Processing of missing claimed access tokens

Abstract

A method implemented at a network function service producer (NFp) is provided. The method includes receiving a service request from a network function service consumer (NFc) to access a service provided by the NFp. The request includes an access token that declares one or more access authorizations that claim and represent access authorizations published to the NFc. The method includes performing verification of the access token in which it is determined that at least one claim is missing from one or more claims declared by the access token. And based on the verification, the method includes sending an error response to the NFc indicating that the service request is denied and indicating the at least one missing claim. A corresponding method implemented at the NFc is also provided.

Description

Technical Field

[0001] The present disclosure relates generally to telecommunications, and in particular, to security procedures, such as authorization procedures, in telecommunications systems. Background Art

[0002] A telecommunications system can be considered as a facility that enables communication sessions between two or more entities (e.g., user terminals, base stations, and / or other nodes) by providing a carrier between the various entities involved in the communication path. A telecommunications system can be provided, for example, via a communication network and one or more compatible communication equipment. A communication session can include, for example, the communication of data used to carry communications (such as voice, video, electronic mail (email), text messages, multimedia, and / or content data). Non-limiting examples of services provided include two-way or multi-way calls, data communications or multimedia services, and access to data network systems (e.g., the Internet).

[0003] In a wireless telecommunications system, at least a portion of a communication session between at least two stations occurs over a wireless link. Examples of wireless systems include public land mobile networks (PLMNs), satellite-based communication systems, and various wireless local area networks, such as wireless local area networks (WLANs). Some wireless systems can be divided into cells and are therefore often referred to as cellular systems.

[0004] A user can access the telecommunications system through appropriate communication equipment or terminals. A user's communication equipment may be referred to as user equipment (UE) or user equipment. The communication equipment has appropriate signal receiving and transmitting means to enable communications, such as accessing a communication network or communicating directly with other users. The communication equipment can access a carrier provided by a site (e.g., a base station in a cell) and send and / or receive communications over the carrier.

[0005] Telecommunication systems and associated equipment typically operate according to a given standard or specification that sets out what the various entities associated with the system are allowed to do and how it should be done. The communication protocols and / or parameters that should be used for the connection are also typically defined. One example of a telecommunication system is the Universal Mobile Telecommunications System (UMTS). Other examples of telecommunication systems are Long Term Evolution (LTE), Advanced LTE, and so-called 5G or New Radio (NR) networks. NR is standardized by the Third Generation Partnership Project (3GPP). Summary of the Invention

[0006] Example embodiments of the present disclosure are directed to telecommunications, and in particular, to security procedures, such as authorization procedures, in telecommunications systems.The present disclosure includes, but is not limited to, the following example embodiments.

[0007] Some example embodiments provide an apparatus for implementing a network function service producer (NFp), the apparatus comprising: at least one memory configured to store instructions; at least one processing circuit configured to access the at least one memory and execute the instructions to cause the apparatus to at least perform the following operations: receive a service request from a network function service consumer (NFc) for accessing a service provided by the NFp, the request including an access token asserting one or more claims and indicating access authorization issued to the NFc; perform validation of the access token, in which validation, it is determined that at least one claim is missing from the one or more claims asserted by the access token; and, based on the validation, send an error response to the NFc indicating that the service request is denied and indicating the at least one missing claim.

[0008] Some example embodiments provide an apparatus for implementing a network function service producer (NFp), the apparatus comprising: means for receiving, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request comprising an access token asserting one or more claims and indicating access authorization issued to the NFc; means for performing validation of the access token, in which validation it is determined that at least one claim is missing from the one or more claims asserted by the access token; and means for sending, to the NFc, an error response indicating that the service request is denied and indicating the at least one missing claim, based on the validation.

[0009] Some example embodiments provide a method implemented at a network function service producer (NFp), the method comprising: receiving, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and representing access authorization issued to the NFc; performing validation of the access token, in which validation it is determined that at least one claim is missing from the one or more claims asserted by the access token; and sending, based on the validation, an error response to the NFc indicating that the service request is denied and indicating the at least one missing claim.

[0010] Some example embodiments provide a computer-readable storage medium implemented at a network function service producer (NFp), the computer-readable storage medium being non-transitory and having instructions stored therein that, in response to being executed by at least one processing circuit, cause an apparatus to at least perform the following operations: receive, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and indicating access authorization issued to the NFc; perform validation of the access token, in which validation it is determined that at least one claim is missing from the one or more claims asserted by the access token; and, based on the validation, send an error response to the NFc indicating that the service request is denied and indicating the at least one missing claim.

[0011] Some example embodiments provide an apparatus for implementing a network function service consumer (NFc), the apparatus comprising: at least one memory configured to store instructions; at least one processing circuit configured to access the at least one memory and execute the instructions to cause the apparatus to at least perform the following operations: send a service request for accessing a service provided by a network function service producer (NFp) to the NFp, the service request including an access token that asserts one or more claims and represents access authorization issued to the NFc; receive an error response from the NFp indicating that the service request is denied and indicating at least one claim missing from the one or more claims asserted by the access token; and retrieve a second access token based on the error response, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and the at least one missing claim.

[0012] Some example embodiments provide an apparatus for implementing a network function service consumer (NFc), the apparatus comprising: means for sending a service request for accessing a service provided by a network function service producer (NFp) to the NFp, the service request including an access token asserting one or more claims and indicating access authorization issued to the NFc; means for receiving an error response from the NFp indicating that the service request is denied and indicating at least one claim missing from the one or more claims asserted by the access token; and means for retrieving a second access token based on the error response, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and the at least one missing claim.

[0013] Some example embodiments provide a method implemented at a network function service consumer (NFc), the method comprising: sending a service request for accessing a service provided by a network function service producer (NFp) to the NFp, the service request including an access token that asserts one or more claims and represents access authorization issued to the NFc; receiving an error response from the NFp indicating that the service request is denied and indicating at least one claim missing from the one or more claims asserted by the access token; and retrieving a second access token based on the error response, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and the at least one missing claim.

[0014] Some example embodiments provide a computer-readable storage medium implemented at a network function service consumer (NFc), the computer-readable storage medium being non-transitory and having instructions stored therein that, in response to being executed by at least one processing circuit, cause an apparatus to perform at least the following operations: send a service request to a network function service producer (NFp) for accessing a service provided by the NFp, the service request including an access token asserting one or more claims and indicating access authorization issued to the NFc; receive an error response from the NFp indicating that the service request is denied and indicating at least one claim missing from the one or more claims asserted by the access token; and retrieve a second access token based on the error response, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and the at least one missing claim.

[0015] These and other features, aspects, and advantages of the present disclosure will become apparent upon reading the following detailed description in conjunction with the accompanying drawings briefly described below. The present disclosure includes any combination of two, three, four, or more features or elements listed in this disclosure, regardless of whether such features or elements are explicitly combined or otherwise listed in the specific example embodiments described herein. This disclosure is intended to be read holistically so that any separable features or elements of the present disclosure in any aspect and example embodiment thereof should be considered combinable unless the context of the present disclosure clearly dictates otherwise.

[0016] Therefore, it should be understood that this summary is provided only for the purpose of summarizing some example embodiments to provide a basic understanding of certain aspects of the disclosure. Therefore, it should be understood that the above-described example embodiments are merely examples and should not be construed as narrowing the scope or spirit of the present disclosure in any way. Other example embodiments, aspects, and advantages will become apparent from the following detailed description taken in conjunction with the accompanying drawings that illustrate, by way of example, the principles of some of the described example embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Having thus described the disclosed example embodiments in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, in which:

[0018] Figure 1 A telecommunications system including one or more public land mobile networks (PLMNs) coupled to one or more external data networks is shown according to some example embodiments of the present disclosure;

[0019] Figure 2 A telecommunications system including two PLMNs according to some example embodiments is shown;

[0020] Figure 3 and 4 is a signaling diagram for access token request and validation according to various example embodiments;

[0021] Figure 5 is a flowchart illustrating various steps in a method implemented at a network function service producer (NFp) according to some example embodiments;

[0022] Figure 6A 、 6B , 6C and 6D are flow charts illustrating steps in a method 600 implemented at a network function service consumer (NFc) according to various example embodiments;

[0023] Figure 7 An apparatus according to some example embodiments is shown. DETAILED DESCRIPTION

[0024] Certain embodiments of the present disclosure will now be described more fully herein with reference to the accompanying drawings, which illustrate some, but not all, embodiments of the present disclosure. Indeed, various embodiments of the present disclosure may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these example embodiments are provided so that this disclosure will be thorough and complete and will fully convey the scope of the disclosure to those skilled in the art. Like reference numerals refer to like elements throughout.

[0025] Unless otherwise specified or clear from the context, references to first, second, etc. should not be construed as implying a particular order. A feature described as being above another feature (unless otherwise specified or clear from the context) may be below the other feature, and vice versa; and similarly, a feature described as being to the left of another feature may be to the right, and vice versa. Furthermore, although reference may be made herein to quantitative measurements, values, geometric relationships, etc., any one or more (if not all) of these may be absolute or approximate, unless otherwise specified, to account for acceptable variations that may occur, such as variations due to engineering tolerances, etc.

[0026] As used herein, unless otherwise specified or the context clearly indicates otherwise, an "or" of a set of operands is an "inclusive or," and is therefore true if and only if one or more of the operands are true, as opposed to an "exclusive or," which is false when all of the operands are true. Thus, for example, "[A] or [B]" is true if [A] is true, or if [B] is true, or if both [A] and [B] are true. Furthermore, "a" and "an" refer to "one or more" unless otherwise specified or the context clearly indicates a singular form. Furthermore, it should be understood that the terms "data," "content," "digital content," and "information," and similar terms, are sometimes used interchangeably unless otherwise specified. The term "network" may refer to a set of interconnected computers, including clients and servers; and within a network, these computers may be interconnected directly or indirectly by various means, including through one or more switches, routers, gateways, access points, and the like.

[0027] Reference may be made herein to terminology specific to systems, architectures, etc., but it should be understood that example embodiments of the present disclosure are equally applicable to any of a variety of systems, architectures, etc. For example, reference may be made to 3GPP technologies such as Global System for Mobile Communications (GSM), UMTS, LTE, LTE-Advanced, 5G NR, 5G-Advanced, and 6G; however, it should be understood that example embodiments of the present disclosure are equally applicable to non-3GPP technologies, such as IEEE 802, Bluetooth, and Bluetooth Low Energy.

[0028] In addition, as used in this application, the term "circuitry" may refer to one or more or all of the following: (a) a purely hardware circuit implementation (e.g., an implementation solely in analog and / or digital circuitry); (b) a combination of hardware circuitry and software, such as (as applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware, and (ii) any portion of a hardware processor (including a digital signal processor) with software, software, and memory that work together to enable a device such as a mobile phone or server to perform various functions; or (c) a hardware circuit and / or processor, such as a microprocessor or portion of a microprocessor, that requires software (e.g., firmware) to operate, but in which case the software may not be present when not required for operation.

[0029] The above definition of "circuitry" applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term "circuitry" also covers an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term "circuitry" also includes, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or networking device.

[0030] Figure 1 A telecommunications system 100 is shown according to various example embodiments of the present disclosure. The telecommunications system typically includes one or more telecommunications networks. As shown, for example, the system includes one or more public land mobile networks (PLMNs) 102 coupled to one or more other external data networks 104, particularly including a wide area network (WAN) such as the Internet. Each PLMN includes a core network (CN) 106 backbone, such as the Evolved Packet Core (EPC) of LTE, the 5G Core Network (5GC), etc.; each core network and the Internet are coupled to one or more radio access networks (RANS) 108 implementing one or more radio access technologies (RATS), air interfaces, etc. As used herein, "network equipment" refers to any suitable equipment on the network side of a telecommunications network. Examples of suitable network equipment are described in more detail below.

[0031] In addition, the system includes one or more radio units that may be variously referred to as user equipment (UE) 110, terminal equipment, terminal devices, mobile stations, etc. A UE is generally a device configured to communicate with a network device or another UE in a telecommunications network. A UE may be a portable computer (e.g., a laptop, notebook, tablet), a mobile phone (e.g., a cellular phone, a smartphone), a wearable computer (e.g., a smartwatch), etc. In other examples, a UE may be an Internet of Things (IoT) device, an Industrial IoT (IIoT) device, a vehicle equipped with vehicle-to-everything (V2X) communication technology, etc. In some examples, as described by 3GPP, a UE may be a narrowband IoT (NB-IoT) device, an enhanced machine type communication (eMTC) device, a reduced capability (RedCap) device, an ambient IoT device, etc.

[0032] In operation, these UEs 110 can be configured to connect to one or more RANs 108 according to their specific radio access technology, thereby accessing a specific CN 106 of the PLMN 102 or accessing one or more external data networks 104 (e.g., the Internet). The external data network can be configured to provide Internet access, operator services, third-party services, etc. For example, the International Telecommunication Union (ITU) has classified 5G mobile network services into three categories: enhanced mobile broadband (eMBB), ultra-reliable low-latency communications (URLLC), and massive machine type communications (mMTC) or massive Internet of Things (MIoT).

[0033] Examples of radio access technologies include 3GPP radio access technologies such as GSM, UMTS, LTE, LTE-Advanced, 5G NR, 5G-Advanced, and 6G. Other examples of radio access technologies include IEEE 802 technologies such as IEEE 802.11 (Wi-Fi), IEEE 802.15 (including 802.15.1 (WPAN / Bluetooth), 802.15.4 (Zigbee), and 802.15.6 (WBAN), Bluetooth, Bluetooth Low Energy (BLE), Ultra-Wideband (UWB), and the like. In general, a radio access technology may refer to any 2G, 3G, 4G, 5G, 6G, or higher generation mobile communication technology and different versions thereof, as well as any other wireless radio access technology that may be arranged to cooperate with such mobile communication technologies to provide access to the CN 106 of a mobile network operator (MNO).

[0034] In various examples, the RAN 108 can be configured as one or more macro cells, micro cells, pico cells, femto cells, and the like. The RAN generally may include one or more radio access nodes configured to interact with the UE 110. In various examples, the radio access nodes may be referred to as base stations (BSs), access points (APs), base transceiver stations (BTSs), Node Bs (NBs), evolved NBs (eNBs), macro BSs, NBs (MNBs) or eNBs (MeNBs), home BSs, NBs (HNBs) or eNBs (HeNBs), next-generation NBs (gNBs), enhanced gNBs (en-gNBs), next-generation eNBs (ng-eNBs), and the like. The RAN may include some type of network control / management entity responsible for controlling the radio access nodes. The network control / management entity and the radio access nodes may be separate or integrated into a single device. The network control / management entity may include processing circuitry configured to perform various management functions, among other things. The processing circuitry may be associated with a memory, a computer-readable storage medium, or a database for maintaining information required for the management functions.

[0035] The RAN 108 can be centralized or distributed. In various examples, components of the RAN can be interconnected via Ethernet, Gigabit Ethernet, asynchronous transfer mode (ATM), optical fiber, dark fiber, passive wavelength division multiplexing (WDM), WDM passive optical network (WDM-PON), optical transport network (OTN), time-sensitive network (TSN), and / or any other data link layer network (which may include radio links). The RAN can be connected to the CN 106 through one or more gateways, network functions, etc.

[0036] Figure 2 A telecommunications system 200 including two PLMNs 102A and 102B is shown, according to some example embodiments of the present disclosure. As shown, each PLMN is equipped with multiple network functions (NFs), two of which are shown as NF service consumer (NFc) 202 and NF service producer (NFp) 204. A network function can refer to an operational and / or physical entity. A network function can be a specific network node or element, or a specific function or set of functions performed by one or more entities, such as a virtualized network element (VNF). A physical node can be configured to execute multiple NFs. A network function can be implemented as a network element on dedicated hardware, as a software instance running on dedicated hardware, or as a virtualized function instantiated on an appropriate platform (e.g., on a cloud infrastructure). Examples of such network functions include resource control or management functions, session management or control functions, interworking, data management or storage functions, authentication functions, or a combination of one or more of these functions.

[0037] In the context of 3GPP 5G service-based architecture (SBA), the core network NF may include one or more of the following: access and mobility management function (AMF), session management function (SMF), network slice selection function (NSSF), network exposure function (NEF), network repository function (NRF) 206, 208, unified data management (UDM), authentication server function (AUSF), policy control function (PCF), application function (AF), etc. Each of the PLMNs may also include a security edge protection proxy (SEPP) 210, 212 configured to operate as a security edge node or gateway.

[0038] In some examples, NFs can communicate with each other using representational state transfer application programming interfaces (APIs), which can be referred to as RESTful APIs. Other examples of NFs include NFs related to gaming, streaming media, or industrial process control. The telecommunications system may also include nodes from 3G or 4G node systems, such as a home subscriber server (HSS), and suitable interworking functions for protocol conversion between, for example, diameter and REST API JSON (JavaScript Object Notation). Although primarily described herein using the terminology of a 5G system, example embodiments of the present disclosure may also be applicable to other communication networks using the agents described herein, such as 4G networks and non-3GPP networks.

[0039] Although telecommunications system 200 is shown as having two PLMNs 102A, 102B, generally at least some example embodiments can be implemented in a single PLMN, which does not necessarily need to have a SEPP. In the inter-PLMN scenario, SEPPs 210, 212 are network nodes at the border of an MNO's network that can be configured to receive messages, such as Hypertext Transfer Protocol (HTTP) request messages or HTTP response messages, from a NF to apply transmission protection and forward the reformatted message to a receiving SEPP via a chain of intermediate nodes (e.g., IP Exchange (IPX) 214, 216). The receiving SEPP receives the message sent by the transmitting SEPP and forwards the message to a NF (e.g., AUSF) within its MNO network.

[0040] exist Figure 2 In the example of FIG, NFp 204 may provide NF services for NFc 202. As described above, NFc and NFp may reside in different PLMNs 102A, 102B, or NFc and NFc may reside in the same PLMN.

[0041] In some examples, a service communication proxy (SCP) 218, 220 can be deployed for indirect communication between NFs. The SCP is an intermediate network entity that facilitates indirect communication between NFc 202 and NFp 204, including routing messages, such as control plane messages between NFs. The SCP can discover and select NFp on behalf of NFc. The SCP can request an access token from NRF 206, 208 or an authorization server on behalf of NFc to access NFp services.

[0042] For NF services, direct communication can be applied between NFc 202 and NFp 204, or NF service communication can be performed indirectly through SCPs 218 and 220. In direct communication, NFc performs target NFp discovery through local configuration or via a local NRF 206 (this NRF may be referred to as NRFc). In indirect communication, NFc may delegate target NFp discovery to SCP 218. In the latter case, SCP may use parameters provided by NFc to perform target NFp discovery and / or selection, for example, by referencing one or more NRFs 206 and 208.

[0043] NF discovery and NF service discovery enable entities such as NFc 202 or SCP 218 to discover a set of NF instances and NF service instances for a specific NF service or NFp type. NFc and / or SCP may be core network entities. The NRF may include functionality for supporting NF and NF service registration, discovery, authorization, and status notification functionality. Additionally or alternatively, NRFs 206 and 208 may be configured to act as authorization servers. The NRF may maintain NF profiles of available NFp entities and their supported services. The NRF may notify subscribed NFcs or SCPs of newly registered, updated, or deregistered NFp entities and their NF services. Thus, the NRF may advise NFc entities or SCPs on where they can obtain the services they need, i.e., from which NFp entities. Generally speaking, an NRF is an example of a network support node, and an SCP is an example of an agent entity. The NRF may be separate from or co-located with the SCP, or even hosted by a service provider.

[0044] In order for the NFc 202 or SCP 218 to obtain information about the NFp and / or NF services registered or configured in the PLMN / slice, the NFc or SCP may initiate a discovery process with an NRF (such as NRF 206) based on local configuration. The discovery process may be initiated by providing the type of NFp 204 and optionally a list of specific services it is attempting to discover. The NFc or SCP may additionally or alternatively provide other service parameters, such as information related to the network slice.

[0045] It is worth noting that at least some entities or nodes, such as NFc 202, NFp 204, and NRFs 206 and 208, can play both service-consuming and service-providing roles, and their physical structures may be similar or identical. In this example, their roles in delivering specific messages or services are identified by using the prefix / suffix "c" or "p," indicating whether they are serving as service-consuming or service-producing NFs. It is worth noting that, instead of "c" and "p," "v," representing visited, and "h," representing home, can be used to refer to at least some corresponding entities in the visited and home PLMNs. In some example embodiments, the telecommunications system includes components from multiple generations of mobile communication technologies.

[0046] In some example embodiments, OAuth (Open Authorization) or another authorization framework for service authorization and / or token exchange is applied between NFc 202 and NFp 204 for the purpose of authorizing NFc to access NFp's services. In some of these example embodiments, NRFs 206, 208 or another network entity may be or function as an authorization server, such as an OAuth authorization server. NFc may be an OAuth client, and NFp may function as an OAuth resource server, and both may be configured to support the OAuth authorization framework.

[0047] Generally speaking, a network support function such as NRF 206 can also be configured to act as an authorization server and provide a cryptographic access token to NFc 202 (or SCP 218 acting on behalf of the NFc), authorizing the NFc to use the services provided by NFp 204. In this regard, the access token is a credential that the NFc can use to access the service. An example of a suitable access token is an OAuth access token, which in some further examples can be formatted as a JSON Web Token (JWT). The access token can assert a number of claims, including information used by the NFp to identify the NFc, access scope, expiration date, etc. The access token can include a unique token identifier and a cryptographic signature generated using the NRF's private key.

[0048] NFc 202 (or SCP 218) can include an access token in a service request for accessing a service provided by NFp 204, for example, in an "Authorization Bearer" header. In this regard, the purpose of the access token is to inform the NFp that the bearer of the token is authorized to access the service and perform a specific action (specified by the scope of access granted). The access token can be used as a bearer credential (and is therefore sometimes called a bearer access token) and sent in the HTTP Authorization header of an HTTP request message.

[0049] The NFp 204 can receive the service request and perform validation of the access token before allowing access to the service. The NFp can verify the validity of the cryptographic signature using the corresponding public key of the NRF 206, which the NFp can obtain in connection with registering the services it provides with the NRF. The NFp can also verify the claims declared in the access token (information used by the NFp to identify the NFc, access scope, expiration date, etc.). In some examples, this validation may include verifying whether the access token has expired according to its expiration date, which may be sufficient to enable the NFc to reuse the access token.

[0050] When verification is unsuccessful, NFp 204 can send an error response, such as an HTTP error response message including an appropriate HTTP status code. The bearer authentication scheme that carries the access token uses a WWW-Authenticate header that contains at least one challenge applicable to the requested service. The WWW-Authenticate header identifies the authentication scheme and includes a number of attribute-value pairs that carry corresponding parameters.

[0051] When NFp 204 rejects a service request without an access token or an invalid access token, NFp may send an HTTP error response message including a 401 "Unauthorized" status code. The HTTP error response message may include a WWW-Authenticate header with the authentication scheme set to "Bearer." The attribute-value pairs in the WWW-Authenticate header may include "realm" and "error" attributes. In the case of a request / response service operation, the "realm" attribute may be set to the Uniform Resource Identifier (URI) of the service for which access failed (e.g., an API URI). If the request includes an access token that NFp considers invalid (e.g., expired, malformed), the "error" attribute may be set to "invalid_token"; alternatively, if the request does not include an access token, the "error" attribute may be omitted from the WWW-Authenticate header.

[0052] When NFp 204 rejects a service request in which the access token does not include the scope required to invoke a service operation, NFp may send an HTTP error response message including a 403 "Forbidden" status code. In the case of a request / response service operation, the WWW-Authenticate header in this error response message may also set the authentication scheme to "Bearer" and the "Realm" attribute to the URI of the service to which access failed. The "Error" attribute may be set to "insufficient_scope" and the WWW-Authenticate header may include a "scope" attribute set with the scope required to access the service.

[0053] Although the error response message conveys some information about the unsuccessful access token validation, there is currently no standard framework by which the NFp 204 can communicate that it requires the access token for the service to contain certain claims, or that the access token validation failed because it omitted one or more of these claims. Simply conveying the error response message to the NFc may not solve this problem because the NFc may still cache and attempt to reuse the access token until the access token expires.

[0054] Thus, example embodiments of the present disclosure provide a framework by which NFp 204 can communicate at least one missing claim in an access token provided by NFc 202 in a service request for accessing a service provided by NFp. This framework can be backward compatible, as NFc can indicate to NFp that it supports receiving missing claim information, and NFp can determine to communicate the missing claim based on operator policy defined at NFp. According to some examples, the missing claim can be indicated in an error response to NFc, such as in a WWW-Authenticate header of an HTTP error response message. In other examples, the missing claim can be indicated in a problem details object (e.g., "ProblemDetails") in the payload of the HTTP error response message. NFc can thus be notified of the missing claim and retrieve a second access token including the missing claim from NRF 206 or another authorization server, which can then be presented to NFp to access the service.

[0055] Therefore, some example embodiments provide an NFc 202 configured to send a service request to an NFp 204 to access a service provided by the NFp. The service request includes an access token that asserts one or more claims and represents an access authorization issued to the NFc. In some examples, the service request may also include a supported feature indication indicating support for receiving missing claim information.

[0056] The NFp 204 is configured to receive the service request and perform validation of the access token, wherein it is determined that at least one claim is missing from the claims asserted by the access token. The NFp is configured to send an error response to the NFc 202 based on the validation and, in some examples, based on a supported feature indication from the NFc. The error response indicates that the service request is denied and indicates the missing claim.

[0057] As described above, in various examples, the missing claims can be indicated in a field of the WWW-Authenticate header of the HTTP error response message or in a Problem Details object in the message payload. In some examples, the error response identifies the missing claims or includes a resource identifier (e.g., a URI) for a resource that identifies the missing claims. In other examples, the error response identifies one or more required claims or includes a resource identifier (e.g., a URI) for a resource that identifies the required claims. In some of these other examples, the NFc 202 can be configured to determine the missing claims based on a comparison of the required claims with the claims declared in the access token.

[0058] NFc 202 is configured to receive an error response from NFp 204; and based on the error response, NFc is configured to retrieve a second access token asserting a plurality of claims, including the claim and the missing claim. In this regard, in some examples, NFc is configured to send an access token request to NRF 206 to request the second access token, and receive the second access token from the NRF based on the access token request. NFc can then be configured to access services provided by NFp based on the second access token.

[0059] As described above, in some examples, missing claims can be indicated in a field of the WWW-Authenticate header of the HTTP error response message. As described above, the WWW-Authenticate header can include an "error" attribute that can provide the reason why the service request was denied. In some examples, the WWW-Authenticate header can include an "error_description" attribute and / or an "error_uri" attribute, either of which can be used to convey the missing claims. As currently specified, these attributes include human-readable information; however, according to some example embodiments of the present disclosure, either or both attributes can be repurposed to indicate missing claims. In this regard, the WWW-Authenticate header can include an "error_description" attribute set to indicate the missing claims (e.g., error_description="Missing OAuth Claims: <comma-separated list of one or more claim names>"). In another example, the WWW-Authenticate header can include an "error_uri" attribute set to include the URI of a webpage or other resource indicating the missing claims. In these and other examples, the missing claim can be identified by a claim name, which can be an identifier (ID) or URI defined by 3GPP or the Internet Assigned Numbers Authority (IANA).

[0060] As described above, in some examples, the missing claim can be indicated in a problem details object in the message payload of the HTTP error response message. The problem details object can be formatted as a JSON object, for example, in accordance with the manner described in Internet Engineering Task Force (IETF) RFC 7808, "Problem Details for HTTP APIs." In some of these examples, HTTP response messages from NFp 204, including 401 (Unauthorized) and 403 (Forbidden) error response messages, can be formatted by status code to include the following appropriate content:

[0061]

[0062] And an example definition for a JSON property might include:

[0063] JsonAttributes:

[0064] type:string

[0065] description: Json attributes that usually occur in AccessTokenReq.Ex:targetSnssaiList (Description: Json attributes that usually appear in access token requests. For example: targetSnssaiList)

[0066] To further illustrate various example embodiments of the present disclosure, Figure 3 and Figure 4 300, 400 are signaling diagrams for access token request and validation according to various example embodiments. In the example shown, access to services provided by NFp 204 requires (assertion of) the S-NSSAI (Single Network Slice Selection Assistance Information) list of NFp. Figure 3 As shown, in some examples, NFc 202 receives an access token (Token-A) from NRF 206 in step 301 to use one or more services provided by NFp. NFc discovers these services without indicating an S-NSSAI list (targetSnssaiList); and therefore, the access token lacks information about the S-NSSAI of NFp.

[0067] In step 302, NFc 202 sends a service request including the access token to NFp 204, along with a supported feature indication (BitForReceivingErrOnMissingClaim) set to indicate that NFc supports receiving missing claim information. As shown in step 303, NFp performs validation of the access token, determining that the access token is missing a claim for NFp's S-NSSAI (producerSnssaiList). Therefore, in step 304, NFp rejects the service request with an HTTP error response message with status code 401 and includes an "error_description" attribute in the WWW-Authenticate header set to indicate the missing claim.

[0068] NFc 202 receives an HTTP error response message indicating the missing claim. At step 305, NFc acquires or otherwise retrieves a second token (Token-B) indicating the previously missing S-NSSAI list (targetSnssaiList). NFc then sends a service request to NFp 204 at step 306, including the second token, which includes the previously missing claim with NFp's S-NSSAI (producerSnssaiList). Then, at step 307, NFp successfully validates the second token because it includes NFp's S-NSSAI.

[0069] Figure 4 In, similar to Figure 3 In step 401, NFc 202 receives an access token (Token-A) from NRF 206 to use one or more services provided by NFp. NFc discovers these services without indicating an S-NSSAI list (targetSnssaiList); therefore, the access token lacks information about NFp's S-NSSAI. In step 402, NFc sends a service request to NFp 204, including the token and a supported feature indication (BitForReceivingErrOnMissingClaim) set to indicate that NFc supports receiving missing claim information. NFp performs validation of the access token in step 403, determining that the access token lacks a claim to NFp's S-NSSAI (producerSnssaiList).

[0070] exist Figure 4 In step 404, NFp 204 rejects the service request with an HTTP error response message having status code 401. This HTTP error response message may comply with 3GPP TS 29.500 and IETF RFC 6749 and include a message payload having a problem-details object indicating the missing claim. Similarly, similar to the previous example, NFc 202 receives the HTTP error response message indicating the missing claim; and in step 405, NFc obtains or otherwise retrieves a second token (Token-B) indicating the previously missing S-NSSAI list (targetSnssaiList). NFc sends a service request to NFp 204, including the second token, which includes the previously missing claim with NFp's S-NSSAI (producerSnssaiList). Then, in step 407, NFp successfully validates the second token because the second token includes NFp's S-NSSAI.

[0071] Figure 55 is a flowchart illustrating various steps in a method 500 implemented at a network function service producer (NFp) according to some example embodiments. The method includes receiving a service request from a network function service consumer (NFc) for accessing a service provided by the NFp, the request including an access token asserting one or more claims and indicating access authorization issued to the NFc, as shown in block 502. The method includes performing validation of the access token, wherein it is determined that at least one claim is missing from the one or more claims asserted by the access token, as shown in block 504. Based on the validation, the method includes sending an error response to the NFc indicating that the service request is denied and indicating the at least one missing claim, as shown in block 506.

[0072] In some examples, the service request includes a supported feature indication indicating support for receiving the missing claim information, and the error response is sent at block 506 based on the supported feature indication.

[0073] In some examples, the error response identifies the at least one missing claim, or includes a resource identifier of a resource that identifies the at least one missing claim.

[0074] In some examples, the error response identifies one or more required claims, or includes a resource identifier that identifies a resource for one or more required claims.

[0075] In some examples, the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0076] In some examples, the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a problem detail object of the message payload.

[0077] Figures 6A to 6D 6 is a flow chart illustrating various steps in a method 600 implemented at a network function service consumer (NFc) according to various example embodiments. The method includes sending a service request to a network function service producer (NFp) for accessing a service provided by the NFp, the service request including an access token asserting one or more claims and representing access authorization issued to the NFc, such as Figure 6AThe method includes receiving an error response from the NFp indicating that the service request is denied and indicating that at least one claim is missing from the one or more claims asserted by the access token, as shown in block 604. Based on the error response, the method includes retrieving a second access token asserting a plurality of claims including the one or more claims and the at least one missing claim, as shown in block 606.

[0078] In some examples, the service request includes a support feature indication indicating support for receiving missing claim information, and an error response is received at block 604 based on the support feature indication.

[0079] In some examples, the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0080] In some examples, the error response identifies one or more required claims, or includes a resource identifier of a resource that identifies the one or more required claims. In some of these examples, method 600 also includes determining at least one missing claim based on a comparison of the one or more required claims and the one or more claims asserted by the access token, such as Figure 6B As shown in box 608.

[0081] In some examples, the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0082] In some examples, the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a problem detail object of the message payload.

[0083] In some examples, retrieving the second access token at block 606 includes sending an access token request to a network repository function (NRF) to request the second access token, and receiving the second access token from the NRF based on the access token request, such as Figure 6C As shown in boxes 610 and 612.

[0084] In some examples, the method 600 further includes accessing a service provided by the NFp based on the second access token, such as Figure 6D As shown in box 614.

[0085] According to example embodiments of the present disclosure, telecommunications system 100 or PLMN 102 and its components, such as NFc 202, NFp 204, NRFc 218, and / or NRFp 220, can be implemented using various components. Components for implementing the system and its components may include hardware, firmware, software, or a combination thereof. In some examples, one or more devices may be configured to function as or otherwise implement the system and its components as shown and described herein. In examples involving more than one device, the various devices may be connected to or otherwise communicate with each other in a variety of different ways, such as directly or indirectly via a wired or wireless network.

[0086] According to some example embodiments, Figure 5 At least some of the described method 500 may be performed by an apparatus comprising means for performing the functions of the corresponding steps of the method. Figures 6A-6D At least some of the described method 600 may be performed by an apparatus comprising means for performing the functionality of the corresponding steps of the method. Examples of suitable apparatuses may include a network function or any suitable apparatus, such as a server, host, or node.

[0087] Figure 7 An apparatus 700 according to some example embodiments of the present disclosure is shown, wherein means for performing various functions include hardware, either alone or under the direction of one or more computer programs from a computer-readable storage medium or other memory (such as computer memory). The apparatus may include one or more of each of a number of components, such as a processing circuit 702 connected to a computer-readable storage medium or other memory 704.

[0088] The processing circuitry 702 may include one or more processors alone or in combination with one or more computer-readable storage media. A processing circuit is generally any piece of computer hardware capable of processing information (e.g., data, computer programs, and / or other suitable electronic information). The processing circuitry comprises a set of electronic circuits, some of which may be packaged as an integrated circuit or multiple interconnected integrated circuits (integrated circuits are sometimes more commonly referred to as "chips"). The processing circuitry may be configured to execute computer programs, which may be stored on the processing circuitry or otherwise stored in memory 704 (of the same or another device).

[0089] Depending on the specific embodiment, the processing circuit 702 can be a plurality of processors, a multi-core processor, or some other type of processor. In addition, the processing circuit can be implemented using multiple heterogeneous processor systems, in which a main processor and one or more auxiliary processors are present on a single chip. As another illustrative example, the processing circuit can be a symmetric multi-processor system containing multiple processors of the same type. In another example, the processing circuit can be embodied as or otherwise include one or more ASICs, FPGAs, etc. Therefore, although the processing circuit is capable of executing a computer program to perform one or more functions, the processing circuits of various examples are capable of performing one or more functions without the assistance of a computer program. In any instance, the processing circuit can be appropriately programmed to perform functions or operations according to example embodiments of the present disclosure.

[0090] Memory 704 is generally any piece of computer hardware capable of temporarily and / or permanently storing information, such as data, computer programs, instructions 706 (e.g., computer-readable program code), and / or other suitable information. Memory can include volatile and / or nonvolatile memory and can be fixed or removable. Examples of suitable memory include a recording medium, random access memory (RAM), read-only memory (ROM), a hard drive, flash memory, a thumb drive, a removable computer disk, an optical disk, or some combination thereof.

[0091] Memory 704 is a non-transient device capable of storing information. An example of a suitable memory is a computer-readable storage medium, which is different from a computer-readable transmission medium that can carry information from one location to another. Examples of suitable computer-readable transmission media include electronic carrier signals, telecommunications signals, software distribution packages, or some combination thereof. As used herein, the term "non-transient" is a limitation on the medium itself (i.e., tangible, rather than a signal), rather than a limitation on data storage persistence (e.g., RAM vs. ROM). Computer-readable media as described herein generally refers to computer-readable storage media or computer-readable transmission media. A computer-readable medium is any entity or device capable of storing and carrying information (such as one or more computer programs or portions thereof).

[0092] In addition to the memory 704 (e.g., a computer-readable storage medium), the processing circuit 702 may also be connected to one or more interfaces for displaying, sending, and / or receiving information. The interface may include a communication interface 708 and / or one or more user interfaces (e.g., a display, a user input interface). The communication interface may be configured to send and / or receive information to other devices, networks, etc. The communication interface may be configured to send and / or receive information via a physical (wired) and / or wireless communication link. Examples of suitable communication interfaces include a network interface controller (NIC), a wireless NIC (WNIC), etc.

[0093] The execution of instructions 706 by processing circuit 702 or the storage of instructions in memory 704 supports a combination of operations for implementing example embodiments of the present disclosure. In this manner, apparatus 700 may include at least one processing circuit and at least one memory coupled to the at least one processing circuit, wherein the at least one processing circuit is configured to execute instructions stored in the at least one memory. It will also be understood that one or more functions and combinations of functions may be implemented by a dedicated hardware-based computer system and / or processing circuitry that performs the specified functions, or by a combination of dedicated hardware and program code instructions.

[0094] Some example embodiments of the present disclosure may also be performed in the form of a computer process defined by one or more computer programs or parts thereof. The example embodiments of the present disclosure may be performed by running at least a portion of a computer program comprising instructions. The computer program may be in source code form, object code form, or some intermediate form. The computer program may be stored in a computer-readable medium that can be read by a computer, a processing circuit, or other suitable device. As described above, for example, the computer program may be stored in a memory (e.g., a computer-readable storage medium). Additionally or alternatively, for example, the computer program may be stored in a computer-readable transmission medium. The coding of the software for executing the example embodiments of the present disclosure is fully within the scope of those of ordinary skill in the art.

[0095] It should be understood that any suitable instructions can be loaded from a memory or computer-readable medium (e.g., a computer-readable storage medium, a computer-readable transmission medium) into a computer, a processing circuit, or other programmable device to generate a specific machine so that the specific machine becomes a component that implements the functions described herein. Instructions can also be stored in a computer-readable medium that can direct a computer, a processing circuit, or other programmable device to operate in a specific manner, thereby generating a specific machine or a specific product. In some examples, the instructions stored in the computer-readable medium can generate a product, wherein the product becomes a component that implements the functions described herein. Instructions can be retrieved from the computer-readable medium and loaded into a computer, a processing circuit, or other programmable device to configure the computer, the processing circuit, or other programmable device to perform operations to be performed on or by the computer, the processing circuit, or other encodable device.

[0096] The retrieval, loading, and execution of instructions, including program code instructions, may be performed sequentially, such that one instruction is retrieved, loaded, and executed at a time. In some example embodiments, the retrieval, loading, and / or execution may be performed in parallel, such that multiple instructions are retrieved, loaded, or executed together. The execution of the program code instructions may produce a computer-implemented process such that the instructions executed by a computer, processing circuit, or other programmable device provide operations for implementing the functionality described herein.

[0097] As stated above and reiterated below, the present disclosure includes, but is not limited to, the following example embodiments.

[0098] Article 1. An apparatus implementing a network function service producer (NFp), the apparatus comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the apparatus to at least: receive, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and indicating access authorization issued to the NFc; perform validation of the access token, in which validation, it is determined that at least one claim is missing from the one or more claims asserted by the access token; and, based on the validation, send an error response to the NFc, the error response indicating that the service request is denied and indicating the at least one missing claim.

[0099] Clause 2. The apparatus of Clause 1, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is sent based on the supported feature indication.

[0100] Clause 3. The apparatus of Clause 1 or 2, wherein the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0101] Clause 4. The apparatus of any of Clauses 1 to 3, wherein the error response identifies one or more required claims or includes a resource identifier identifying a resource of the one or more required claims.

[0102] Clause 5. The apparatus of any one of Clauses 1 to 4, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0103] Clause 6. An apparatus according to any one of Clauses 1 to 5, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question detail object of the message payload.

[0104] Article 7. An apparatus implementing a network function service producer (NFp), the apparatus comprising: means for receiving, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and representing access authorization issued to the NFc; means for performing validation of the access token, wherein at least one claim is determined to be missing from the one or more claims asserted by the access token; and means for sending, based on the validation, an error response to the NFc, the error response indicating that the service request is denied and indicating the at least one missing claim.

[0105] Clause 8. The apparatus of Clause 7, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is sent based on the supported feature indication.

[0106] Clause 9. The apparatus of Clause 7 or 8, wherein the error response identifies the at least one missing claim or includes a resource identifier identifying a resource of the at least one missing claim.

[0107] Clause 10. The apparatus of any of Clauses 7 to 9, wherein the error response identifies one or more required claims or includes a resource identifier identifying a resource of the one or more required claims.

[0108] Clause 11. The apparatus of any one of Clauses 7 to 10, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0109] Clause 12. An apparatus according to any one of Clauses 7 to 11, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question detail object of the message payload.

[0110] Article 13. A method implemented at a network function service producer (NFp), the method comprising: receiving, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and representing access authorization issued to the NFc; performing validation of the access token, wherein at least one claim is determined to be missing from the one or more claims asserted by the access token; and based on the validation, sending an error response to the NFc, the error response indicating that the service request is denied and indicating the at least one missing claim.

[0111] Clause 14. The method of clause 13, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is sent based on the supported feature indication.

[0112] Clause 15. The method of Clause 13 or 14, wherein the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0113] Clause 16. The method of any of Clauses 13 to 15, wherein the error response identifies one or more required claims or includes a resource identifier that identifies a resource of the one or more required claims.

[0114] Clause 17. The method of any one of Clauses 13 to 16, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0115] Clause 18. The method of any one of Clauses 13 to 17, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question-details object of the message payload.

[0116] Article 19. A computer-readable storage medium implemented at a network function service producer (NFp), the computer-readable storage medium being non-transitory and having instructions stored therein that, in response to execution by at least one processing circuit, cause the apparatus to at least: receive, from a network function service consumer (NFc), a service request for accessing a service provided by the NFp, the request including an access token asserting one or more claims and indicating access authorization issued to the NFc; perform validation of the access token, wherein at least one claim is determined to be missing from the one or more claims asserted by the access token; and, based on the validation, send an error response to the NFc, the error response indicating that the service request is denied and indicating the at least one missing claim.

[0117] Clause 20. The computer-readable storage medium of Clause 19, the service request comprising a supported feature indication indicating support for receiving missing claim information, and the error response is sent based on the supported feature indication.

[0118] Clause 21. The computer-readable storage medium of Clause 19 or 20, wherein the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0119] Clause 22. The computer-readable storage medium of any one of Clauses 19 to 21, wherein the error response identifies one or more required claims or includes a resource identifier that identifies a resource of the one or more required claims.

[0120] Clause 23. The computer-readable storage medium of any one of Clauses 19 to 22, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing claim is indicated in a field of the WWW-Authenticate header.

[0121] Clause 24. The computer-readable storage medium of any one of Clauses 19 to 23, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question-details object of the message payload.

[0122] Clause 25. An apparatus comprising means for performing the method of any one of Clauses 13 to 18.

[0123] Clause 26. A computer-readable medium comprising computer-readable program code that, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of Clauses 13 to 18.

[0124] Clause 27. A computer-readable storage medium comprising computer-readable program code, the computer-readable program code, in response to being executed by at least one processing circuit, causing an apparatus to perform the method of any one of Clauses 13 to 18.

[0125] Clause 28. A computer program comprising computer readable program code that, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of Clauses 13 to 18.

[0126] Article 29. An apparatus for implementing a network function service consumer (NFc), the apparatus comprising: at least one memory configured to store instructions; and at least one processing circuit configured to access the at least one memory and execute the instructions to cause the apparatus to at least: send a service request to a network function service producer (NFp) for accessing a service provided by the NFp, the service request including an access token asserting one or more claims and indicating access authorization issued to the NFc; receive an error response from the NFp, the error response indicating that the service request is denied and indicating that at least one claim is missing from the one or more claims asserted by the access token; and based on the error response, retrieve a second access token asserting a plurality of claims including the one or more claims and the at least one missing claim.

[0127] Clause 30. The apparatus of Clause 29, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is received based on the supported feature indication.

[0128] Clause 31. The apparatus of Clause 29 or 30, wherein the error response identifies the at least one missing claim or includes a resource identifier identifying a resource of the at least one missing claim.

[0129] Clause 32. The apparatus of any of Clauses 29 to 31, wherein the error response identifies one or more required claims, or includes a resource identifier identifying a resource of the one or more required claims, and wherein the at least one processing circuit is configured to execute the instructions to cause the apparatus to further determine the at least one missing claim based on a comparison of the one or more required claims with one or more claims asserted by the access token.

[0130] Clause 33. The apparatus of any one of Clauses 29 to 32, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0131] Clause 34. An apparatus according to any one of Clauses 29 to 33, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question detail object of the message payload.

[0132] Article 35. An apparatus according to any one of Articles 29 to 34, wherein the apparatus caused to retrieve the second access token includes an apparatus caused to perform the following operations: sending an access token request to a network repository function (NRF) to request the second access token; and receiving the second access token from the NRF based on the access token request.

[0133] Clause 36. The apparatus of any one of Clauses 29 to 35, wherein the at least one processing circuit is configured to execute the instructions to cause the apparatus to further access a service provided by the NFp based on the second access token.

[0134] Article 37. An apparatus implementing a network function service consumer (NFc), the apparatus comprising: means for sending a service request to a network function service producer (NFp) to access a service provided by the NFp, the service request including an access token asserting one or more claims and representing access authorization issued to the NFc; means for receiving an error response from the NFp, the error response indicating that the service request is denied and indicating that at least one claim is missing from the one or more claims asserted by the access token; and means for retrieving a second access token asserting a plurality of claims including the one or more claims and the at least one missing claim based on the error response.

[0135] Clause 38. The apparatus of Clause 37, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is received based on the supported feature indication.

[0136] Clause 39. The apparatus of Clause 37 or 38, wherein the error response identifies the at least one missing claim or includes a resource identifier identifying a resource of the at least one missing claim.

[0137] Clause 40. The apparatus of any of Clauses 37 to 39, wherein the error response identifies one or more required claims, or includes a resource identifier of a resource identifying the one or more required claims, and wherein the apparatus further comprises means for further determining the at least one missing claim based on a comparison of the one or more required claims with one or more claims asserted by the access token.

[0138] Clause 41. The apparatus of any one of Clauses 37 to 40, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0139] Clause 42. An apparatus according to any one of Clauses 37 to 41, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question detail object of the message payload.

[0140] Article 43. The apparatus of any one of Articles 37 to 42, wherein the means for retrieving the second access token comprises: means for sending an access token request to a network repository function (NRF) to request the second access token; and means for receiving the second access token from the NRF based on the access token request.

[0141] Clause 44. The apparatus of any one of Clauses 37 to 43, wherein the apparatus further comprises means for accessing a service provided by the NFp based on the second access token.

[0142] Article 45. A method implemented at a network function service consumer (NFc), the method comprising: sending a service request to a network function service producer (NFp) for accessing a service provided by the NFp, the service request including an access token asserting one or more claims and representing access authorization issued to the NFc; receiving an error response from the NFp, the error response indicating that the service request is denied and indicating that at least one claim is missing from the one or more claims asserted by the access token; and retrieving a second access token asserting a plurality of claims including the one or more claims and the at least one missing claim based on the error response.

[0143] Clause 46. The method of clause 45, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is received based on the supported feature indication.

[0144] Clause 47. The method of Clause 45 or 46, wherein the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0145] Clause 48. The method of any of Clauses 45 to 47, wherein the error response identifies one or more required claims, or includes a resource identifier of a resource that identifies the one or more required claims, and wherein the method further comprises determining the at least one missing claim based on a comparison of the one or more required claims with one or more claims asserted by the access token.

[0146] Clause 49. The method of any one of Clauses 45 to 48, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing assertion is indicated in a field of the WWW-Authenticate header.

[0147] Clause 50. The method of any one of Clauses 45 to 49, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question-details object of the message payload.

[0148] Clause 51. The method of any one of Clauses 45 to 50, wherein retrieving the second access token comprises: sending an access token request to a network repository function (NRF) to request the second access token; and receiving the second access token from the NRF based on the access token request.

[0149] Article 52. The method of any one of Articles 45 to 51, wherein the method further comprises accessing a service provided by the NFp based on the second access token.

[0150] Article 53. A computer-readable storage medium implemented at a network function service consumer (NFc), the computer-readable storage medium being non-transitory and having instructions stored therein that, in response to execution by at least one processing circuit, cause the apparatus to at least: send a service request to a network function service producer (NFp) for access to a service provided by the NFp, the service request including an access token asserting one or more claims and indicating access authorization issued to the NFc; receive an error response from the NFp, the error response indicating that the service request is denied and indicating that at least one claim is missing from the one or more claims asserted by the access token; and, based on the error response, retrieve a second access token asserting a plurality of claims including the one or more claims and the at least one missing claim.

[0151] Clause 54. The computer-readable storage medium of Clause 53, wherein the service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is received based on the supported feature indication.

[0152] Clause 55. The computer-readable storage medium of Clause 53 or 54, wherein the error response identifies the at least one missing claim or includes a resource identifier that identifies a resource of the at least one missing claim.

[0153] Clause 56. The computer-readable storage medium of any one of Clauses 53 to 55, wherein the error response identifies one or more required claims or includes a resource identifier of a resource identifying the one or more required claims, and wherein the computer-readable storage medium has further instructions stored therein that, in response to being executed by the at least one processing circuit, cause the apparatus to further determine the at least one missing claim based on a comparison of the one or more required claims with one or more claims asserted by the access token.

[0154] Clause 57. The computer-readable storage medium of any one of Clauses 53 to 56, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing claim is indicated in a field of the WWW-Authenticate header.

[0155] Clause 58. The computer-readable storage medium of any one of Clauses 53 to 57, wherein the service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question-details object of the message payload.

[0156] Article 59. A computer-readable storage medium as described in any one of Articles 53 to 58, wherein the means for causing to retrieve the second access token includes means for causing to perform the following operations: sending an access token request to a network repository function (NRF) to request the second access token; and receiving the second access token from the NRF based on the access token request.

[0157] Article 60. The computer-readable storage medium of any one of Articles 53 to 59, wherein the computer-readable storage medium stores further instructions stored therein, the further instructions, in response to being executed by the at least one processing circuit, causing the device to further access services provided by the NFp based on the second access token.

[0158] Clause 61. An apparatus comprising means for performing the method of any one of Clauses 45 to 52.

[0159] Clause 62. A computer-readable medium comprising computer-readable program code, the computer-readable program code, in response to being executed by at least one processing circuit, causing an apparatus to perform the method of any one of Clauses 45 to 52.

[0160] Clause 63. A computer-readable storage medium comprising computer-readable program code, the computer-readable program code, in response to being executed by at least one processing circuit, causing an apparatus to perform the method of any one of Clauses 45 to 52.

[0161] Clause 64. A computer program comprising computer readable program code that, in response to being executed by at least one processing circuit, causes an apparatus to perform the method of any one of Clauses 45 to 52.

[0162] With the benefit of the teachings presented in the foregoing description and the associated drawings, those skilled in the art to which the present disclosure pertains will appreciate many modifications and other embodiments of the present disclosure set forth herein. Therefore, it should be understood that the present disclosure is not limited to the specific embodiments disclosed, and modifications and other embodiments are intended to be included within the scope of the appended claims. In addition, although the foregoing description and the associated drawings describe example embodiments in the context of certain example combinations of elements and / or functions, it should be understood that different combinations of elements and / or functions may be provided by alternative embodiments without departing from the scope of the appended claims. In this regard, for example, as may be described in some of the appended claims, combinations of elements and functions different from those explicitly described above may also be considered. Although specific terms are used herein, they are used only in a general and descriptive sense, and not for purposes of limitation.

Claims

1. A device for implementing a network function service producer (NFp), the device comprising: means for receiving, from a network function service consumer NFc, a service request for accessing a service provided by said NFp, said request comprising an access token asserting one or more claims and representing an access authorization issued to said NFc; means for performing validation of the access token, wherein the validation determines that at least one claim is missing from the one or more claims asserted by the access token; and based on said verification, means for sending an error response to the NFc indicating that the service request is rejected and indicating at least one missing claim.

2. The device according to claim 1, wherein The service request includes a supported feature indication indicating support for receiving missing claim information, and the error response is sent based on the supported feature indication.

3. The device according to claim 1 or 2, wherein: The error response identifies the at least one missing claim or includes a resource identifier of a resource identified by the at least one missing claim.

4. The device according to any one of claims 1 to 3, wherein The error response identifies one or more required claims or includes a resource identifier of a resource for which the one or more required claims are identified.

5. The device according to any one of claims 1 to 4, wherein The service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the error response is formatted as an HTTP error response message including a WWW-Authenticate header, and the at least one missing claim is indicated in a field of the WWW-Authenticate header.

6. The device according to any one of claims 1 to 5, wherein: The service request is formatted as a Hypertext Transfer Protocol (HTTP) request message, the response is formatted as an HTTP response message including a message payload, and the at least one missing claim is indicated in a question detail object of the message payload.

7. A method implemented at a network function service producer (NFp), the method comprising: receiving, from a network function service consumer NFc, a service request for accessing a service provided by the NFp, the request comprising an access token asserting one or more claims and representing an access authorization issued to the NFc; performing a validation of the access token, wherein it is determined that at least one claim is missing from the one or more claims asserted by the access token; and based on said verification, An error response is sent to the NFc indicating that the service request is rejected and indicating at least one missing claim.

8. A device for implementing a network function service consumer (NFC), the device comprising: means for sending a service request to a network function service producer NFp for accessing a service provided by said NFp, said service request comprising an access token asserting one or more claims and representing an access authorization issued to said NFc; means for receiving an error response from the NFp indicating that the service request is denied and indicating at least one claim missing from the one or more claims asserted by the access token; and based on the error response, Means for retrieving a second access token, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and at least one missing claim.

9. A method implemented on a network function service consumer (NFC), the method comprising: Sending a service request to a network function service producer NFp for accessing a service provided by the NFp, the service request including an access token declaring one or more claims and indicating access authorization issued to the NFc; receiving an error response from the NFp indicating that the service request is denied and indicating at least one claim is missing from the one or more claims asserted by the access token; and based on the error response, A second access token is retrieved, the second access token asserting a plurality of claims, the plurality of claims including the one or more claims and at least one missing claim.

Images