master node device, causes the device to perform at least the following: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node.

[0077] According to the thirty-third aspect, a computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: sending a registration message to an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request from the access and mobility management function, the request requesting the user device to authenticate a user of the user device; authenticating the user based on the request; generating user authentication data; and sending the user authentication data to the access and mobility management function.

[0078] According to the thirty-fourth aspect, a computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: receiving a registration message from an access and mobility management function, the registration message indicating whether a user device supports sharing of user authentication information; receiving a request to invoke user authentication at a user device, or a request for user authentication data, from at least one application function, at least one network function, or at least one operator and maintenance instance; determining whether the user device supports sharing of user authentication information; when the user device supports sharing of user authentication information, sending a request to the user device via the access and mobility management function, the request requesting authentication of the user at the user device; and receiving user authentication data from the user device via the access and mobility management function.

[0079] According to the thirty-fifth aspect, a computer-readable medium is provided, which includes program instructions stored thereon, and is used to perform at least the following: receiving a registration message from a user device, the registration message indicating whether the user device supports user authentication information sharing; receiving a request message from a unified data management node prompting the user device to authenticate the user; receiving user authentication data from the user device; and sending the user authentication data to the unified data management node.

[0080] According to the thirty-sixth aspect, a computer-readable medium is provided, comprising program instructions stored thereon, for performing at least the following: sending a request to a unified data management node, the request requesting to call user authentication at a user device or requesting user authentication data; and receiving user authentication data from the unified data management node. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Embodiments will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0082] Figure 1 shows a representation of a network system according to some example embodiments;

[0083] Figure 2 is a signaling diagram according to an example embodiment.

[0084] Figure 3 is a signaling diagram according to an example embodiment.

[0085] Figure 4 shows a schematic representation of a control device according to some example embodiments;

[0086] Figure 5 shows a schematic representation of an apparatus according to some example embodiments;

[0087] Figure 6 is a flow chart of a method according to an example embodiment;

[0088] Figure 7 is a flow chart of a method according to an example embodiment;

[0089] Figure 8 is a flow chart of a method according to an example embodiment;

[0090] Fig. 9 is a flow chart of a method according to an example embodiment;

[0091] Fig.10 A schematic representation of a non-volatile memory medium storing instructions that, when executed by a processor, allow the processor to perform one or more steps of the method of some embodiments is shown. DETAILED DESCRIPTION

[0092] In the following, some embodiments are explained with reference to a mobile communication device capable of communicating via a wireless cellular system and a mobile communication system serving such a mobile communication device. Before explaining the exemplary embodiments in detail, some general principles of a wireless communication system, its access system and a mobile communication device will be explained with reference to Figure 1 are briefly explained to help understand the technology on which the examples are based.

[0093] Figure 1 A schematic diagram of a 5G system (5GS) is shown, which is provided by way of example of a communication system. The 5GS may include a terminal or user equipment (UE) 100, a 5G radio access network (5GRAN) 108 or a next generation radio access network (NG-RAN), a 5G core network (5GC) 110, one or more application functions (AFs) 106, and one or more data networks.

[0094] 5G-RAN may include one or more gNodeBs (gNBs) or one or more gNodeB (gNB) distributed unit functions connected to one or more gNodeB (gNB) centralized unit functions.

[0095] 5GC may include the following entities: network slice selection function (NSSF); network exposure function 112; network repository function (NRF); policy control function (PCF); unified data management (UDM) 104; application function (AF) 106; authentication server function (AUSF) 114; access and mobility management function (AMF) 104; session management function (SMF) 116; user plane function 118; and data network 120. Figure 1 Also shown are the various interfaces (N1, N2, etc.) that may be implemented between the various elements of the system.

[0096] It should be noted that although some embodiments are described with respect to 5G networks, similar principles may be applied with respect to other networks and communication systems, such as advanced 5G networks or 6G networks.

[0097] SA1 Metaverse TR 22856 describes that, subject to regulatory requirements, operator policy and user consent, 5G systems may be able to support mechanisms for exposing the results of UE authentication of a user to a trusted third party (e.g., a conference focus). For example, a conference focus may be a term used in 3GPP for a conference server. How the UE authenticates the user identity at the terminal device (e.g., using biometrics) is beyond the scope of 3GPP.

[0098] There are various ways in which a UE can authenticate a user. For example, some UEs (e.g., mobile phones) provide facial biometrics or finger biometrics, through which the user is authenticated. However, there are also many UEs that do not support authenticating users via biometrics, such as limited feature mobile phones, where only a personal identification number (PIN) is used for user authentication. In other UEs, the PIN may not be supported.

[0099] A single UE may be used by multiple users (e.g., an entire family). For example, a single UE may be used by multiple users to connect to a communication system, or more specifically to the Internet or the Metaverse. In this case, the UE may want to share information about how the UE authenticated the user with the Metaverse or a third party. The UE may also want to share the results of the user authentication. However, currently, the results of the UE authenticating the user are not shared with the 5GC. Therefore, the 5GC cannot share this information with the Metaverse.

[0100] The present disclosure proposes a framework in which 5GC provides services that expose user authentication data at the UE. For example, 5GC can provide services to expose the user authentication status at the UE. For example, 5GC can expose the results of UE authenticating the user. This can be applicable to any industry. For example, embodiments can be applicable to Industrial Internet of Things (IIoT) settings. Embodiments can also be applicable to banking or gaming.

[0101] Some embodiments disclosed herein provide a framework for an application function (AF) to request the 5GC to collect user authentication data from the UE. Some embodiments disclosed herein provide an exposure service at the 5GC that indicates the user authentication data at the UE to the service. Some embodiments disclosed herein provide changes to the UE to enable these frameworks to work.

[0102] Figure 2 An example for single user authentication is shown. Single user authentication may occur when user device 200 (eg, a mobile phone) is being used by a single user.

[0103] In this example, at S201, the owner or user of UE 200 registers and / or stores identification information for the user of UE 200 in UE 200. The identification information may include at least one of the following: biometric information (e.g., facial biometric information or finger recognition information); PIN information. UE 200 may assign a user name to the user's identification information. If the biometric information is registered and / or stored in UE 200, UE 200 may assign a profile ID to the user name and the associated biometric information. If the user registers and / or stores PIN information in UE 200, UE 300 may assign a PIN ID to the user name and the associated PIN information. In some examples, 5GC does not store the user's identification information. Instead, 5GC may store a profile ID and / or PIN ID assigned to the user.

[0104] At S202, UE 200 may send a username and associated profile ID and / or PIN ID to UDM 204 via AMF 202. UDM 204 may store this information.

[0105] At S203, UE 200 sends a registration message to AMF 202. The registration message may include an indication that UE 200 supports a user authentication information sharing feature. In some examples, if UE 200 supports the user authentication information sharing feature, UE 200 will share information of UE 200 with 5GC. For example, if UE 200 supports the user authentication information sharing feature, UE 200 may share user authentication data with 5GC. AMF 202 may store the registration message. AMF 202 may store an indication that UE 200 supports a user authentication information sharing feature.

[0106] At S204, AMF 202 sends a registration message to UDM 204. The registration message may be sent as a new flag to indicate that UE 200 supports the user authentication information sharing feature. For example, the registration message sent at S202 may be in the form of a Nudm_UECM_Registration message.

[0107] At S205 , UDM 204 sends a registration completion message to AMF 202 .

[0108] At S206, AMF 202 sends a registration completion message to UE 200.

[0109] At S207 , the AMF 202 authenticates the UE 200 .

[0110] At S208, AF 206 sends a request to UDM 204, which requests that 5GC invoke user authentication at UE 200. Alternatively, AF 206 sends a request to UDM 204, which requests user authentication data of the last stored user authentication data at UE 200. In some examples, the request may be sent to a network function. In some examples, the request may be sent to an operator and maintenance instance. In some examples, the request may be a Nudm_UEAuthorisation_request. In some examples, Nudm_UEAuthorisation_request may include a general public subscription identifier (GPSI). In some examples, AF 206 may be a metaverse AF. In some examples, AF 206 may be an external AF. For example, the external AF may be a third-party AF of the 5GC network. In the case where AF 206 is an external AF, the request is sent to a network exposure function (NEF) before UDM 204. Then, the NEF sends the request to UDM 204. The NEF enables the external AF to send information to the 5GC.

[0111] At S209 , UDM 204 checks whether UE 200 supports the user authentication information sharing feature. If UE 200 supports the user authentication information sharing feature, S210 to S216 apply. If UE 200 does not support the user authentication information sharing feature, UDM 204 may not request user authentication at UE 200 .

[0112] At S210, UDM 204 sends a message or request to AMF 202, requesting user authentication at UE 200. Alternatively, UDM 204 sends a message or request to AMF 202, requesting user authentication data of the user authentication data last stored at UE 200. In some examples, the request may be a service request message. In some examples, the request may be a notification message.

[0113] At S211, AMF 202 sends a message to UE 200, requesting UE to authenticate the user. In some examples, the message may be a NAS message.

[0114] At S212, based on the request received from AMF 202, UE 200 authenticates the user. In some examples, UE 200 requires the user to authenticate himself. For example, UE 200 requires the user to provide identification information. The identification information may include at least one of biometric information (e.g., facial biometric information or finger recognition information); PIN information. If the identification information provided by the user matches the identification information provided by the user in S201, UE 200 can authenticate the user. UE 200 generates user authentication data. In some examples, the user authentication data includes at least one of authentication type; authentication result; profile ID; PIN ID. In some examples, the authentication type may be at least one of facial biometrics; finger recognition; PIN. In some examples, the authentication result may be "success" or "failure". The profile ID and / or PIN ID are associated with the identification information of the authenticated user.

[0115] At S213, UE 200 sends user authentication data to AMF 202. In some examples, UE 200 periodically sends user authentication data.

[0116] At S214 , the AMF 202 sends the user authentication data to the UDM 204 .

[0117] At S215, UDM 204 adds additional information to the user authentication data received from AMF 202. In some examples, the additional information may include at least one of the following: a timestamp; a user name. From S202, UDM 204 stores the user name and the associated profile ID and / or PIN ID. In some examples, when UDM 204 receives the profile ID and / or PIN ID in the authentication data, UDM 204 selects the user name associated with the profile ID and / or PIN ID.

[0118] At S216, UDM 204 sends the updated user authentication data (i.e., the user authentication data received from AMF 202 and the additional information added by UDM 204) to AF 206. In some examples, UDM 204 does not send the profile ID and / or PIN ID to AF 206. Instead, UDM 204 sends the user name associated with the profile ID and / or PIN ID to AF 206. In some examples, AF 206 may be a metaverse AF. In some examples, AF 206 may be an external AF. In some examples, UDM 204 may send the updated user authentication data to the network function. In some examples, UDM 204 may send the updated user authentication data to the operator and maintenance instance.

[0119] Figure 3 An example for multi-user authentication is shown. Multi-user authentication may occur when a user equipment 300 (e.g., a mobile phone) is being used by or accessible to multiple users. For example, each of the multiple users may access the UE 300 at different times.

[0120] In this example, at S301, the owner or user of UE 300 registers and / or stores identification information for each user of UE 300 in UE 300. The identification information may include at least one of the following: biometric information (e.g., facial biometric information or finger recognition information); PIN information. In some examples, storing multiple PINs may not be supported by UE. In some examples, PIN information may not ensure complete user authentication because any user can store any PIN. UE 300 may assign identification information of each user to a user name. If biometric information is registered and / or stored in UE 300, UE 300 may assign a profile ID to each user name and associated biometric information. If registering and / or storing multiple PINs is supported by UE 300, and each user registers and / or stores PIN information in UE 300, UE 300 may assign a PIN ID to each user name and associated PIN information. For example, the information stored on UE 300 may be as shown in Table 1 below. In some examples, 5GC does not store identification information of users. Instead, the 5GC may store a profile ID and / or PIN ID assigned to the user.

[0121] username Profile ID Identification data X 1 Face 1 Y 2 Facial 2

[0122] Table 1: Example information stored on the UE for multi-user authentication process

[0123] At S302, UE 300 may send a username and associated profile ID and / or PIN ID to UDM 304 via AMF 302. UDM 304 may store this information.

[0124] At S303, UE 300 sends a registration message to AMF 302. The registration message may include an indication that UE 300 supports a user authentication information sharing feature. In some examples, if UE 300 supports the user authentication information sharing feature, UE 300 will share information of UE 300 with 5GC. For example, if UE 300 supports the user authentication information sharing feature, UE 300 may share user authentication data with 5GC. AMF 302 may store the registration message. AMF 302 may store an indication that UE 300 supports a user authentication information sharing feature.

[0125] At S304, AMF 302 sends a registration message to UDM 304. The registration message may be sent as a new flag to indicate that UE 300 supports the user authentication information sharing feature. For example, the registration message sent at S303 may be in the form of a Nudm_UECM_Registration message.

[0126] At S305 , UDM 304 sends a registration completion message to AMF 302 .

[0127] At S306 , AMF 302 sends a registration completion message to UE 300 .

[0128] At S307, AMF 302 authorizes the user authentication information sharing feature.

[0129] At S308, AF 306 sends a request to UDM 304 requesting 5GC to invoke user authentication at UE 300. Alternatively, AF 306 sends a request to UDM 304 requesting user authentication data of the last stored user authentication data at UE 300. In some examples, the request may be sent to a network function. In some examples, the request may be sent to an operator and maintenance instance. In some examples, the request may be a Nudm_UEAuthorisation_request. In some examples, Nudm_UEAuthorisation_request may include a general public subscription identifier (GPSI). In some examples, AF 306 may be a metaverse AF. In some examples, AF 306 may be an external AF. For example, the external AF may be a third-party AF to the 5GC network. In the case where AF 306 is an external AF, the request may be sent to a network exposure function (NEF) before UDM 304. Then, the NEF sends the request to UDM 304. The NEF enables the external AF to send information to the 5GC.

[0130] At S309 , UDM 304 checks whether UE 300 supports the user authentication information sharing feature. If UE 300 supports the user authentication information sharing feature, S310 to S316 apply. If UE 300 does not support the user authentication information sharing feature, UDM 304 may not request user authentication at UE 200 .

[0131] At S310, UDM 304 sends a message or request to AMF 302 requesting user authentication at UE 300. Alternatively, UDM 304 sends a message or request to AMF 302 requesting user authentication data of the last stored user authentication data at UE 300. In some examples, the request may be a service request message. In some examples, the request may be a notification message.

[0132] At S311, AMF 302 sends a message to UE 300, requesting UE 300 to authenticate the user. In some examples, the message may be a NAS message.

[0133] At S312, based on the request received from AMF 302, UE 300 authenticates the user. In some examples, UE 300 requires the user to verify itself. For example, UE 300 requires the user to provide identification information. In some examples, the identification information may be at least one of the following: biometric information (e.g., facial biometric information or finger recognition information); PIN information. If the identification information provided by the user matches the identification information provided by the user in S301, UE 300 may authenticate the user. UE 300 generates user authentication data. In some examples, the user authentication data includes at least one of the following: authentication type; authentication result; profile ID; PIN ID. In some examples, the authentication type may be at least one of the following: facial biometrics; finger recognition; PIN. In some examples, the authentication result may be success or failure. The profile ID and / or PIN ID are associated with the identification information of the authenticated user.

[0134] At S313, UE 300 sends user authentication data to AMF 302. In some examples, UE 300 periodically sends user authentication data.

[0135] At S314 , the AMF 302 sends the user authentication data to the UDM 304 .

[0136] At S315, UDM 304 adds additional information to the user authentication data received from AMF 302. In some examples, the additional information may include at least one of a timestamp and a username. Starting from S302, UDM 304 stores the username and the associated profile ID and / or PIN ID. In some examples, when UDM 304 receives the profile ID and / or PIN ID in the authentication data, UDM 304 selects the username associated with the profile ID and / or PIN ID. If storing multiple PINs is not supported by UE 300, UDM 304 may add information to the authentication data indicating that multiple PINs are not supported by UE 300.

[0137] At S316, UDM 304 sends the updated user authentication data (i.e., the user authentication data received from AMF 302 and the additional information added by UDM 304) to AF 306. In some examples, UDM 304 does not send the profile ID and / or PIN ID to AF 306. Instead, UDM 304 sends the user name associated with the profile ID and / or PIN ID to AF 306. In some examples, AF 306 may be a metaverse AF. In some examples, AF 306 may be an external AF. In some examples, UDM 304 may send the updated user authentication data to the network function. In some examples, UDM 304 may send the updated user authentication data to the operator and maintenance instance.

[0138] In 5G / 5GC, operators can expose new capabilities through application programming interfaces (APIs). In some examples, the UDM can provide a service API. For example, the UDM can provide the UE's authentication data via the service API. In some examples, the AF can request the UE's last stored user authentication data. In some examples, the AF can send the request to the UDM. In this case, the UDM can provide the UE's last stored user authentication data to the AF via the service API without querying the UE.

[0139] Figure 4 Shows the control Figure 1 An example of a control device 400 for the functions of a 5GRAN or 5GC shown. The control device may include at least one random access memory (RAM) 411a, at least one read-only memory (ROM) 411b, at least one processor 412, 413, and an input / output interface 414. At least one processor 412, 413 may be coupled to the RAM 411a and the ROM 411b. At least one processor 412, 413 may be configured to execute appropriate software code 415. The software code 415 may, for example, allow one or more steps to be executed to perform one or more aspects of the present invention. The software code 415 may be stored in the ROM 411b. The control device 400 may be interconnected with another control device 400 that controls another function of the 5GRAN or 5GC. In some embodiments, each function of the 5GRAN or 5GC includes a control device 400. In an alternative embodiment, two or more functions of the 5GRAN or 5GC may share a control device.

[0140] Figure 5 An example of a terminal 500 is shown, such as Figure 1The terminal shown. Terminal 500 can be provided by any device capable of sending and receiving radio signals. Non-limiting examples include user equipment, mobile stations (MS) or mobile devices (such as mobile phones or so-called "smart phones"), computers provided with wireless interface cards or other wireless interface facilities (e.g., USB dongles), personal data assistants (PDAs) or tablets provided with wireless communication capabilities, machine type communication (MTC) devices, Internet of Things (IoT) type communication devices, or any combination of these, etc. Terminal 500 can provide, for example, communication for carrying data for communication. The communication can be one or more of voice, electronic mail (email), text message, multimedia, data, machine data, etc.

[0141] The terminal 500 may be provided with at least one processor 501, at least one memory ROM 502a, at least one RAM 502b and other possible components 503 for software and hardware assistance to perform the tasks it is designed to perform, including controlling access to and communication with access systems and other communication devices. The at least one processor 501 is coupled to the RAM 502b and the ROM 502a. The at least one processor 501 may be configured to execute appropriate software code 508. The software code 508 may, for example, allow the execution of one or more aspects of the present invention. The software code 508 may be stored in the ROM 502a.

[0142] The processor, storage and other related control means may be provided on an appropriate circuit board and / or in a chipset. This feature is indicated by reference numeral 504. The device may optionally have a user interface, such as a keyboard 505, a touch screen or touch pad, a combination thereof, etc. Depending on the type of device, one or more of a display, a speaker and a microphone may optionally be provided.

[0143] The terminal 500 may receive signals over the air or radio interface 507 via appropriate means for receiving, and may transmit signals via appropriate means for transmitting radio signals. Figure 5 In the embodiment of the present invention, the transceiver device is schematically designated by block 506. The transceiver device 506 may be provided, for example, by a radio part and an associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0144] Figure 6 is a flow chart of a method according to an example. Figure 6 The flowchart is viewed from the perspective of an apparatus. For example, the apparatus may include a user device.

[0145] As shown at S601 , the method includes sending a registration message to an access and mobility management function, the registration message indicating whether a user equipment supports user authentication information sharing.

[0146] At S602, the method includes receiving a request from an access and mobility management function, the request requesting a user equipment to authenticate a user of the user equipment.

[0147] At S603 , the method includes authenticating the user based on the request.

[0148] At S604 , the method includes generating user authentication data.

[0149] At S605 , the method includes sending user authentication data to an access and mobility management function.

[0150] Figure 7 is a flow chart of a method according to an example. Figure 7 The flowchart is viewed from the perspective of a device. For example, the device may include a unified data management node.

[0151] As shown at S701 , the method includes receiving a registration message from an access and mobility management function, the registration message indicating whether a user equipment supports user authentication information sharing.

[0152] At S702 , the method includes receiving a request to invoke user authentication at a user device or a request for user authentication data from at least one application function, at least one network function, or at least one operator and maintenance instance.

[0153] At S703 , the method includes determining whether the user equipment supports user authentication information sharing.

[0154] At S704, when the user equipment supports user authentication information sharing, the method includes sending a request to the user equipment via an access and mobility management function, the request requesting authentication of the user at the user equipment; and

[0155] At S705 , the method includes receiving user authentication data from a user equipment via an access and mobility management function.

[0156] Figure 8 is a flow chart of a method according to an example. Figure 8 The flowchart is from the perspective of the device. For example, the device may include access and mobility management functions.

[0157] As shown at S801 , the method includes receiving a registration message from a user equipment, where the registration message indicates whether the user equipment supports user authentication information sharing.

[0158] At S802 , the method includes receiving, from a unified data management node, a request message prompting a user device to authenticate a user.

[0159] At S803 , the method includes receiving user authentication data from a user device.

[0160] At S804, the method includes sending user authentication data to a unified data management node.

[0161] Fig. 9 is a flow chart of a method according to an example. Fig. 9 The flowchart is from the perspective of the device. For example, the device may include at least one of the following: at least one application function; at least one network function; at least one operator and maintenance instance.

[0162] As shown at S901 , the method includes sending a request to a unified data management node, the request requesting to invoke user authentication at a user device, or requesting user authentication data.

[0163] At S902 , the method includes receiving user authentication data from a unified data management node.

[0164] Fig.10 Schematic representations of non-volatile storage media 1000a (e.g., a computer compact disk (CD) or digital versatile disk (DVD)) and 1000b (e.g., a universal serial bus (USB) memory stick) are shown storing instructions and / or parameters 1002 that, when executed by a processor, allow the processor to perform Figure 6 , 7 , one or more steps of the method in 8 or 9.

[0165] It should be understood that these devices may include or be coupled to other units or modules, such as radio components or radio heads for transmission and / or reception. Although these devices are described as one entity, different modules and memories may be implemented in one or more physical or logical entities.

[0166] It should be noted that although some embodiments have been described with respect to 5G networks, similar principles may be applied with respect to other networks and communication systems. Therefore, although certain embodiments are described above by way of example with reference to certain example architectures of wireless networks, technologies and standards, the embodiments may be applied to any other suitable form of communication system other than the communication system shown and described herein.

[0167] It is also noted herein that while the above describes example embodiments, there are numerous variations and modifications which may be made to the disclosed solution without departing from the scope of the present invention.

[0168] As used herein, “at least one of: ” and “at least one of ” and similar expressions, where a list of two or more elements is connected by “and” or “or”, mean at least any one element, or at least any two or more elements, or at least all elements.

[0169] In general, various embodiments may be implemented in hardware or dedicated circuit systems, software, logic, or any combination thereof. Certain aspects of the present disclosure may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device, but the present disclosure is not limited thereto. Although various aspects of the present disclosure may be illustrated and described in block diagrams, flow charts, or using other graphical representations, it is fully understood that, as non-limiting examples, the boxes, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or controllers or other computing devices, or combinations thereof.

[0170] As used in this application, the term "circuitry" may refer to one, more, or all of the following:

[0171] (a) hardware circuitry only (such as implemented solely in analog and / or digital circuitry) and (b) a combination of hardware circuitry and software, such as (as applicable):

[0172] (i) a combination of analog and / or digital hardware circuits and software / firmware and

[0173] (ii) any portion of hardware processor(s) (including digital signal processor(s)), software and memory(s) with software that work together to enable a device (such as a mobile phone or server) to perform various functions and (c) hardware circuit(s) and / or processor(s), such as microprocessor(s) or portion(s) of microprocessor(s) that require software (e.g., firmware) to operate, but where the software is not required for operation, the software may not be present.

[0174] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term "circuitry" also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term "circuitry" also covers (for example, if applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit of a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0175] The embodiments of the present disclosure may be implemented by computer software executable by a data processor (such as a processor entity) of a mobile device, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products) include software routines, applets and / or macros, which can be stored in a data storage medium readable by any device, and they include program instructions for performing specific tasks. A computer program product may include one or more computer executable components that are configured to perform an embodiment when the program is run. One or more computer executable components may be at least one software code or a portion thereof.

[0176] Furthermore, it should be noted in this regard that any box of the logic flow shown in the figure may represent program steps, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. The software may be stored on physical media, such as memory chips or memory blocks implemented within a processor, magnetic media (e.g., hard disk or floppy disk), and optical media (such as, for example, DVD and its data variant CD). Physical media are non-transient media.

[0177] The term "non-transitory" as used herein refers to a limitation of the medium itself (ie, tangible, not a signal), not a limitation of data storage persistence (eg, RAM vs. ROM).

[0178] The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor may be of any type suitable for the local technical environment and may include, as non-limiting examples, one or more of the following: a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an FPGA, a gate-level circuit, and a processor based on a multi-core processor architecture.

[0179] Embodiments of the present disclosure may be practiced in various components, such as integrated circuit modules. The design of integrated circuits is generally a highly automated process. Complex and powerful software tools are available to convert a logic level design into a semiconductor circuit design that can be etched and formed on a semiconductor substrate.

[0180] The scope of protection sought by various embodiments of the present disclosure is defined by the independent claims. Embodiments and features described in this specification that do not belong to the scope of the independent claims (if any) should be interpreted as examples that help understand the various embodiments of the present disclosure.

[0181] The foregoing description has provided by way of non-limiting examples a complete and informative description of exemplary embodiments of the present disclosure. However, various modifications and adaptations may become apparent to those skilled in the relevant art when the foregoing description is read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications of the teachings of the present disclosure will still fall within the scope of the present invention as defined in the appended claims. Indeed, there are further embodiments comprising a combination of one or more embodiments with any other embodiments previously discussed.

Claims

1. A device comprising: means for sending a registration message to an access and mobility management function, the registration message indicating whether the apparatus supports sharing of user authentication information; means for receiving a request from the access and mobility management function, the request requesting the device to authenticate a user of the device; means for authenticating the user based on the request; A component for generating user authentication data; as well as Means for sending said user authentication data to said access and mobility management function.

2. The device according to claim 1, wherein the device comprises: means for enabling the user to register identification information in the device for each user of the device.

3. The apparatus according to claim 2, further comprising: Means for assigning to said identification information for each user a username, and at least one of: a profile identifier and a personal identification number identifier.

4. The apparatus according to claim 3, further comprising: Means for sending, via the access and mobility management function, to a unified data management node a username for each user of the device and at least one of: the profile identifier and the personal identification number identifier.

5. The apparatus according to claim 1, wherein the user authentication data comprises at least one of the following: authentication type; authentication result; profile identifier; personal identification number identifier.

6. A device comprising: means for receiving a registration message from an access and mobility management function, the registration message indicating whether the user equipment supports sharing of user authentication information; means for receiving, from at least one application function, at least one network function, or at least one operator and maintenance instance, a request to invoke user authentication at said user equipment, or a request for user authentication data; A component for determining whether the user equipment supports sharing of user authentication information; means for sending a request to the user equipment via the access and mobility management function, the request requesting authentication of the user at the user equipment, when the user equipment supports user authentication information sharing; as well as Means for receiving user authentication data from said user equipment via said access and mobility management function.

7. The apparatus according to claim 6, further comprising: Means for receiving and storing a user name and, for each user of said user device, at least one of: a profile identifier and a personal identification number identifier.

8. The apparatus according to claim 6, further comprising: Means for sending a request message to the access and mobility management function to prompt the user equipment to authenticate the user.

9. The apparatus according to claim 6, wherein the user authentication data comprises at least one of the following: authentication type; authentication result; profile identifier; personal identification number identifier.

10. The apparatus according to claim 6, further comprising: means for updating the user authentication data and sending the updated user authentication data to at least one of: the at least one application function; At least one network function; or at least one operator and maintenance instance.

Images