Mechanism for authorizing data exchange

Abstract

The embodiment of the invention provides a device, a method and a computer readable medium for authorizing data exchange. An apparatus comprising: at least one processor, and at least one memory to store instructions that, when executed by the at least one processor, cause the apparatus to at least perform: defining, for each user device, an authorization policy; configuring an authorization policy for the one or more user devices by providing a key material usable to validate the access token, and information about the authorization policy; receiving a request for authorization of a requester user device to access the specified data from the producer element or the producer function; processing a request for authorization of a requester user device to determine whether the request is allowed; and in the event that the request is allowed, obtaining an access token for allowing access to the specified data from the producer element or producer function; and sending the access token to the requester user device.

Description

Technical Field

[0001] Examples of embodiments described herein relate to apparatus, methods, systems, computer programs, computer program products, and (non-transient) computer-readable media that can be used to perform an authorization process that allows data to be exchanged between a requestor UE and a producer element or producer function (such as another UE, or a suitable network element or network function). In particular, some examples of embodiments relate to apparatus, methods, systems, computer programs, computer program products, and (non-transient) computer-readable media that can be used to enable mechanisms for authorizing a requestor UE to access AIML-related data from a corresponding producer element or function. Background Art

[0002] The following description of the background may include insights, discoveries, understandings or disclosures, or associations, and disclosures that are not yet known but are provided herein by the present disclosure as one or more examples of embodiments. Some examples of embodiments may be specifically pointed out below, while other such contributions will be apparent from the relevant context.

[0003] The abbreviations used in this document have the following meanings:

[0004] 3GPP Third Generation Partnership Project

[0005] 4G Fourth Generation

[0006] 5G Fifth Generation

[0007] 5GC 5G Core

[0008] AKA Authentication and Key Agreement

[0009] AKMA Application Authentication and Key Management

[0010] AUSF authentication server function

[0011] CN Core Network

[0012] CPU Central Processing Unit

[0013] D2D Device to Device

[0014] eNB E-UTRAN Node B

[0015] gNB Next Generation Node B

[0016] HPLMN belongs to PLMN

[0017] ID

[0018] IP Internet Protocol

[0019] KID Key Identifier

[0020] LTE Long Term Evolution

[0021] LTE-A LTE-Advanced

[0022] MSISDN Mobile Subscriber ISDN Number

[0023] NAS Non-Access Stratum

[0024] NF Network Function

[0025] NG Next Generation

[0026] NW Network, network side

[0027] PLMN Public Land Mobile Network

[0028] ProSe Proximity-based Services

[0029] RAN Radio Access Network

[0030] UDM Unified Data Manager

[0031] UE User Equipment

[0032] UPUUE parameter update

[0033] WLAN Wireless Local Area Network Summary of the invention

[0034] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory, the at least one memory being used to store instructions, which instructions, when executed by the at least one processor, cause the device to at least perform: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy for one or more user devices by providing key material that can be used to verify an access token, and information about the authorization policy, the information indicating: permission for a connection between a requester user device and a producer element or producer function with a valid access token or without an access token; receiving a request for authorization for the requester user device to access specified data from the producer element or producer function; processing the request for authorization for the requester user device to determine whether the request is allowed; and if the request is allowed, obtaining an access token for allowing access to specified data from the producer element or producer function; and sending the access token to the requester user device.

[0035] In addition, according to an example of an embodiment, for example, a method is provided, including: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy for one or more user devices by providing key material that can be used to verify an access token, and information about the authorization policy, the information indicating: permission for a connection between a requester user device and a producer element or producer function with a valid access token or without an access token; receiving a request for authorization for the requester user device to access specified data from the producer element or producer function; processing the request for authorization for the requester user device to determine whether the request is allowed; and if the request is allowed, obtaining an access token for allowing access to specified data from the producer element or producer function; and sending the access token to the requester user device.

[0036] Depending on further refinement, these examples may include one or more of the following features:

[0037] The data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to an artificial intelligence machine learning AIML service, wherein the one or more user devices configured with the authorization policy may be user devices signed to use the one or more AIML services;

[0038] - In order to provide key material and information about authorization policy, one of non-access stratum NAS signaling or user parameter provision signaling may be used for transmission to one or more user equipments;

[0039] The data indicated in the authorization policy may include at least one or more of the following: an AIML model identification, an AIML event identification, or a data subject identification, wherein the user device that is allowed to access the data may be identified by at least one of the following: a predefined list of user devices, an indication of a specified area in which the user device is located, an indication of a communication network to which the user device belongs, or an indication that any user device is allowed;

[0040] - the request for authorisation of the requestor user equipment may be received from one of the requestor user equipments, or from a controlling network element or a controlling network function of another communication network;

[0041] - with the access token sent to the requester user device, information indicating at least one of the following items may be indicated: information identifying at least one producer element or producer function, for prompting the requester user device to contact only the identified producer element or producer function as a target for requesting the specified data; or information indicating a specified data resource, for prompting the requester user device to request only the indicated resource from a suitable producer element or producer function, wherein the access token may be a generic access token;

[0042] - when receiving a request for authorization of a requestor user device, it may be determined whether a unique temporary identifier of a producer element or producer function associated with another communication network is included; and in the event that the determination is positive, the request for authorization of the requestor user device may be forwarded to a control network element or control network function of the other communication network to obtain an access token; the access token may be received from the control network element or control network function of the other communication network; and the received access token may be sent to the requestor user device;

[0043] The unique temporary identifier may be configured in the producer element or producer function by the control network element or control network function, or generated by the producer element or producer function;

[0044] - when the processing of the request for authorization of the requestor user device is determined to be allowed, an access token for allowing access to specified data from the producer element or producer function may be generated, and the generated access token may be sent to the requestor user device;

[0045] - to process a request for authorization of a requestor user equipment, a decision may be made based on operator policy and subscription data of a producer element or producer function whether the request is allowed;

[0046] - the access token may comprise at least one of: an identification of the source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0047] - the access token may be signed by a private key, where the key material may be a corresponding public key used to verify the access token at a producer element or producer function;

[0048] - The specified data indicated in the request for authorization of the requestor user device may include at least one of the following items: AIML model data, AIML training data or AIML analysis data.

[0049] - the request for authorization of the requestor user equipment may include an identification of the producer element or producer function;

[0050] -The device may include a core network control element or a core network control function, an access network control element or an access network control function, or may be included in a core network control element or a core network control function, an access network control element or an access network control function; or the device may include a unified data management entity, or may be included in a unified data management entity.

[0051] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory for storing instructions, which, when executed by the at least one processor, causes the device to at least perform: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information comprising: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; sending a request to the control network element or the control network function for authorization to access specified data from the producer element or the producer function; in response to the request, receiving an access token for allowing access to specified data from the producer element or the producer function; and sending a request to the producer element or the producer function for a request to be provided with the specified data, wherein the received access token is included in the request.

[0052] In addition, according to an example of an embodiment, for example, a method is provided, comprising: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information comprising: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; sending a request to the control network element or the control network function for authorization to access specified data from the producer element or the producer function; in response to the request, receiving an access token for allowing access to specified data from the producer element or the producer function; and sending a request to the producer element or the producer function for a data access provided with the specified data, wherein the received access token is included in the request.

[0053] Depending on further refinement, these examples may include one or more of the following features:

[0054] - the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to artificial intelligence machine learning AIML services, wherein one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services;

[0055] - the key material, and information about the authorization policy may be received using one of Non-Access Stratum NAS signaling or User Parameter Provisioning signaling for transmission from a controlling network element or a controlling network function,

[0056] - the producer element or producer function indicated in the request for authorization to access specified data may be one of a producer user equipment, or a producer communication network element, or a producer communication network function;

[0057] - the access token received from the control network element or the control network function may include information indicating at least one of the following: information identifying at least one producer element or producer function, for prompting to contact only the identified producer element or producer function as a target for requesting the specified data; or information indicating a specified data resource, for prompting to request the indicated resource only from an appropriate producer element or producer function, wherein the access token is a generic access token;

[0058] - the specified data indicated in the request for authorization may include at least one of the following: AIML model data, AIML training data, or AIML analysis data;

[0059] - the request for authorization may include the identification of the producer element or producer function,

[0060] - the access token may comprise at least one of: an identification of the source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0061] - the access token may be signed by a private key, where the key material may be a corresponding public key used to verify the access token at a producer element or producer function;

[0062] - a unique temporary identifier may be obtained, the unique temporary identifier being assigned for protecting privacy in device-to-device communications, wherein the unique temporary identifier may be received from a control network element or a control network function, or the unique temporary identifier may be generated, wherein the unique temporary identifier may be indicated in a request for authorization to access specified data available at a producer element or a producer function identified by the unique temporary identifier,

[0063] - a second unique temporary identifier of the producer element or producer function may be received from the producer element or producer function from which the specified data is to be obtained, the second unique temporary identifier being assigned for protecting privacy in device-to-device communications; and the second unique temporary identifier may be indicated as an identification of the producer element or producer function in a request for authorization to access the specified data;

[0064] - the received access token may be stored;

[0065] - after receiving a query for presenting an access token from a producer element or producer function, a request for authorization to access specified data may be sent to a controlling network element or controlling network function;

[0066] -The requested specified data may be received from a producer element or producer function.

[0067] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory for storing instructions, which, when executed by the at least one processor, causes the device to at least perform: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information comprising: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; receiving a request for specified data to be provided from a producer element or a producer function from a requester user device, wherein the request comprises: an access token for allowing access to specified data from the producer element or the producer function; determining the validity of the received access token; and if the validity of the access token is confirmed, sending the requested specified data to the requester user device.

[0068] In addition, according to an example of an embodiment, for example, a method is provided, comprising: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information including: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; receiving a request for specified data to be provided from the producer element or the producer function from the requester user device, wherein the request includes: an access token for allowing access to the specified data from the producer element or the producer function; determining the validity of the received access token; and if the validity of the access token is confirmed, sending the requested specified data to the requester user device.

[0069] Depending on further refinement, these examples may include one or more of the following features:

[0070] - the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to artificial intelligence machine learning AIML services, wherein one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services;

[0071] - the key material, and information about the authorization policy may be received using one of non-access stratum NAS signaling or user parameter provision signaling for transmission from a controlling network element or a controlling network function;

[0072] - the specified data indicated in the request may include at least one of the following: AIML model data, AIML training data, or AIML analysis data;

[0073] - the access token may comprise at least one of: an identification of the source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0074] - the access token may be signed by a private key, where the key material may be a corresponding public key used to verify the access token at a producer element or producer function;

[0075] - a unique temporary identifier may be obtained, the unique temporary identifier being assigned for protecting privacy in device-to-device communications, wherein the unique temporary identifier may be received from a controlling network element or a controlling network function, or the unique temporary identifier may be generated, wherein the unique temporary identifier may be indicated to a requestor user device attempting to access specified data;

[0076] - A query for presenting an access token may be sent to the requestor user device;

[0077] -The apparatus may comprise, or may be comprised in, a producer element or a producer function, and wherein the producer element or the producer function may be one of a producer user equipment, or a producer communication network element, or a producer communication network function.

[0078] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory, the at least one memory being used to store instructions, which instructions, when executed by the at least one processor, cause the device to at least perform: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy by pushing authorization policy information to a network element or a network function and one or more user devices, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; receiving a request for authorization for a requester user device to access specified data from a producer element or a producer function; and processing the request for authorization for the requester user device to determine whether the request is allowed.

[0079] In addition, according to an example of an embodiment, for example, a method is provided, including: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy by pushing authorization policy information to a network element or a network function and one or more user devices, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; receiving a request for authorization for the requester user device to access specified data from the producer element or the producer function; processing the request for authorization for the requester user device to decide whether the request is allowed.

[0080] Depending on further refinement, these examples may include one or more of the following features:

[0081] - the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to artificial intelligence machine learning AIML services, wherein one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services;

[0082] - in the event that the request is allowed, the requestor user device may be authorized to access the specified data from the producer element or producer function, and an indication of the authorization may be sent to the requestor user device;

[0083] - using the authorized indication, information related to the producer element or producer function can be provided;

[0084] - the data indicated in the authorization policy may include at least one or more of the following: an AIML model identification, an AIML event identification, or a data subject identification, wherein the user device that is allowed to access the data may be identified by at least one of the following: a predefined list of user devices, an indication of a specified area where the user device is located, an indication of a communication network to which the user device belongs, or an indication that any user device is allowed;

[0085] - the request for authorisation of the requestor user equipment may be received from one of the requestor user equipments, or from a controlling network element or a controlling network function of another communication network;

[0086] - when receiving a request for authorization of a requestor user equipment, it may be determined whether a unique temporary identifier of a producer element or producer function associated with another communication network is included; and in the event that the determination is positive, the request for authorization of the requestor user equipment may be forwarded to a controlling network element or controlling network function of the other communication network to obtain an indication that the request is allowed; and the received indication of authorization may be sent to the requestor user equipment;

[0087] - the unique temporary identifier may be configured in the producer element or producer function by the control network element or control network function, or generated by the producer element or producer function;

[0088] - To process a request for authorization of a requestor user equipment, it may be decided based on operator policy and subscription data of a producer element or producer function whether the request is allowed;

[0089] - may check whether the authorization policy information pushed to the network element as a producer element or producer function, the network function or the user equipment is sufficient for the specified data indicated in the request for authorization; if it is determined that the authorization policy information pushed to the network element as a producer element or producer function, the network function or the user equipment is insufficient for the specified data, the authorization policy information may be updated in the network element as a producer element or producer function, the network function or the user equipment;

[0090] - the authorization policy information may comprise at least one of the following: an identification of a source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0091] - the specified data indicated in the request for authorization of the requestor user device may include at least one of the following: AIML model data, AIML training data, or AIML analysis data;

[0092] -The device may include a core network control element or a core network control function, an access network control element or an access network control function, or may be included in a core network control element or a core network control function, an access network control element or an access network control function; or the device may include a unified data management entity, or may be included in a unified data management entity.

[0093] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory, the at least one memory being used to store instructions, which instructions, when executed by the at least one processor, cause the device to at least perform: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; sending a request for authorization to the control network element or the control network function to access specified data from the producer element or the producer function; receiving, in response to the request, an indication allowing access to the specified data from the producer element or the producer function; and after receiving the indication allowing access to the specified data from the producer element or the producer function, sending a request to the producer element or the producer function for data provided with the specified data.

[0094] In addition, according to an example of an embodiment, for example, a method is provided, comprising: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; sending a request for authorization to the control network element or the control network function to access specified data from the producer element or the producer function; receiving an indication of permission to access the specified data from the producer element or the producer function in response to the request; and after receiving the indication of permission to access the specified data from the producer element or the producer function, sending a request to the producer element or the producer function to be provided with the specified data.

[0095] Depending on further refinement, these examples may include one or more of the following features:

[0096] - the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to artificial intelligence machine learning AIML services, wherein one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services;

[0097] - the indication of authorization may also include information related to the producer element or producer function;

[0098] - the producer element or producer function indicated in the request for authorization to access specified data may be one of a producer user equipment, or a producer communication network element, or a producer communication network function;

[0099] - the authorization policy information may comprise at least one of the following: an identification of a source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0100] - the specified data indicated in the request for authorization may include at least one of the following: AIML model data, AIML training data, or AIML analysis data;

[0101] - the request for authorization may include the identification of the producer element or producer function;

[0102] - a unique temporary identifier may be obtained, the unique temporary identifier being assigned for protecting privacy in device-to-device communications, wherein the unique temporary identifier may be received from a controlling network element or a controlling network function, or the unique temporary identifier may be generated, wherein the unique temporary identifier may be indicated in a request for authorization to access specified data;

[0103] - a second unique temporary identifier of the producer element or producer function may be received from the producer element or producer function from which the specified data is to be obtained, the second unique temporary identifier being assigned for protecting privacy in device-to-device communications, and the second unique temporary identifier may be indicated as an identification of the producer element or producer function in a request for authorization to access the specified data;

[0104] - may receive requested specified data from a producer element or producer function;

[0105] According to an example of an embodiment, for example, a device is provided, comprising: at least one processor, and at least one memory, the at least one memory being used to store instructions, which, when executed by the at least one processor, causes the device to at least perform: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; receiving a request for specified data to be provided from the producer element or the producer function from the requester user device; determining the validity of the request based on the received authorization policy information; and sending the requested specified data to the requester user device if the validity of the request is confirmed.

[0106] In addition, according to an example of an embodiment, for example, a method is provided, comprising: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; sending a request for authorization to the control network element or the control network function to access specified data from the producer element or the producer function; receiving an indication of permission to access the specified data from the producer element or the producer function in response to the request; and after receiving the indication of permission to access the specified data from the producer element or the producer function, sending a request to the producer element or the producer function to be provided with the specified data.

[0107] Depending on further refinement, these examples may include one or more of the following features:

[0108] - the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed may relate to data related to artificial intelligence machine learning AIML services, wherein one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services;

[0109] - the specified data indicated in the request may include at least one of the following: AIML model data, AIML training data, or AIML analysis data;

[0110] - Updates to the authorization policy information may be received from a controlling network element or a controlling network function;

[0111] - the authorization policy information may comprise at least one of the following: an identification of a source user device of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network in which the producer element or producer function of the requested data is located, or an indication of a type of connection used to obtain the requested data from the producer element or producer function;

[0112] - a unique temporary identifier may be obtained, the unique temporary identifier being assigned to protect privacy in device-to-device communications, wherein the unique temporary identifier may be received from a controlling network element or a controlling network function, or the unique temporary identifier may be generated, wherein the unique temporary identifier may be indicated to a requestor user device attempting to access specified data;

[0113] - the apparatus may comprise, or may be comprised in, a producer element or a producer function, and wherein the producer element or the producer function is one of a producer user equipment, or a producer communication network element, or a producer communication network function;

[0114] In addition, according to an embodiment, for example, a computer program product for a computer is provided, comprising software code portions for executing the steps of the method defined above when the product is run on the computer. The computer program product may include a computer-readable medium storing the software code portions. In addition, the computer program product may be directly loaded into the internal memory of the computer and / or may be sent via a network by means of: upload; download; and / or push process. BRIEF DESCRIPTION OF THE DRAWINGS

[0115] Some examples of the present disclosure related to the embodiments are described below by way of example only with reference to the accompanying drawings, in which:

[0116] Figure 1 shows a diagram illustrating an example for a communication scenario according to an example of an embodiment;

[0117] Figure 2 shows a diagram illustrating an example for a communication scenario according to an example of an embodiment;

[0118] Figure 3 shows a signaling diagram illustrating an example of an authorization process according to an example of an embodiment;

[0119] Figure 4 shows a signaling diagram illustrating an example of an authorization process according to an example of an embodiment;

[0120] Figure 5 shows a signaling diagram illustrating an example of an authorization process according to an example of an embodiment;

[0121] Figure 6 shows a signaling diagram illustrating an example of an authorization process according to an example of an embodiment;

[0122] Figure 7 A flow chart showing the processing performed in a control element according to some examples of embodiments;

[0123] Figure 8 A flowchart showing the processing performed in a requester UE according to some examples of the embodiments;

[0124] Fig. 9 Flowcharts showing processing performed in a producer element or producer function according to some examples of embodiments;

[0125] Fig.10 A diagram showing a communication network control element according to some examples of embodiments;

[0126] Fig.11 A diagram showing a requester UE according to some examples of the embodiments;

[0127] Fig.12 Diagrams showing some example producer elements or functions according to embodiments;

[0128] Fig.13 A flow chart showing the processing performed in a control element according to some examples of embodiments;

[0129] Fig.14 A flowchart showing the processing performed in a requester UE according to some examples of the embodiments;

[0130] Fig.15 Flowcharts showing processing performed in a producer element or producer function according to some examples of embodiments;

[0131] Fig.16 A diagram showing a communication network control element according to some examples of embodiments;

[0132] Fig.17 A diagram showing a requester UE according to some examples of the embodiments; and

[0133] Fig.18 Diagrams showing some example producer elements or functions according to embodiments. DETAILED DESCRIPTION

[0134] In the past few years, communication networks have been continuously expanded all over the world, such as wire-based communication networks, such as Integrated Services Digital Network (ISDN), Digital Subscriber Line (DSL), or wireless communication networks, such as cdma2000 (Code Division Multiple Access) system, cellular third generation (3G) like Universal Mobile Telecommunications System (UMTS), fourth generation (4G) communication networks or enhanced communication networks (e.g. based on Long Term Evolution (LTE), or Long Term Evolution-Advanced (LTE-A)), fifth generation (5G) communication networks, cellular second generation (2G) communication networks (such as Global System for Mobile Communications (GSM)), General Packet Radio System (GPRS), etc. The 3rd Generation Partnership Project (3GPP), the Telecommunications and Internet Convergence Services and Protocols for Advanced Networks (TISPAN), the International Telecommunication Union (ITU), the 3rd Generation Partnership Project 2 (3GPP2), the Internet Engineering Task Force (IETF), the IEEE (Institute of Electrical and Electronics Engineers), the WiMAX Forum, etc. are developing standards or specifications for telecommunication networks and access environments.

[0135] Basically, in order to correctly establish and process communication between two or more endpoints (e.g., communication stations or elements, such as terminal devices, user equipment (UE) or other communication network elements, databases, servers, hosts, etc.), one or more network elements or functions (e.g., physical nodes or virtualized network functions) may be involved, such as communication network control elements or functions, such as access network elements (e.g., access points, radio base stations, relay stations, eNBs, gNBs, etc.), and core network elements or functions, such as control nodes, support nodes, service nodes, gateways, user plane functions, access and mobility functions, etc., which may belong to one communication network system, or different communication network systems. However, it should be noted that communication without intermediate network elements is basically possible.

[0136] In communication networks, such as 3GPP based networks, one goal is to enhance performance. One way to achieve this is the use of Artificial Intelligence (AI) / Machine Learning (ML) concepts.

[0137] For example, in 5G systems and other systems, AI / ML can be used to intelligently manage complex networks, solve system optimization problems, and improve user experience.

[0138] AI / ML models are applicable to mobile devices in 5G systems, for example, image recognition, speech recognition, and video processing. Due to various applications, changing environments, and limited storage at user equipment (UE), it is not optimal to load all AI / ML models in the UE in advance. Therefore, it is required to download AI / ML models or AI / ML related data as needed. In addition, for some applications, the UE may not have sufficient computing resources to perform reasoning, in which case the reasoning operation may need to be offloaded from the UE to the network, such as a 5G cloud or edge. In addition, training data must be shared across different entities that collaborate to train global AI / ML models in the 5G system. The delivery of AI / ML models and data results in services that need to be served by the 5G system.

[0139] The following should be considered when considering the security aspects of AI / ML enhancement. Concepts will be developed to allow AI-enabled network architecture and leverage AI / ML to enable 5GC and air interface intelligence through consumption data analytics in terms of data collection, machine learning model training, analytical reasoning, and closed-loop processes. Based on this, consider expanding the scope of network AI services by providing network automation and improving the efficiency of 5G network architecture to leverage AI / ML technologies to enable 5GC and air interface intelligence.

[0140] In addition, security aspects must also be considered. For example, these aspects relate to AI / ML alignment and convergence with respect to the air interface and 5GC, how to support model transfer / delivery to the UE, security and privacy aspects regarding data collection and model transfer / delivery to the UE (e.g. in terms of authorization, authorization, subscription management).

[0141] Specifically, the following issues need to be considered, for example, when sharing AI / ML models and related data. A mechanism will be provided that enables authorization for consumer UEs (also referred to as requestor UEs) to request and consume AI / ML models, their training data and / or analytical data available at the 5G Core and / or RAN. In the case where the desired model / data is already available at one or more producer elements or functions, such as in one or more producer UEs or producer network elements, a corresponding mechanism is also required, which is located, for example, in the vicinity of the requestor UE and can therefore be contacted by using a direct connection between UEs (such as a D2D connection, a ProSe-based connection, etc.). In this case, it will be required to ensure / verify through the producer UE that the consumer UE is authorized to consume the model and / or related data.

[0142] Therefore, there is a need to provide a mechanism to enable UE-level authorization, for example in 5GS, to enable sharing of AI / ML models or related training / analysis data between consumer UE and 5GC / RAN or between consumer UE and producer UE. Such a mechanism should also be applicable to enable cross-domain AI ML model and training data sharing.

[0143] Therefore, according to an example of an embodiment, a mechanism related to an authorization mechanism is proposed, which basically enables authorization of a requester UE to access data in a producer UE or a producer network element or a producer network function (hereinafter referred to as a producer element or a producer function). More specifically, an authorization mechanism is proposed, which enables authorization of a requester UE to access data for model / analysis / data sharing in a producer UE, etc.

[0144] For the corresponding mechanism, the following basic concepts are used.

[0145] According to the first concept, a token-based mechanism is implemented. Specifically, for example, an access token is used based on a standardized authorization protocol similar to Oauth 2.0, where a communication network control entity (such as a 5GC network element or function) or a RAN element or function (i.e., the entity where the UE is registered) first verifies whether the requester UE is authorized to receive the requested service / data. The communication network control entity then generates an access token and provides it to the requester UE in order to become a consumer. The producer element or function is enabled to verify the authorization and provision of the access token for the data.

[0146] On the other hand, according to the second concept, static / dynamic authorization policies are used. Static / dynamic authorization policies can be pushed directly to the involved UEs, such as producer UEs. The policies allow the producer UE to make authorization decisions. An update mechanism can be included, which allows the 5GC to also affect authorization at a later point in time, for example when a request for authorization of access is received from a requestor UE.

[0147] It should be noted that the above concepts can be modified so that the requester and producer entities are part of the same communication network, i.e. involving a single PLMN; or the requester entity and producer entity are part of different communication networks (e.g. requester UE1 belongs to operator A, and producer UE2 belongs to operator B), so that inter-PLMN communication occurs.

[0148] That is, in the following, different examples of the embodiment will be described for illustrating the process for performing the authorization process for the requester UE. For this purpose, as an example of a communication network to which the example of the embodiment can be applied, a communication network architecture of a communication network based on the 3GPP standard (such as 5G) is used, without limiting the present disclosure to such an architecture. It will be apparent to those skilled in the art that the example of the embodiment can also be applied to other types of communication networks, such as Wi-Fi, Worldwide Interoperability for Microwave Access (WiMAX), Personal Communications Service (PCS), Wideband Code Division Multiple Access (WCDMA), systems using ultra-wideband (UWB) technology, mobile ad hoc networks (MANET), wired access, etc. In addition, without loss of generality, the description of some examples of the embodiments is related to mobile communication networks, but the principles described herein can also be extended and applied to any other type of communication network, such as a wired communication network.

[0149] The following examples and embodiments should be understood as illustrative examples only. Although the text herein may refer to "one", "an" or "some" examples or embodiments at several places, this does not necessarily mean that each such reference is related to the same example or embodiment, or that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide other embodiments. In addition, terms such as "comprising" and "including" should be understood as not limiting the described embodiments to consist only of those features that have been mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0150] The basic system architecture of a (telecommunication) communication network (including a mobile communication system, where some examples of the embodiments are applicable) may include the architecture of one or more communication networks, including (multiple) wireless or wired access network subsystems and (multiple) core networks. Such an architecture may include one or more communication network control elements or functions, access network elements, radio access network elements, access service network gateways or base transceiver stations, such as base stations (BS), access points (AP), NodeBs (NBs), eNBs or gNBs, distributed or centralized units, which control the corresponding coverage area or (multiple) cells, and utilize one or more communication stations (communication elements or communication functions) thereof, such as user equipment (UE), such as user devices or terminal equipment, or another device with similar functions, such as a modem chipset, chip, module, etc., which may also be part of a station, element, function or application capable of communication, such as a UE, element or function available in a machine-to-machine communication architecture, or as a separate element attached to such an element, function or application capable of communication, etc., capable of communicating via one or more channels via one or more communication beams for sending several types of data in multiple access domains. Furthermore, core network elements or network functions may be included, such as gateway network elements / functions, mobility management entities, mobile switching centers, servers, databases, etc.

[0151] The general functionality and interconnection of the described elements and functions (which also depends on the actual network type) are understood by a person skilled in the art and described in the corresponding specifications, so that a detailed description thereof is omitted herein. However, it should be noted that in addition to those described in detail below in this document, several additional network elements and signaling links may be employed for communicating with elements, functions or applications (e.g., communication endpoints), communication network control elements (such as servers), gateways, radio network controllers and other elements of the same or other communication networks.

[0152] The communication network architecture as considered in the examples of embodiments may also be able to communicate with other networks (such as the public switched telephone network or the Internet), as well as with individual devices or groups of devices that are not considered to be part of the network, such as monitoring devices like cameras, sensors, sensor arrays, etc. The communication network may also be able to support cloud services for virtual network elements or their functions, wherein it should be noted that the virtual network parts of the telecommunications network may also be provided by non-cloud resources (e.g., internal networks, etc.). It should be understood that the network elements and / or corresponding functions of the access system, core network, etc. may be implemented by using any node, host, server, access node or entity, etc. suitable for such purpose. In general, the network functions may be implemented as network elements on dedicated hardware, software instances running on dedicated hardware, or virtualized functions instantiated on an appropriate platform (e.g., cloud infrastructure).

[0153] In addition, network elements or network functions, such as RAN nodes, 5GC nodes like UDM, UE or other network elements or network functions as described herein, and any other elements, functions or applications can be implemented by software (e.g., by a computer program product for a computer) and / or by hardware. In order to perform their corresponding processing, the correspondingly used devices, nodes, functions or network elements may include several devices, modules, units, components, etc. (not shown) for control, processing and / or communication / signaling functions. Such means, modules, units and components may include, for example, one or more processors or processor units, including one or more processing parts for executing instructions and / or programs and / or for processing data, storage or memory units or means for storing instructions, programs and / or data, for use as a working area for a processor or processing part, etc. (e.g. ROM, RAM, EEPROM, etc.), input or interface means for inputting data and instructions by software (e.g. floppy disk, CD-ROM, EEPROM, etc.), user interface for providing monitoring and manipulation possibilities to the user (e.g. screen, keyboard, etc.), other interfaces or means for establishing links and / or connections under the control of the processor unit or part (e.g. wired and wireless interface means, radio interface means including, for example, antenna units, etc., means for forming a radio communication part, etc.), etc., wherein the corresponding means forming the interface, such as the radio communication part, may also be located at a remote site (e.g. a radio head or radio station, etc.). It should be understood in this document that a processing part should not be considered only as a processing part representing one or more processors, but can also be considered as a logical division of the mentioned processing tasks performed by one or more processors.

[0154] It should be understood that according to some examples, a so-called "liquid" or flexible network concept may be adopted, wherein the operations and functions of a network element, a network function, or another entity of a network may be performed in a flexible manner in different entities or functions (such as in nodes, hosts, or servers). The "division of labor" between the network elements, functions, or entities involved may vary from case to case.

[0155] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0156] (a) hardware circuit implementations only (such as implementations in analog and / or digital circuitry only), and

[0157] (b) a combination of hardware circuitry and software such as (where applicable):

[0158] (i) a combination of analog and / or digital hardware circuits and software / firmware, and

[0159] (ii) any portion of a hardware processor(s) with software (including a digital signal processor(s), software, and memory(s) that work together to enable a device (such as a mobile phone or server) to perform various functions), and hardware circuit(s) and / or processor(s), such as a microprocessor(s), or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but where it is not required for operation, the software may not be present. This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used herein, the term circuitry also encompasses an implementation of only a hardware circuit or processor (or processors), or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. For example, and if applicable to a particular claim element, the term circuitry also encompasses a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0160] In addition, as used herein, “at least one of the following:” and “at least one of…” and similar expressions (wherein a list of two or more elements is connected by “and” or “or”) mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.

[0161] As indicated above, two main concepts with corresponding modifications are considered.

[0162] In a first concept (which is based on a token-based authorization protocol using, for example, Oauth2.0 access tokens), a controlling network element or function (or controlling entity) (which is, for example, a core network element (e.g., UDM) or part of a RAN element) determines that a consumer UE requesting access to data (such as AIML-related data) is authorized to receive the corresponding data (e.g., AI / ML model or related data). Based on this determination, the controlling entity then generates an access token and provides it to the consumer UE. The consumer UE presents the access token to a producer element or producer function (which is, for example, a producer UE, or another network element or function that can provide the requested data) for verification. Based on this verification, the producer element or function (e.g., producer UE) provides the data, e.g., model, or related data, to the consumer UE.

[0163] In one variation of this first concept, it is assumed that both the consumer (or requester) UE and the producer element (eg producer UE) are from the same PLMN, wherein the consumer UE is connected to the PLMN (ie has an active connection).

[0164] In another variation of this first concept, it is assumed that both the consumer (or requester) UE and the producer element (e.g. producer UE) are from different PLMNs, wherein the consumer UE is connected to its PLMN (i.e. has an active connection). In this case, a unique temporary ID is used for the consumer UE privacy in a direct communication connection with the producer (e.g. in D2D communication).

[0165] As another variation of this first concept, assume that both consumer UEs are not connected to the PLMN (ie, no active connection). In this case, an access token may be provided in advance to enable the consumer UE to access data at the producer without being connected to the PLMN.

[0166] In the second concept (which is based on a static or dynamic authorization policy pushed to a producer element or function by a corresponding control network element or function, which is, for example, a core network element (e.g., UDM) or part of a RAN element), the producer element or function (e.g., a producer UE) processes to authorize a request received from a consumer UE using the static or dynamic authorization policy being pushed. Based on this determination, the producer element or function provides the requested data (e.g., an AI / ML model or related data) to the consumer UE.

[0167] In one variation of this second concept, it is assumed that the consumer (or requester) UE and the producer element (eg producer UE) are from the same PLMN, where a generic and updated authorization policy (without access token) is pushed at the UE.

[0168] In another variation of this second concept, it is assumed that the consumer (or requester) UE and the producer element (e.g. producer UE) are from different PLMNs, where a common and updated authorization policy (without access token) is pushed at the UE. In this case, a unique temporary ID is used for consumer UE privacy in a direct communication connection with the producer (e.g. in D2D communication).

[0169] Figure 1 A diagram illustrating an example of a communication scenario according to an example of an embodiment is shown. Specifically, Figure 1 An example is shown in which a consumer (or requester) UE and a producer element or function (in Figure 1 In the example, it is assumed that the producer element or function is the producer UE) and belongs to the same communication network or PLMN.

[0170] Reference numeral 10 denotes a UE 1 which in the following example is a consumer or requester UE and which requests access to data, such as AIML related data. The UE 10 is connected to a PLMN and is also configured to communicate with other UEs, for example via a direct connection such as a D2D connection.

[0171] Reference numeral 20 denotes UE2, which is a producer UE in the following example, and which has data requested by UE 10, such as AIML-related data. UE 20 is also connected to the PLMN and is also configured to communicate with other UEs, for example, via a direct connection (e.g., a D2D connection). As indicated above, the producer element or function (which is UE 20 in this example) may also be another network element or function, such as a RAN element, etc.

[0172] Reference numeral 30 denotes the PLMN 1 (i.e., the communication network) to which both UE 10 and UE 20 belong. It should be noted that the PLMN 30 is simplified for the sake of convenience, wherein only the parts useful for understanding the concepts of the embodiments are described below. As known to those skilled in the art, other elements or functions other than those indicated below may be part of the PLMN.

[0173] Specifically, among other elements, the PLMN 30 includes a RAN element 31 (such as a gNB) for connecting to the UE 10 and the UE 20. In addition, the core network 34 is part of the PLMN 30, which includes, for example, an authentication server function (AUSF) 32 and a unified data manager function (UDM) 33. The AUSF 32 supports, for example, authentication for 3GPP and non-3GPP accesses, and is connected with the UDM and AMF (access and mobility management function) for providing AUSF services. The UDM 33 supports, for example, the generation of 3GPP 5G AKA authentication vectors, user identity processing (such as storage and management of identities for each subscriber), service NF registration management of the UE (such as storing the service AMF for the UE), etc. It should be noted that in the following example, the control entity for authorization policy-related processing resides in the UDM 33, for example; however, the control entity for authorization policy-related processing as described below may also reside in another network element or function, such as a RAN or 5GC element or function.

[0174] like Figure 1 As indicated in , UE1 10 and UE2 20 are connected to PLMN 30, for example, via RAN 31. In addition, direct communication between UE1 10 and UE2 20 may be established, such as a connection based on ProSe, or a D2D connection, such as Figure 1 Indicated by the dotted arrow in .

[0175] Figure 2 A diagram illustrating another example of a communication scenario according to an example of an embodiment is shown. Specifically, Figure 2 An example is shown in which a consumer (or requester) UE and a producer element or function (in Figure 2 In the example, it is assumed that the producer element or function is a producer UE) belongs to a different communication network or PLMN.

[0176] Reference numeral 10 denotes UE1 which in the following example is a consumer or requester UE and which requests access to data, such as AIML related data. UE 10 is connected to PLMN1 and is also configured to communicate with other UEs, for example via a direct connection, such as a D2D connection.

[0177] Reference numeral 20 denotes UE2, which is a producer UE in the following example, and which has data requested by UE 10, such as AIML-related data. UE 20 is connected to PLMN2 and is also configured to communicate with other UEs, for example, via direct connections (e.g., D2D connections). As indicated above, the producer element or function (which is UE 20 in this example) may also be another network element or function, such as a RAN element, etc.

[0178] Reference numeral 30 denotes the PLMN1 (i.e., the communication network) to which the UE1 10 is connected. It should be noted that the PLMN1 30 is simplified for the sake of convenience, wherein only the parts useful for understanding the concepts of the embodiments are described below. As known to those skilled in the art, other elements or functions than those indicated below may be part of the PLMN.

[0179] Specifically, among other elements, PLMN1 30 includes a RAN element 31 (such as a gNB) for connecting to UE1 10. In addition, a core network 34 is part of PLMN1 30, and PLMN1 30 includes, for example, an authentication server function (AUSF) 32 and a unified data manager function (UDM) 33. It should be noted that in the following example, the control entity for authorization policy-related processing for UE1 10 resides in UDM 33, for example; however, the control entity for authorization policy-related processing as described below may also reside in another network element or function, such as a RAN or 5GC element or function.

[0180] Reference numeral 40 denotes a PLMN2 (i.e., a communication network) to which the UE2 20 is connected. It should be noted that for the sake of convenience, the PLMN2 40 is simplified, wherein only a portion that is helpful for understanding the concepts of the embodiments is described below. As known to those skilled in the art, other elements or functions other than those indicated below may be part of the PLMN.

[0181] Specifically, among other elements, PLMN2 40 includes a RAN element 41 (such as a gNB) for connecting to UE2 20. In addition, a core network 44 is part of PLMN2 40, which includes, for example, an authentication server function (AUSF) 42 and a unified data manager function (UDM) 43. It should be noted that in the following example, the control entity for authorization policy-related processing resides in the UDM 43, for example; however, the control entity for authorization policy-related processing as described below may also reside in another network element or function, such as a RAN or 5GC element or function.

[0182] like Figure 2 As indicated in , UE1 10 and UE2 20 are connected to PLMN1 30 and PLMN2 40, respectively, for example, via RAN 31 and RAN 41. In addition, direct communication between UE1 10 and UE2 20, such as a ProSe-based connection or a D2D connection, may be established. Figure 1 Furthermore, data exchange between PLMN1 30 and PLMN2 40 is possible, for example via corresponding control entities (eg UDM 32 and UDM 42) for authorization processing.

[0183] In the following, an example of an embodiment of a process for allowing an authorization process to be performed for allowing data to be exchanged between a requester UE (i.e. UE1 10) and a producer element or producer function (such as UE2 20) is described, in particular, relating to authorizing the requester UE1 10 to access, for example, AIML-related data from the producer UE 20.

[0184] Figures 3 to 6 The diagram shows the Figure 1 and Figure 2 A signaling diagram of an example of an authorization control process performed in an example communication scenario of the described embodiment.

[0185] In detail, Figure 3 A signalling diagram illustrating an example of an authorization procedure according to an example of an embodiment of a variant of the first concept (token-based concept) is shown, wherein it is assumed that the consumer (or requester) UE and the producer element (e.g. producer UE) are from the same PLMN, wherein the consumer UE is connected to the PLMN (i.e. has an active connection).

[0186] In S310, the control entity (i.e., UDM / 5GC in this example) defines each UE authorization policy. That is, for a given category of data (such as a given model ID, event ID, data subject ID available at a producer element or function (e.g., at 5GC or RAN or other (multiple) UEs), it is defined which consumer UE is allowed to access the corresponding category or data. For example, this is indicated in the form of a predefined UE list, or the permission is related to the UE's area (e.g., the PLMN to which the requester UE belongs), or it is defined that any UE is allowed to access the data.

[0187] For example, access to model / analysis / data-X may be defined, where access is allowed for any UE (ie allowed UE list = all UEs), or for specific UEs (eg only UEs from PLMN1), or UEs in a certain area (eg geographical area, etc.).

[0188] In S320 and S325, the control entity (e.g., UDM / 5GC) sends configuration information to the UE via suitable signaling (e.g., NAS, User Parameter Provisioning (UPU) or other messages). For example, the information includes key material that allows verification of the access token, such as an authorization public key (i.e., the key material of the authorization server that generated the access token); and policy information indicating, for example, that a UE-to-UE connection is allowed (e.g., only after a valid token), or that a UE-to-UE connection is allowed without an access token.

[0189] In S330, the requester UE1 attempts to connect to a producer element or function, such as UE2, for example, via a D2D connection (for direct connection, technologies such as SideLink, Wifi, Bluetooth may be used). When the connection is initiated, the producer UE2 requests an access token from UE1 to present the requested data (e.g., for certain data / analysis or model data).

[0190] In S340, UE1 sends an authorization request to the control entity (e.g., UDM / 5GC) for obtaining permission to access the requested data. With the help of the request in S340, UE2 requests resources from the target UE2, which becomes a producer element or function. The request is sent for specific data (e.g., a given model ID / analysis ID, event ID, and / or data subject ID), i.e., specifies the type of data that UE1 wants to access. In this example of the embodiment, the request in S340 is used to obtain an access token.

[0191] In S350 , the control entity authorizes the request based on operator policy, subscription data of UE2, etc. Then, an access token is generated by signing the token via the authorization server private key.

[0192] According to an example of an embodiment, in order to sign the token, an existing network function, such as a network repository function, may be used. Alternatively, a new authorization server for UE to UE authorization may be created. For example, such an authorization server may be deployed in the RAN or the core network, or in both.

[0193] In S360, the control entity sends a signed access token to UE1. According to an example of an embodiment, the access token includes at least one of the following information: an indication of a request source (which is, for example, UE1), an indication of a producer element or function for defining which UE is allowed (for example, UE1 or * (for all UEs)), an indication of a producer PLMN (for example, xyz), an indication of a connection type (for example, ProSe, WIFI), and an indication of a kind of data that is allowed to be accessed (for example, model ID / analysis ID / data type ID / event ID).

[0194] As indicated above, the token is signed by a private key. A public key is configured in each UE (eg in S320, S325).

[0195] In S370 , UE1 sends a service request (ie, access to designated data) and the access token received in S360 to UE2 .

[0196] In S380, UE2 verifies the token via the authorization server public key provided in S320. In case of successful verification, UE2 provides the requested service (eg, sends the requested data to UE1).

[0197] It should be noted that in an alternative example, UE1 can directly send a request of S340 to 5GC in order to request resources (i.e., models / analysis / data types). The control entity (e.g., UDM) in 5GC first determines whether UE1 requesting resources is indeed authorized, and after successful confirmation, the control entity initiates sending the requested resources and a signed access token consisting of the UE ID in the consumer for later use.

[0198] In addition, in the case where the requested resource is already available at a neighbor UE, the 5GC can provide the corresponding producer information (e.g., UE-specific or a list of UEs) in the access token to indicate the producer. Therefore, the consumer UE can only contact and request resources from the UE for which the access token was generated. Alternatively, the 5GC can provide a generic access token that is only applicable and limited to the resource being requested, such as a specified model ID "abc", a specified analysis ID "xyz", a specified data type "123", etc. The requester UE can then use the token to request the resource at any neighbor UE that has the resource.

[0199] In summary, according to the example described above, the control entities involved in the authorization process perform the following processing. An authorization policy is defined and configured in the UE, where the authorization policy specifies what kind of data the consumer UE is allowed to access, for example based on a list of allowed UEs, UEs allowed per area, or any UE allowed. The authorization policy and public key are delivered to the UEs, namely the producer UE2 and the consumer UE1. When a request including a token for connecting to UE2 is received from UE1, the request is authorized based on the operator policy and the subscription data of UE2. The token is signed with the authorized private key for generating an access token. The signed token is sent to UE1, which also includes the consumer ID (UE1), the producer ID (UE2), and the connection type (e.g., ProSe or WLAN).

[0200] In addition, according to the example described above, the requester (or consumer) UE involved in the authorization process performs the following processing. The UE receives the authorization policy and the public key. Then, it sends a request to the control entity (e.g., UDM / 5GC), which includes a token for connecting to UE2. Then, a token signed by the control entity is received as an access token. Then, a request including the signed token can be sent to the producer (e.g., UE2).

[0201] On the other hand, according to the example described above, the producer element or function (i.e., producer UE) involved in the authorization process performs the following processing. It receives the authorization policy and the public key. When it receives a request including a token signed by a control entity (e.g., UDM / 5GC), it determines whether the token is valid for the request, and if this is the case, it provides the requested data, such as the requested ML model and / or related data, to the requester UE.

[0202] Figure 4 A signaling diagram illustrating an example of an authorization process according to an example of an embodiment of a variant of the first concept (token-based concept) is shown, wherein it is assumed that the consumer (or requester) UE and the producer element (e.g. producer UE) are from different PLMNs, wherein the consumer UE is connected to its PLMN (i.e. has an active connection). In this example, a temporary ID is used to protect the consumer UE privacy in a D2D communication (e.g. ProSe or WLAN) with the producer UE. According to an example of an embodiment, the temporary ID is, for example, an AKMA-KID based on 3GPP specification TS 33.535. It should be noted that WLAN Direct can be used for any D2D communication based on WLAN.

[0203] In S410 and S420, the corresponding control entities of PLMN1 and PLMN2 (e.g., UDM / 5GC in this example) define each UE authorization policy. That is, for a given category of data (such as a given model ID, event ID, data subject ID available at a producer element or function (e.g., at 5GC or RAN or other (multiple) UEs)), it is defined which consumer UE is allowed to access the corresponding category or data. For example, this is indicated in the form of a predefined UE list, or the permission is related to the area of ​​the UE (e.g., the PLMN to which the requester UE belongs), or it is defined that any UE is allowed to access the data. For example, it can be defined to allow access to model / analysis / data-X, where access is allowed for any UE (i.e., the allowed UE list = all UEs), or for a specific UE (e.g., only UEs from PLMN1), or UEs in a certain area (e.g., a geographical area, etc.).

[0204] In S415 and S425, the control entity (e.g., UDM / 5GC) sends configuration information to the corresponding UE via suitable signaling (e.g., NAS, User Parameter Provisioning (UPU) or other messages). For example, the information includes key material that allows verification of the access token, such as an authorization public key (i.e., the key material of the authorization server that generated the access token); and policy information indicating, for example, that a UE-to-UE connection is allowed (e.g., only after a valid token), or that a UE-to-UE connection is allowed without an access token.

[0205] In addition, the UE is also configured with a temporary ID (e.g., a temporary number). The temporary ID may be generated at the UE or assigned by the PLMN. The temporary ID is unique to the UE and may be used to protect privacy at the D2D connection until the time when the communication is not authorized. For example, the temporary ID may be an AKMA-KID, or alternatively, it is a new temporary number with the following format:

[0206] <Temp Number><HPLMN ID>

[0207] It should be noted that the temporary ID may be updated after each authentication process.

[0208] In S430, the requester UE1 attempts to connect to a producer element or function, such as UE2, for example, via a D2D connection (for direct connection, technologies such as SideLink, Wifi, Bluetooth can be used). When initiating the connection, the producer UE2 requests from UE1 an access token for the requested data (e.g., for certain data / analysis or model data). In this context, UE2 shares its temporary ID (e.g., obtained in conjunction with S425) with UE1 (e.g., replacing the MSISDN).

[0209] In S440, UE1 sends an authorization request to the control entity (e.g., UDM / 5GC) for obtaining permission to access the requested data. The request includes the temporary ID of UE2 received in S430 as information, as well as the source number and information about the data of interest (e.g., model ID / analysis ID, etc.). With the help of this request in S440, UE2 requests resources from the target UE2 that becomes a producer element or function. The request is sent for specific data (e.g., a given model ID / analysis ID, event ID, and / or data subject ID), i.e., specifies the type of data that UE1 wants to access. In this example of the embodiment, the request in S440 is used to obtain an access token.

[0210] In S450, the control entity of the PLMN of UE1 (i.e. PLMN1) determines the included temporary ID, which belongs to another PLN (i.e. PLMN2), based on the inspection of the request received in S440. Therefore, in S460, the control entity of PLMN1 sends an access token request to the control entity of PLMN2. The request in S460 includes, for example, an indication of the temporary ID, an indication of the source PLMN, information about the source area, etc., which is required by the control entity of PLMN2 to decide the authorization of the request from UE1.

[0211] In S465, when deciding to authorize the request of UE1, the control entity of PLMN2 signs the token using its private key. The signed access token is then sent back to the control entity of PLMN1. According to an example of an embodiment, the access token includes at least one of the following information. An indication of the request source (which is, for example, UE1), an indication of a producer element or function for defining which UE is allowed (e.g., UE1 or * (for all UEs)), an indication of the producer PLMN (e.g., xyz), an indication of the connection type (e.g., ProSe, WIFI), and an indication of the kind of data that is allowed to be accessed (e.g., model ID / analysis ID / data type ID / event ID).

[0212] As indicated above, the token is signed by the private key of PLMN2.A public key is configured in each UE (eg in S415, S425).

[0213] In S470 , the control entity of PLMN1 sends the received access token to UE1 in response to the request in S440 .

[0214] Then, in S480 , UE1 sends a service request (ie, access to designated data) and the access token received in S470 to UE2 .

[0215] In S490, UE2 verifies the token via the authorization server public key provided in S425. In case of successful verification, UE2 provides the requested service (eg, sends the requested data to UE1).

[0216] In the example described above, it is assumed that the requester UE1 is connected to the network (i.e. PLMN1) when sending the request to the producer, so that the authorization process can be performed with the control entity of the PLMN. However, it is also conceivable that when sending the request to UE2, UE1 is not connected to the PLMN. In this case, the following process can be applied.

[0217] Specifically, according to an example of the embodiment, UE1 can retrieve the access token in advance. For example, the method of obtaining the access token can be combined with Figure 3 and Figure 4 The same way as described. After obtaining the access token, the access token can be stored on the UE1 side. Due to this, when the UE1 is not connected to the network (e.g. out of range, etc.), the UE1 can use the stored token when connecting to other UEs (e.g. by using a direct connection like D2D, WLAN or ProSe).

[0218] Next, the description Figure 5 , Figure 5 A signaling diagram illustrating an example of an authorization process according to an example of an embodiment of a variant of the second concept (authorization policy without a token) is shown, wherein it is assumed that the consumer (or requester) UE and the producer element (e.g. producer UE) are from the same PLMN, wherein the consumer UE is connected to the PLMN (i.e. has an active connection). According to the example, the authorization policy can be updated at the target UE.

[0219] In S510, the control entity (i.e., UDM / 5GC in this example) defines a per-UE authorization policy. That is, for a given category of data, such as a given model ID, event ID, data subject ID available at a producer element or function (e.g., at 5GC or RAN or other (multiple) UEs), it is defined which consumer UE is allowed to access the corresponding category or data. For example, this is indicated in the form of a predefined UE list, or the permission is related to the UE's area (e.g., the PLMN to which the requester UE belongs), or it is defined that any UE is allowed to access the data.

[0220] For example, access to model / analysis / data-X may be defined, where access is allowed for any UE (ie allowed UE list = all UEs), or for specific UEs (eg only UEs from PLMN1), or UEs in a certain area (eg geographical area, etc.).

[0221] In S520 and S525, the control entity (e.g., UDM / 5GC) pushes configuration information to the UE (e.g., via suitable signaling (e.g., NAS, User Parameter Provisioning (UPU) or other messages). The information includes, for example, general authorization policy information indicating, for example, model / analysis / data type sharing for each PLMN or each geographic area at (multiple) UEs registered for the model training service. In addition, information indicating that UE-to-UE connections are allowed (e.g., only after a valid token), or that UE-to-UE connections are allowed without an access token may be included.

[0222] In S530, the requester UE1 attempts to connect to a producer element or function, such as UE2, for example, via a D2D connection (for direct connection, technologies like SideLink, Wifi, Bluetooth may be used). When the connection is initiated, the producer UE2 processes the request for data from UE1.

[0223] That is, for example, UE2 determines whether to provide the requested service to UE1 based on the authorization policy information received in S520. If the authorization policy information authorizes UE1 to obtain the service (e.g., access to specified data), UE2 may authorize UE1, for example, based on a static policy available at UE2. In this case, S580 (described later) may be performed.

[0224] On the other hand, in case the authorization policy information does not allow immediate authorization (eg, UE2 does not have a suitable policy), or when UE2 is configured for a dynamic authorization procedure for UE1, UE2 requires UE1 to request authorization from the network.

[0225] In S540, UE1 sends an authorization request to the control entity (e.g., UDM / 5GC) to obtain permission to access the requested data. The request is sent for specific data (e.g., a given model ID / analysis ID, event ID, and / or data subject ID), i.e., specifies the type of data that UE1 wants to access.

[0226] In S550, the control entity decides whether to authorize the request of UE1 based on the operator policy, subscription data of UE1 and UE2, etc. Then, when it is decided that the authorization request is allowed, the control entity determines whether the authorization policy configured in the UE is sufficient.

[0227] In the case where it is determined that the authorization policy provided in S520, S525 is insufficient, in S555, the control entity determines the necessary changes in the policy settings and updates the authorization policy information in UE2 accordingly. For example, the control entity updates the policy at UE2 with more fine-grained information, such as the UE1 ID requesting the service, the authorized model ID / analysis ID / data type, etc.

[0228] For example, information for the authorization policy being sent includes an indication of the source (UE1), an indication of the producer (UE1), the producer PLMN (e.g., xyz), the connection type (ProSe, WIFI), and / or information about model ID / analysis ID / data type.

[0229] After the update in S555 , or in case the control entity determines in S550 that the authorization policy configured in the UE is sufficient, in S560 , an OK message for the request in S540 is sent to UE1 , the message including information for UE1 to request data from UE2 .

[0230] In S570 , UE1 sends a service request (ie, access to designated data) to UE2.

[0231] In S580, UE2 verifies the details of UE1 according to the authorization policy information received in S520 or S555 to allow access to data. In case of successful verification, UE2 provides the requested service (eg, sends the requested data to UE1).

[0232] In summary, according to the examples described above, the control entities involved in the authorization process perform the following processing. The authorization policy is configured, for example, based on a list of allowed UEs, allowed UEs per area, or any allowed UE, specifying what kind of data the consumer UE is allowed to access. A general authorization policy is pushed to the producer UE2, for example, based on the type of ML models and / or related data allowed to be shared per PLMN or geographic area. In addition, a general authorization policy is pushed to the consumer UE1. When a request to access a specific ML model or related data is received, authorization of the request is determined based on the authorization policies and subscription data of UE1 and UE2. If necessary, in response to determining that the general authorization policy is insufficient for the request, an updated policy is pushed to UE2. Information is provided to UE1 to request the ML model or data from UE2.

[0233] In addition, according to the example described above, the consumer (or requester) UE involved in the authorization process performs the following processing: Receive general authorization policy information. Send a request to a control entity (e.g., UDM / 5GC / RAN) for access to the ML model or related data. Receive information that can be used to send a request to UE2. Send a corresponding request to UE2 for access to the ML model or related data.

[0234] On the other hand, according to the example described above, the producer element or function (such as a producer) involved in the authorization process performs the following processing. Receive general authorization policy information. In addition, if the updated policy is sent by the control entity, the updated policy can be received. After determining that the request is valid for UE1 based on the pushed at least one authorization policy and the details of UE1, send the requested ML model or related data to UE1.

[0235] Figure 6 A signaling diagram illustrating an example of an authorization process according to an example of an embodiment of a variant of the second concept (generic authorization policy without a token) is shown, wherein it is assumed that the consumer (or requester) UE and the producer element (e.g., producer UE) are from different PLMNs, wherein the consumer UE is connected to its PLMN (i.e., has an active connection). In this example, a temporary ID is used to protect the privacy of the consumer UE in a D2D communication (e.g., ProSe or WLAN) with the producer UE. According to the example of the embodiment, the temporary ID is, for example, an AKMA-KID based on 3GPP specification TS 33.535. It should be noted that WLAN Direct can be used for any WLAN-based D2D communication. In this example, due to inter-PLMN communication, PLMN1 of the requester UE requests authorization on behalf of UE1 at PLMN2 of the producer UE2. Moreover, according to the example, the authorization policy can be updated at the target UE.

[0236] In S610 and S620, the corresponding control entities of PLMN1 and PLMN2 (e.g., UDM / 5GC in this example) define each UE authorization policy. That is, for a given category of data, such as a given model ID, event ID, data subject ID available at a producer element or function (e.g., at 5GC or RAN or other (multiple) UEs), it is defined which consumer UE is allowed to access the corresponding category or data. For example, this is indicated in the form of a predefined UE list, or the permission is related to the area of ​​the UE (e.g., the PLMN to which the requester UE belongs), or it is defined that any UE is allowed to access the data. For example, it can be defined that access to model / analysis / data-X is allowed, where access is allowed for any UE (i.e., the allowed UE list = all UEs), or for a specific UE (e.g., only UEs from PLMN1), or UEs in a certain area (e.g., a geographical area, etc.).

[0237] In S615 and S625, the control entity (e.g., UDM / 5GC) pushes configuration information to the UE (e.g., via suitable signaling (e.g., NAS, User Parameter Provisioning (UPU) or other messages). The information includes, for example, general authorization policy information indicating, for example, model / analysis / data type sharing for each PLMN or each geographic area at (multiple) UEs registered for the model training service. In addition, information indicating that UE-to-UE connections are allowed (e.g., only after a valid token), or that UE-to-UE connections are allowed without an access token may be included.

[0238] In addition, the UE is also configured with a temporary ID (e.g., a temporary number). The temporary ID may be generated at the corresponding UE or assigned by the corresponding PLMN. The temporary ID is unique to each UE and may be used to protect privacy at the D2D connection until the time when the communication is not authorized. For example, the temporary ID may be an AKMA-KID, or alternatively, it is a new temporary number having the following format:

[0239] <Temp Number><HPLMN ID>

[0240] It should be noted that the temporary ID may be updated after each authentication process.

[0241] In 630, the requester UE1 attempts to connect to a producer element or function, such as UE2, for example, via a D2D connection (for direct connection, technologies such as SideLink, Wifi, Bluetooth may be used). When initiating the connection, the producer UE2 processes the request for data from UE1. In addition, when initiating the connection, the producer UE2 shares its temporary ID (e.g., obtained in conjunction with S625) with UE1 (e.g., replacing the MSISDN).

[0242] In the process, UE2 determines whether to provide the requested service to UE1 based on the authorization policy information received in S625. If the authorization policy information authorizes UE1 to obtain the service (e.g., access to specified data), UE2 can authorize UE1, for example, based on a static policy available at UE2. In this case, S690 (described later) can be performed.

[0243] On the other hand, in case the authorization policy information does not allow immediate authorization (eg, UE2 does not have a suitable policy), or when UE2 is configured for a dynamic authorization procedure for UE1, UE2 requires UE1 to request authorization from the network.

[0244] In S640, UE1 sends an authorization request to the control entity (e.g., UDM / 5GC) to obtain permission to access the requested data. The request is sent for specific data (e.g., a given model ID / analysis ID, event ID, and / or data subject ID), i.e., specifies the type of data that UE1 wants to access. In addition, the request includes the temporary ID of UE2 received in S630 as information, as well as the source number and information about the data of interest (e.g., model ID / analysis ID, etc.). With the help of this request in S440, UE2 requests resources from the target UE2, which becomes a producer element or function. The request is sent for specific data (e.g., a given model ID / analysis ID, event ID, and / or data subject ID), i.e., specifies the type of data that UE1 wants to access.

[0245] In S650, the control entity of the PLMN of UE1 (i.e., PLMN1) determines, based on the inspection of the request received in S640, that the included temporary ID belongs to another PLMN (i.e., PLMN2). Therefore, in S660, the control entity of PLMN1 sends a request to the control entity of PLMN2 to allow UE1 to access data from UE2. The request in S660 includes, for example, an indication of the temporary ID, an indication of the source PLMN, information about the source area, etc., which is required by the control entity of PLMN2 to decide on the authorization of the request from UE1.

[0246] The control entity of PLMN2 decides to authorize the request of UE1. In this context, the control entity of PLMN2 also determines whether the authorization policy configured in UE2 is sufficient.

[0247] In the case where it is determined that the authorization policy provided in S625 is insufficient, in S663, the control entity determines the necessary changes in the policy settings and updates the authorization policy information in UE2 accordingly. For example, the control entity updates the policy at UE2 with more fine-grained information, such as UE1 ID requiring service, authorized model ID / analysis ID / data type, etc.

[0248] For example, information for the authorization policy being sent includes an indication of the source (UE1), an indication of the producer (UE1), the producer PLMN (e.g., xyz), the connection type (ProSe, WIFI), and / or information about model ID / analysis ID / data type.

[0249] After the update in S663, or in the case where the control entity determines that the authorization policy configured in UE2 is sufficient, in S667, the control entity of PLMN2 sends an OK message of the request in S660 to the control entity of PLMN1.

[0250] Then, in S670 , the control entity of PLMN1 sends an OK message to UE1 for the request in S640 , where the message includes information for UE1 to request data from UE2 .

[0251] Then, in S680, UE1 sends a service request (ie, access to designated data) to UE2.

[0252] In S690, UE2 verifies the details of UE1 according to the authorization policy information received in S625 or S663 to allow access to the data. In case of successful verification, UE2 provides the requested service (eg, sends the requested data to UE1).

[0253] Figure 7 A flowchart showing the processing performed in a control entity (such as a 5GC network element or function, a RAN element or function, or a UDM) according to some examples of the embodiments, which performs an authorization process as a control entity, such as in combination with Figure 3 and Figure 4 described. That is, Figure 7 Shown by Figure 1 or Figure 2 The control entity may include or be included in one of a core network control element or a core network control function, an access network control element or an access network control function. For example, the control entity includes or is included in a UDM entity.

[0254] In S710, an authorization policy for each UE is defined in a control entity. For example, the authorization policy generally indicates which data is allowed to be accessed by which user equipment.

[0255] In S720, an authorization policy for one or more UEs (e.g., UE1 and UE2) is configured by providing key material that can be used to verify the access token, and information about the authorization policy. The information indicates the permission of a connection between the requester UE and a producer element or producer function (e.g., UE2) with a valid access token or without an access token.

[0256] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0257] Specifically, according to some examples of the embodiments, the data indicated in the authorization policy includes at least one or more of the following items: an AIML model ID, an AIML event ID, or a data subject ID. The UE that is allowed to access the data is identified by at least one of the following items: a list of predefined UEs, an indication of a specified area (e.g., a geographic area) where the UE is located, an indication of the communication network (PLMN) to which the UE belongs, or an indication that any UE is allowed.

[0258] According to an example of an embodiment, key material, and information about authorization policy may be provided using one of NAS signaling or User Parameter Provision (UPU) signaling for transmission to one or more UEs.

[0259] In S730 , the control entity receives a request for authorization of a requester UE (eg UE1 ) to access specified data from a producer element or producer function (eg UE2 ).

[0260] According to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0261] Furthermore, according to an example of an embodiment, the request for authorization of the requestor user device includes an identification of a producer element or a producer function.

[0262] Furthermore, according to an example of an embodiment, a request for authorization of a requester UE is received from one of the requester UEs (corresponding to Figure 3 , i.e. the control entity is located in PLMN 1), or from a control network element or control network function (corresponding to a control entity in another communication network) of another communication network. Figure 4 , i.e. the control entity is located in PLMN 2) is received.

[0263] In S740 , the request for authorization of the requester UE is processed to determine whether the request is allowed.

[0264] According to an example of an embodiment, when a request for authorization of a requester UE is processed, it is decided whether to allow the request based on operator policy and subscription data of a producer element or producer function.

[0265] In S750 , if the request is allowed, an access token for allowing access to designated data from the producer element or producer function is obtained.

[0266] According to an example of an embodiment, the access token includes at least one of the following items: an identification of the source UE of the request, an identification of a producer element or producer function of the requested data, an identification of a communication network where the producer element or producer function of the requested data is located, or an indication of a connection type used to obtain the requested data from the producer element or producer function.

[0267] Furthermore, according to an example of an embodiment, the access token is signed by a private key, wherein the key material is a corresponding public key for verifying the access token at a producer element or producer function.

[0268] In S760, the obtained access token is sent to the requester UE.

[0269] In this connection, according to an example of an embodiment, using the access token sent to the requester UE, information indicating at least one of the following items is provided: information identifying at least one producer element or producer function, used to prompt the requester UE to contact only the identified producer element or producer function as a target for requesting specified data; or information indicating a specified data resource is provided, used to prompt the requester UE to request only the indicated resource from a suitable producer element or producer function. In this case, the access token is a general access token.

[0270] According to an example of an embodiment, when processing of a request for authorization of a requestor UE is decided to be allowed, an access token for allowing access to specified data from a producer element or producer function is generated by a control entity, wherein the generated access token is sent to the requestor UE.

[0271] On the other hand, according to an example of an embodiment, when a request for authorization of a requester UE is received, it is also checked whether a unique temporary ID for a producer element or a producer function is included in the request, wherein the unique temporary ID indicates a relationship with another communication network (e.g., PLMN2), for example, as combined with Figure 4 Described. In the case where the determination is positive, the request for authorization of the requester UE is forwarded to the control network element or control network function of another communication network (PLMN2) (i.e., the corresponding control entity) to obtain an access token. When the access token is received from the control network element or control network function of another communication network, the received access token is sent to the requester user equipment (described later).

[0272] According to an example of embodiment, the unique temporary identifier is configured in the producer element or producer function by a controlling network element or controlling network function of the corresponding PLMN, or it is generated by the producer element or producer function itself.

[0273] Figure 8A flowchart showing the processing performed in a requester UE (such as UE1) performing an authorization process according to some examples of the embodiments, such as in combination with Figure 3 and Figure 4 described. That is, Figure 8 Shown by Figure 1 or Figure 2 Flowchart related to the processing performed by the requester UE of PLMN1.

[0274] In S810, configuration information about the authorization policy is received from a controlling network element or a controlling network function. The information includes key material that can be used to verify the access token, and information indicating the permission of the connection between the requester UE and the producer element or producer function with a valid access token or without an access token.

[0275] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0276] According to an example of an embodiment, key material, and information about authorization policy may be received via one of NAS signaling or User Parameter Provisioning (UPU) signaling for transmission to one or more UEs.

[0277] In S820, a request for authorization to access specified data from a producer element or producer function is sent to a controlling network element or controlling network function (eg, the controlling entity of PLMN1).

[0278] According to an example of an embodiment, the producer element or producer function indicated in the request for authorization to access specified data is one of a producer UE, or a producer communication network element, or a producer communication network function (such as a RAN or 5GC, etc.).

[0279] Furthermore, according to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0280] Furthermore, according to an example of an embodiment, the request for authorization comprises an identification of a producer element or a producer function.

[0281] According to an example of embodiment, after receiving a query for presenting an access token from a producer element or producer function, eg received after contacting the producer element or producer function, a request for authorization to access specified data is sent to the controlling entity.

[0282] In S830 , in response to the request for authorization, the requester UE receives an access token for allowing access to specified data from the producer element or producer function.

[0283] According to an example of an embodiment, the access token received from the control entity includes information indicating at least one of the following items: information identifying at least one producer element or producer function, for prompting to contact only the identified producer element or producer function as a target for requesting specified data; or information indicating a specified data resource, for prompting to request only the indicated resource from a suitable producer element or producer function. In this case, the access token is a generic access token.

[0284] In addition, according to an example of an embodiment, the access token includes at least one of the following items: an ID of the requesting source UE, an ID of a producer element or producer function of the requested data, an ID of a communication network where the producer element or producer function of the requested data is located, or an indication of a connection type used to obtain the requested data from the producer element or producer function.

[0285] According to an example of an embodiment, the access token is signed by a private key, wherein the key material is a corresponding public key used to verify the access token at a producer element or producer function.

[0286] In S840, the requester UE sends a request for the specified data to the producer element or producer function, including the received access token.

[0287] According to an example of an embodiment, in response to the request in S840 , the requested specified data is received from the producer element or the producer function.

[0288] According to a further example of the embodiment, Figure 4 As described, a unique temporary ID assigned for protecting privacy in D2D communication is obtained. The unique temporary ID is received from a control entity or generated in a requester UE. The unique temporary ID is indicated in a request for authorization to access specified data available at a producer element or producer function identified by a unique temporary identifier.

[0289] In addition, according to an example of the embodiment, as combined with Figure 4 As described, the requester UE receives a unique temporary ID of the producer element or producer function from which the specified data will be obtained, and the unique temporary ID is used to protect privacy in D2D communication. In the request for authorization to access the specified data sent in S820, the unique temporary ID is indicated as the identification of the producer element or producer function.

[0290] Furthermore, according to an example of embodiment, it is also possible that the requester UE stores the received access token for later use, for example, when the UE is not connected to a PLMN.

[0291] Fig. 9 A flowchart showing the processing performed in a producer element or producer function performing an authorization process according to some examples of the embodiments, i.e. a producer UE (e.g. UE2) or a producer communication network element or producer communication network function (such as a RAN or 5GC element or function), as combined with Figure 3 and Figure 4 described. That is, Fig. 9 Shown by Figure 1 or Figure 2 Flowchart related to the processing performed by producer UE2 of PLMN 1 or PLMN 2.

[0292] In S910, configuration information about the authorization policy is received from a controlling network element or a controlling network function. The information includes key material that can be used to verify the access token, and information indicating the permission of the connection between the requester UE and the producer element or producer function with a valid access token or without an access token.

[0293] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0294] According to an example of an embodiment, key material, and information about authorization policy may be received via one of NAS signaling or User Parameter Provisioning (UPU) signaling for transmission to one or more UEs.

[0295] In S920 , a request for specified data to be provided from a producer element or producer function is received from a requester UE (eg, UE1 ), wherein the request includes an access token for allowing access to the specified data from the producer element or producer function.

[0296] According to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0297] Moreover, according to an example of an embodiment, the access token includes at least one of the following items: an ID of the requesting source UE, an ID of a producer element or producer function of the requested data, an ID of a communication network where the producer element or producer function of the requested data is located, or an indication of a connection type used to obtain the requested data from the producer element or producer function.

[0298] According to an example of an embodiment, the access token is signed by a private key, wherein the key material is a corresponding public key used to verify the access token at a producer element or producer function.

[0299] In S930, the validity of the received access token is determined. This is based on, for example, the key material received in S910.

[0300] In S940 , if the validity of the access token is confirmed, the requested specified data is sent to the requester UE.

[0301] According to a further example of the embodiment, Figure 4 As described, a unique temporary ID assigned for protecting privacy in D2D communication is obtained. The unique temporary ID is received from a control entity or generated in a producer element or producer function. The unique temporary ID is indicated to a requester UE attempting to access specified data.

[0302] Furthermore, according to an example of an embodiment, a query for presenting an access token is sent to the requester UE.

[0303] Fig.10 A diagram of a network element or network function 300 (such as a 5GC network element or function, a RAN element or function, or a UDM) according to some examples of embodiments is shown, which performs an authorization process as a control entity, such as in conjunction with Figure 3 and Figure 4 As described. It should be noted that the network element or function 300 (such as the UDM as a control entity) may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element, or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof (such as hardware, software, firmware, one or more processors and / or circuit systems).

[0304] Fig.10The control entity 300 shown in may include processing circuits, processing functions, control units or processors 301, such as CPUs, etc., which are suitable for executing instructions given by programs related to the control process, etc. Processor 301 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided in one or more further processors, processing functions or processing parts, as an example, such as in a physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 302 and 303 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 301. I / O unit 302 may be used to communicate with a network part. I / O unit 303 may be used to communicate with a UE (such as UE1 or UE2). I / O units 302 and 303 may be a combined unit including a communication device toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 304 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 301 and / or as working storage for the processor or processing function 301. It should be noted that the memory 304 may be implemented by using one or more memory portions of the same or different types of memory.

[0305] The processor or processing function 301 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 301 includes one or more of the following sub-parts. Sub-part 3001 is a processing part that can be used as a part for defining an authorization policy. Part 3001 can be configured to perform processing according to Figure 7 In addition, the processor or processing circuit or function 301 may include a sub-portion 3002 that can be used as a portion for configuring the authorization policy. Portion 3002 may be configured to execute according to Figure 7 In addition, the processor or processing circuit or function 301 may include a sub-section 3003 that can be used as a section for receiving a request. Section 3003 may be configured to perform according to Figure 7 In addition, the processor or processing circuit or function 301 may include a sub-portion 3004 that can be used as a portion for processing the request. Portion 3004 may be configured to perform according to Figure 7 Furthermore, the processor or processing circuit or function 301 may include a sub-portion 3005 that can be used as a portion for obtaining an access token. Portion 3005 may be configured to perform the Figure 7In addition, the processor or processing circuit or function 301 may include a sub-portion 3006 that can be used as a portion for sending an access token. Portion 3006 may be configured to perform according to Figure 7 The S760 is processed.

[0306] Fig.11 A diagram showing a network element or network function 10 (such as UE1) according to some examples of embodiments, which performs an authorization process as a requester UE, such as in conjunction with Figure 3 and Figure 4 As described. It should be noted that the network element or function 10 (such as UE1) may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element, or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof (such as hardware, software, firmware, one or more processors and / or circuit systems).

[0307] Fig.11 The requester UE1 10 shown may include a processing circuit, a processing function, a control unit or a processor 101, such as a CPU, etc., which is suitable for executing instructions given by a program or the like related to the control process. The processor 101 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided in one or more further processors, processing functions or processing parts, as an example, such as in a physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 102 and 103 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 101. The I / O unit 102 may be used to communicate with a communication network (such as PLMN1). The I / O unit 103 may be used to communicate directly with another UE (such as UE2) via D2D, etc. The I / O units 102 and 103 may be a combined unit including communication devices toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 104 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 101 and / or as working storage for the processor or processing function 101. It should be noted that the memory 104 may be implemented by using one or more memory portions of the same or different types of memory.

[0308] The processor or processing function 101 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 101 includes one or more of the following sub-parts. Sub-part 1011 is a processing part that can be used as a part for receiving configuration information. Part 1011 can be configured to perform according to Figure 8 In addition, the processor or processing circuit or function 101 may include a sub-portion 1012 that can be used as a portion for sending a request. Portion 1012 may be configured to perform according to Figure 8 In addition, the processor or processing circuit or function 101 may include a sub-portion 1013 that can be used as a portion for receiving an access token. Portion 1013 may be configured to perform according to Figure 8 In addition, the processor or processing circuit or function 101 may include a sub-section 1014 that can be used as a section for requesting data. Section 1014 may be configured to perform according to Figure 8 The S840 is processed.

[0309] Fig.12 A diagram showing a network element or network function 20 (such as UE2) according to some examples of embodiments, which performs an authorization process as a producer element or function, such as in conjunction with Figure 3 and Figure 4 As described. It should be noted that the network element or function 20, such as UE2, may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof, such as hardware, software, firmware, one or more processors and / or circuit systems.

[0310] Fig.12The producer UE2 20 shown may include a processing circuit, a processing function, a control unit or a processor 201, such as a CPU or the like, which is suitable for executing instructions given by a program or the like related to a control process. The processor 201 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided in one or more further processors, processing functions or processing parts, as an example, such as in one physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 202 and 203 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 201. The I / O unit 202 may be used to communicate with a communication network (such as PLMN1 or PLMN2). The I / O unit 203 may be used to communicate directly with another UE (such as UE1) via D2D or the like. The I / O units 202 and 203 may be a combined unit including communication devices toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 204 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 201 and / or as working storage for the processor or processing function 201. It should be noted that the memory 204 may be implemented by using one or more memory portions of the same or different types of memory.

[0311] The processor or processing function 201 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 201 includes one or more of the following sub-parts. Sub-part 2011 is a processing part that can be used as a part for receiving configuration information. Part 2011 can be configured to perform according to Fig. 9 In addition, the processor or processing circuit or function 201 may include a sub-portion 2012 that can be used as a portion for receiving a request. Portion 2012 may be configured to perform according to Fig. 9 In addition, the processor or processing circuit or function 201 may include a sub-portion 2013 that can be used as a portion for determining the verification. Portion 2013 may be configured to perform according to Fig. 9 In addition, the processor or processing circuit or function 201 may include a sub-portion 2014 that can be used as a portion for providing data. Portion 2014 may be configured to perform according to Fig. 9 The S940 is processed.

[0312] Fig.13A flowchart showing the processing performed in a control entity (such as a 5GC network element or function, a RAN element or function, or a UDM) according to some examples of the embodiments, which performs an authorization process as a control entity, such as in combination with Figure 5 and Figure 6 described. That is, Fig.13 Shown by Figure 1 or Figure 2 The control entity may include or be included in one of a core network control element or a core network control function, an access network control element or an access network control function. For example, the control entity includes or is included in a UDM entity.

[0313] In S1310, an authorization policy for each UE is defined in a control entity. For example, an authorization policy generally indicates which data is allowed to be accessed by which user equipment.

[0314] In S1320, an authorization policy is configured to one or more UEs (e.g., UE1 and UE2) by pushing authorization policy information to a network element or network function, and one or more user equipment (i.e., at least a producer element or producer function, such as UE2). The information indicates permission for a connection between a requester UE and a producer element or producer function (e.g., UE2) with a valid access token or without an access token.

[0315] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0316] Specifically, according to some examples of the embodiments, the data indicated in the authorization policy includes at least one or more of the following items: an AIML model ID, an AIML event ID, or a data subject ID. The UE that is allowed to access the data is identified by at least one of the following items: a predefined list of UEs, an indication of a specified area (e.g., a geographic area) where the UE is located, an indication of the communication network (PLMN) to which the UE belongs, or an indication that any UE is allowed.

[0317] In S1330 , the control entity receives a request for authorization of a requestor UE to access specified data from a producer element or a producer function.

[0318] According to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0319] Furthermore, according to an example of an embodiment, a request for authorization of a requester UE is received from one of the requester UEs (corresponding to Figure 5 , i.e. the control entity is located in PLMN 1), or from a control network element or control network function (corresponding to a control entity in another communication network) of another communication network. Figure 6 , i.e. the control entity is located in PLMN 2) is received.

[0320] In S1340 , the request for authorization of the requester UE is processed to determine whether the request is allowed.

[0321] According to an example of an embodiment, when processing a request for authorization of a requester UE, it is decided whether to allow the request based on operator policy and subscription data of a producer element or producer function.

[0322] Furthermore, according to an example of an embodiment, in case the request is allowed, the requester UE is authorized to access the specified data from the producer element or producer function, for example by sending a corresponding OK indication.

[0323] In this connection, according to an example of embodiment, information related to a producer element or producer function (eg UE2) is provided together with an indication of authorization.

[0324] Furthermore, according to an example of an embodiment, it is checked whether the authorization policy information pushed to the network element, network function or user equipment as a producer element or producer function is sufficient for the specified data indicated in the request for authorization. In the case where it is determined that the authorization policy information pushed to the network element, network function or user equipment as a producer element or producer function is insufficient for the specified data, an update process is performed, wherein the authorization policy information in the network element, network function or user equipment as a producer element or producer function is updated so as to be able to process the request for the specified data.

[0325] According to an example of an embodiment, the authorization policy information includes at least one of the following items: the ID of the requesting source UE, the ID of the producer element or producer function of the requested data, the ID of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

[0326] Furthermore, according to an example of an embodiment, when a request for authorization of a requester UE is received, it is checked whether a unique temporary ID of a producer element or producer function is included in the request, wherein the unique temporary ID indicates a relationship with another communication network (e.g. PLMN2), for example, as combined with Figure 6 As described. In the case where the determination is positive, the request for authorization of the requester UE is forwarded to the control network element or control network function (i.e., the corresponding control entity) of the other communication network (PLMN2) to obtain an access token. When the access is allowed by the control network element or control network function of the other communication network, the permission is indicated to the requester UE.

[0327] According to an example of embodiment, the unique temporary identifier is configured in the producer element or producer function by a controlling network element or controlling network function of the corresponding PLMN, or it is generated by the producer element or producer function itself.

[0328] Fig.14 A flowchart showing the processing performed in a requester UE (such as UE1) of an authorization process according to some examples of the embodiments, such as in conjunction with Figure 5 and Figure 6 described. That is, Fig.14 Shown by Figure 1 or Figure 2 Flowchart related to the processing performed by the requester UE of PLMN1.

[0329] In S1410, configuration information about an authorization policy is received from a controlling network element or a controlling network function. The policy information indicates permission for a connection between a requester UE and a producer element or a producer function (eg, UE2).

[0330] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0331] According to an example of an embodiment, the authorization policy information includes at least one of the following items: the ID of the requesting source UE, the ID of the producer element or producer function of the requested data, the ID of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

[0332] In S1420 , a request for authorization to access specified data from a producer element or producer function is sent to a controlling network element or controlling network function (eg, a controlling entity of PLMN1 ).

[0333] According to an example of an embodiment, the producer element or producer function indicated in the request for authorization to access specified data is one of a producer UE, or a producer communication network element, or a producer communication network function (such as a RAN or 5GC, etc.).

[0334] Furthermore, according to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0335] Furthermore, according to an example of an embodiment, the request for authorization comprises an identification of a producer element or a producer function.

[0336] In S1430 , in response to the request for authorization, the requester UE receives an indication of permission to access designated data from the producer element or producer function.

[0337] According to an example of embodiment, the indication of authorization also includes information related to the producer element or producer function (eg UE2).

[0338] In S1440 , after receiving the indication of allowing access to the specified data from the producer element or producer function in S1403 , the requester UE sends a request to the producer element or producer function to be provided with the specified data.

[0339] According to a further example of the embodiment, Figure 6 As described, a unique temporary ID assigned for protecting privacy in D2D communication is obtained. The unique temporary ID is received from a control entity or generated in a requester UE. The unique temporary ID is indicated in a request for authorization to access specified data available at a producer element or producer function identified by a unique temporary identifier.

[0340] In addition, according to an example of the embodiment, as combined with Figure 6 As described, the requester UE receives a unique temporary ID of the producer element or producer function from which the specified data will be obtained, and the unique temporary ID is used to protect privacy in D2D communication. In the request for authorization to access the specified data sent in S1420, the unique temporary ID is indicated as the identification of the producer element or producer function.

[0341] According to an example of an embodiment, in response to the request in S1440 , the requested designated data is received from the producer element or the producer function.

[0342] Fig.15A flowchart showing the processing performed in a producer element or producer function (i.e., a producer UE (e.g., UE2) or a producer communication network element or producer communication network function (such as a RAN or 5GC element or function)) performing an authorization process according to some examples of the embodiments, as shown in combination with Figure 5 and Figure 6 described. That is, Fig.15 Shown by Figure 1 or Figure 2 Flowchart related to the processing performed by the producer UE2 of PLMN1 or PLMN 2.

[0343] In S1510, configuration information about an authorization policy is received from a controlling network element or a controlling network function. The information includes authorization policy information indicating permission for a connection between a requester user device and a producer element or a producer function.

[0344] According to an example of an embodiment, the data allowed to be accessed related to the authorization policy and the specified data requested to be accessed relate to data related to the AIML service. In this case, the one or more UEs configured with the authorization policy are, for example, UEs signed to use one or more AIML services.

[0345] In S1520 , a request for designated data to be provided from a producer element or producer function is received from a requester UE (eg, UE1 ).

[0346] According to an example of an embodiment, the specified data indicated in the request for authorization of the requester UE includes at least one of the following items: AIML model data, AIML training data, or AIML analysis data.

[0347] According to a further example of embodiment, it is also possible that updates to the authorization policy information are received from a controlling network element or a controlling network function.

[0348] In S1530, the validity of the request of S1520 is determined based on the received authorization policy information (ie, the initially received or updated authorization policy).

[0349] According to an example of an embodiment, the authorization policy information includes at least one of the following items: the ID of the requesting source UE, the ID of the producer element or producer function of the requested data, the ID of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

[0350] In S1540, if the validity of the request is confirmed, the requested specified data is sent to the requester UE.

[0351] According to a further example of the embodiment, Figure 6 As described, a unique temporary ID assigned to protect privacy in D2D communication is obtained. The unique temporary ID is received from a control entity, or generated in a producer element or producer function. The unique temporary ID is indicated to a requester UE attempting to access specified data.

[0352] Fig.16 A diagram of a network element or network function 400 (such as a 5GC network element or function, a RAN element or function, or a UDM) according to some examples of embodiments is shown, which performs an authorization process as a control entity, such as in conjunction with Figure 5 and Figure 6 As described. It should be noted that the network element or function 400, such as the UDM as a control entity, may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof, such as hardware, software, firmware, one or more processors and / or circuit systems.

[0353] Fig.16The control entity 400 shown may include processing circuits, processing functions, control units or processors 401, such as CPUs, etc., which are suitable for executing instructions given by programs related to the control process, etc. Processor 401 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided in one or more further processors, processing functions or processing parts, as an example, such as in a physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 402 and 403 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 401. I / O unit 402 may be used to communicate with a network part. I / O unit 403 may be used to communicate with a UE (such as UE1 or UE2). I / O units 402 and 403 may be a combined unit including a communication device toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 404 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 401 and / or as working storage for the processor or processing function 401. It should be noted that the memory 404 may be implemented by using one or more memory portions of the same or different types of memory.

[0354] The processor or processing function 401 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 401 includes one or more of the following sub-parts. Sub-part 4001 is a processing part that can be used as a part for defining an authorization policy. Part 4001 can be configured to perform processing according to Fig.13 In addition, the processor or processing circuit or function 401 may include a sub-portion 4002 that can be used as a portion for configuring the authorization policy. Portion 4002 may be configured to execute according to Fig.13 In addition, the processor or processing circuit or function 401 may include a sub-portion 4003 that can be used as a portion for receiving a request. Portion 4003 may be configured to perform according to Fig.13 In addition, the processor or processing circuit or function 401 may include a sub-portion 4004 that can be used as a portion for processing the request. Portion 4004 may be configured to perform according to Fig.13 Processing of S1340.

[0355] Fig.17 A diagram showing a network element or network function 500 (such as UE1) according to some examples of embodiments, which performs an authorization process as a requester UE, such as in conjunction with Figure 5 and Figure 6 As described. It should be noted that the network element or function 500, such as UE1, may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof, such as hardware, software, firmware, one or more processors and / or circuit systems.

[0356] Fig.17 The requester UE1 500 shown may include a processing circuit, a processing function, a control unit or a processor 501, such as a CPU, etc., which is suitable for executing instructions given by a program or the like related to the control process. The processor 501 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided in one or more further processors, processing functions or processing parts, as an example, such as in one physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 502 and 503 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 501. The I / O unit 502 may be used to communicate with a communication network (such as PLMN1). The I / O unit 503 may be used to communicate directly with another UE (such as UE2) via D2D, etc. The I / O units 502 and 503 may be a combined unit including communication devices toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 504 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 501 and / or as working storage for the processor or processing function 501. It should be noted that the memory 504 may be implemented by using one or more memory portions of the same or different types of memory.

[0357] The processor or processing function 501 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 501 includes one or more of the following sub-parts. Sub-part 5001 is a processing part that can be used as a part for receiving configuration information. Part 5001 can be configured to perform according to Fig.14 In addition, the processor or processing circuit or function 501 may include a sub-portion 5002 that can be used as a portion for sending a request. Portion 5002 may be configured to perform according to Fig.14In addition, the processor or processing circuit or function 501 may include a sub-portion 5003 that can be used as a portion for receiving an access indication. Portion 5003 may be configured to perform according to Fig.14 In addition, the processor or processing circuit or function 501 may include a sub-portion 5004 that can be used as a portion for requesting data. Portion 5004 may be configured to perform according to Fig.14 Processing of S1440.

[0358] Fig.18 A diagram showing a network element or network function 500 (such as UE2) according to some examples of embodiments, which performs an authorization process as a producer element or function, such as in conjunction with Figure 5 and Figure 6 As described. It should be noted that the network element or function 600, such as UE2, may include other elements or functions in addition to those described below in this document. In addition, even if a network element or function is referenced, the element or function may be another device or function with a similar task, such as a chipset, a chip, a module, an application, etc., which may also be part of the network element or attached to the network element as a separate element, etc. It should be understood that each box and any combination thereof may be implemented by various means or combinations thereof, such as hardware, software, firmware, one or more processors and / or circuit systems.

[0359] Fig.18The producer UE2 600 shown may include a processing circuit, a processing function, a control unit or a processor 601, such as a CPU or the like, which is suitable for executing instructions given by a program or the like related to a control process. The processor 601 may include one or more processing parts or functions dedicated to a specific process as described below, or the process may be run in a single processor or processing function. The part for performing such a specific process may also be provided as a discrete component, or provided within one or more further processors, processing functions or processing parts, as an example, such as in one physical processor (e.g., CPU) or in one or more physical or virtual entities. Reference numerals 602 and 603 represent input / output (I / O) units or functions (interfaces) connected to the processor or processing function 601. The I / O unit 602 may be used to communicate with a communication network (such as PLMN1 or PLMN2). The I / O unit 603 may be used to communicate directly with another UE (such as UE1) via D2D or the like. The I / O units 602 and 603 may be a combined unit including communication devices toward several entities, or may include a distributed structure with multiple different interfaces for different entities. Reference numeral 604 denotes a memory which may be used, for example, to store data and programs to be executed by the processor or processing function 601 and / or as working storage for the processor or processing function 601. It should be noted that the memory 604 may be implemented by using one or more memory portions of the same or different types of memory.

[0360] The processor or processing function 601 is configured to perform processing related to the authorization process described above. In particular, the processor or processing circuit or function 601 includes one or more of the following sub-parts. Sub-part 6011 is a processing part that can be used as a part for receiving configuration information. Part 6011 can be configured to perform according to Fig.15 In addition, the processor or processing circuit or function 601 may include a sub-portion 6012 that can be used as a portion for receiving a request. Portion 6012 may be configured to perform according to Fig.15 In addition, the processor or processing circuit or function 601 may include a sub-portion 6013 that can be used as a portion for determining the verification. Portion 6013 may be configured to perform according to Fig.15 In addition, the processor or processing circuit or function 601 may include a sub-portion 6014 that can be used as a portion for providing data. Portion 6014 may be configured to perform according to Fig.15 The S1540 is processed.

[0361] According to a further example of the embodiment, for example, a device is provided, comprising: a component configured to define an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; a component configured to configure the authorization policy for one or more user devices by providing key material that can be used to verify an access token, and information about the authorization policy, the authorization policy indicating: permission for a connection between a requester user device and a producer element or producer function with a valid access token or without an access token; a component configured to receive a request for authorization for the requester user device to access specified data from the producer element or producer function; a component configured to process the request for authorization for the requester user device to determine whether the request is allowed; and a component configured to obtain an access token for allowing access to specified data from the producer element or producer function if the request is allowed; and a component configured to send the access token to the requester user device.

[0362] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Figure 7 A component of at least one of the processes defined in the described method).

[0363] According to a further example of the embodiment, for example, a device is provided, comprising: a component configured to receive configuration information about an authorization policy from a control network element or a control network function, the configuration information comprising: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; a component configured to send a request to the control network element or the control network function for authorization to access specified data from the producer element or the producer function; a component configured to receive an access token for allowing access to specified data from the producer element or the producer function in response to the request; and a component configured to send a request to the producer element or the producer function for being provided with specified data, wherein the received access token is included in the request.

[0364] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Figure 8 A component of at least one of the processes defined in the described method).

[0365] According to a further example of the embodiment, for example, a device is provided, comprising: a component configured to receive configuration information about an authorization policy from a control network element or a control network function, the configuration information including: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; a component configured to receive a request for specified data to be provided from a producer element or a producer function from a requester user device, wherein the request includes an access token for allowing access to the specified data from the producer element or the producer function; a component configured to determine the validity of a received access token; and a component configured to send the requested specified data to the requester user device if the validity of the access token is confirmed.

[0366] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Fig. 9 A component of at least one of the processes defined in the described method).

[0367] According to a further example of the embodiment, for example, a device is provided, comprising: a component configured to define an authorization policy for each user device, the authorization policy indicating which data is allowed to be accessed by which user device; a component configured to configure the authorization policy by pushing authorization policy information to a network element or a network function and one or more user devices, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; a component configured to receive a request for authorization for a requester user device to access specified data from a producer element or a producer function; and a component configured to process a request for authorization for a requester user device to decide whether the request is allowed.

[0368] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Fig.13 A component of at least one of the processes defined in the described method).

[0369] According to a further example of an embodiment, for example, a device is provided, comprising: a component configured to receive authorization policy information from a control network element or a control network function, the authorization policy information indicating permission for a connection between a requester user device and a producer element or a producer function; a component configured to send a request for authorization to access specified data from the producer element or the producer function to the control network element or the control network function; a component configured to receive an indication of permission to access the specified data from the producer element or the producer function in response to the request; and a component configured to send a request to the producer element or the producer function for being provided with the specified data after receiving the indication of permission to access the specified data from the producer element or the producer function.

[0370] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Fig.14 A component of at least one of the processes defined in the described method).

[0371] According to a further example of the embodiment, for example, a device is provided, comprising: a component configured to receive authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; a component configured to receive a request for specified data to be provided from the producer element or the producer function from the requester user device; a component configured to determine the validity of the request based on the received authorization policy information; and a component configured to send the requested specified data to the requester user device if the validity of the request is confirmed.

[0372] In addition, according to some other examples of the embodiments, the apparatus defined above may also include a method for performing the method described above (for example, according to the combination of Fig.15 A component of at least one of the processes defined in the described method).

[0373] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy for one or more user devices by providing key material that can be used to verify an access token, and information about the authorization policy, the authorization policy indicating: permission for a connection between a requester user device and a producer element or producer function with a valid access token or without an access token; receiving a request for authorization for the requester user device to access specified data from the producer element or producer function; processing the request for authorization for the requester user device to determine whether the request is allowed; and if the request is allowed, obtaining an access token for allowing access to specified data from the producer element or producer function; and sending the access token to the requester user device.

[0374] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information including: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; sending a request to the control network element or the control network function for authorization to access specified data from the producer element or the producer function; in response to the request, receiving an access token for allowing access to specified data from the producer element or the producer function; and sending a request to the producer element or the producer function for data provided with the specified data, wherein the received access token is included in the request.

[0375] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: receiving configuration information about an authorization policy from a control network element or a control network function, the configuration information including: key material that can be used to verify an access token, and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token; receiving a request from a requester user device for specified data to be provided from a producer element or a producer function, wherein the request includes an access token for allowing access to specified data from the producer element or the producer function; determining the validity of the received access token; and if the validity of the access token is confirmed, sending the requested specified data to the requester user device.

[0376] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: defining an authorization policy for each user device, the authorization policy indicating: which data is allowed to be accessed by which user device; configuring the authorization policy by pushing authorization policy information to a network element or a network function and one or more user devices, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; receiving a request for authorization for a requester user device to access specified data from a producer element or a producer function; processing the request for authorization for the requester user device to determine whether the request is allowed.

[0377] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; sending a request to the control network element or the control network function for authorization to access specified data from the producer element or the producer function; in response to the request, receiving an indication allowing access to the specified data from the producer element or the producer function; and after receiving the indication allowing access to the specified data from the producer element or the producer function, sending a request to the producer element or the producer function for data provided with the specified data.

[0378] According to a further example of the embodiment, for example, a non-transitory computer-readable medium is provided, which includes program instructions for causing an apparatus to perform processing, the processing including: receiving authorization policy information from a control network element or a control network function, the authorization policy information indicating: permission for a connection between a requester user device and a producer element or a producer function; receiving a request for specified data to be provided from the producer element or the producer function from the requester user device; determining the validity of the request based on the received authorization policy information; and if the validity of the request is confirmed, sending the requested specified data to the requester user device.

[0379] It should be understood that

[0380] - The access technology via which services are transmitted to and from entities in the communication network may be any suitable existing or future technology, such as WLAN (Wireless Local Access Network), WiMAX (Worldwide Interoperability for Microwave Access), LTE, LTE-A, 5G, Bluetooth, infrared, etc.; in addition, embodiments may also apply wired technology, for example, IP-based access technology, such as a wired network or a fixed line;

[0381] - embodiments suitable for being implemented as software code or part thereof, and running using a processor or processing function, are independent of software code, and may be specified using any known or future developed programming language, such as a high-level programming language, such as objective-C, C, C++, C#, Java, Python, Javascript, other scripting languages, etc.; or a low-level programming language, such as machine language or assembly language;

[0382] - the implementation of the embodiments is hardware independent and can be implemented using any known or future developed hardware technology or any mixture of these technologies, such as a microprocessor or CPU (Central Processing Unit), MOS (Metal Oxide Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BiCMOS (Bipolar CMOS), ECL (Emitter Coupled Logic) and / or TTL (Transistor-Transistor Logic);

[0383] - embodiments may be implemented as separate devices, means, units, components or functions, or in a distributed manner, for example, one or more processors or processing functions may be used or shared in a process, or one or more processing portions or processing portions may be used and shared in a process, where one physical processor, or more than one physical processor may be used to implement one or more processing portions dedicated to a specific process as described;

[0384] - the device may be implemented by a semiconductor chip, a chipset, or a (hardware) module including such a chip or chipset;

[0385] - the embodiments may also be implemented as any combination of hardware and software, such as ASIC (Application Specific IC (Integrated Circuit)) components, FPGA (Field Programmable Gate Array) or CPLD (Complex Programmable Logic Device) components, or DSP (Digital Signal Processor) components;

[0386] The embodiments may also be implemented as a computer program product, including a computer usable medium having computer readable program code embodied therein, the computer readable program code being adapted to execute the processes as described in the embodiments, wherein the computer usable medium may be a non-transitory medium.

[0387] Although the present disclosure has been described herein before with reference to specific embodiments of the present disclosure, the present disclosure is not limited thereto and various modifications may be made thereto.

Claims

1. A device for communication, comprising: at least one processor, and at least one memory, the at least one memory being configured to store instructions, which when executed by the at least one processor, cause the apparatus to at least perform: For each user device, an authorization policy is defined, which indicates: which data is allowed to be accessed by which user device, configuring an authorization policy for one or more user devices by providing key material that can be used to validate an access token, and information about the authorization policy indicating permission for a connection between a requester user device and a producer element or producer function with a valid access token or without an access token, receiving a request for authorization for a requestor user device to access specified data from a producer element or producer function, processing the request for authorization of the requestor user device to determine whether the request is allowed, and obtaining an access token for allowing access to the specified data from the producer element or producer function if the request is allowed, and The access token is sent to the requester user device.

2. The apparatus according to claim 1, wherein the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed relate to data related to an artificial intelligence machine learning (AIML) service, and wherein the one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services.

3. The apparatus according to claim 1 or 2, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: In order to provide the key material and the information about the authorization policy, one of non-access stratum NAS signaling or user parameter provision signaling is used for transmission to the one or more user equipments.

4. The apparatus according to any one of claims 1 to 3, wherein the data indicated in the authorization policy comprises at least one or more of the following items: AIML model identifier, AIML event identifier, or Data subject identifier, The user device that is allowed to access the data is identified by at least one of the following items: A predefined list of user devices, an indication of a specified area in which the user equipment is located, an indication of the communications network to which the user equipment belongs, or An indication of any user equipment that is allowed.

5. The apparatus according to any one of claims 1 to 4, wherein the request for authorization of the requester user equipment is received from one of the requester user equipments, or from a controlling network element or a controlling network function of another communication network.

6. The apparatus according to any one of claims 1 to 5, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: Indicating, using the access token sent to the requester user device, information indicating at least one of the following: information identifying at least one producer element or producer function for prompting the requester user device to contact only the identified producer element or producer function as a target for requesting the specified data, or Information indicating a specified data resource, used to prompt the requester user device to request the indicated resource only from a suitable producer element or producer function, wherein The access token is a universal access token.

7. The apparatus according to any one of claims 1 to 6, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: determining, when receiving said request for authorization of said requestor user equipment, whether a unique temporary identifier of a producer element or producer function associated with another communication network is included, and in case the determination is positive, forwarding the request for authorization of the requester user equipment to a controlling network element or a controlling network function of another communication network to obtain the access token, receiving the access token from the control network element or control network function of another communication network, and The received access token is sent to the requester user device.

8. The apparatus of claim 7, wherein the unique temporary identifier: configured in said producer element or producer function by a control network element or control network function, or Generated by the producer element or producer function.

9. The apparatus according to any one of claims 1 to 7, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: generating said access token for allowing access to said specified data from said producer element or producer function when said processing of said request for authorization of said requestor user device is determined to be permitted, and The generated access token is sent to the requester user device.

10. The apparatus according to any one of claims 1 to 9, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: To process the request for authorization of the requester user equipment, a decision is made based on operator policy and subscription data of the producer element or producer function whether the request is allowed.

11. The apparatus according to any one of claims 1 to 10, wherein the access token comprises at least one of the following: An identification of the source user device of the request, an identification of the producer element or producer function of the requested data, an identification of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

12. The apparatus according to any one of claims 1 to 11, wherein the access token is signed by a private key, wherein the key material is a corresponding public key for verifying the access token at the producer element or producer function.

13. The apparatus according to any one of claims 1 to 12, wherein the specified data indicated in the request for authorization of the requester user equipment comprises at least one of the following: AIML model data, AIML training data, or AIML analyzes data.

14. An apparatus according to any one of claims 1 to 13, wherein the request for authorization of the requestor user equipment comprises an identification of a producer element or producer function.

15. The apparatus according to any one of claims 1 to 14, wherein the apparatus comprises or is included in one of a core network control element or a core network control function, an access network control element or an access network control function, or The device comprises a unified data management entity, or is included in a unified data management entity.

16. An apparatus for communication, comprising: at least one processor, and at least one memory, the at least one memory being configured to store instructions, which when executed by at least one processor, cause the apparatus to at least perform: receiving configuration information about an authorization policy from a controlling network element or a controlling network function, the configuration information including key material that can be used to verify an access token and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token, sending a request to the control network element or control network function for authorization to access specified data from the producer element or producer function, receiving, in response to the request, an access token for allowing access to the specified data from the producer element or producer function, and A request provided with the specified data is sent to the producer element or producer function, wherein the received access token is included in the request.

17. An apparatus according to claim 16, wherein the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed relate to data related to artificial intelligence machine learning (AIML) services, and wherein the one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services.

18. The apparatus of claim 16 or 17, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: The key material and the information about the authorization policy are received for transmission from the controlling network element or controlling network function by using one of non-access stratum (NAS) signaling or user parameter provision signaling.

19. An apparatus according to any one of claims 16 to 18, wherein the producer element or producer function indicated in the request for authorization to access the specified data is one of a producer user device, or a producer communication network element, or a producer communication network function.

20. The device according to any one of claims 16 to 19, wherein: The access token received from the control network element or control network function includes information indicating at least one of the following: information identifying at least one producer element or producer function for prompting to contact only the identified producer element or producer function that is the target for requesting the specified data, or Information indicating a designated data resource is used to prompt that the indicated resource is requested only from a suitable producer element or producer function, wherein the access token is a general access token.

21. The apparatus according to any one of claims 16 to 20, wherein the specified data indicated in the request for authorization comprises at least one of the following: AIML model data, AIML training data, or AIML analyzes data.

22. An apparatus according to any one of claims 16 to 21, wherein the request for authorisation comprises an identification of a producer element or producer function.

23. The apparatus of any one of claims 16 to 22, wherein the access token comprises at least one of the following: An identification of the source user device of the request, an identification of the producer element or producer function of the requested data, an identification of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

24. An apparatus according to any one of claims 16 to 23, wherein the access token is signed by a private key, wherein the key material is a corresponding public key for verifying the access token at the producer element or producer function.

25. The apparatus of any one of claims 16 to 24, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: obtaining a unique temporary identifier assigned for protecting privacy in device-to-device communications, wherein The unique temporary identifier is received from the control network element or control network function, or The unique temporary identifier is generated, wherein said unique temporary identifier is indicated in said request for authorization to access said specified data available at said producer element or producer function identified by the unique temporary identifier.

26. The apparatus of any one of claims 16 to 25, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: receiving, from a producer element or producer function from which the specified data is to be obtained, a second unique temporary identifier of the producer element or producer function, the second unique temporary identifier being assigned for protecting privacy in device-to-device communications, and In said request for authorization to access said specified data, said second unique temporary identifier is indicated as an identification of said producer element or producer function.

27. The apparatus of any one of claims 16 to 26, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: The received access token is stored.

28. The apparatus of any one of claims 16 to 27, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: After receiving a query for presenting the access token from the producer element or producer function, the request for authorization to access specified data is sent to the control network element or control network function.

29. The apparatus of any one of claims 16 to 28, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: The requested specified data is received from the producer element or producer function.

30. An apparatus for communication, comprising: at least one processor, and at least one memory, the at least one memory being configured to store instructions, which when executed by the at least one processor, cause the apparatus to at least perform: receiving configuration information about an authorization policy from a controlling network element or a controlling network function, the configuration information including key material that can be used to verify an access token and information indicating permission for a connection between a requester user device and a producer element or a producer function with a valid access token or without an access token, receiving, from a requestor user device, a request for specified data to be provided from a producer element or producer function, wherein the request includes: an access token for allowing access to the specified data from the producer element or producer function, determining the validity of the received access token, and If the validity of the access token is confirmed, the requested specified data is sent to the requester user device.

31. An apparatus according to claim 30, wherein the data allowed to be accessed in association with the authorization policy and the specified data requested to be accessed relate to data related to artificial intelligence machine learning (AIML) services, wherein the one or more user devices configured with the authorization policy are user devices signed to use one or more AIML services.

32. The apparatus of claim 31 , wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: The key material and the information about the authorization policy are received for transmission from the controlling network element or controlling network function by using one of non-access stratum (NAS) signaling or user parameter provision signaling.

33. The apparatus according to any one of claims 30 to 32, wherein the specified data indicated in the request comprises at least one of the following: AIML model data, AIML training data, or AIML analyzes data.

34. The apparatus of any one of claims 30 to 33, wherein the access token comprises at least one of the following: An identification of the source user device of the request, an identification of the producer element or producer function of the requested data, an identification of the communication network where the producer element or producer function of the requested data is located, or an indication of the connection type used to obtain the requested data from the producer element or producer function.

35. An apparatus according to any one of claims 30 to 34, wherein the access token is signed by a private key, wherein the key material is a corresponding public key for verifying the access token at the producer element or producer function.

36. The apparatus of any one of claims 30 to 35, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: obtaining a unique temporary identifier assigned for protecting privacy in device-to-device communications, wherein The unique temporary identifier is received from a control network element or a control network function, or The unique temporary identifier is generated, The unique temporary identifier is indicated to a requestor user device attempting to access specified data.

37. An apparatus according to any one of claims 30 to 36, wherein the instructions, when executed by the at least one processor, cause the apparatus to at least perform: A query is sent to the requestor user device to present an access token.

38. An apparatus according to any one of claims 30 to 37, wherein the apparatus includes the producer element or producer function, or is included in the producer element or producer function, and wherein the producer element or producer function is one of a producer user device, a producer communication network element, or a producer communication network function.

Images