Method for managing access to traffic policy management functions and associated devices

Abstract

The present invention relates to a method for managing access to a traffic policy management function (111) implemented by a terminal (100) connected to a telecommunications network (200), the method comprising the following steps implemented by the operating system (110) of the terminal (100): using an authorization process implemented via the telecommunications network and selected by a controller (210) of the telecommunications network (200), checking whether a computer application (120) of the terminal (100) that wishes to access the traffic policy management function (111) is authorized to invoke the function; and authorizing the computer application to access the function (111) based on the result of the check.

Description

Technical Field

[0001] This invention belongs to the general field of telecommunications. More specifically, this invention relates to a method for managing access to traffic policy management functions, a method for accessing traffic policy management functions, and a terminal configured to implement such a method.

[0002] The present invention also relates to a method for controlling access to traffic policy management functions, and a controller of a telecommunications network configured to implement the access control method.

[0003] The present invention also relates to a general method for access traffic policy management functions, and a system for access traffic policy management functions including a terminal and a controller.

[0004] This invention has particular advantages, but is by no means limited to applications in fifth-generation (5G) telecommunications networks. Background Technology

[0005] To accommodate the continuous and rapid growth of data traffic transmitted by telecommunications systems, various technologies have been implemented to improve the efficiency of telecommunications networks. These mechanisms are still being improved with the aim of achieving optimal development in the coming years.

[0006] Among the various technologies employed, "differentiated traffic processing for telecommunications networks" (hereinafter referred to as "differentiated processing") is particularly effective in preventing or managing network congestion. This congestion typically occurs when data packets traveling through the network compete with other packets also seeking access to the network's resources. Differentiated processing can also be applied to ensure compliance with service level agreements (SLAs).

[0007] In this context, various actions can be performed, such as packet ordering, selection of one or more paths to minimize transmission time, or selection of paths that guarantee a specific level of service (including security levels). More generally, differential processing includes different ways in which data packets can be processed differently from each other during routing through one or more telecommunications networks to their respective receivers. Therefore, the application areas of differential processing include classic techniques of ordering, formatting, and queue management, through which data packets are processed, for example, at nodes in the network, as well as techniques for separating and / or routing data streams through different physical or logical paths within the network.

[0008] Telecommunications network operators currently use this differentiated approach, for example, to adjust the quality of service offered to customers through subscription levels, manage large volumes of customer traffic that could lead to network congestion, prioritize the transmission of control or signaling data on the network, guarantee a certain quality of service, such as that defined within the framework of a service level agreement, or ensure a balance between signaling, voice, and multimedia data, such as guaranteeing a certain quality of experience.

[0009] To this end, operators define service policies, which include policies for classifying flows or packets, sorting policies, and / or routing policies that are typically formalized as rules.

[0010] The reality remains that these rules, defined and enforced by operators, may not necessarily suit the needs of specific terminals that wish to access particular remote applications. Specifically, these needs can depend heavily on the characteristics of the terminal, the application itself (e.g., whether it relies on voice communication, continuous video streaming, and / or the use of a web browser), and the option of having or not having subscribed to the application's administrator or provider.

[0011] Therefore, existing solutions need to be improved in traffic processing to optimize the quality of service provided and the user experience. Summary of the Invention

[0012] The purpose of this invention is to overcome all or part of the shortcomings of the prior art, particularly those set forth above, by providing a solution that allows a terminal's computer application to access traffic policy management functions and to do so under the control of a telecommunications operator.

[0013] For this purpose, and according to a first aspect, the present invention relates to a method for managing access to traffic policy management functions implemented by a terminal connected to a telecommunications network (such functions are typically exposed via a local API). The method includes the following steps implemented by the operating system of the terminal:

[0014] Using an authorization process implemented via the telecommunications network and selected by the telecommunications network's controller, the computer application of the terminal wishing to access traffic policy management functions is checked to see if it is authorized to invoke those functions; and,

[0015] Based on the inspection results, authorization is granted to access the functions through the computer application.

[0016] Generally, the steps of a method are not considered to be related to the concept of continuity over time.

[0017] As previously mentioned, the term "traffic policy management" should be understood as adjusting how data packets are processed differently from each other as they are routed through one or more telecommunications networks to their respective receivers (also known as "differentiated traffic policies"). This adaptation includes, in particular, packet sorting, management of queues for processing data packets, separation of data streams, routing of data streams through different physical or logical paths of telecommunications networks, invocation of hardware-supported acceleration or encoding functions, selection of categories or network slices, etc.

[0018] In a manner known per se, a "computer application" is a computer program designed to provide one or more services. Applications are typically deployed according to a client / server model. Applications are deployed on electronic devices (such as user terminals or servers) and execute using the services of the operating system of the device on which they are deployed, in order to utilize the device's software and / or hardware resources. Applications embedded in a device are typically the "client" portion, but server models are also encompassed (e.g., video content streaming servers). No assumptions are made regarding the nature of this application.

[0019] An "operating system," commonly referred to as an "OS," is a set of programs that act as an intermediary between the resources of an electronic device and the computer applications running on that device. The operating system specifically manages storage resources (e.g., access to random access memory and / or mass storage), computing resources, and / or resources used in communication with peripheral devices or via telecommunications networks.

[0020] Within the meaning of this invention, the operating system is considered to be trusted by telecommunications network operators. Therefore, the operating system meets certain security standards required by the operator, such as conformity to "general standards" certification. These general standards are a set of internationally recognized standards (ISO / IEC 15408) whose purpose is to impartially evaluate the security of computer systems and software.

[0021] A “telecommunications network controller” is a software module deployed on electronic devices within a telecommunications network, or it may be provided or localized by components of the telecommunications network. Therefore, when the telecommunications network in question is a 5G network, this controller is provided, for example, by an SMF (Session Management Function) entity, which is typically responsible for managing the network control plan and, more specifically, for controlling PDU (Packet Data Unit) sessions. This SMF entity is described in the technical specification 3GPP TS 29.502, 5G Systems; Session Management Services; Phase 3, v18.4.0, published in September 2023.

[0022] In this variant, the telecommunications network controller is integrated into the SDN (Software-Defined Networking) network controller. As is known per se, the SDN network controller is the entity within the telecommunications network that enables the optimization of network resources and allows the network to quickly adapt to the ever-changing demands of services, applications, and traffic. The SDN network controller provides orchestration, management, statistics collection, and network automation functions.

[0023] The authorization process is selected by the telecommunications network and is implemented at least in part by the same telecommunications network, which therefore allows the network operator to control—i.e., authorize or not authorize—the computer application's access to the traffic policy management function. As described in more detail below, the authorization process may include one or more separate authorization mechanisms, such as checks based on the computer application's identification data and / or checks that the computer application has been validly authenticated to the telecommunications network.

[0024] If the computer application is indeed authorized to call (or invoke) the function, for example because it has been identified as a trusted application based on its identifier and / or it has been authenticated to the telecommunications network in a valid manner, then the operating system (which then acts as a firewall to some extent) authorizes access to the traffic policy management function.

[0025] More precisely, the operating system then allows the application to invoke the functions (or primitives) of the traffic policy management function, and also obtains the results representing the implementation of these functions.

[0026] On the other hand, if the application is not authorized to access the function, the operating system will block the computer application from accessing the traffic policy management function. Furthermore, this access denial may also cause the operating system to refuse to invoke the function. In this case, in response to a new call from the same computer application to the traffic policy management function, the operating system ignores the new call or even blocks any new attempts to invoke the function.

[0027] In certain implementations, the method for managing access may also include one or more of the following features, individually or in any technically possible combination.

[0028] In a particular implementation, the method for managing access further includes the operating system receiving data from the controller of the telecommunications network indicating whether a computer application is authorized or unauthorized to manage traffic policies, and data indicating a mechanism for authenticating computer applications that wish to access traffic policy management functions of the telecommunications network; and performing a check based on the received data to determine whether the computer application is authorized to manage the traffic policies.

[0029] In a particular implementation, "identification data of computer applications authorized or unauthorized to manage traffic policies" includes or enables the determination of an identifier of a computer application authorized to manage traffic policies on the terminal, and checking whether the computer application is authorized to manage traffic policies includes comparing the identifier of the computer application with the identifier of the computer application authorized to manage traffic policies on the terminal.

[0030] In a particular implementation, the check is performed in response to a call to the traffic policy management function by a computer application on the terminal. More specifically, the check may be conditional upon the operating system detecting a call to the management function.

[0031] In certain implementations, the traffic policy management function, and (where applicable) one or more of its functions or primitives, are presented to computer applications by the operating system via an application programming interface (API).

[0032] According to a second aspect, the present invention relates to a method for accessing traffic policy management functions implemented by a terminal connected to a telecommunications network, the method comprising the following steps implemented by a computer application of said terminal:

[0033] Calling the traffic policy management function;

[0034] Transmit to the terminal's operating system the authentication elements received from the authentication system of the telecommunications network and required for the authorization process selected and implemented via the telecommunications network; and,

[0035] Access the traffic policy management function based on the result of the authorization process.

[0036] Within the meaning of this invention, the authentication system may comprise only the controller of the previously described telecommunications network or the controller of the telecommunications network coupled to the authentication manager. One or more controllers may be deployed.

[0037] It is equally important to remember that the steps of a method should not be interpreted as relating to the concept of continuity over time. Therefore, the previously described transport step can be implemented before the step of invoking the traffic policy management function, and vice versa. Furthermore, as described in more detail below, the invocation and transport steps can also be the same step.

[0038] Therefore, in certain implementations, the authentication element includes an authentication token sent to the operating system when a function is invoked.

[0039] In certain implementations, the access method further includes transmitting the terminal's identification data and / or timestamp to the operating system.

[0040] This transmission of the terminal's identification data and / or timestamp can be a separate transmission from the call and the previously described transmissions, or it can be part of the same step. In the latter case, the terminal's identification data and / or timestamp can then be transmitted as parameters of the function call.

[0041] In certain implementations, the authentication element includes a response associated with the challenge sent to the operating system after the challenge is received from the operating system.

[0042] In certain implementations, traffic policy management functionality includes adding, removing, and / or modifying traffic classification rules generated by a manager of the telecommunications network. This manager may be, for example, the telecommunications network itself or its service manager.

[0043] In a particular implementation, the traffic policy management function includes adding rules that associate at least one flow of communication with a terminal with at least one network slice of a telecommunications network accessible to the terminal.

[0044] Recent developments in the fifth-generation network field now enable the creation of custom logical sub-networks based on the same physical network infrastructure. These logical sub-networks are called "network slices" and allow customers to access services by leveraging virtualized network functions that can be enabled, disabled, and parameterized as needed, as well as by utilizing network functions deployed on the physical network infrastructure. Therefore, adding rules related to the use of a specific network slice for at least one communication flow between a terminal and a service accessible through the telecommunications network advantageously enables the provision of the required quality of service, not to mention a user experience suited to that service.

[0045] In a particular implementation, the method further includes exchanging their respective capabilities between the terminal and the telecommunications network to control access to the terminal's traffic policy management functions.

[0046] In a particular implementation, the exchange includes the following steps performed by the terminal:

[0047] Send an instruction to the controller of the telecommunications network, according to which the terminal is configured to control the computer application of the terminal to access traffic policy management functions;

[0048] The terminal receives an instruction from the controller of the telecommunications network, according to which the terminal is authorized or not authorized to allow its computer application to access the traffic policy management function.

[0049] In certain implementations, the authorization process includes authentication via an authentication token or challenge-response authentication.

[0050] In certain implementations, authentication tokens are typically "temporary authentication tokens," "long-term authentication tokens," or "persistent tokens" that can only be used once.

[0051] In a particular implementation, the authorization process includes authentication via an authentication token, and the method further includes a step implemented by the terminal's operating system, namely transmitting an authentication request from a computer application to the controller, the request including an authentication token previously generated by the authentication system and provided to the operating system by the computer application.

[0052] In a particular implementation, the authentication request may also include identification data of a computer application, which is controlled by the terminal's operating system.

[0053] The fact that the identification data of the computer application is controlled by the terminal's operating system and then transmitted to the network controller, rather than being transmitted directly to the network controller by the computer application, allows the controller to ensure that the application calling the traffic policy management function is not malicious. Therefore, this feature provides the advantage of improved security for access to this management function by preventing spoofing attacks from malicious computer applications.

[0054] In certain implementations, the authentication request may also include identification data of the terminal previously transmitted by the authentication system and provided to the operating system by a computer application.

[0055] The purpose of this terminal identification data is to allow the controller to check whether the terminal is malicious. Needless to say, this feature provides the advantage of improved security for access to the management functions by preventing spoofing attacks by malicious terminals. Specifically, this terminal identification data (e.g., the terminal's identifier in the telecommunications network) is generated, for example, by the previously described authentication system in response to a request to obtain an authentication token, and then retransmitted to the computer application. It is this latter computer application that also sends the terminal identification data to the operating system by invoking a traffic policy management function. The latter then generates an authentication request, which includes the terminal's identification data. Upon receiving the request, the telecommunications network controller is then able to compare the terminal identification data with a set of terminal identification data authorized to allow one of its computer applications to manage traffic policies.

[0056] In certain implementations, the authentication request may also include a timestamp previously transmitted by the authentication system and provided to the operating system by a computer application.

[0057] The purpose of this timestamp is to allow the controller to check whether the authentication request has been maliciously duplicated. More precisely, the timestamp is generated, for example, by the previously described authentication system in response to a request for an authentication token, and then resent to the computer application. It is this latter computer application that also sends the timestamp to the operating system by invoking a traffic policy management function. The latter then generates an authentication request and includes the timestamp in it. Upon receiving the request, the controller of the telecommunications network is then positioned to check the validity of the request, for example, by comparing the difference between the value representing the current time and the timestamp value to a predetermined time interval. If the timestamp is not included in that interval, it means that the authentication request may have been resubmitted.

[0058] In a particular implementation, authentication is performed using a long-lived authentication token, and if the computer application is authenticated, the controller provides the operating system with the authentication result, which includes the time period during which the operating system must authorize new access to traffic policy management functions without requiring new authentication of the computer application to the telecommunications network.

[0059] Compared to authentication via temporary tokens, this feature offers the advantage of reducing the number of exchanges between the terminal and the authentication service.

[0060] In a particular implementation, the method further includes receiving authentication results from the computer application from the controller.

[0061] In a particular implementation, the authentication process is a challenge-response authentication, and the method further includes the following steps implemented by the operating system:

[0062] Send challenges to computer applications;

[0063] The transmission of parameterized data addressed to the controller, the parameterized data including the challenge and a first response associated with the challenge;

[0064] Receive a second response, which is a response previously provided to the computer application by the controller in response to receiving a request to obtain a response sent by the computer application that includes the challenge;

[0065] And if the first response and the second response are equal, then access to the traffic policy management function is authorized.

[0066] In a particular implementation, the method for managing access further includes the step of having the terminal's operating system compare the first and second responses.

[0067] In a particular implementation, the parameterized data and the request for a response also include identification data of the computer application controlled by the terminal's operating system.

[0068] In a particular implementation, the authentication process is a challenge-response authentication, and the access method further includes the following steps implemented by a computer application:

[0069] Send a request to the controller to obtain a response, the response including a challenge provided by the operating system to the computer application; and,

[0070] After receiving a request for a response, a second response provided by the controller to the computer application is sent to the operating system.

[0071] According to a third aspect, the present invention relates to a method for controlling access to a traffic policy management function implemented by a terminal connected to a telecommunications network, the method comprising the following steps implemented by a controller of the telecommunications network:

[0072] Determine that the terminal is authorized to allow the terminal's computer applications to access traffic policy management functions; and,

[0073] The terminal is transmitted identification data of computer applications that are authorized or unauthorized to manage the traffic policy, as well as data representing the mechanism for authenticating computer applications that wish to access the traffic policy management functions to the telecommunications network (200).

[0074] In certain implementations, the method for controlling access may also include one or more of the following features, individually or in any technically possible combination.

[0075] In a particular implementation, the determination previously described is performed in response to receiving an instruction from a terminal configured to control access to traffic policy management functions by the terminal's computer application.

[0076] In a particular implementation, the authentication mechanism is authentication via an authentication token, and the method further includes the following steps implemented by the authentication system of the telecommunications network:

[0077] In response to receiving a request for an authentication token issued by a computer application on the terminal and including identification data of the computer application, the system checks whether the application can obtain the authentication token based on the identification data; and,

[0078] Transmit the authentication token generated based on the check to the computer application.

[0079] In certain implementations, the method for controlling access further includes the following steps implemented by the authentication system:

[0080] Generate identification data for the terminal (100); and,

[0081] The terminal's identification data is transmitted to a computer application.

[0082] As previously stated, this identification data of the terminal allows the controller to check whether it is a malicious terminal that is sending a request to authenticate a computer application.

[0083] According to a fourth aspect, the present invention relates to a terminal configured to implement the previously described methods for managing access and / or access methods.

[0084] According to a fifth aspect, the present invention relates to a controller for a telecommunications network configured to implement the control method previously described.

[0085] According to a sixth aspect, the present invention relates to a system for access traffic policy management functions, the system comprising the aforementioned terminal and controller.

[0086] According to a seventh aspect, the present invention relates to a computer program including instructions, which, when executed by a computer, are used to implement a method for managing access to traffic policy management functions.

[0087] According to an eighth aspect, the present invention relates to a computer program including instructions, which, when executed by a computer, are used to implement a method for access traffic policy management functions.

[0088] According to a ninth aspect, the present invention relates to a computer program including instructions for implementing a method of controlling access to traffic policy management functions when the computer executes the program.

[0089] According to a tenth aspect, the present invention relates to a computer-readable recording medium having a computer program according to the seventh, eighth and / or ninth aspects recorded thereon. Attached Figure Description

[0090] Other features and advantages of the invention will become apparent from the following description, with reference to the accompanying drawings, which illustrate exemplary embodiments of the invention but are not limited thereto. In the drawings:

[0091] [ Figure 1 ] Figure 1 This is an example of an access system that implements a general approach for access-differentiated traffic policy management.

[0092] [ Figure 2A ] Figure 2A This schematically illustrates a module embedded in a terminal according to a simplified exemplary embodiment of the present invention;

[0093] [ Figure 2B ] Figure 2B An example of the terminal's hardware architecture is shown;

[0094] [ Figure 3A ] Figure 3A This schematically illustrates a module embedded in a controller of a telecommunications network according to an exemplary embodiment of the present invention.

[0095] [ Figure 3B ] Figure 3B An example of the hardware architecture of a controller for a telecommunications network is shown;

[0096] [ Figure 4] Figure 4 The main steps of a general method for accessing differentiated traffic policy management functions according to an exemplary embodiment of the present invention are illustrated in flowchart form.

[0097] [ Figure 5A ] Figure 5A A mechanism for authenticating a computer application to a telecommunications network via a temporary authentication token, according to a first exemplary embodiment of the present invention, is illustrated in flowchart form.

[0098] [ Figure 5B ] Figure 5B A mechanism for authenticating a computer application to a telecommunications network via a temporary authentication token, according to a second exemplary embodiment of the present invention, is illustrated in flowchart form.

[0099] [ Figure 5C ] Figure 5C A mechanism for authenticating a computer application to a telecommunications network via a temporary authentication token, according to a third exemplary embodiment of the present invention, is illustrated in flowchart form.

[0100] [ Figure 6 ] Figure 6 A mechanism for authenticating a computer application to a telecommunications network via a long-term authentication token, according to an exemplary embodiment of the present invention, is illustrated in flowchart form.

[0101] [ Figure 7 ] Figure 7 A mechanism for authenticating a computer application to a telecommunications network via a challenge-response method, according to an exemplary embodiment of the present invention, is illustrated in flowchart form. Detailed Implementation

[0102] The terms “first,” “second,” etc., are used herein by any convention to identify and distinguish different elements (e.g., messages) considered in the embodiments described below, and do not imply any particular order unless explicitly stated otherwise.

[0103] Figure 1 This is an example of an access system that implements a general method for access traffic policy management. In the remainder of the specification, the process proposed in this invention is referred to as IMURIG (Innovative Management of Novel Collaborative API Gating).

[0104] The system includes a terminal 100 connected to a telecommunications network 200. The terminal 100 may support, for example, the IP communication protocol and may be a user terminal (e.g., in the form of a laptop computer, personal assistant, connected device, or mobile phone of the "smartphone" type), a router, a home gateway, a TV decoder, etc.

[0105] like Figure 1 As shown, the terminal 100 includes an operating system 110 and an application programming interface (or API). The operating system 110 includes an IMURIG module 112, which is configured to implement methods for managing access to a traffic policy management function 111 (typically a differentiated traffic policy). The function 111 itself is implemented by the operating system 110. The functions (or primitives) of the traffic policy management function 111 are presented to one or more computer applications 120 of the terminal 100 via the application programming interface (or API).

[0106] Using an API is advantageous because it allows the computer application 120 of terminal 100 to communicate with the traffic policy management function 111 without needing to know the implementation details of that function.

[0107] like Figure 1 As shown, the system also includes a remote server 300, which is also connected to the telecommunications network 200 via a data network DN such as the Internet and / or a local / private network, and is configured to provide a service S. In a manner known per se, a service is defined as a computer program directly used to perform a task or a set of basic tasks in the same domain. Examples include services for providing multimedia content (such as video-on-demand), services for accessing social networks, or payment services.

[0108] In this embodiment, and for the sake of simplicity, the access system is considered to include a single terminal 100 and a single remote server 300 providing a single service S, the two devices being connected via a telecommunications network including a single controller IMURIG_CTRL 210. However, it should be noted that no assumptions are made regarding the number of terminals, remote servers, and deployed services, or the number of networks and controllers considered. If more than one terminal, more than one remote server, more than one service S, more than one telecommunications network, and / or more than one controller are considered, those skilled in the art can indeed readily summarize the following developments.

[0109] like Figure 1 As shown, the telecommunications network 200 in this example includes a radio access network (RAN) and a core network (CN) interconnected with each other. In other words, in the embodiment described herein, the radio RAN and core CN networks form the telecommunications network 200 to which the terminal 100 is connected and are capable of communicating with each other.

[0110] For the remainder of the specification, it is considered, but not limited to, that the telecommunications network 200 is a 5G type mobile network. However, it should be noted that the invention is still applicable to other types of telecommunications networks 200, such as, for example, 4G mobile networks, B5G (“Super 5G”) networks, 6G networks, WLAN networks (such as Wi-Fi networks), IP / MPLS networks, etc.

[0111] Radio access networks (RANs) are, for example, V-RAN (Virtual RAN) networks. A V-RAN is a radio access network RAN ​​whose network functions are deployed as virtual instances located at different locations on the network, depending on the telecom operator's deployment strategy. This approach offers the advantage of limiting the use of expensive equipment and facilitates the creation of network slices that can coexist on the same hardware.

[0112] The core network CN includes the module telecommunications network controller IMURIG_CTRL 210, which is configured to implement methods for controlling access to traffic policy management function 111. For example... Figure 1 As shown, the controller 210 is deployed on the electronic device 2100 of the core network CN. In one variant, the controller 210 is provided to or co-located with components of the telecommunications network.

[0113] Therefore, this controller is provided, for example, by an SMF (Session Management Function) entity, which is typically responsible for managing the network's control plan and, more specifically, for controlling PDU (Packet Data Unit) sessions. This SMF entity is specifically described in Section 4 ("Overview") and Section 5 ("Services Provided by SMF") of the technical specification 3GPP TS 29.502 "5G Systems; Session Management Services; Phase 3", v18.4.0, released in September 2023.

[0114] In a variant, the controller 210 of the telecommunications network 200 is integrated into the controller of the SDN network. In a manner known per se, the network controller (SDN) is an entity of the telecommunications network that enables the optimization of network resources and allows the network to quickly adapt to changing requirements of services, applications, and traffic, and for this purpose provides orchestration, management, statistics, and automation functions for the network.

[0115] In a particular implementation, the core network CN also includes an authentication manager AUTH_MNG 220, which is connected to the controller IMURIG_CTRL 210 and is specifically configured to generate authentication elements such as authentication tokens.

[0116] In certain implementations, the Radio Access RAN and Core CN networks support one or more network slices. It is generally important to note that no assumptions are made regarding the nature of the slices deployed in the network, their number, or the paths between instances or sub-instances of a slice.

[0117] Figure 2A This schematically illustrates the embedding of a simplified exemplary embodiment of the invention in, for example, Figure 1 The module in the terminal 100.

[0118] like Figure 2A As shown, terminal 100 includes operating system 110 and desired access (differentiated) traffic policy management functions, and... Figure 1 At least one computer application 120 marked 111. Operating system 110 includes an inspection module MOD_CHK and an access authorization module MOD_AUTH, the functions of which are referenced in [reference needed]. Figure 2B The computer application 120 includes both the calling and transferring module MOD_CALL and the access module MOD_ACC, the functions of which are described below. Figure 2B Describe it.

[0119] Figure 2B An example of the hardware architecture of terminal 100 is shown. For example... Figure 2B As shown, terminal 100 has a computer hardware architecture. Therefore, terminal 100 specifically includes a processor 1, random access memory 2, read-only memory 3, and non-volatile memory 4. It also includes a communication module 5.

[0120] The read-only memory 3 or non-volatile memory 4 of terminal 100 constitutes the proposed recording medium, which can be read by processor 1, and on this recording medium is recorded a first computer program PROG executed by operating system 110. The first computer program PROG includes instructions for performing steps for the methods for managing access as described below. Program PROG defines one or more functional submodules of operating system 110 that depend on or control the aforementioned hardware elements 1 to 5, and specifically includes:

[0121] The module MOD_CHK is used to check whether a computer application 120 wishing to access the traffic policy management function 111 is authorized to call the function, using an authentication process implemented via the telecommunications network 200 and selected by the controller 210 of the telecommunications network 200; and,

[0122] The MOD_AUTH module is used to authorize the computer application 120 to access traffic policy management functions 111 based on the results of the check.

[0123] The read-only memory 3 or non-volatile memory 4 of terminal 100 also constitutes a medium for recording a second computer program PROG_APP executed by computer application 120, and includes instructions for performing the steps of the access method described below. The program PROG_APP defines one or more functional submodules that depend on or control the aforementioned hardware elements 1 to 5, and specifically includes:

[0124] The module MOD_CALL is used to invoke the traffic policy management function 111 and to send the authentication elements required for the authorization process received from the authentication systems 210 and 220 of the telecommunications network 200 and selected and implemented by the telecommunications network 200 to the operating system 110 of the terminal 100; and,

[0125] The MOD_ACC module is used to access the traffic policy management function based on the result of the authorization process.

[0126] In addition, terminal 100 may include other modules, particularly specific patterns for implementing methods for managing access, as will be described in more detail below.

[0127] Figure 3A The illustration schematically depicts a module embedded in a controller 210 of a telecommunications network 200 according to an exemplary embodiment of the present invention.

[0128] like Figure 3A As shown, the electronic device 2100 of the core network CN includes a controller 210 for the telecommunications network. This controller 210 includes a determination module MOD_DET and a transmission module MOD_TX, the functions of which are referenced in [reference needed]. Figure 3B describe.

[0129] Figure 3B An example of the hardware architecture of an electronic device 2100, including a controller 210, is shown. Figure 3B As shown, electronic device 2100 has a computer hardware architecture. Therefore, electronic device 2100 specifically includes a processor 1, random access memory 2, read-only memory 3, and non-volatile memory 4. It also includes a communication module 5.

[0130] The read-only memory 3 or non-volatile memory 4 of the electronic device constitutes the proposed recording medium, which can be read by the processor 1, and on which is recorded a computer program PROG_CTRL, which includes instructions for performing the steps of the controlled access method described below. The program PROG_CTRL defines one or more functional sub-modules of the electronic device 2100 that depend on or control the aforementioned hardware elements 1 to 5, and specifically includes:

[0131] The module MOD_DET is used to determine whether terminal 100 is authorized to access traffic policy management function 111 through its own computer application; and,

[0132] The MOD_TX module is used to send identification data of computer applications that are authorized or unauthorized to manage traffic policies, as well as data representing the mechanism used to authenticate computer applications that wish to access differentiated traffic policy management functions to the telecommunications network 200.

[0133] In addition, the electronic device 2100 may also include other modules, particularly specific modes for implementing methods for controlling access, as will be described in further detail.

[0134] Figure 4 The main steps of a general method for access traffic policy management functions according to an exemplary embodiment of the present invention are illustrated in flowchart form.

[0135] The general method includes: a method for managing access to traffic policy management functions (differentiated traffic policies in the example contemplated herein), including steps S100 to S190 implemented by the operating system 110 of terminal 100, and steps S300 and S310 implemented by the computer application 120 of terminal 100; and a method for controlling access to traffic policy management functions (differentiated traffic policies in the example contemplated herein), implemented by the controller 210 of telecommunications network 200, including steps S200 to S250.

[0136] In the remainder of this document, it will be assumed that messages exchanged between terminal 100 and controller 210 in the telecommunications network are mutually authenticated according to well-known authentication methods in the prior art, such as authentication by certificate or using a pre-shared key (PSK).

[0137] The authentication of exchanged messages advantageously prevents malicious software installed on terminal 100 from carrying out malicious acts, such as by spoofing module IMURIG 112.

[0138] A general method for accessing traffic policy management functions (differentiated traffic policies in the example contemplated here) includes a first step S100, during which terminal 100 (and more specifically, module IMURIG 112 of operating system 110) transmits an indication IMURIG_CAPABLE (UE_STATUS) to controller 210 of telecommunications network 200, according to which terminal 100 is configured to control access to traffic policy management function 111 by computer applications of terminal 100.

[0139] According to a particular implementation, the instruction IMURIG_CAPABLE (UE_STATUS) is sent in the context of being attached to the telecommunications network 200 via a message including specific information elements. The information elements are fields in IEEE 802.11 management frames or messages exchanged within a mobile phone network between a base station and a user terminal. The information elements typically use a type-length value encoding scheme.

[0140] According to a specific implementation, the telecommunications network 200 is of 5G type, and information elements are inserted, for example, into the "Extended Protocol Configuration Options" field of the "PDU Session Establishment Request" message. This message is a request to establish a session that allows data exchange between a user terminal and a data network (such as the Internet or a private network). For example, it conforms to Section 5.6 of standard 3GPP TS 23.501 "System Architecture for 5G Systems (5GS)" version 18.3.0, published on September 19, 2023.

[0141] In the variant, the instruction IMURIG_CAPABLE(UE_STATUS) is sent to controller 210 as an option for the Dynamic Host Configuration Protocol DHCPv6 (representing "Dynamic Host Configuration Protocol version 6"), which is defined, for example, in IETF (Internet Engineering Task Force) document RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" published in November 2018.

[0142] In one variant, the instruction IMURIG_CAPABLE (UE_STATUS) is transmitted to controller 210 as a field value of the "Neighbor Advertisement" message of the "Neighbor Discovery Protocol," which is defined, for example, in IETF document RFC4861 "Neighbor Discovery for IP Version 6 (IPv6)" published in September 2007.

[0143] According to a particular implementation, the indication IMURIG_CAPABLE(UE_STATUS) includes the flag UE_STATUS, which indicates whether the terminal 100 is configured to control access to the traffic policy management function 111 by the computer application of the terminal 100. Therefore, if the flag UE_STATUS is, for example, equal to "1", it means, for example, that the terminal 100 is configured to control access to the traffic policy management function 111 by its own computer application. If the flag UE_STATUS is, for example, equal to "0", it means that the terminal 100 cannot control access to the traffic policy management function 111 by its own computer application, and therefore it does not authorize its computer application to access the traffic policy management function 111.

[0144] In the latter case, the functionality provided by traffic policy management function 111 is then not exposed by the operating system via the API. In a variant, the functionality (or "primitive") is exposed via the API, but the operating system does not respond to calls (or enablements) from computer applications that wish to access these functionalities.

[0145] During step S200, the controller 210 of the telecommunications network 200 receives the indication IMURIG_CAPABLE(UE_STATUS). The method also includes step S210, during which the controller 210 extracts information from the received message.

[0146] During step S220, controller 210 checks, according to the IMURIG procedure, whether telecommunications network 200 provides the possibility of authorized terminal control access to traffic policy management functions. If this is not the case (selecting "No"), the controller implements step S225. According to a first exemplary embodiment of step S225, the message received in step S200 is ignored, and the communication establishment process is terminated. According to a second exemplary embodiment, controller 210 only ignores the indication IMURIG_CAPABLE (UE_STATUS).

[0147] On the other hand, if the telecommunications network 200 provides the possibility for an authorized terminal to access traffic policy management functions according to the program IMURIG control (selecting "Yes"), then the controller 210 executes step S230, during which the controller 210 checks whether the terminal 100, which has sent this indication IMURIG_CAPABLE (UE_STATUS), can be authorized to allow at least one of its computer applications to access traffic policy management functions 111. Whether or not this authentication is granted to the terminal depends on, for example, congestion conditions in the telecommunications network, or on restrictions related to the services already subscribed to by the user of said terminal 100.

[0148] If controller 210 does not authorize terminal 100 to access traffic policy management function 111 (selects "No"), then controller executes step S240, during which an indication IMURIG_CAPABLE (NWK_STATUS) indicating that unauthorized terminal 100 of network 200 is allowed to access traffic policy management function 111 is transmitted to operating system 110.

[0149] In a particular implementation, the indication IMURIG_CAPABLE(NWK_STATUS) is sent via a PDU session establishment accept message. In a variant, the indication IMURIG_CAPABLE(NWK_STATUS) is sent via a PDU session establishment reject message. These messages, for example, conform to standard 3GPP TS 23.501, “System Architecture for 5G Systems (5GS),” version 18.3.0, published on September 19, 2023.

[0150] According to a specific implementation, if a request to establish a PDU session is rejected, the "PDU Session Establishment Rejected" message includes a specific reason code ("5GSM Reason"), the value of which indicates that terminal 100 is not authorized to allow its application to access traffic policy management function 111. Reason codes standardized in the 3GPP framework to date are defined, for example, in standard TS 29.524 "5G Systems; Reason Code Mapping Between 5GC Interfaces; Phase 3", version 17.3.0, published in December 2021.

[0151] The message is received by the operating system 110 during step S110.

[0152] Returning to step S230, if, conversely, terminal 100 is indeed authorized by controller 210 to allow at least one of its computer applications to access traffic policy management function 111 (select "Yes"), then controller 210 executes step S250, during which controller 210 sends a message including the data IMURIG_CAPABLE (LIST; GRANT_M), which indicates that terminal 100 is authorized to allow at least one of its applications to access traffic policy management function 111.

[0153] According to a specific implementation, the data IMURIG_CAPABLE(LIST,GRANT_M) is sent via a specific information element in the "Extended Protocol Configuration Options" field of the "PDU Session Establishment Accept" message.

[0154] According to a particular implementation, the data IMURIG_CAPABLE(LIST,GRANT_M) includes identification data of computer applications that are not authorized by controller 210 to access traffic policy management function 111.

[0155] The identification data is, for example, a list (LIST) of one or more identifiers of a computer application authorized by controller 210 to access traffic policy management function 111.

[0156] In a variant, the identification data is a list of one or more identifiers that are not authorized to access traffic policy management function 111. Therefore, by comparing the identifiers of computer applications that are not authorized to access traffic policy management function 111 with the identifiers of computer applications installed on terminal 100, operating system 110 is then able to determine the computer applications installed on terminal 100 that are also authorized by controller 210 to access traffic policy management function 111.

[0157] In the variant, the identifier data {APP_FILTER, OP} is at least one pair of filters APP_FILTER that include the application operand OP. The filter APP_FILTER makes it possible to identify one or more computer applications, for example, using an application identifier (“APP_ID”) or a group of applications (“group_id”), domain name, etc.

[0158] The operand OP represents the operation to be applied to the filter APP_FILTER and references an exact match or the logical operator "Not". For example, the operand OP takes the value "0" when referencing an exact match, and "1" when referencing the "Not" operator.

[0159] If the operand OP references match exactly, only the computer application identified by the filter APP_FILTER is authorized to access traffic policy management function 111. For example, controller 210 returns identification data {4234d49b, 0} to indicate to terminal 100 that only applications with the identifier "4234d49b" are allowed to access traffic policy management function 111, and operating system 110 systematically denies calls from other applications.

[0160] On the other hand, if the operand OP references the logical operator "Not", it means that all computer applications except those identified by the filter APP_FILTER are authorized to access traffic policy management function 111. For example, the network returns the identification data {4234d49b; 1} to indicate to terminal 100 that all applications except those with the identifier "4234d49b" are allowed to access traffic policy management function 111.

[0161] It is also important to note that the controller 210 of the telecommunications network can send several pairs {APP_FILTER, OP} to the terminal 100 in the form of an ordered list. Typically, these pairs have the same operand value. If the pairs in the list contain different operands, the filter is applied in the order they are listed.

[0162] According to a particular implementation, the data IMURIG_CAPABLE(LIST,GRANT_M) also includes the data GRANT_M, which represents a mechanism for authenticating computer applications that wish to access traffic policy management functions to the telecommunications network.

[0163] In other words, the data GRANT_M represents the authentication mechanism that the operating system 110 of terminal 100 must initiate with the telecommunications network so that one of the computer applications wishing to access the traffic policy management function 111 can authenticate itself with the telecommunications network.

[0164] Here, the data "GRANT_M" takes the value "0" for example when the authentication mechanism is temporary token authentication, "1" when the authentication mechanism is long-term token authentication, and "2" when the authentication mechanism is challenge-response authentication. (See reference) Figures 5A to 5C , Figure 6 and Figure 7 These different authentication mechanisms will be described in more detail. Of course, other authentication mechanisms or more general authorization mechanisms can be envisioned.

[0165] During step S120, operating system 110 receives data IMURIG_CAPABLE(LIST, GRANT_M), indicating that terminal 100 is authorized to allow at least one of its applications to access traffic policy management function 111. Then, during step S130, operating system 110 extracts information from the message received in step S120 and records this information in a dedicated table OIG. In table OIG, this information is associated with the identification data of the telecommunications network 200 that sent the data IMURIG_CAPABLE(LIST, GRANT_M). The identification data of the telecommunications network 200 is, for example, an identifier, domain name, or Public Land Mobile Network (PLMN) for the local interface of the terminal communicating with the network.

[0166] The general access method also includes step S300, which involves calling or invoking the traffic policy management function 111, implemented by the computer application 120 of terminal 100. This step S300 is implemented, for example, by the previously described module MOD_CALL. During step S140, the operating system 110 detects the call.

[0167] Then, during step S150, the operating system 110 determines whether the computer application (120) wishing to access the traffic policy management function 111 is authorized to access it by the telecommunications network 200. This step is implemented, for example, by the previously described checking module MOD_CHK. To do this, the operating system 110 determines whether there is a match between the identifier of the computer application 120 wishing to access the traffic policy management function 111 and one of the rules in the list LIST stored in table OIG. In other words, the operating system 110 uses the identifier to check whether the computer application 120 wishing to access the management function 111 is listed as authorized to access the function, or is not listed as an application not allowed to access the function.

[0168] If the computer application is not authorized (select "No"), the operating system 110 implements step S160, during which it rejects the call detected in step S140.

[0169] On the other hand, if the computer application 120 is authorized to access function 111, the operating system 110 executes step S170, during which the operating system 110 determines, for example, by consulting table OIG, the authentication mechanism to be initiated, so that the computer application 120 is authenticated by the telecommunications network, and initiates the authentication mechanism. This step is also implemented, for example, by the previously described checking module MOD_CHK.

[0170] If the computer application 120's authentication of the telecommunications network is valid, the general access method further includes step S180, during which the computer application 120 is granted access to the traffic policy management function 111. This step is implemented, for example, by the previously described access authorization module MOD_AUTH. More specifically, the operating system 110 authorizes the computer application 120 to invoke one or more functions (or "primitives") of the traffic policy management function 111.

[0171] According to a particular implementation, these functions include adding, removing, and / or modifying traffic classification rules generated by the manager of telecommunications network 200. These traffic classification rules are, for example, stored in the memory of terminal 100.

[0172] According to a specific implementation, the invoked function corresponds to an association rule for adding at least one flow of communication with terminal 100 to at least one network slice of telecommunications network 200 accessible to terminal 100.

[0173] Then, during step S190, the operating system 110 sends a confirmation CALL_ACK to the application 120 for the call. This confirmation includes the result of the access traffic policy management function and is received by the computer application 120 during step S310. This step S310 is implemented, for example, by the previously described module MOD_ACC.

[0174] Figure 5A A mechanism for authenticating a computer application to a telecommunications network via a temporary authentication token, according to a first exemplary embodiment of the present invention, is illustrated in flowchart form.

[0175] In this first example, an authentication system is envisioned, which on the one hand includes an authentication manager AUTH_MNG 220 of a telecommunications network 200, which is specifically configured to generate authentication tokens, and on the other hand includes a controller 210 as previously described to check the validity of the authentication tokens.

[0176] like Figure 5A As shown, this authentication mechanism via temporary tokens includes a first step S400-1 implemented by computer application 120, during which computer application 120 obtains identification data used by operating system 110 to identify itself. Typically, this identification data is an application identifier chosen by the computer application developer according to a specific naming convention. In a variant, the application identifier is instantiated by operating system 110, for example, when application 120 is installed, and then operating system 110 sends the identifier to computer application 120 or presents an API to computer application 120 allowing it to obtain the application identifier.

[0177] The authentication mechanism also includes step S410-1: the computer application 120 sends a request to the authentication manager AUTH_MNG 220 of the telecommunications network 200 to obtain an authentication token GET_TOKEN including the identifier APP_ID of the computer application 120. During step S500-1, the authentication manager 220 receives the request. During step S510-1, the authentication manager 220 extracts the identifier APP_ID of the computer application 120 from the received message, and then checks whether the computer application 120 can indeed receive the authentication token based on the extracted identifier (step S520-1).

[0178] If this is the case (select "Yes"), then the authentication manager 220 performs step S530-1, during which a temporary authentication token TKN, a timestamp TS, and the identifier UE_ID of terminal 100 are generated. In a variant, the identifier UE_ID of terminal 100 is generated by an electronic device different from that of controller 210 and authentication manager 220. During step S540-1, authentication manager 220 sends the generated temporary authentication token TKN, timestamp TS, and identifier UE_ID of terminal 100 to controller 210. This data is received by controller 210 during step S600-1 and, for example, recorded in the table ACTIVE_TOKENS.

[0179] During step S550-1, this data is also sent by the authentication manager 220 to the computer application 120, and received by the same computer application 120 during step S420-1.

[0180] The authentication mechanism via temporary tokens also includes a call (i.e., invocation) S430-1 to the traffic policy management function 111, which is detected by the operating system 110 during step S700-1. This call specifically includes the temporary authentication token TKN, the timestamp TS, and the identifier UE_ID of the terminal 100. Steps S430 and S700 correspond to the previously referenced... Figure 4 Steps S300 and S140 are described. Then, during step S710-1, the operating system 110 extracts data from the received message and determines the identification data (APP_ID) of the computer application 120 that made the call.

[0181] During step S720-1, the operating system 110 sends an authentication request CHECK_TOKEN to the controller 210. This authentication request CHECK_TOKEN includes a temporary authentication token TKN, a timestamp TS, the identifier UE_ID of the terminal 100, and the identifier APP_ID of the computer application that invoked the traffic policy management function 111. During step S610-1, the controller 210 receives the authentication request CHECK_TOKEN.

[0182] Then, during step S620-1, controller 210 extracts information from the request and compares that information with data recorded in the table ACTIVE_TOKENS during step S630-1. If a valid entry is found in the table ACTIVE_TOKENS, controller 210 implements step S640-1, during which an ACK confirming the authentication validity is sent to operating system 110 and received by operating system 110 during step S730-1.

[0183] On the other hand, if no valid entry is found (select "No"), the controller 210 implements step S650-1, during which an instruction NACK is sent to the operating system 110 and received by the operating system 110 during step S740-1. According to the instruction NACK, the authentication of the computer application 120 is invalid.

[0184] Figure 5B A flowchart illustrates a mechanism for authenticating a computer application to a telecommunications network using a temporary authentication token, according to a second exemplary embodiment of the present invention. This second example is... Figure 5A Variations of steps S400-1 to S420-1, S500-1 to S550-1 and S600-1 in the middle dashed line.

[0185] In this second example, an authentication system is envisioned, which includes, on the one hand, an authentication manager AUTH_MNG 220 of a telecommunications network 200 specially configured to generate authentication tokens, and on the other hand, a controller 210 that checks the validity of the authentication tokens. However, unlike the first example, the computer application 120 no longer interacts directly with the authentication manager 220, but interacts with the controller 210, which is then responsible for communicating with the authentication manager 220.

[0186] like Figure 5B As shown, this authentication mechanism via temporary tokens includes a first step S400-2 implemented by computer application 120, during which computer application 120 obtains identification data APP_ID used by the operating system to identify computer application 120. This step is similar to that in the previous reference. Figure 5A Step S400-1 is described.

[0187] The authentication mechanism also includes step S410-2: the computer application 120 sends a request GET_TOKEN to the controller 210 of the telecommunications network 200 to obtain an authentication token TKN including the identifier APP_ID of the computer application 120. During step S600-2, the controller 210 receives the request. During step S610-2, the controller 210 extracts the identifier APP_ID of the computer application 120 from the received message, and then checks whether the computer application 120 can indeed receive the authentication token based on the extracted identifier APP_ID (step S620-2).

[0188] If this is the case (select "Yes"), then controller 210 sends a request GET_TOKEN to obtain an authentication token during step S630-2, which is received by authentication manager 220 during step S500-2. Authentication manager 220 implements step S510-2, during which a temporary authentication token TKN, a timestamp TS, and an identifier UE_ID for terminal 100 are generated. In a variant, the identifier UE_ID for terminal 100 is generated by an electronic device separate from controller 210 and authentication manager 220.

[0189] During step S520-2, the authentication manager 220 sends the generated temporary authentication token TKN, timestamp TS, and terminal 100 identifier UE_ID to the controller 210. This data is received by the controller 210 during step S640-2 and, for example, recorded in the table ACTIVE_TOKENS. Then, this data is transmitted by the controller 210 to the computer application 120 during step S650-2 and received by the same computer application 120 during step S420-2.

[0190] The authentication mechanism also includes steps S430-1, S700-1, etc. (Previous reference) Figure 5A These embodiments have been described, and therefore will not be repeated here for the sake of brevity.

[0191] Figure 5C A flowchart illustrates a mechanism for authenticating a computer application to a telecommunications network using a temporary authentication token, according to a third example of an embodiment of the present invention. This third example corresponds to... Figure 5A The steps S400-1 to S420-1, S500-1 to S550-1, and S600-1 are variations of the dashed lines. In this third example, the authentication system includes only controller 210.

[0192] like Figure 5C As shown, this authentication mechanism via temporary tokens includes a first step S400-3 implemented by computer application 120, during which computer application 120 obtains identification data APP_ID used by the operating system to identify computer application 120. This step is similar to the previously referenced... Figure 5A Step S400-1 is described.

[0193] The authentication mechanism via temporary tokens also includes step S410-3: the computer application 120 sends a request GET_TOKEN to the controller 210 of the telecommunications network 200 to obtain an authentication token TKN including the identifier APP_ID of the computer application 120. During step S600-3, the controller 210 receives the request.

[0194] During step S610-3, controller 210 extracts the identifier APP_ID of computer application 120 from the received message, and then checks whether computer application 120 can indeed receive authentication tokens based on the extracted identifier APP_ID (step S620-3). If this is the case (selecting "Yes"), controller 210 implements step S630-3, during which a temporary authentication token TKN, a timestamp TS, and the identifier UE_ID of terminal 100 are generated. In a variant, the identifier UE_ID of terminal 100 is generated by an electronic device different from controller 210 and authentication manager 220.

[0195] Then, during step S640-3, controller 210 sends the generated temporary authentication token TKN, timestamp TS, and terminal 100 identifier UE_ID to computer application 120. During step S420-3, this data is received by the same computer application 120.

[0196] The authentication mechanism also includes steps S430-1, S700-1, etc. (Previous reference) Figure 5A These embodiments have been described, and therefore will not be repeated here for the sake of brevity.

[0197] Figure 6 A mechanism for authenticating a computer application to a telecommunications network via a long-term authentication token, according to an exemplary embodiment of the present invention, is illustrated in flowchart form.

[0198] like Figure 6 As shown, this authentication mechanism via long-lived tokens includes a first step S400-4 implemented by computer application 120, during which computer application 120 obtains identification data used by the operating system to identify itself. Typically, this identification data is an application identifier APP_ID chosen by the computer application's developer according to a specific naming convention. In a variant, the application identifier APP_ID is instantiated by operating system 110, for example, during application installation, and then operating system 110 sends the identifier APP_ID to computer application 120, or presents an API to computer application 120 allowing it to obtain the application identifier APP_ID.

[0199] The authentication mechanism also includes step S410-4: the computer application 120 sends a request GET_TOKEN to the controller 210 of the telecommunications network 200 to obtain an authentication token including the identifier APP_ID of the computer application 120. During step S600-4, the controller 210 receives the request. During step S610-4, the controller 210 extracts the identifier APP_ID of the computer application 120 from the received message, and then checks whether the computer application 120 can indeed receive the authentication token based on the extracted identifier (step S620-4).

[0200] If this is the case (select "Yes"), then controller 210 performs step S630-4, during which a long-term authentication token TKN and the identifier UE_ID of terminal 100 are generated. This data is then recorded, for example, in a table ACTIVE_TOKENS accessible by controller 210. During step S640-4, controller 210 sends the authentication token TKN and the identifier UE_ID of terminal 100 received by computer application 120 during step S420-4 to computer application 120.

[0201] The authentication mechanism via long-lived tokens also includes step S430-4 of invoking (awakening) the traffic policy management function 111, which is then detected by the operating system 110 during step S700-4. This invocation specifically includes the authentication token TKN previously received in step S420-4 and the identifier UE_ID of the terminal 100. Then, during step S710-4, the operating system 210 extracts data from the received message and determines the identification data APP_ID of the computer application 120 that made the invocation.

[0202] Then, during step S720-4, the operating system 110 sends an authentication request CHECK_TOKEN to the controller 210. This authentication request CHECK_TOKEN includes an authentication token TKN, the identifier UE_ID of the terminal 100, and the identifier APP_ID of the computer application that invoked the traffic policy management function 111. During step S650-4, the controller 210 receives the authentication request CHECK_TOKEN.

[0203] During step S660-4, controller 210 extracts information from the request and compares it with the data recorded in table ACTIVE_TOKENS during step S630-1. If no valid entry is found in table ACTIVE_TOKENS (select "No"), controller 210 executes step S670-1, during which a NACK instruction is sent to operating system 110 and received by operating system 110 during step S730-4. According to the NACK instruction, the authentication of computer application 120 is invalid.

[0204] On the other hand, if a valid input is found (selecting "Yes"), the controller 210 implements step S680-4, during which an ACK confirming the validity of the authentication of the computer application 120 is sent to the operating system 110 and received by the operating system 110 during step S740-4. This ACK includes a value P, which indicates the time period during which the operating system 110 must authorize new access to the traffic policy management function 111 without requiring new authentication of the computer application 120 on the telecommunications network 200.

[0205] In response to receiving the ACK, the operating system 110 executes step S750-4, during which the operating system 110 authorizes the computer application 120 to access the traffic policy management function 111. During the same step S750-4, the operating system 110 records the authentication token TKN, the identifier UE_ID of the terminal 100, the identifier APP_ID of the computer application, and the value of the time period P in the table "LOCAL_TOKENS".

[0206] Finally, the authentication mechanism includes step S760-4, which is performed by the operating system 110 after the time period P has elapsed, and during step S760-4, the operating system 110 removes the corresponding entry from the table LOCAL_TOKENS.

[0207] Therefore, in the context of this embodiment, once the operating system 110 detects a call to the traffic policy management function 111, the operating system 110 consults the table LOCAL_TOKENS and checks whether it contains an entry that includes the identifier of the calling computer application. If this is the case, it means that new authentication of the calling computer application to the telecommunications network 200 is unnecessary, and then the operating system 110 authorizes access to function 111.

[0208] So far, the authentication mechanism using long-lived authentication tokens has been described in a scenario where the authentication system only includes controller 210. It also applies to scenarios where the authentication system includes both controller 210 and an authentication manager, as referenced... Figure 5A and Figure 5B As shown.

[0209] Figure 7 A mechanism for authenticating a computer application to a telecommunications network via a challenge-response method, according to an exemplary embodiment of the present invention, is illustrated in flowchart form.

[0210] like Figure 7 As shown, the mechanism for authenticating a computer application via challenge-response includes a first step S400-5 where the computer application 120 invokes (or evokes) the traffic policy management function 111. During step S700-5, the operating system 110 detects the call. In response to this detection, the operating system 110 sends a message CHALLENGE to the application, including a challenge CHAL and a timestamp TS, and the CHALLENGE message is received by the application 120 during step S410-5.

[0211] During steps S720-5, the operating system 110 determines the identification data APP_ID of the computer application 120 that made the call. It then sends the authenticated parameterized data SHARE_CHALLENGE to the controller 210. This authenticated parameterized data SHARE_CHALLENGE includes the challenge CHAL, the response RESP (so-called first response) associated with the challenge CHAL, and a timestamp TS. This parameterized data is received by the controller 210 during steps S600-5. Then, during steps S610-5, the controller 210 extracts the parameterized data SHARE_CHALLENGE and records it in table ACR.

[0212] In response to computer application 120's receipt of the CHALLENGE message S410-5, computer application 120 sends a request SEEK_RESPONSE during step S430-5 to obtain a response with the challenge CHAL, timestamp TS, and an identifier APP_ID of the application addressing controller 210 as parameters. During step S620-5, controller 210 receives the request SEEK_RESPONSE and then checks whether an entry exists in table ACR during step S630-5. If so, the controller implements step S640-5: sending an acknowledgment ACK to computer application 120 including a response RESP* (the so-called second response), which is a response associated with the challenge CHAL in table ACR. During step S440-5, computer application 120 receives the acknowledgment ACK.

[0213] The authentication mechanism also includes step S450-5, which sends the response RESP* to the operating system 110. During step S740-5, the operating system 110 receives the response RESP*, and compares the first response and the second response, checking if they are equal. If this is the case (selecting "Yes"), then the computer application 120 is granted access to the traffic policy management function 111.

[0214] It is important to note that step S710-5 and the two steps S720-5 and S730-5 are not related to the concept of continuity over time. Specifically, step S710-5 and the two steps S720-5 and S730-5 can be implemented simultaneously, but the two steps S720-5 and S730-5 can also be implemented before step S710-5.

[0215] So far, a challenge-response authentication mechanism has been described in a scenario where the authentication system only includes controller 210. It still applies to scenarios where the authentication system includes both controller 210 and an authentication manager, as referenced... Figure 5A and Figure 5B What is presented.

Claims

1. A method for managing access to a traffic policy management function (111), the function being implemented by a terminal (100) connected to a telecommunications network (200), the method comprising the following steps implemented by an operating system (110) of the terminal (100): Using an authorization process implemented via the telecommunications network and selected by the controller (210) of the telecommunications network (200), it is checked (S150, S170) that the computer application (120) of the terminal (100) wishing to access the traffic policy management function (111) is authorized to invoke the function; and, Based on the results of the inspection, the computer application is authorized to access the function (S180) (111).

2. The method for managing access according to claim 1, further comprising: The operating system (110) receives (S120) data from the controller (210) of the telecommunications network (200) representing a computer application that is authorized or unauthorized to manage the traffic policy, and data representing a mechanism for authenticating a computer application that wishes to access the traffic policy management function (111) of the telecommunications network (200); The computer application (120) is authorized to manage the traffic policy being implemented, based on the received data.

3. A method for accessing traffic policy management functions (111), said functions being implemented by a terminal (100) connected to a telecommunications network (200), said method comprising the following steps implemented by a computer application of said terminal (100): The call to the traffic policy management function (111) (S300); The terminal (100) transmits to its operating system (110) authentication elements received from the authentication system (210, 220) of the telecommunications network (200) and required by the authorization process selected and implemented via the telecommunications network (200); and, Based on the result of the authorization process, access (S310) the traffic policy management function (111).

4. The access method according to claim 3, wherein, The authentication element includes an authentication token (TKN) sent to the operating system (110) when the function is invoked.

5. The access method according to claim 3 or 4 further includes transmitting the identification data (UE_ID) and / or timestamp of the terminal (100) to the operating system (110).

6. The access method according to claim 3, wherein, The authentication element includes a response (RESP*) associated with the challenge (CHAL) sent (S450-5) to the operating system (110) after receiving (S410-5) the challenge (CHAL) from the operating system (110).

7. The method according to any one of claims 1 to 6, wherein, The traffic policy management function (111) includes adding, removing, and / or modifying traffic classification rules generated by the manager of the telecommunications network (200).

8. The method according to claim 7, wherein, The traffic policy management function (111) includes adding rules that associate at least one flow of communication with the terminal (100) with at least one network slice of the telecommunications network (200) accessible to the terminal (100).

9. The method according to any one of claims 1 to 8, wherein, The authorization process includes authentication via authentication tokens or challenge-response type authentication.

10. The method according to any one of claims 1 to 9, wherein, The authorization process includes authentication via an authentication token, and the method further includes the following steps implemented by the operating system (110) of the terminal (100): sending (S720-1, S720-4) an authentication request (CHECK_TOKEN) for the computer application (120) to the controller (210), the authentication request including an authentication token (TKN) previously generated by the authentication system (210, 220) and provided by the computer application (120) to the operating system (110).

11. The method according to claim 10, wherein, The authentication request (CHECK_TOKEN) also includes identification data (APP_ID) of the computer application (120), which is controlled by the operating system (110) of the terminal (100).

12. The method according to claim 10 or 11, wherein, The authentication request (CHECK_TOKEN) also includes the identification data (UE_ID) of the terminal (100) previously transmitted by the authentication system (210, 220) and provided to the operating system by the computer application (120).

13. The method according to any one of claims 10 to 12, wherein, The authentication request (CHECK_TOKEN) also includes a timestamp (TS) previously transmitted by the authentication system (210, 220) and provided to the operating system (110) by the computer application (120).

14. The method according to any one of claims 10 to 12, wherein, The authentication is performed using a long-term authentication token, and if the authentication of the computer application (120) is valid, the authentication result provided by the controller (210) to the operating system (110) includes a time period (P) during which the operating system (110) must authorize new access to the traffic policy management function (111) without requiring the computer application (120) to perform new authentication to the telecommunications network (200).

15. The method for managing access according to any one of claims 1 or 2, wherein, The authentication process is a challenge-response authentication, and the method further includes the following steps implemented by the operating system (110): Send (S710-5) challenge (CHAL) to the computer application (120); Send (S730-5) parameterized data including the challenge (CHAL) and the first response (RESP) associated with the challenge (CHAL) to the controller (210); - Receive (S740-5) by the controller (210) in response to receiving (S620) a second response (RESP*) previously provided to the computer application (120) that was sent by the computer application (120) and included a request (SEEK_RESPONSE) for obtaining a response to the challenge (CHAL). And if the first response and the second response are equal, then the access to the traffic policy management function (111) is authorized (S760-5).

16. The access method according to any one of claims 3 to 9 in conjunction with claim 3, wherein, The authentication process is a challenge-response authentication, and the method further includes the following steps implemented by the operating system (120): Send a (S430-5) request (SEEK_RESPONSE) to the controller (210) to obtain a response including a challenge (CHAL) provided by the operating system (110) to the computer application (120); and, After receiving (S620-5) a request for a response (SEEK_RESPONSE), a second response (RESP*) provided by the controller (210) to the computer application (120) is sent (450-5) to the operating system (110).

17. A method for controlling access to a traffic policy management function (111), the function being implemented by a terminal (100) connected to a telecommunications network (200), the method comprising the following steps implemented by a controller (210) of the telecommunications network (200): Determine (S230) that the terminal (100) is authorized to allow the computer application of the terminal (100) to access the traffic policy management function (111); and, Send (S250) to the terminal (100) identification data of a computer application authorized or unauthorized to manage the traffic policy, and data indicating a mechanism for authenticating a computer application wishing to access the traffic policy management function (111) to the telecommunications network (200).

18. The method for controlling access according to claim 17, wherein, The authentication mechanism is based on authentication tokens, and the method further includes the following steps implemented by the authentication system (210, 220) of the telecommunications network (200): In response to receiving (S500-1, S600-2, S600-3, S600-4) a request for obtaining an authentication token issued by the computer application (120) of the terminal (100) and including the identification data (APP_ID) of the computer application (120), the application (120) is checked (S520-1, S620-2, S620-3, S620-4) based on the identification data to determine whether the application (120) can obtain the authentication token; and, Send (S550-1, S650-2, S640-3, S640-4) the authentication token (TKN) generated according to the checks (S520-1, S620-2, S620-3, S620-4) to the computer application (120).

19. The method for controlling access according to claim 18, further comprising the following steps implemented by the authentication system (210, 220): - Generate (S530-1, S510-2, S630-3, S630-4) the identification data (UE_ID) of the terminal (100); and, - Transmit the identification data (UE_ID) of the terminal (100) (S550-1, S650-2, S640-3, S640-4) to the computer application (120).

20. A terminal (100) configured to implement the method according to any one of claims 1 to 16.

21. A controller (210) for a telecommunications network (200) configured to implement the control method according to any one of claims 17 to 19.

Images