Granting authorization scope in communications networks

Abstract

The present disclosure provides a method for granting or permitting an authorization range in a communication network, the method comprising: receiving, at a first network node from a second network node, a first indication of a first authorization range related to a network node type, receiving, at the first network node from the second network node, a second indication of a second authorization range related to at least one second network node instance, receiving, at the first network node from the second network node, a third indication of a priority related to the first authorization range and / or the second authorization range, and granting, at the first network node, authorization to access to the second network node and / or the authorization range of the second network node based on the first indication, the second indication, and the third indication. In some embodiments, the method further comprises receiving, at the first network node from a third network node, a discovery request for a network node type of the second network node or an access token request for an authorization range of the second network node; authorizing, at the first network node, access by the third network node to the second network node and / or to the authorization range of the second network node based on the first instruction, the second instruction, and the third instruction; and sending, from the first network node to the third network node, a selection result in a discovery response or an access token in an access token response.

Description

[Technical Field]

[0001] The present invention relates generally to authorization mechanisms in communication or mobile networks, and more particularly, the present invention relates to granting or authorizing authorization scopes for network nodes in fifth generation (5G) mobile networks. [Background technology]

[0002] OAuth 2.0 (which stands for "open authorization") is a standard designed to authorize websites or applications to access resources hosted by other web apps on behalf of users. In 3GPP 5GC, OAuth 2.0 is used to authorize an NF service consumer (e.g., a UDM) to access some resources at an NF service producer (e.g., a UDR).

[0003] Scopes are a mechanism in OAuth 2.0 for restricting application access to a user's account. In a 5GC network, authorization is achieved by the NRF (authorization server), which provides an access token granting permission to the requested scopes. Therefore, an NF service consumer (e.g., UDM) can request one or more scopes to access (and update) resources in the requested NF type (e.g., UDR). The NRF will accept the requested scopes only if the NF service producer (e.g., UDR) has registered allowed scopes in the NRF for the requesting NF type (e.g., UDM) or the requesting NF instance (e.g., a unique ID for the UDM instance).

[0004] Problematic aspects of current solutions are described below.

[0005] In 3GPP TS29.510, the attributes "allowedOperationsPerNfType" and "allowedOperationsPerNfInstance" in the NFService type are used to indicate whether a given consumer is allowed to invoke certain operations (e.g., read, update) / operations on certain resources indicated by the required OAuth2.0 scope for such resources.

[0006] A consumer can be pointed to either by its NF type or by its unique NF instance ID.

[0007] In the current specification, a given range requested by a consumer is granted / allowed if such range is included in either the "allowedOperationsPerNfType" attribute or the "allowedOperationsPerNfInstance" attribute for the NF type and NF instance ID of the NF service consumer. This means that it is not possible to have a given NF instance ID with narrower access rights than its corresponding NF type.

[0008] For example, in the current specification, if an NF type UDM is specified (by all UDR NF instances) to have access to range A of the UDR API (e.g., user access and mobility data), while a specific UDM instance is specified to have access to range B of the UDR API (e.g., user authentication data), then such a UDM instance will always have access to ranges A and B; it is not possible to restrict a specific UDM instance to only having access to range A (in other words, not allow the specific UDM instance to access user authentication data) and grant access to ranges A and B for all other UDM NF instances. Summary of the Invention

[0009] The invention is set out in the accompanying claims.

[0010] It is an object of the present invention to enable the granting or authorization of a range of network nodes in a communications network.

[0011] A first aspect of the present invention relates to a method performed by a first network node for granting or permitting an authorization range in a communications network, the method comprising: receiving at the first network node from a second network node a first indication of a first authorization range related to a second network node type; receiving at the first network node from the second network node a second indication of a second authorization range related to at least one second network node instance, wherein the second network node is of a network node type; receiving at the first network node from the second network node a third indication of a priority related to the first authorization range and / or the second authorization range; and granting at the first network node an authorization for access to and / or to the authorization range of the second network node based on the first, second, and third indications, wherein the authorization is part of a network node discovery procedure or an access token request procedure. In some embodiments, the method further comprises receiving, at the first network node from a third network node, a discovery request for a network node type of the second network node or an access token request for an authorization range of the second network node, granting, at the first network node, access to the second network node and / or to the authorization range of the second network node by the third network node based on the first instruction, the second instruction, and the third instruction, and transmitting the discovery result in a discovery response or the access token in an access token response from the first network node to the third network node. In some embodiments, authorizing access to the second network node and / or to the authorization range of the second network node comprises determining that the authorization range for access to the second network node is included in the second authorization range.In some embodiments, authorizing access to the second network node and / or the authorization range of the second network node comprises determining, based on the third indication, that the authorization range of the second network node is included in an authorization range having a preferred or higher priority. In some embodiments, the priority relates to a priority of the first authorization range, to a priority of the second authorization range, or to a priority between the first authorization range and the second authorization range. In some embodiments, the first indication, the second indication, and / or the third indication are included in a network node registration request for network node discovery. In some embodiments, the first network node further transmits to the second network node a registration response message indicating successful registration of the second network node. In some embodiments, the first indication, the second indication, and / or the third indication are included in a network node profile, in particular, the network node profile is a network capability profile. In some embodiments, selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range. In some embodiments, selecting the second network node comprises determining that the first authorization range overrides the second authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range has a higher priority than the first authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range overrides the first authorization range. In some embodiments, the third indication indicates that the first authorization range has a higher priority than the second authorization range or overrides the second authorization range, particularly, the third indication is a Boolean indication. In some embodiments, the third indication indicates that the second authorization range has a higher priority than the first authorization range or overrides the first authorization range, particularly, the third indication is a Boolean indication. In some embodiments, the network node type is a network function type.In some embodiments, the second network node is a network node instance, in particular a network function instance. In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope. In some embodiments, the first indication is an allowedOperationsPerNfType attribute in an NFProfile data type or an NFService data type. In some embodiments, the second indication is an allowedOperationsPerNfInstance attribute in an NFProfile data type or an NFService data type. In some embodiments, the third indication is an allowedOperationsPerNfInstanceOverrides attribute in an NFProfile data type or an NFService data type. In some embodiments, the first network node is a Network Repository Function (NRF), the second network node is a network function producer, and the third network node is a network function consumer.

[0012] A second aspect of the present invention relates to a method performed by a second network node for granting or authorizing authorization ranges in a communications network. The method comprises: transmitting from the second network node to a first network node a first indication of a first authorization range related to a network node type; transmitting from the second network node to the first network node a second indication of a second authorization range related to at least one second network node instance, in particular, the second network node being of a network node type; and transmitting from the second network node to the first network node a third indication of a preference related to the first and / or second authorization ranges. In some embodiments, the preference relates to a preference of the first authorization range, to a preference of the second authorization range, or to a preference between the first and second authorization ranges. In some embodiments, the first, second, and / or third indications are included in a network node registration request for network node discovery. In some embodiments, the first network node further transmits a registration response message to the second network node indicating successful registration of the second network node. In some embodiments, the first instruction, the second instruction, and / or the third instruction are included in a network node profile, and in particular, the network node profile is a network function profile. In some embodiments, the third instruction indicates that the first authorization range has a higher priority than the second authorization range or overrides the second authorization range, and in particular, the third instruction is a Boolean instruction. In some embodiments, the third instruction indicates that the second authorization range has a higher priority than the first authorization range or overrides the first authorization range, and in particular, the third instruction is a Boolean instruction. In some embodiments, the network node type is a network function type. In some embodiments, the second network node is a network node instance, and in particular, a network function instance.In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope. In some embodiments, the first indication is an allowedOperationsPerNfType attribute in an NFProfile data type or an NFService data type. In some embodiments, the second indication is an allowedOperationsPerNfInstance attribute in an NFProfile data type or an NFService data type. In some embodiments, the third indication is an allowedOperationsPerNfInstanceOverrides attribute in an NFProfile data type or an NFService data type. In some embodiments, the first network node is a Network Repository Function (NRF) and the second network node is a network function producer.

[0013] A third aspect of the present invention relates to a method performed by a third network node for granting or authorizing an authorization range in a communication network. The method comprises sending a discovery request for a network node type of a second network node or an access token request for an authorization range of the second network node from the third network node to a first network node, and receiving a selection result in a discovery response or an access token in an access token response from the first network node at the third network node. In some embodiments, authorizing access to the second network node and / or within the authorization range of the second network node comprises determining that the authorization range for access to the second network node is included in the second authorization range. In some embodiments, authorizing access to the second network node and / or within the authorization range of the second network node comprises determining that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority based on a third instruction. In some embodiments, the priority relates to a priority of the first authorization range, to a priority of the second authorization range, or to a priority between the first authorization range and the second authorization range. In some embodiments, selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range. In some embodiments, selecting the second network node comprises determining that the first authorization range overrides the second authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range has a higher priority than the first authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range overrides the first authorization range. In some embodiments, the network node type is a network function type. In some embodiments, the second network node is a network node instance, in particular a network function instance.In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope. In some embodiments, the first network node is a Network Repository Function (NRF), the second network node is a network capability producer, and the third network node is a network capability consumer.

[0014] Other aspects of the present invention relate to mobile network nodes, in particular a first network node (110, 500), a second network node (600), a third network node (700) configured to perform the respective methods described herein. Other aspects of the present invention relate to computer programs and computer program products.

[0015] In some embodiments, the first network node is a Network Repository Function (NRF). In some embodiments, the second network node is a Network Function Producer (NFp). In some embodiments, the third network node is a Network Function Consumer (NFc).

[0016] Advantageously, the solution disclosed herein defines multiple ranges for a given NF type, but allows the flexibility to regulate several ranges for specific NF instances of the same NF type.

[0017] Additional objects, features, and advantages of the concepts disclosed herein will become apparent from the following detailed description, claims, and figures, or may be learned by practice of the described techniques and concepts set forth herein.

[0018] To best explain the manner in which the disclosed concepts may be implemented, as well as to define other objects, advantages, and features of the present disclosure, a more detailed description is provided below and illustrated in the accompanying drawings. With the understanding that these drawings depict only exemplary embodiments of the invention and therefore should not be considered limiting in scope, the examples will be described and explained with additional specificity and detail through the use of the accompanying drawings. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 illustrates an exemplary networked system in accordance with certain embodiments of the solutions described herein. [Figure 2] FIG. 1 illustrates an exemplary flowchart illustrating a method performed by a mobile network node in accordance with certain embodiments of the solutions described herein. [Figure 3] FIG. 1 illustrates an exemplary flowchart illustrating a method performed by a mobile network node in accordance with certain embodiments of the solutions described herein. [Figure 4] FIG. 1 illustrates an exemplary flowchart illustrating a method performed by a mobile network node in accordance with certain embodiments of the solutions described herein. [Figure 5] FIG. 1 illustrates an example block diagram of a mobile network node configured in accordance with certain embodiments of the solutions described herein. [Figure 6] FIG. 1 illustrates an example block diagram of a mobile network node configured in accordance with certain embodiments of the solutions described herein. [Figure 7] FIG. 1 illustrates an example block diagram of a mobile network node configured in accordance with certain embodiments of the solutions described herein. DETAILED DESCRIPTION OF THE INVENTION

[0020] The present invention will now be described in detail below with reference to the accompanying drawings, in which example embodiments or implementations of the invention are shown. The present invention, however, may be embodied or implemented in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. It should also be noted that these embodiments are not mutually exclusive. It may be implicitly assumed that elements from one embodiment are present / used in another embodiment. These embodiments of the disclosed subject matter are presented as instructional examples and should not be construed as limiting the scope of the disclosed subject matter. For example, some details of the described embodiments may be modified, omitted, or expanded without departing from the scope of the described subject matter.

[0021] Example embodiments described herein occur in the context of communication networks, including, but not limited to, communication networks that conform to and / or possibly incorporate aspects of fifth-generation (5G) architecture. Figure 1 is an example networked system 100 in accordance with an example embodiment of the present disclosure. Figure 1 particularly illustrates a user equipment (UE) 101 that may be in communication with a (radio) access network (RAN) 102, as well as an access and mobility management function (AMF) 106 and a user plane function (UPF) 103. The AMF 106 may be in communication with core network services, including a session management function (SMF) 107 and a policy control function (PCF) 111. The core network services may also be in communication with an application server / application function (AS / AF) 113. Other networked services also include a Network Slice Selection Function (NSSF) 108, an Authentication Server Function (AUSF) 105, a User Data Management (UDM) 112, a Network Publishing Function (NEF) 109, a Network Repository Function (NRF) 110, and a Data Network (DN) 104. In some example implementations of embodiments of the present disclosure, each of the entities in the networked system 100 is considered to be a Network Function (NF). One or more additional instances of an NF may be incorporated into the networked system.

[0022] The solution described herein aims to enable the granting or authorization of a range of network nodes in a communication network.

[0023] The present disclosure provides a method for granting or permitting an authorization range in a communication network, the method comprising: receiving, at a first network node from a second network node, a first indication of a first authorization range related to a network node type; receiving, at the first network node from the second network node, a second indication of a second authorization range related to at least one second network node instance, where the second network node is of a network node type; receiving, at the first network node from the second network node, a third indication of a priority related to the first authorization range and / or the second authorization range; and granting, at the first network node, authorization to access to and / or the authorization range of the second network node based on the first, second, and third indications, where the authorization is part of a network node discovery procedure or an access token request procedure. In some embodiments, the method further comprises receiving, at the first network node from a third network node, a discovery request for a network node type of the second network node or an access token request for an authorization range of the second network node, granting, at the first network node, access to the second network node and / or to the authorization range of the second network node by the third network node based on the first instruction, the second instruction, and the third instruction, and sending, from the first network node to the third network node, a selection result in a discovery response or an access token in an access token response. In some embodiments, authorizing access to the second network node and / or to the authorization range of the second network node comprises determining that the authorization range for access to the second network node is included in the second authorization range.In some embodiments, authorizing access to the second network node and / or the authorization range of the second network node comprises determining, based on the third indication, that the authorization range of the second network node is included in an authorization range having a preferred or higher priority. In some embodiments, the priority relates to a priority of the first authorization range, to a priority of the second authorization range, or to a priority between the first authorization range and the second authorization range. In some embodiments, the first indication, the second indication, and / or the third indication are included in a network node registration request for network node discovery. In some embodiments, the first network node further transmits to the second network node a registration response message indicating successful registration of the second network node. In some embodiments, the first indication, the second indication, and / or the third indication are included in a network node profile, in particular, the network node profile is a network capability profile. In some embodiments, selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range. In some embodiments, selecting the second network node comprises determining that the first authorization range overrides the second authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range has a higher priority than the first authorization range. In some embodiments, selecting the second network node comprises determining that the second authorization range overrides the first authorization range. In some embodiments, the third indication indicates that the first authorization range has a higher priority than the second authorization range or overrides the second authorization range, particularly, the third indication is a Boolean indication. In some embodiments, the third indication indicates that the second authorization range has a higher priority than the first authorization range or overrides the first authorization range, particularly, the third indication is a Boolean indication. In some embodiments, the network node type is a network function type.In some embodiments, the second network node is a network node instance, in particular a network function instance. In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope. In some embodiments, the first indication is an allowedOperationsPerNfType attribute in an NFProfile data type or an NFService data type. In some embodiments, the second indication is an allowedOperationsPerNfInstance attribute in an NFProfile data type or an NFService data type. In some embodiments, the third indication is an allowedOperationsPerNfInstanceOverrides attribute in an NFProfile data type or an NFService data type. In some embodiments, the first network node is a Network Repository Function (NRF), the second network node is a network function producer, and the third network node is a network function consumer.

[0024] The present disclosure also provides mobile network nodes, in particular a first network node (110, 500), a second network node (600), and a third network node (700), configured to perform the respective methods described herein. In some embodiments, the first network node is a Network Repository Function (NRF) 110. In some embodiments, the second network node is a Network Function Producer (NFp). In some embodiments, the third network node is a Network Function Consumer (NFc).

[0025] The present disclosure also provides a corresponding computer program and a computer program product comprising code, e.g. in the form of a computer program, which, when run on processing circuitry of a mobile network node, causes the mobile network node to perform the disclosed methods.

[0026] The solutions and features provided herein are further described below.

[0027] The NFp, upon NF registration with the NRF, provides a new flag as part of its NFp profile indicating that the ranges contained in "allowedOperationsPerNfInstance" take precedence (i.e., override) the ranges contained in "allowedOperationsPerNfType" when the NF type of the NF instance in the former attribute is also contained in the latter.

[0028] For example, in the example described in the previous section, if allowedOperationsPerNfType includes ranges A and B and allowedOperationsPerNfInstance includes only range A, when a new instruction is provided, the NRF will grant access only to range A for the particular NF instance and to ranges A and B for the rest of the NF instances of the same type.

[0029] This disclosure describes mechanisms for regulating / narrowing access to specific NF instances of an NF type while leaving all other instances with the (broader) access defined for that NF type.

[0030] The solution must maintain the necessary backward compatibility in the 3GPP API, and two alternatives are described below. 1) A new flag (allowedOperationsPerNfInstanceOverrides) indicating that the NF instance allowed range overrides the NF type allowed range: For example, if the NF type allowed range is 1, 2, 3, 4, 5, 6 and a particular NF instance cannot be granted range 6 (but should be granted all other ranges), then the NF instance range should be 1, 2, 3, 4, 5 and a new flag should be included and set to true. 2) A new attribute (restrictedOperationsPerNfInstance) that indicates the ranges that are not allowed for an NF instance among the ranges allowed for the corresponding NF type: For example, if the NF type allowed ranges are 1, 2, 3, 4, 5, 6, and a particular NF instance cannot be granted range 6 (but should be granted all other ranges), then the new attribute should contain only range 6. This means that the same range cannot exist simultaneously in both the new attribute restrictedOperationsPerNfInstance and the existing attribute allowedOperationsPerNfInstance.

[0031] In some embodiments, in addition to authorizing access operations (generally understood as read operations), other operations are authorized, for example, write, update, or delete operations.

[0032] These attributes are used to determine whether a given resource / operation level range should be granted to an NF service consumer that requested an Oauth2 access token with a particular range. If the attribute "allowedOperationsPerNfInstanceOverrides" is not present or set to false, the NRF should grant such a range in the access token if the range is either present in "allowedOperationsPerNfType" for a particular NF type of the NF service consumer or present in "allowedOperationsPerNfInstance" for a particular instance ID of the NF service consumer; if the attribute "allowedOperationsPerNfInstanceOverrides" is present and set to true, the NRF should grant such a range in the access token if the range is present in. Advantageously, the proposed solution specifies multiple ranges for a given NF type, but allows the flexibility to regulate several ranges for specific NF instances of the same NF type.

[0033] Below, a flowchart illustrating an example embodiment of the solution is described in detail.

[0034] The embodiments are implemented by a first network node (110, 500), a second network node (600), and a third network node (700), and correspond to methods involving the first network node (110, 500), the second network node (600), and the third network node (700).

[0035] FIG. 2 is a flowchart illustrating a method performed by a first network node for granting or authorizing an authorization range in a communication network.

[0036] In step S-201, a first network node receives from a second network node a first indication of a first authorization range associated with a network node type.

[0037] In step S-202, the first network node receives from the second network node a second indication of a second authorization range relating to the second network node, the second network node being of a network node type.

[0038] In step S-203, the first network node receives from the second network node a third indication of a priority associated with the first authorization range and / or the second authorization range.

[0039] In step S-204, the first network node receives a discovery request for the network node type of the second network node or an access token request for the authorization scope of the second network node from the third network node.

[0040] In step S-205, the first network node initiates authorization of access to the second network node and / or to the authorization range of the second network node based on the first instruction, the second instruction, and the third instruction, in particular, the authorization is part of a network node discovery procedure or an access token request procedure.

[0041] In step S-206, the first network node authorizes access by the third network node to the second network node and / or to the authorization range of the second network node based on the first instruction, the second instruction, and the third instruction.

[0042] In step S-207, the first network node sends the selection result in a discovery response or the access token in an access token response to the third network node.

[0043] In some embodiments, authorizing access to the second network node and / or an authorization range of the second network node comprises determining that the authorization range for access to the second network node is included in the second authorization range.

[0044] In some embodiments, authorizing access to the second network node and / or to an authorization range of the second network node comprises determining, based on the third instruction, that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority.

[0045] In some embodiments, the priority relates to a priority of a first authorization range, a priority of a second authorization range, or a priority between a first authorization range and a second authorization range.

[0046] In some embodiments, the first instruction, the second instruction and / or the third instruction are included in a network node registration request for network node discovery.

[0047] In some embodiments, the first network node further transmits to the second network node a registration response message indicating successful registration of the second network node.

[0048] In some embodiments, the first instructions, the second instructions and / or the third instructions are included in a network node profile, and in particular, the network node profile is a network function profile.

[0049] In some embodiments, selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range.

[0050] In some embodiments, selecting the second network node comprises determining that the first authorization range overrides the second authorization range.

[0051] In some embodiments, selecting the second network node comprises determining that the second authorization range has a higher priority than the first authorization range.

[0052] In some embodiments, selecting the second network node comprises determining that the second authorization range overrides the first authorization range.

[0053] In some embodiments, the third instruction indicates that the first authorization range has a higher priority than or overrides the second authorization range, and in particular, the third instruction is a Boolean instruction.

[0054] In some embodiments, the third instruction indicates that the second authorization range has a higher priority than or overrides the first authorization range, and in particular, the third instruction is a Boolean instruction.

[0055] In some embodiments, the network node type is a network function type.

[0056] In some embodiments, the second network node is a network node instance, in particular a network function instance.

[0057] In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope.

[0058] In some embodiments, the first indication is an allowedOperationsPerNfType attribute in an NFProfile data type or an NFService data type.

[0059] In some embodiments, the second indication is an allowedOperationsPerNfInstance attribute in an NFProfile data type or an NFService data type.

[0060] In some embodiments, the third directive is an allowedOperationsPerNfInstanceOverrides attribute in the NFProfile data type or the NFService data type.

[0061] In some embodiments, the first network node is a network repository function (NRF), the second network node is a network function producer, and the third network node is a network function consumer.

[0062] FIG. 3 is a flowchart illustrating a method performed by a second network node to grant or authorize an authorization range in a communication network.

[0063] In step S-301, the second network node sends to the first network node a first indication of a first authorization range associated with a network node type.

[0064] In step S-302, the second network node sends to the first network node a second indication of a second authorization range relating to the second network node, the second network node being of a network node type.

[0065] In step S-303, the second network node transmits to the first network node a third indication of the priority associated with the first authorization range and / or the second authorization range.

[0066] In some embodiments, the priority relates to a priority of a first authorization range, a priority of a second authorization range, or a priority between a first authorization range and a second authorization range.

[0067] In some embodiments, the first instruction, the second instruction and / or the third instruction are included in a network node registration request for network node discovery.

[0068] In some embodiments, the first network node further transmits to the second network node a registration response message indicating successful registration of the second network node.

[0069] In some embodiments, the first instructions, the second instructions and / or the third instructions are included in a network node profile, and in particular, the network node profile is a network function profile.

[0070] In some embodiments, the third instruction indicates that the first authorization range has a higher priority than or overrides the second authorization range, and in particular, the third instruction is a Boolean instruction.

[0071] In some embodiments, the third instruction indicates that the second authorization range has a higher priority than or overrides the first authorization range, and in particular, the third instruction is a Boolean instruction.

[0072] In some embodiments, the network node type is a network function type.

[0073] In some embodiments, the second network node is a network node instance, in particular a network function instance.

[0074] In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope.

[0075] In some embodiments, the first indication is an allowedOperationsPerNfType attribute in an NFProfile data type or an NFService data type.

[0076] In some embodiments, the second indication is an allowedOperationsPerNfInstance attribute in an NFProfile data type or an NFService data type.

[0077] In some embodiments, the third directive is an allowedOperationsPerNfInstanceOverrides attribute in the NFProfile data type or the NFService data type.

[0078] In some embodiments, the first network node is a Network Repository Function (NRF) and the second network node is a network function producer.

[0079] FIG. 4 is a flowchart illustrating a method performed by a third network node for granting or authorizing an authorization range in a communication network.

[0080] In step S-401, the third network node sends to the first network node a discovery request for the network node type of the second network node or an access token request for the authorization scope of the second network node.

[0081] In step S-402, the third network node receives the selection result in a discovery response or the access token in an access token response from the first network node.

[0082] In some embodiments, authorizing access to the second network node and / or an authorization range of the second network node comprises determining that the authorization range for access to the second network node is included in the second authorization range.

[0083] In some embodiments, authorizing access to the second network node and / or to an authorization range of the second network node comprises determining, based on the third instruction, that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority.

[0084] In some embodiments, the priority relates to a priority of a first authorization range, a priority of a second authorization range, or a priority between a first authorization range and a second authorization range.

[0085] In some embodiments, selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range.

[0086] In some embodiments, selecting the second network node comprises determining that the first authorization range overrides the second authorization range.

[0087] In some embodiments, selecting the second network node comprises determining that the second authorization range has a higher priority than the first authorization range.

[0088] In some embodiments, selecting the second network node comprises determining that the second authorization range overrides the first authorization range.

[0089] In some embodiments, the network node type is a network function type.

[0090] In some embodiments, the second network node is a network node instance, in particular a network function instance.

[0091] In some embodiments, the first authorization scope and / or the second authorization scope is an OAuth scope.

[0092] In some embodiments, the first network node is a network repository function (NRF), the second network node is a network function producer, and the third network node is a network function consumer.

[0093] FIG. 5 is a block diagram illustrating elements of a mobile network node 500 of a mobile communications network. In some embodiments, the mobile network node 500 is an NRF 110. As shown, the mobile network node may include a network interface circuit 501 (also referred to as a network interface) configured to provide communications with a core network and / or other nodes of the network. The mobile network node may also include a processing circuit 502 (also referred to as a processor) coupled to the network interface circuit and a memory circuit 503 (also referred to as a memory) coupled to the processing circuit. The memory circuit 503 may include computer-readable program code that, when executed by the processing circuit 502, causes the processing circuit to perform operations according to embodiments disclosed herein. According to other embodiments, the processing circuit 502 may be defined to include memory such that a separate memory circuit is not required. As discussed herein, the operations of the mobile network node may be performed by the processing circuit 502 and / or the network interface circuit 501. For example, the processing circuitry 502 may control the network interface circuitry 501 to send communications to one or more other network nodes and / or to receive communications from one or more other network nodes through the network interface circuitry 501. Moreover, modules may be stored in the memory 503 that, when executed by the processing circuitry 502, cause the processing circuitry 502 to perform respective operations (e.g., operations discussed below with respect to exemplary embodiments relating to a core network node).

[0094] FIG. 6 is a block diagram illustrating elements of a mobile network node 600 of a mobile communications network. In some embodiments, the mobile network node 600 is an NFp. As shown, the mobile network node may include a network interface circuit 601 (also referred to as a network interface) configured to provide communications with a core network and / or other nodes of the network. The mobile network node may also include a processing circuit 602 (also referred to as a processor) coupled to the network interface circuit and a memory circuit 603 (also referred to as a memory) coupled to the processing circuit. The memory circuit 603 may include computer-readable program code that, when executed by the processing circuit 602, causes the processing circuit to perform operations according to embodiments disclosed herein. According to other embodiments, the processing circuit 602 may be defined to include memory such that a separate memory circuit is not required. As discussed herein, the operations of the mobile network node may be performed by the processing circuit 602 and / or the network interface circuit 601. For example, the processing circuit 602 may control the network interface circuit 601 to send communications to one or more other network nodes and / or to receive communications from one or more other network nodes through the network interface circuit 601. Moreover, modules may be stored in the memory 603 that, when executed by the processing circuit 602, cause the processing circuit 602 to perform respective operations (e.g., operations discussed below with respect to exemplary embodiments related to a core network node).

[0095] FIG. 7 is a block diagram illustrating elements of a mobile network node 700 of a mobile communications network. In some embodiments, the mobile network node 700 is an NFc. As shown, the mobile network node may include a network interface circuit 701 (also referred to as a network interface) configured to provide communications with a core network and / or other nodes of the network. The mobile network node may also include a processing circuit 702 (also referred to as a processor) coupled to the network interface circuit and a memory circuit 703 (also referred to as a memory) coupled to the processing circuit. The memory circuit 703 may include computer-readable program code that, when executed by the processing circuit 702, causes the processing circuit to perform operations according to embodiments disclosed herein. According to other embodiments, the processing circuit 702 may be defined to include memory such that a separate memory circuit is not required. As discussed herein, the operations of the mobile network node may be performed by the processing circuit 702 and / or the network interface circuit 701. For example, the processing circuit 702 may control the network interface circuit 701 to send communications to one or more other network nodes through the network interface circuit 701 and / or to receive communications from one or more other network nodes through the network interface circuit 701. Moreover, modules may be stored in the memory 703 that, when executed by the processing circuit 702, cause the processing circuit 702 to perform respective operations (e.g., operations discussed below with respect to exemplary embodiments relating to a core network node).

[0096] Embodiments within the scope of the present invention may also include computer-readable media for carrying or having computer-executable instructions or data structures stored thereon. Such computer-readable media may be any available media that can be accessed by a general-purpose or special-purpose computer. By way of example, and not limitation, such tangible computer-readable media may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code means in the form of computer-executable instructions or data structures. When information is transferred or provided over a network or another communications connection (either wired, wireless, or combination thereof) to a computer, the computer properly views the connection as a computer-readable medium. Any such connection is thereby properly termed a computer-readable medium. Combinations of the above should also be included within the scope of tangible computer-readable media.

[0097] Computer-executable instructions include, for example, instructions and data that cause a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a certain function or group of functions. Computer-executable instructions also include program modules that are executed by computers in stand-alone or network environments. Generally, program modules include routines, programs, objects, components, and data structures that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of the program code means for executing steps of the methods disclosed herein. A particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps.

[0098] Those skilled in the art will appreciate that other embodiments of the present invention may be practiced in networked computing environments with many types of computer system configurations, including personal computers, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, etc. Embodiments may also be practiced in distributed computing environments where tasks are performed by local and remote processing devices that are linked through a communications network (either by hardwired links, wireless links, or a combination thereof). In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0099] Communications at various stages of the described system may be carried out over local area networks, token ring networks, the Internet, corporate intranets, 802.11 series wireless signals, fiber optic networks, radio or microwave transmissions, etc. While the underlying communications technologies may vary, the basic principles described herein remain applicable.

[0100] The various embodiments described above are provided by way of example only and should not be construed as limiting the present invention. For example, the principles herein may be applied to any remotely controlled device. Furthermore, those skilled in the art will recognize that communication between remote, remotely controlled devices need not be limited to communication over a local area network, but can include communication over an infrared channel, Bluetooth, or any other suitable communication interface. Those skilled in the art will readily recognize various modifications and variations that can be made to the present invention without following the exemplary embodiments and applications shown and described herein and without departing from the scope of the present disclosure.

[0101] The terminology used herein is for the purpose of describing various embodiments only and is not intended to limit exemplary embodiments. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly dictates otherwise. It will be further understood that as used herein, the terms "includes," "including," "comprises," and "comprising" specify the presence of stated features, integers, steps, operations, elements, or components, and combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, or components, and combinations thereof. Furthermore, all terms used in the claims are to be interpreted according to their ordinary meaning in the art unless expressly defined otherwise herein. All references to "a / an / the element, apparatus, component, means, module, step, etc.", unless expressly stated otherwise, should be openly interpreted as referring to at least one instance of that element, apparatus, component, means, module, step, etc. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless expressly stated.

Claims

1. 1. A method for granting or authorizing authorization ranges in a communications network, the method comprising: receiving, at the first network node from a second network node, a first indication of a first authorization range associated with the second network node type; receiving, at the first network node from the second network node, a second indication of a second authorization scope relating to at least one second network node instance; receiving, at the first network node from the second network node, a third indication of a priority associated with the first authorization range and / or the second authorization range; granting, at the first network node, authorization for access to the second network node and / or to an authorization range of the second network node based on the first instruction, the second instruction, and the third instruction, in particular, the authorization being part of a network node discovery procedure or an access token request procedure; Including, the first network node is a Network Repository Function (NRF); method.

2. receiving, at the first network node, from a third network node, a discovery request for a network node type of the second network node or an access token request for an authorization scope of the second network node; granting, at the first network node, the access by the third network node to the second network node and / or to the authorization range of the second network node based on the first instruction, the second instruction, and the third instruction; sending a discovery result in a discovery response or an access token in an access token response from the first network node to the third network node; The method of claim 1 further comprising:

3. 3. The method of claim 2, wherein the authorization of the access to the second network node and / or to the authorization range of the second network node comprises determining that an authorization range for the access to the second network node is included in the second authorization range.

4. 4. The method of claim 2 or 3, wherein the authorization of the access to the second network node and / or to the authorization range of the second network node comprises determining, based on the third indication, that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority.

5. 5. The method of claim 1, wherein the priority relates to the priority of the first authorization range, to the priority of the second authorization range, or to the priority between the first authorization range and the second authorization range.

6. The method of claim 1 , wherein the first indication, the second indication and / or the third indication are included in a network node registration request for network node discovery.

7. 7. The method of claim 6, wherein the first network node further sends a registration response message to the second network node indicating successful registration of the second network node.

8. 8. The method according to claim 1, wherein the first instruction, the second instruction and / or the third instruction are included in a network node profile, in particular the network node profile is a network function profile.

9. 9. The method of claim 1, wherein selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range.

10. The method of claim 1 , wherein the selection of the second network node comprises determining that the first authorization range overrides the second authorization range.

11. 11. The method of claim 1, wherein the selection of the second network node comprises determining that the second authorization range has a higher priority than the first authorization range.

12. 12. The method of claim 1, wherein the selection of the second network node comprises determining that the second authorization range overrides the first authorization range.

13. 13. The method according to claim 1, wherein the third instruction indicates that the first authorization range has a higher priority than or overrides the second authorization range, in particular, the third instruction is a Boolean instruction.

14. 14. The method according to claim 1, wherein the third instruction indicates that the second authorization range has a higher priority than or overrides the first authorization range, in particular, the third instruction is a Boolean instruction.

15. The method of claim 1 , wherein the network node type is a network function type.

16. 16. The method according to claim 1, wherein the second network node is a network node instance, in particular a network function instance.

17. 17. The method of claim 1, wherein the first authorization scope and / or the second authorization scope is an OAuth scope.

18. The method of claim 1 , wherein the first indication is an allowedOperationsPerNfType attribute in an NFProfile or NFService data type.

19. The method of claim 1 , wherein the second indication is an allowedOperationsPerNfInstance attribute in the NFProfile data type or the NFService data type.

20. The method of claim 1 , wherein the third indication is an allowedOperationsPerNfInstanceOverrides attribute in the NFProfile data type or the NFService data type.

21. 21. The method of claim 1, wherein the second network node is a network function producer and the third network node is a network function consumer.

22. 1. A method performed by a first network node for granting or authorizing an authorization range in a communications network, the method comprising: receiving, at the first network node from a second network node, a first indication of a first authorization range associated with the second network node type; receiving, at the first network node from the second network node, a second indication of a second authorization scope relating to at least one second network node instance; receiving, at the first network node from the second network node, a third indication of a priority associated with the first authorization range and / or the second authorization range; granting, at the first network node, authorization for access to the second network node and / or to an authorization range of the second network node based on the first instruction, the second instruction, and the third instruction, in particular, the authorization being part of a network node discovery procedure or an access token request procedure; Equipped with the first network node is a Network Repository Function (NRF); method.

23. receiving, at the first network node, from a third network node, a discovery request for a network node type of the second network node or an access token request for an authorization scope of the second network node; granting, at the first network node, the access by the third network node to the second network node and / or to the authorization range of the second network node based on the first instruction, the second instruction, and the third instruction; sending a discovery result in a discovery response or an access token in an access token response from the first network node to the third network node; 23. The method of claim 22, further comprising:

24. 24. The method of claim 23, wherein the authorization of the access to the second network node and / or to the authorization range of the second network node comprises determining that an authorization range for the access to the second network node is included in the second authorization range.

25. 25. The method of claim 23 or 24, wherein the authorization of the access to the second network node and / or to the authorization range of the second network node comprises determining, based on the third indication, that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority.

26. 26. The method of any one of claims 22 to 25, wherein the priority relates to the priority of the first authorization range, to the priority of the second authorization range, or to the priority between the first authorization range and the second authorization range.

27. 27. The method of claim 22, wherein the first indication, the second indication and / or the third indication are included in a network node registration request for network node discovery.

28. 28. The method of claim 27, wherein the first network node further sends a registration response message to the second network node indicating successful registration of the second network node.

29. 29. The method of any one of claims 22 to 28, wherein the first instruction, the second instruction and / or the third instruction are included in a network node profile, in particular the network node profile is a network function profile.

30. 30. The method of any one of claims 22 to 29, wherein selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range.

31. 31. The method of claim 22, wherein the selection of the second network node comprises determining that the first authorization range overrides the second authorization range.

32. 32. The method of claim 22, wherein the selection of the second network node comprises determining that the second authorization range has a higher priority than the first authorization range.

33. 33. The method of any one of claims 22 to 32, wherein the selection of the second network node comprises determining that the second authorization range overrides the first authorization range.

34. 34. The method of claim 22, wherein the third instruction indicates that the first authorization range has a higher priority than or overrides the second authorization range, in particular, the third instruction is a Boolean instruction.

35. 35. The method of claim 22, wherein the third instruction indicates that the second authorization range has a higher priority than or overrides the first authorization range, in particular, the third instruction is a Boolean instruction.

36. 36. The method of any one of claims 22 to 35, wherein the network node type is a network function type.

37. 37. The method of any one of claims 22 to 36, wherein the second network node is a network node instance, in particular a network function instance.

38. 38. The method of any one of claims 22 to 37, wherein the first authorization scope and / or the second authorization scope is an OAuth scope.

39. 39. The method of any one of claims 22 to 38, wherein the first indication is an allowedOperationsPerNfType attribute in an NFProfile or NFService data type.

40. 40. The method of claim 22, wherein the second indication is an allowedOperationsPerNfInstance attribute in the NFProfile data type or the NFService data type.

41. 41. The method of claim 22, wherein the third indication is an allowedOperationsPerNfInstanceOverrides attribute in the NFProfile data type or the NFService data type.

42. 42. The method of any one of claims 22 to 41, wherein the second network node is a network function producer and the third network node is a network function consumer.

43. 1. A method performed by a second network node for granting or authorizing an authorization range in a communications network, the method comprising: transmitting, from the second network node to the first network node, a first indication of a first authorization range associated with the second network node type; sending, from the second network node to the first network node, a second indication of a second authorization range relating to at least one second network node instance; sending from the second network node to the first network node a third indication of a priority associated with the first authorization range and / or the second authorization range; Equipped with the first network node is a Network Repository Function (NRF); method.

44. 44. The method of claim 43, wherein the priority relates to the priority of the first authorization range, to the priority of the second authorization range, or to the priority between the first authorization range and the second authorization range.

45. 45. The method of claim 43 or 44, wherein the first indication, the second indication and / or the third indication are included in a network node registration request for network node discovery.

46. 46. ​​The method of claim 45, wherein the first network node further sends a registration response message to the second network node indicating successful registration of the second network node.

47. 47. The method of any one of claims 43 to 46, wherein the first instruction, the second instruction and / or the third instruction are included in a network node profile, in particular the network node profile is a network function profile.

48. 48. The method of claim 43, wherein the third instruction indicates that the first authorization range has a higher priority than or overrides the second authorization range, in particular, the third instruction is a Boolean instruction.

49. 49. The method of any one of claims 43 to 48, wherein the third instruction indicates that the second authorization range has a higher priority than or overrides the first authorization range, in particular, the third instruction is a Boolean instruction.

50. 50. The method of any one of claims 43 to 49, wherein the network node type is a network function type.

51. 51. The method of any one of claims 43 to 50, wherein the second network node is a network node instance, in particular a network function instance.

52. 52. The method of any one of claims 43 to 51, wherein the first authorization scope and / or the second authorization scope is an OAuth scope.

53. 53. The method of any one of claims 43 to 52, wherein the first indication is an allowedOperationsPerNfType attribute in an NFProfile or NFService data type.

54. 54. The method of any one of claims 43 to 53, wherein the second indication is an allowedOperationsPerNfInstance attribute in the NFProfile data type or the NFService data type.

55. 55. The method of any one of claims 43 to 54, wherein the third indication is an allowedOperationsPerNfInstanceOverrides attribute in the NFProfile data type or the NFService data type.

56. 56. The method of any one of claims 43 to 55, wherein the second network node is a network function producer.

57. 1. A method performed by a third network node for granting or authorizing an authorization range in a communications network, the method comprising: sending, from a third network node to the first network node, a discovery request for a network node type of the second network node or an access token request for an authorization scope of the second network node; receiving, at the third network node, from the first network node, a discovery result in a discovery response or an access token in an access token response; Equipped with the first network node is a Network Repository Function (NRF); method.

58. 58. The method of claim 57, wherein authorizing access to the second network node and / or the authorization range of the second network node comprises determining that the authorization range for the access to the second network node is included in a second authorization range.

59. 59. The method of claim 57 or 58, wherein the authorization of access to the second network node and / or to the authorization range of the second network node comprises determining, based on a third indication, that the authorization range of the second network node is included in an authorization range that is preferred or has a higher priority.

60. 60. The method of any one of claims 57 to 59, wherein the priority relates to a priority of a first authorization range, to a priority of the second authorization range, or to a priority between the first authorization range and the second authorization range.

61. 61. The method of any one of claims 57 to 60, wherein selecting the second network node comprises determining that the first authorization range has a higher priority than the second authorization range.

62. 62. The method of any one of claims 57 to 61, wherein the selection of the second network node comprises determining that the first authorization range overrides the second authorization range.

63. 63. The method of any one of claims 57 to 62, wherein the selection of the second network node comprises determining that the second authorization range has a higher priority than the first authorization range.

64. 64. The method of any one of claims 57 to 63, wherein the selection of the second network node comprises determining that the second authorization range overrides the first authorization range.

65. 65. The method of any one of claims 57 to 64, wherein the network node type is a network function type.

66. 66. The method of any one of claims 57 to 65, wherein the second network node is a network node instance, in particular a network function instance.

67. 67. The method of any one of claims 57 to 66, wherein the first authorization scope and / or the second authorization scope is an OAuth scope.

68. 68. The method of any one of claims 57 to 67, wherein the second network node is a network function producer and the third network node is a network function consumer.

69. 43. An apparatus for granting or authorizing authorization ranges in a communications network, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to perform the method of any one of claims 22 to 42.

70. 57. An apparatus for granting or authorizing authorization ranges in a communications network, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to perform the method of any one of claims 43 to 56.

71. 69. An apparatus for granting or authorizing authorization ranges in a communications network, the apparatus comprising a processor and a memory, the memory containing instructions executable by the processor such that the apparatus is operable to perform the method of any one of claims 57 to 68.

72. A system comprising the device of claim 69, the device of claim 70, and the device of claim 71.

73. 69. A computer-implemented system comprising one or more processors and one or more computer storage media storing computer usable instructions, the computer usable instructions, when used by the one or more processors, causing the one or more processors to perform the method of any one of claims 22 to 68.

74. 69. A computer program comprising instructions which, when executed on at least one processor, cause the at least one processor to perform the method of any one of claims 22 to 68.

75. 69. A computer program product embodied on a non-transitory machine-readable medium comprising instructions executable by a processor to cause the processor to perform the method of any one of claims 22 to 68.

Images