Apparatuses and methods for access token revocation

Abstract

Example embodiments enable access token revocation based on integer identifiers of the access tokens An apparatus may be configured to store at least one list of non- overlapping identifier ranges having integer values, wherein each list is allocated for assigning unique identifiers to access tokens based on at least one information element; provide an access token with an identifier of the access token to at least one first network entity authorized to access a service of a network function provider, wherein the identifier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; store a mapping of the provided access tokens and the assigned identifiers; receive an indication that access tokens having an identifier assigned from one or more of the lists based on the mapping are to be revoked; and send a notification to at least one second network entity, wherein the notification comprises information on one or more identifiers of the revoked access tokens. Apparatuses, methods, and computer programs are disclosed.

Description

APPARATUSES AND METHODS FOR ACCESS TOKEN REVOCATIONTECHNICAL FIELD

[0001] The present application generally relates to information technology . Some example embodiments of the present application relate to a mechanism for access token revocation .BACKGROUND

[0002] Open authori zation ( OAuth) is an open standard for access delegation . OAuth may be used, for example , to let resource owners to provide a client application with a secure delegated access to server resources . The resource owners may be allowed to authori ze third-party access to the server resources with access tokens issued by an authori zation server, with the approval of the resource owner . An access token concept may be used in 5G core network in form of SBA ( service-based architecture ) communication . Further, RAN ( radio-access network) and 6G concept are also being built around SBA. Hence , SBA may become a core concept for 6G as well . Therefore , it would be beneficial to further develop the access token mechanism for improved security .SUMMARY

[0003] This summary is provided to introduce a selection of concepts in a simpli fied form that are further described below in the detailed description . This summary is not intended to identi fy key features or essential features of the claimed subj ect matter, nor is it intended to be used to limit the scope of the claimed subj ect matter .

[0004] Example embodiments may enable implementing access token revocation based on access token ranges with integer identi fiers of access tokens . The integer identi fiers may be allocated from numeric ranges according to information associated with the network function which requested the access token . An apparatus may be configured to detect when one or more allocated access tokens are no longer val id and inform linked entities about integer identi f iers of the invalid access tokens . Hence , service requests from malicious or anomalous requesters , or no longer authori zed entities after a profile or policy update , can be rej ected by the entities based on the identi fier of the access token . This may be achieved by the features of the independent claims . Further implementation forms are provided in the dependent claims , the description, and the drawings .

[0005] According to a first aspect , a first apparatus may be comprise at least one proces sor ; and at least one memory including instructions which, when executed by the at least one processor, cause the first apparatus at least to store at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; provide an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; store a mapping of the provided access tokens and the assigned identi fiers ; receive an indication that access tokens having an identi fier assigned from the at least one list based on the mapping are to be revoked;and send a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens .

[0006] According to an example embodiment of the first aspect , at least one of the one or more nonoverlapping identi fier ranges having integer values is stored as an information element comprising a minimum value of an integer in the range and a maximum value of an integer in the range .

[0007] According to an example embodiment of the first aspect , the access token is provided to a first network entity based on a request received from the first network entity .

[0008] According to an example embodiment of the first aspect , the identi fier is assigned based on an information element of the request .

[0009] According to an example embodiment of the first aspect , the at least one list is allocated for assigning the unique identi fiers based on a time window and the at least one information element associated with the first network entity comprises a timestamp of the provided access token within the time window .

[0010] According to an example embodiment of the first aspect , the timestamp comprises a creation time of the access token or an expiry time of the access token .

[0011] According to an example embodiment of the first aspect , the at least one memory further comprises instructions which, when executed by the at least one processor, cause the first apparatus to send a noti fication comprising an indication of a time window of timestamps associated with the revoked access tokens .

[0012] According to an example embodiment of the first aspect , the information element associated witheach of the at least one first network entity comprises at least one of an identity of a network function customer instance , a type of a network function customer, an identi fier of a host platform of the network function customer, an identi fier of a source public land mobi le network or a service region .

[0013] According to an example embodiment of the first aspect , the indication comprises at least one of an identity of a network function consumer instance , a type of a network function consumer or an identi fier of a public land mobile network being determined to be a source of malicious or anomalous service requests ; and wherein the at least one list is allocated for assigning identi fiers to access tokens based on at least one of the identi fier of a network function consumer instance , the type of a network function consumer or the identifier of a public land mobile network being determined to be a source of malicious or anomalous service requests .

[0014] According to an example embodiment of the first aspect , the indication comprises a change in authori zation to access the service of the network function provider ; and the at least one list is allocated for assigning identi fiers to access tokens based on information af fected by the authori zation change .

[0015] According to an example embodiment of the first aspect , the indication comprises a request for profile update from the network function provider .

[0016] According to an example embodiment of the first aspect , the indication comprises a request for policy change .

[0017] According to an example embodiment of the first aspect , the indication compri sing a request for policy change is received from an operations , administration and maintenance function .

[0018] According to an example embodiment of the first aspect , each of the at least one first network entity is a network function consumer or a user equipment .

[0019] According to an example embodiment of the first aspect , the at least one second network entity comprises at least one of the network function provider, a security edge protection proxy or a service communication proxy .

[0020] According to an example embodiment of the first aspect , the at least one memory comprises instructions which, when executed by the at least one processor, cause the first apparatus to store in the mapping information about each of the at least one first network entity, and about the access tokens associated with each of the at least one first network entity; and send a noti fication comprising information on the one or more identi f iers of the revoked access tokens to one or more of the at least one first network entity associated with a revoked access token based on the mapping .

[0021] According to an example embodiment of the first aspect , the information on the one or more identi fiers of the revoked access tokens comprises at least one of : one or more identi f iers , or one or more identi fier ranges .

[0022] According to an example embodiment of the first aspect , the mapped information about the at least one network function consumer comprises at least one of an identity of a network function consumer instance , a type of a network function consumer, s lice information, identity of a publ ic land mobile network, or one or more information elements associated with a service request of the network function consumer .

[0023] According to an example embodiment of the first aspect , the first apparatus comprises or is comprised in a network repository function .

[0024] According to a second aspect , a second apparatus comprises at least one processor ; and at least one memory including instructions which, when executed by the at least one processor, cause the second apparatus to store at least one access token with an associated access token identi fier ; receive a noti fication comprising one or more identi f iers of revoked access tokens ; and determine , for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi f iers of revoked access tokens .

[0025] According to an example embodiment of the second aspect , the noti fication comprises at least one of : one or more identi fiers , or one or more identifier ranges .

[0026] According to an example embodiment of the second aspect , the at least one memory further comprises instructions which, when executed by the at least one processor, cause the second apparatus to : receive a noti fication comprising an indication of a time window of timestamps associated with the revoked access tokens ; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window .

[0027] According to an example embodiment of the second aspect , the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .

[0028] According to a third aspect , a third apparatus comprises at least one processor ; and at least one memory including instructions which, when executed by the at least one processor, cause the third apparatus at least to receive , from a first network entity, one or more identi fiers of revoked access tokens ; receive a service request comprising an access token with an associated access token identi fier ; determine that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi f iers of revoked access tokens ; and rej ect the service request based on the determining that the access token has been revoked .

[0029] According to an example embodiment of the third aspect , the one or more identi f iers are received in a message compri sing at least one of : one or more identi fiers or one or more identi fier ranges .

[0030] According to an example embodiment of the third aspect , the at least one memory further comprises instructions which, when executed by the at least one processor, cause the third apparatus to send a request for profile update to the first network entity; and wherein at least one of the one or more identi fiers of revoked access tokens is received in response to the request .

[0031] According to an example embodiment of the third aspect , the third apparatus comprises or is comprised in one of : a network function provider, a security edge protection proxy or a service communication proxy .

[0032] According to an example embodiment of the third aspect , the at least one memory further comprises instructions which, when executed by the at least one processor, cause the third apparatus to receive anindication of a time window of timestamps associated with the revoked access tokens ; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window .

[0033] According to an example embodiment of the third aspect , the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .

[0034] According to a fourth aspect , a method carried out by a first apparatus is provided . The method comprises storing at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; providing an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identifier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; storing a mapping of the provided access tokens and the assigned identi f iers ; receiving an indication that access tokens having an identifier assigned from the at least one list based on the mapping are to be revoked; and sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens .

[0035] According to an example embodiment of the fourth aspect , at least one of the one or more nonoverlapping identi fier ranges having integer values is stored as an information element comprising a minimum value of an integer in the range and a maximum value of an integer in the range .

[0036] According to an example embodiment of the fourth aspect , the access token is provided to a first network entity based on a request received from the first network entity .

[0037] According to an example embodiment of the fourth aspect , the identi fier is assigned based on an information element of the request .

[0038] According to an example embodiment of the fourth aspect , the at least one list is allocated for assigning the unique identi fiers based on a time window and the at least one information element associated with the first network entity comprises a timestamp of the provided access token within the time window .

[0039] According to an example embodiment of the fourth aspect , the timestamp comprises a creation time of the access token or an expiry time of the access token .

[0040] According to an example embodiment of the fourth aspect , the method comprises sending a noti fication comprising an indication of a time window of timestamps associated with the revoked access tokens .

[0041] According to an example embodiment of the fourth aspect , the information element associated with each of the at least one first network entity comprises at least one of an identity of a network function customer instance , a type of a network function customer, an identi fier of a host platform of the network function customer, an identi fier of a source public land mobi le network or a service region .

[0042] According to an example embodiment of the fourth aspect , the indication comprises at least one of an identity of a network function consumer instance , a type of a network function consumer or an identi fier ofa public land mobile network being determined to be a source of malicious or anomalous service requests ; and wherein the at least one list is allocated for assigning identi fiers to access tokens based on at least one of the identi fier of a network function consumer instance , the type of a network function consumer or the identifier of a public land mobile network being determined to be a source of malicious or anomalous service requests .

[0043] According to an example embodiment of the fourth aspect , the indication comprises a change in authori zation to access the service of the network function provider ; and the at least one list is allocated for assigning identi fiers to access tokens based on information af fected by the authori zation change .

[0044] According to an example embodiment of the fourth aspect , the indication comprises a request for profile update from the network function provider .

[0045] According to an example embodiment of the fourth aspect , the indication comprises a request for policy change .

[0046] According to an example embodiment of the fourth aspect , the indication comprising a request for policy change is received from an operations , administration and maintenance function .

[0047] According to an example embodiment of the fourth aspect , each of the at least one first network entity is a network function consumer or a user equipment .

[0048] According to an example embodiment of the fourth aspect , the at least one second network entity comprises at least one of the network function provider, a security edge protection proxy or a service communication proxy .

[0049] According to an example embodiment of the fourth aspect , the method comprises storing in the mapping information about each of the at least one first network entity, and about the access tokens associated with each of the at least one first network entity; and sending a noti fication comprising information on the one or more identi fiers of the revoked access tokens to one or more of the at least one first network entity associated with a revoked access token based on the mapping .

[0050] According to an example embodiment of the fourth aspect , the information on the one or more identi fiers of the revoked access tokens comprises at least one of : one or more identi f iers , or one or more identi fier ranges .

[0051] According to an example embodiment of the fourth aspect , the mapped information about the at least one network function consumer comprises at least one of an identity of a network function consumer instance , a type of a network function consumer, s lice information, identity of a publ ic land mobile network, or one or more information elements associated with a service request of the network function consumer .

[0052] According to an example embodiment of the fourth aspect , the first apparatus comprises or is comprised in a network repository function .

[0053] According to a fi fth aspect , a method carried out by a second apparatus is provided . The method comprises storing at least one access token with an associated access token identifier ; receiving a noti fication comprising one or more identi fiers of revoked access tokens ; and determining, for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fierassociated with the access token matching with an identifier comprised in the one or more identifiers of revoked access tokens.

[0054] According to an example embodiment of the fifth aspect, the notification comprises at least one of: one or more identifiers, or one or more identifier ranges .

[0055] According to an example embodiment of the fifth aspect, the method may comprise receiving a notification comprising an indication of a time window of timestamps associated with the revoked access tokens; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window.

[0056] According to an example embodiment of the fifth aspect, the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token.

[0057] According to a sixth aspect, a method carried out by a third apparatus is provided. The method comprises receiving, from a first network entity, one or more identifiers of revoked access tokens; receiving a service request comprising an access token with an associated access token identifier; determining that the access token has been revoked based on the access token identifier associated with the access token matching an identifier comprised in the one or more identifiers of revoked access tokens; and rejecting the service request based on the determining that the access token has been revoked .

[0058] According to an example embodiment of the sixth aspect, the one or more identifiers are received in a message comprising at least one of: one or more identifiers or one or more identifier ranges.

[0059] According to an example embodiment of the sixth aspect , the method further comprises sending a request for profile update to the first network entity; and wherein at least one of the one or more identi fiers of revoked access tokens is received in response to the request .

[0060] According to an example embodiment of the sixth aspect , the third apparatus comprises or is comprised in one of : a network function provider, a security edge protection proxy or a service communication proxy .

[0061] According to an example embodiment of the sixth aspect , the method comprises receiving an indication of a time window of timestamps associated with the revoked access tokens ; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window .

[0062] According to an example embodiment of the sixth aspect , the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .

[0063] According to a seventh aspect , a computer program may be configured, when executed by a processor, to cause an apparatus at least to perform the following : store at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identifiers to access tokens based on at least one information element ; provide an access token with an identifier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity;store a mapping of the provided access tokens and the assigned identi fiers ; receive an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; and send a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens . The computer program may further comprise instructions for causing the apparatus to perform any example embodiment of the method of the fourth aspect .

[0064] According to an eight aspect , a computer readable medium may comprise program instructions that , when executed by an apparatus , cause the apparatus to perform the method, or any example embodiment of the method, of the fourth aspect .

[0065] According to a ninth aspect , an apparatus may comprise means for storing at least one list of nonoverlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; means for providing an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one li st based on at least one information element associated with the at least one first network entity; means for storing a mapping of the provided access tokens and the assigned identi fiers ; means for receiving an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; and means for sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of therevoked access tokens . The apparatus may further comprise means for performing any example embodiment of the method of the fourth aspect .

[0066] According to a tenth aspect , a computer program may comprise instructions for causing an apparatus to perform at least the following : store at least one access token with an associated access token identi fier ; receive a noti fication comprising one or more identi fiers of revoked access tokens ; and determine , for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi fiers of revoked access tokens . The computer program may further comprise instructions for causing the apparatus to perform any example embodiment of the method of the fi fth aspect .

[0067] According to an eleventh aspect , a computer readable medium may comprise program instructions that , when executed by an apparatus , cause the apparatus to perform the method, or any example embodiment of the method, of the fi fth aspect .

[0068] According to a twel fth aspect , an apparatus may comprise means for storing at least one access token with an associated access token identi fier ; means for receiving a noti fication comprising one or more identi fiers of revoked access tokens ; and means for determining, for each o f the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi fiers of revoked access tokens . The apparatus may further comprise means for performing any example embodiment of the method of the fi fth aspect .

[0069] According to a thirteenth aspect , a computer program may comprise instructions for causing an apparatus to perform at least the following : receive , from a first network entity, one or more identi fiers of revoked access tokens ; receive a service request comprising an access token with an associated access token identi fier ; determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi f iers of revoked access tokens ; and rej ect the service request based on the determining that the access token has been revoked . The computer program may further comprise instructions for causing the apparatus to perform any example embodiment of the method of the sixth aspect .

[0070] According to a fourteenth aspect , a computer readable medium may comprise program instructions that , when executed by an apparatus , cause the apparatus to perform the method, or any example embodiment of the method, of the sixth aspect .

[0071] According to a fi fteenth aspect , an apparatus may comprise means for receiving, from a first network entity, one or more identi fiers of revoked access tokens ; means for receiving a service request comprising an access token with an associated access token identi fier ; means for determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi fiers of revoked access tokens ; and means for rej ecting the service request based on the determining that the access token has been revoked . The apparatus may further comprise means for performing any example embodiment of the method of the sixth aspect .

[0072] According to a sixteenth aspect , a system is provided comprising at least one processor and at least one memory storing instructions that , when executed by the at least one processor, cause the system at least to perform : store at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; provide an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; store a mapping of the provided access tokens and the assigned identi fiers ; receive an indication that access tokens having an identi fier ass igned from one or more of the lists based on the mapping are to be revoked; send a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens ; store at least one access token with an associated access token identi fier ; receive a noti fication comprising one or more identi fiers of revoked access tokens ; and determine , for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi fiers of revoked access tokens ; receive , from a third network entity, one or more identi fiers of revoked access tokens ; receive a service request comprising an access token with an associated access token identi fier ; determine that the access token has been revoked based on the access token identi fierassociated with the access token matching an identi fier comprised in the one or more identi f iers of revoked access tokens ; and rej ect the service request based on the determining that the access token has been revoked . The memory may further comprise instructions for caus ing the system to perform any example embodiment of the method of fourth aspect , the fi fth aspect , and / or the sixth aspect .

[0073] According to a seventeenth aspect , a system is provided comprising means for storing at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; means for providing an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; means for storing a mapping of the provided access tokens and the assigned identi fiers ; means for receiving an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; means for sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens ; means for storing at least one access token with an associated access token identi f ier ; means for receiving a noti fication comprising one or more identi fiers of revoked access tokens ; and means for determining, for each o f the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the accesstoken matching with an identi fier comprised in the one or more identi fiers of revoked access tokens ; means for receiving, from a third network entity, one or more identi fiers of revoked access tokens ; means for receiving a service request comprising an access token with an associated access token identi fier ; means for determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi fiers of revoked access tokens ; and means for rej ecting the service request based on the determining that the access token has been revoked . The system may further comprise means for performing any example embodiment of the fourth aspect , the fi fth aspect , and / or the sixth aspect .

[0074] Many of the attendant features wil l be more readi ly appreciated as they become better understood by reference to the following detailed description considered in connection with the accompanying drawings .DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings , which are included to provide a further understanding of the example embodiments and constitute a part of this speci fication, illustrate example embodiments and together with the description help to explain the example embodiments . In the drawings :

[0076] FIG . 1 illustrates an example of a communication system according to an example embodiment ;

[0077] FIG . 2 illustrates an example of an apparatus configured to practice one or more example embodiments ;

[0078] FIG . 3 illustrates an example of a message sequence chart for access token revocation procedure according to an example embodiment ;

[0079] FIG . 4 illustrates an example of a method for access token revocation according to an example embodiment ;

[0080] FIG . 5 illustrates an example of a method for determining validity of an access token according to an example embodiment ;

[0081] FIG . 6 illustrates an example of a method for validating an access token, according to an example embodiment .

[0082] Like references are used to designate like parts in the accompanying drawings .DETAILED DESCRIPTION

[0083] Reference will now be made in detail to example embodiments , examples of which are illustrated in the accompanying drawings . The detailed description provided below in connection with the appended drawings is intended as a description of the present examples and is not intended to represent the only forms in which the present examples may be constructed or utili zed . The description sets forth the functions o f the example and a possible sequence of operations for constructing and operating the example . However, the same or equivalent functions and sequences may be accompl ished by di f ferent examples .

[0084] An obj ective is to provide an improved mechanism for access token revocation . With the improved mechanism, NF (network function) service producers may be protected from access token re-use attacks by di f ferent types of NF consumers or NF consumers in di f ferent PLMNs (public land mobile networks ) , for example . Further, the NF producers , NF consumers and other suitable entities can be noti fied of access tokensprovided to the NF consumers that are no longer valid, for example , due to updates . Hence , performance of access token validation can be improved .

[0085] According to an example embodiment , access tokens are modi fied to include an access token identi fier . The identi fier may be in a form of an integer . The modi fication may be performed by an authori zation server configured to generate the access tokens and manage the security of service access between NFs . The integer identi fiers may be allocated from numeric ranges according to at least one of an identifier of a NF consumer, a type of the NF consumer or a public land mobile network used by the NF consumer, or a timestamp of the access token . The authori zation server may be further configured to inform one or more NFs about the identi fiers of revoked access tokens . In addition, the authori zation server may be configured to inform the one or more NFs about a time window of timestamps of the revoked access tokens .

[0086] FIG . 1 illustrates an example of a communication system 100 . The communication system 100 may comprise a plurality of network functions . A network function may refer to at least one of an operational or a physical entity, such as a device . A network function may be , for example , a network node , a network element , a speci fic function or a set of functions carried out by one or more network entities , such as Virtual Network Functions , VNFs . One physical node may be configured to perform a plurality of network functions . Examples of network functions include a resource control or management function, session management or control function, interworking, data management or storage function, authentication function or a combination of one or more of these functions . Although depicted as asingle device, a network node may not be a stand-alone device, but for example a distributed computing system coupled to a remote radio head.

[0087] For example, the communication system 100 may comprise a network repository function (NRF) , such as NRF 102. The communication system 100 may comprise at least one network function producer (NFp) , represented by a NFp 106. The communication system 100 may further comprise at least one network function consumer (NFc) , represented by a NFc 104. The NFc 104 may be configured for requesting access to a service provided by the NFp 106. The NRF 102 may be configured to verify if an access token request is allowable and generate the access token. For example, the NRF 102 may be configured to check if the NFc 104 is allowed to access the service provided by the NFp 106 based on an identifier (ID) of the NFc 104.

[0088] NRF 102, NFc 104 and NFp 106 may be in the same network, such as in the same Public Land Mobile Networks, PLMN, or in different networks. For example, different PLMNs may be equipped with different network functions. NRF 102, NFc 104 and NFp 106 may be configured to operate according to at least one cellular communication standard. More specifically, NRF 102, NFc 104 and NFp 106 may be located in a core network of a cellular communication system, such as in a core network operating in accordance with at least one standard defined by the 3rd Generation Partnership Project, 3GPP, like a 5G or a 6G standard, and configured to operate according to the at least one 3GPP standard. NRF 102, NFc 104 and NFp 106 may be connected to each other via at least one wired connection and / or wireless connection and communicate with each other via said connection ( s ) . It is appreciated that example embodiments presented herein are not limited to this example network and maybe applied in any present or future wireless or wired communication networks, or combinations thereof, for example other type of cellular networks, short-range wireless networks, broadcast or multicast networks, or the like.

[0089] For example, in a third generation partnership project, 3GPP, fifth generation, 5G, system service based architecture, SBA, core network, NFs may comprise at least some of an access and mobility management function, AMF, a session management function, SMF, a network slice selection function, NSSF, a network exposure function, NEF, a network repository function, NRF, a unified data management, UDM, an authentication server function, AUSF, a policy control function, PCF, or an application function, AF. The PLMNs each may further comprise a security edge protection proxy, SEPP, configured to operate as a security edge node or gateway. A SEPP may be configured to handle traffic from PLMN to a NF. The communication system 100 may also comprise a service communication proxy (SCP) . An SCP is an intermediate network entity deployed to assist in indirect communication between the NFs, such as in routing control plane messages. A SEPP or SCP may be configured to verify an access token on behalf of an associated NFp . The NFs may communicate with each other using, for example, representational state transfer, REST, application programming interfaces. These may be known as RESTful APIs.

[0090] However, other network elements may also be used to implement some or all of the procedures described herein. Also, it is to be understood that not all functions of a 5G network are depicted in FIG. 1. The system 100 may further comprise one or more proxy entities, such as the SEPP and / or SCP. The communicationsystem 100 may also comprise one or more base stations , such as gNBs , and / or one or more client nodes , which may be also referred to as user nodes or UE . In an embodiment , a UE may be configured to perform one or more functions of a NFc . The base stations may be configured to communicate with the core network elements over a communication interface , such as for example a control plane interface or a user plane interface NG- C / U . Base stations may be also called radio access network (RAN) nodes and they may be part of a radio access network between the core network and the UEs . Entities of the communication system 100 , such as a NFc , a NFp, a NRF, a proxy entity, a base station or a UE may be also referred to as network entities .

[0091] The NRF 102 may be a central registry holding information about NFs o f the system . The NRF 102 may be also referred to as an authori zation server or an authori zation and registration server . The NRF 102 may allow a NF to register / deregister itsel f , services supported by the NF and to update status of the services with a profile change . For security reasons , NF consumers may need to be authori zed before initiating a service request . Thus , an NF producer may define access authori zation policies to determine the NF consumers that can access the respective NF producer . The authori zation policies may be based on an NF type , a PLMN or S-NSSAI ( single network slice selection assistance information) , for example . The NF producer may be configured to send the authori zation policies to the NRF during the registration and / or profile update . Alternatively, the authori zation policies can be configured directly on the NRF . A central authori zation server, such as the NRF 102 , may be further configured to issue access tokens to clients , such as the NFconsumers, after previous authentication of the NFc . The NFc may be then configured to present the access token to the NF producer when invoking a service. The NF producer may be configured to first validate the access token before granting the NF consumer access to its services .

[0092] Access token is an object describing a security context of a process or thread. Access token can comprise, for example, one or more NF instance IDs (identities) , an indication of services for which the token authorizes access, an expiry time indicating when the access token is no longer valid, and the like. Information associated with the access token can be stored in the databased of an authorization server, such as the NRF 102.

[0093] In an embodiment, access token claims may be enhanced by including an access token identifier to the access token claim. Access token claim may refer to a content of the access token. For example, a NFc may be configured to request an access token from an NFR. In response, the NRF may allocate an integer as an identifier for the access token and include the integer in the access token claim. The identifier may be allocated by the NFR from one or more lists of integer values. The integer values on the one or more lists may be non-overlapping. Each list may comprise consecutive integer values. The list with consecutive integer values may be also referred to as an identifier range. The list may also comprise a minimum value of an integer in the range and a maximum value of an integer in the range. The identifier (e.g., a unique integer from the list of integer values) , or the identifier range (e.g., the list comprising a plurality of consecutive integer values) , can be assigned per NFc, NFc type or source PLMN. Inaddition, or alternatively, the identi fiers may be assigned per a time window based on a timestamp associated with the access token . Hence , a particular list may be configured to be used according to information associated with the NFc, the created access token, or the request received from the NFc, for example . The NRF may be aware of which integers from each list are already allocated for identi fiers , and when the access tokens assigned with certain identi fier have expired such that the same identifier may be re-used without the being allocated to access tokens being in use at the same time .

[0094] In case of revocation, the NRF may be configured to inform at least one of the NFc, NFp, SEPPp and / or SCPp about the one or more access token identi fiers that are revoked . SEPPp and SCPp may refer to proxy entities associated with the NFp . Further, when an NFc that may be a source of malicious or anomalous service requests is using the access token that is revoked, the NFp, SEPPp or SCPp can be configured to match the identi fier available in the access token with the identi fiers of the one or more revoked access tokens .

[0095] An access token, or multiple access tokens , can be revoked for example based on a NFc instance , NFc type , or source PLMN being determined to be a source of malicious or anomalous service requests . In addition, or alternatively, one or more access tokens can be revoked based on a change of NFp service policy af fecting scope of NFc authori zation, i . e . , one or more provided access tokens are no longer valid . Revocation decisions may be performed by the NRF .

[0096] For example , upon receiving a request , the SEPPp may be configured to veri fy that the associated access token matches with a revocation access token listand reject the request. The revocation access token list comprising identifiers of invalid access tokens may be received from the NRF. Alternatively, the NRF may be configured to inform the SEPPp about one or more identifiers of invalid access tokens (instead of sending the complete list) , and the SEPPp may be configured to update the list of revoked access token identifiers stored by the SEPPp.

[0097] For example, upon receiving a request, the SCP may be configured to verify that the associated access token matches with the revocation access token identifier list and reject the request.

[0098] For example, upon receiving a request, the NFp may be configured to verify that the associated access token matches with the revocation access token identifier list and reject the request.

[0099] Each of NFp, SEPPp and SCP may maintain their respective lists of identifiers of revoked access tokens, and update the lists based on one or more identifiers received from the NRF.

[0100] According to an example embodiment, the NRF 102 may be configured to have a mapping of currently valid access tokens generated and send to NF service consumers. The mapping may comprise the associated individual identifiers to each generated access token. In case of a NFp profile update at the NRF, the NRF may be configured check if the NFp profile update affects the already generated and sent access tokens. If the access tokens are affected by the NFp profile update, the NRF may be configured to send a list of affected access token identifiers to the NFp. The list may be further sent to other entities associated with the access tokens. In addition to NFp profile update, the list may be sent in response to a policy change at the NRF.

[0101] For example, a certain access token identifier range may be assigned per PLMN. If the access tokens need to be revoked for certain PLMN, the SEPPp may be configured with the access token identifiers or identifier range assigned to that PLMN. Hence, the SEPPp can easily identify to reject a service request with an access token matching the configured range.

[0102] Without an access token identifier, NFp / SEPPp may need to maintain the revoked access token list itself. In addition, matching the received access token with the stored revoked access token list would be a tedious and a resource consuming task.

[0103] The procedure may enable informing the NFp 106 which access tokens provided to the NF service consumers are no longer valid, for example, after an update of a profile of the NFp that was previously registered at the NFR 102. Also, after the update, the NF consumers, such as the NFc 104, may be informed that their access tokens are no longer valid for the updated services. The NRF may be configured to keep a mapping of the generated access tokens with information of the NFc for this purpose. A profile update may refer to adding, deleting and / or replacing services to the NF profile. The update may be applied the whole profile, or a subset of parameters of the profile.

[0104] FIG. 2 illustrates an example of an apparatus 200 configured to practice one or more example embodiments. The apparatus 200 may comprise for example a network entity, such as the NRF 102, NFc 104, NFp 106, SEPP or SCP, and be configured to perform respective functions of the network entity.

[0105] The apparatus 200 may comprise at least one processor 202. The at least one processor 202 may comprise, for example, one or more of various processingdevices, such as for example a co-processor, a microprocessor, a controller, a digital signal processor (DSP) , a processing circuitry with or without an accompanying DSP, or various other processing devices including integrated circuits such as, for example, an application specific integrated circuit (ASIC) , a field programmable gate array (FPGA) , a microcontroller unit (MCU) , a hardware accelerator, a special-purpose computer chip, or the like.

[0106] The apparatus 200 may further comprise at least one memory 204. The memory 204 may be configured to store, for example, computer program code 206 or the like, for example operating system software and application software. The memory 204 may comprise one or more volatile memory devices, one or more non-volatile memory devices, and / or a combination thereof. For example, the memory 204 may be embodied as magnetic storage devices (such as hard disk drives, magnetic tapes, etc.) , optical magnetic storage devices, or semiconductor memories (such as mask ROM, PROM (programmable ROM) , EPROM (erasable PROM) , flash ROM, RAM (random access memory) , etc.) .

[0107] The apparatus 200 may further comprise one or more communication interfaces 208 configured to enable the apparatus 200 to transmit information to other apparatuses. The communication interface 208 may be further configured to receive information from other apparatuses. The communication interface 208 may be configured to provide at least one wireless radio connection, such as for example a 3GPP mobile broadband connection (e.g. 3G, 4G, 5G or beyond) . However, the communication interface 208 may be configured to provide one or more other type of connections, for example a wireless local area network (WLAN) connection such asfor example standardi zed by IEEE 802 . 11 series or Wi-Fi alliance ; a short range wireless network connection such as for example a Bluetooth, NFC (near- field communication) , or RFID connection; a wired connection such as for example a local area network ( LAN) connection, a universal serial bus (USB ) connection or an optical network connection, or the like ; or a wired Internet connection . The communication interface 208 may comprise , or be configured to be coupled to , at least one antenna to transmit and / or receive radio frequency signals . One or more of the various types of connections may be also implemented as separate communication interfaces , which may be coupled or configured to be coupled to a plurality of antennas .

[0108] The apparatus 200 may further comprise a user interface comprising an input device and / or an output device . The input device may take various forms such a keyboard, a touch screen, or one or more embedded control buttons . The output device may for example comprise a display, a speaker, or the like .

[0109] When the apparatus 200 is configured to implement some functionality, some component and / or components of the apparatus 200 , such as for example the at least one processor 202 and / or the memory 204 , may be configured to implement this functionality . Furthermore , when the at least one processor 202 is configured to implement some functionality, this functionality may be implemented using program code 206 comprised, for example , in the memory 204 .[001 10] The functionality described herein may be performed, at least in part , by one or more computer program product components such as software components . According to an embodiment , the apparatus 200 comprises a proces sor or processor circuitry, such as for examplea microcontroller, configured by the program code when executed to execute the embodiments of the operations and functionality described. Alternatively, or in addition, the functionality described herein can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs) , application-specific Integrated Circuits (ASICs) , application-specific Standard Products (ASSPs) , System- on-a-chip systems (SOCs) , Complex Programmable Logic Devices (CPLDs) , Graphics Processing Units (GPUs) .

[0111] The apparatus 200 comprises means for performing at least one method described herein. In one example, the means comprises the at least one processor 202, the at least one memory 204 including instructions which, when executed by the at least one processor 202, cause the apparatus 200 to perform the method.

[0112] The apparatus 200 may comprise for example a computing device such as for example a network node, a server device, a proxy device, a client node, a mobile phone, a tablet computer, a laptop, or the like. Although the apparatus 200 is illustrated as a single device it is appreciated that, wherever applicable, functions of apparatus 200 may be distributed to a plurality of devices .

[0113] FIG. 3 illustrates an example of a message sequence chart for access token revocation according to an example embodiment.

[0114] At 300, an authorization and registration server, such as the NRF 102, may be configured to receive an access token request from a NF service consumer, such as the NFc 104. In an embodiment, the NFc may be comprised in a UE .

[0115] At 302, the NRF 102 may be configured to provide the access token to the NFc 104 in case of a successful verification. The NRF 102 may be configured to generate the access token with a unique identifier ("Access Token ID") .

[0116] Opt ionally, the NRF 102 may be configured to create an internal mapping such that every generated access token is correlated with the access token identifier. In addition, the NRF may be configured to keep a mapping with respect to at least one of a NFp, a service provided by the NFp, details of the NFc, or expiry time of the access token. For example, the generated access token may be mapped by the NRF 102 with information associated with the NFc. The information may comprise, for example, at least one of NFc instance ID, NFc type, NFc slice information, NFc PLMN information (e.g., NFc PLMN ID) , an identifier of a host plat f orm / device of the NFc and / or service requests (or analytics request) such as a resource name for which the access token is generated. In addition, or alternatively, the generated access token may be mapped by the NRF with corresponding information associated with the NFp. The information may comprise, for example, at least one of NFp instance ID, NFp type, NFp slice information, and / or NFp PLMN information (e.g., NFp PLMN ID) . The information for the mapping may be received from the access token request or determined based on the access token request.

[0117] The NRF 102 may store one or more rules for assigning the identifier. The identifiers may be assigned based on one or more information elements associated with the requester of the access token. For example, the NRF 102 may be configured to assign the identifier to the generated access token based on a PLMN,a NF type, a NF instance, a region, or an area. For example, an identifier of an access token for a first PLMN may be configured to be allocated from a list of integer values starting at 10000 and ending at 20000. Similarly, an access token identifier for a NF type AMF may be configured to be allocated from a list of integer values starting at 5000 and ending at 10000. These examples are for illustration, and the ranges may be configurable and implementation specific. Further, with a relatively short validity (expiry) time of access tokens, it may be assumed that each list of integer values is large enough for re-using the list from the beginning after the last value of the list has been allocated to an access token.

[0118] At 304, the NRF 102 may be configured to send an access token response to the NFc 104. The access token response may comprise the access token with the assigned identifier .

[0119] At 306, the NRF 102 may be configured to receive a profile update request from the NFp 106. The profile update may impact the allocated access token generated at 302. For example, an authorization scope based on which the access token request was verified may have changed.

[0120] Alternatively, or additionally, an 0AM (operations, administration and management function) may change the NRF policy, which may impact the authorization scope or the allocated access token generated at 302.

[0121] At 310, the NRF 102 may determine if scope of the authorization is changed due to the operations 306 or 308. If yes, the NRF 102 may be configured to determine access token identifiers impacted by the change. The change in authorization scope may affect access tokens having identifiers assigned form a certainlist, for example. The impacted access token identifiers may be added to a list of revoked access token identifiers by the NRF 102. Optionally, the NFR may be configured to keep the NFc mapping along with the access token identifier and generate a list of NFc(s) where the access token is allocated and still active. The identifiers of revoked access tokens may be determined based on the certain list, and / or based on the mapping stored by the NRF 102.

[0122] Thereafter, the NRF 102 may be configured to inform the NFp 106 about the access token identifier ( s ) which are now invalid. For example, at 312, the NRF 102 may receive a heartbeat message from the NFp 106. The NFp 106 may be configured to contact the NRF 102 periodically with the heartbeat message to indicate that the NFp 106 is still operative. In response to the heartbeat message, at 314, the NRF 102 may be configured to provide the list of revoked access token identifiers. The list may comprise one or more identifiers of the revoked (invalid) access tokens. For example, if the update affects authorization of a specific NFc type, the NRF 102 may be configured to provide the range of access token identifiers (integer values) dedicated for the NFc type in the list.

[0123] At 316, the NRF 102 may be configured to send to the NFc 104 a notification with the list of revoked access tokens identifier. The notification may also indicate an expiry time of the access tokens. The notification may be optional, and configured to be sent in case the NRF 102 maintains the list of NFc(s) where access token (s) are allocated based on the mapping.

[0124] The NRF 102 may be configured to inform one or more proxy entities 324, such SEPP or SCP, to block service requests with access tokens matching with thelist of revoked access token identifiers. The blocked service request may be associated with an access token having a matching identifier on the list or within an identifier range comprised in the list.

[0125] At 318, the NRF 102 may be configured to send a notification comprising the list of revoked access token identifiers to at least one of the SEPP or SCP. At 320, the SEPP and / or SCP may receive a service request with access token matching with the list of revoked access token identifiers. In response, the SEPP and / or SCP is configured to reject the request.

[0126] The NRF may be also configured to send a notification comprising instructions to reject access tokens generated between a specific time window, e.g. between time T1 and T2. The time window may send in a same notification with the one or more identifiers of revoked access tokens, or in a separate notification. Each generated access token may be associated with a timestamp. The timestamp may comprise a creation time of the access token. The timestamp may also comprise an expiry time of the access token, and the notification may comprise instructions to reject access token having an expiry time within the time window. An identifier range may be configured to be assigned per time window by the NRF 102. For example, an identifier range of integer values from 10000 to 20000 may be assigned within a first time window (e.g., for access tokens with a timestamp between the time T1 and T2) , and an identifier range of integer values from 20001 to 30000 may be configured to be assigned within a second time window (e.g., for access tokens with a timestamp between time T2 and T3) . Hence, the NFp, NFc, SEPP and / or SCP may check at least one of the identifier or the timestamp of the access token to be matched with information receivedfrom the NRF to determine if the access token is revoked. Alternatively, the identifier range may comprise timestamps as identifiers, and the range of timestamps may be informed to the NFp, NFc, SEPP and / or SCP in order to reject access tokens with a timestamp within the informed range of timestamps, i.e, within a certain time window .

[0127] At 322, the NFp 106 may receive a request with an access token identifier matching with the list of revoked access token identifiers. In response, the NFp 106, the SEPP and / or SCP may be configured to reject the request .

[0128] FIG. 4 illustrates an example of a method 400 for access token revocation. The method may be implemented by a first apparatus. The first apparatus may comprise, for example, an authorization server, such as an NRF.

[0129] At 402, the method may comprise storing at least one list of non-overlapping identifier ranges having integer values, wherein each list is allocated for assigning unique identifiers to access tokens based on at least one information element. The information element may be associated to a requester of the access token or an access token generated for the requester. In addition, or alternatively, the at least one list may be allocated for assigning the unique identifiers based on a time window. For example, access tokens generated within a certain time window may be configured to be allocated from a certain list.

[0130] At 404, the method may comprise providing an access token with an identifier of the access token to at least one first network entity authorized to access a service of a network function provider, wherein the identifier is assigned to the access token from the atleast one list based on at least one information element associated with the at least one first network entity . The first network entity may comprise , for example , a network function consumer . In an embodiment , the first network entity may comprise a UE . The at least one information element may comprise at least one of an identity of a network function customer instance , a type of a network function customer, an identi fier of a host platform of the network function customer, an identi fier of a source public land mobile network or a service region . For example , the information element may be obtained from a request for access token received from a network entity . In addition, or alternatively, the at least one information element may comprise a timestamp associated with the access token, such as a creation time or an expiry time of the access token .[001 31 ] At 406 , the method may comprise storing a mapping of the provided access tokens and the assigned identi fiers .[001 32] At 408 , the method may comprise receiving an indication that access tokens having an identifier assigned from one or more of the lists based on the mapping are to be revoked .[001 33] At 410 , the method may comprise sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens . The at least one second network may be informed, for example , identi fier ranges of the one or more lists . The at least one second network entity may comprise at least one of the first network entity, a network function provider, or a proxy entity .[001 34] FIG . 5 illustrates an example o f a method 500 for determining validity of an access token according toan example embodiment. The method may be performed by a second apparatus. The second apparatus may comprise a network entity, for example, a network function consumer or a UE .

[0135] At 502, the method may comprise storing at least one access token with an associated access token identifier. The identifier may have an integer value.

[0136] At 504, the method may comprise receiving a notification comprising one or more identifiers of revoked access tokens. The notification may be received from a network entity such as a first apparatus. The network entity may be, for example, an authorization server such as an NRF.

[0137] At 506, the method may comprise determining, for each of the at least one stored access token, that the access token has been revoked, based on the access token identifier associated with the access token matching with an identifier comprised in the one or more identifiers of revoked access tokens. The notification may also comprise an identifier range having integer values, and the second apparatus may be configured to check if the identifier of the received access token is within the range.

[0138] FIG. 6 illustrates an example of a method 600 for validating an access token, according to an example embodiment. The method may be performed by a third apparatus, such as a network entity. The third apparatus may comprise, for example, a network function producer. Alternatively, the third apparatus may comprise a SEPP or a SCP.

[0139] At 602, the method may comprise receiving, from a network entity such as a first apparatus, one or more identifiers of revoked access tokens. The network entity may be, for example, an NFR.

[0140] At 604 , the method may comprise receiving a service request comprising an access token with an associated access token identi fier .

[0141] At 606 , the method may comprise determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi fiers of revoked access tokens .

[0142] At 608 , the method may comprise rej ecting the service request based on the determining that the access token has been revoked . The third apparatus may be also configured to receive an identifier range from the first apparatus and rej ect service requests based on identi fier comprised in the service request being within the range .

[0143] Further features of the methods directly result from the functionalities and parameters of the apparatuses , as described in the appended claims and throughout the speci fication and are therefore not repeated here . It is noted that one or more operations of the method may be performed in di f ferent order .

[0144] An apparatus , for example a network node , a user node or a client node , may be configured to perform or cause performance of any aspect of the method ( s ) described herein . Further, a computer program may comprise instructions for causing, when executed, an apparatus to perform any aspect of the method ( s ) described herein . Further, an apparatus may comprise means for performing any aspect of the method ( s ) described herein . According to an example embodiment , the means comprises at least one processor, and memory including program code , the at one memory and the program code configured to , when executed by the at least oneprocessor, cause performance of any aspect of the method ( s ) .

[0145] Any range or device value given herein may be extended or altered without losing the ef fect sought . Also , any embodiment may be combined with another embodiment unless explicitly disallowed .

[0146] Although the subj ect matter has been described in language speci fic to structural features and / or acts , it is to be understood that the subj ect matter defined in the appended claims is not necessarily limited to the speci fic features or acts described above . Rather, the speci fic features and acts described above are disclosed as examples of implementing the claims and other equivalent features and acts are intended to be within the scope of the claims .

[0147] It will be understood that the benef its and advantages described above may relate to one embodiment or may relate to several embodiments . The embodiments are not limited to those that solve any or all of the stated problems or those that have any or al l of the stated benefits and advantages . It will further be understood that reference to ' an ' item may refer to one or more of those items .

[0148] The operations of the methods described herein may be carried out in any suitable order, or simultaneously where appropriate . Additionally, individual blocks may be deleted from any of the methods without departing from the scope of the subj ect matter described herein . Aspects of any of the embodiments described above may be combined with aspects of any of the other embodiments described to form further embodiments without losing the ef fect sought .

[0149] The term ' comprising ' is used herein to mean including the method, blocks , or elements identified,but that such blocks or elements do not comprise an exclusive list and a method or apparatus may contain additional blocks or elements.

[0150] As used in this application, the term 'circuitry' may refer to one or more or all of the following: (a) hardware-only circuit implementations (such as implementations in only analog and / or digital circuitry) and (b) combinations of hardware circuits and software, such as (as applicable) : (i) a combination of analog and / or digital hardware circuit (s) with software / firmware and (ii) any portions of hardware processor (s) with software (including digital signal processor ( s ) ) , software, and memory (ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions) and (c) hardware circuit (s) and or processor ( s ) , such as a microprocessor ( s ) or a portion of a microprocessor ( s ) , that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation. This definition of circuitry applies to all uses of this term in this application, including in any claims.

[0151] As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.[001 52] It will be understood that the above description is given by way of example only and that various modi fications may be made by those skilled in the art . The above speci fication, examples and data provide a complete description of the structure and use of exemplary embodiments . Although various embodiments have been described above with a certain degree of particularity, or with reference to one or more individual embodiments , those skilled in the art could make numerous alterations to the disclosed embodiments without departing from scope of this speci fication .[001 53] As used herein, "at least one of the following : " and "at least one of " and similar wording, where the list of two or more elements are j oined by "and" or "or" , mean at least any one of the elements , or at least any two or more of the elements , or at least all the elements .

Claims

CLAIMS1 . A first apparatus , comprising : at least one processor ; and at least one memory including instructions which, when executed by the at least one processor, cause the first apparatus at least to : store at least one list of one or more nonoverlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; provide an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identifier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; store a mapping of the provided access tokens and the assigned identi fiers ; receive an indication that access tokens having an identi fier assigned from the at least one list based on the mapping are to be revoked; and send a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens .2 . The first apparatus of claim 1 , wherein at least one of the one or more non-overlapping identi fier ranges having integer values is stored as an information element comprising a minimum value of an integer in the range and a maximum value of an integer in the range .3 . The first apparatus of claim 1 or 2 , wherein the access token is provided to a first network entity based on a request received from the first network entity .4 . The first apparatus of any preceding claim, wherein the at least one list is allocated for assigning the unique identi fiers based on a time window and the at least one information element associated with the first network entity comprises a timestamp of the provided access token within the time window .5 . The first apparatus of claim 4 , wherein the timestamp comprises a creation time of the access token or an expiry time of the access token .6 . The first apparatus of any preceding claim, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the first apparatus to : send a noti fication comprising an indication of a time window of timestamps associated with the revoked access tokens to the at least one second network entity .7 . The first apparatus of any preceding claim, wherein the information element associated with each of the at least one first network entity comprises at least one of an identity of a network function customer instance , a type of a network function customer, an identi fier of a host platform of the network function customer, an identi fier of a source public land mobi le network or a service region .8 . The first apparatus of any preceding claim,wherein the indication comprises at least one of an identity of a network function consumer instance , a type of a network function consumer or an identi fier of a public land mobile network being determined to be a source of malicious or anomalous service requests ; and wherein the at least one list is allocated for assigning identi fiers to access tokens based on at least one of the identi fier of a network function consumer instance , the type of a network function consumer or the identi fier of a public land mobile network being determined to be a source of malicious or anomalous service requests .9 . The first apparatus of any preceding claim, wherein the indication comprises a change in authori zation to access the service of the network function provider ; and the at least one list is allocated for assigning identi fiers to access tokens based on information af fected by the authori zation change .10 . The first apparatus claim 9 , wherein the indication comprises a request for profile update from the network function provider .11 . The first apparatus claim 9 , wherein the indication comprises a request for policy change .12 . The first apparatus of claim 11 , wherein the indication comprising a request for policy change is received from an operations , administration and maintenance function .13 . The first apparatus of any preceding claim,wherein each of the at least one first network entity is a network function consumer or a user equipment .14 . The first apparatus of any preceding claim, wherein the at least one second network entity comprises at least one of the network function provider, a security edge protection proxy or a service communication proxy .15 . The first apparatus of any preceding claim, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the first apparatus to : store in the mapping information about each of the at least one first network entity, and about the access tokens associated with each of the at least one first network entity; and send a noti fication comprising information on the one or more identi fiers of the revoked access tokens to one or more of the at least one first network entity associated with a revoked access token based on the mapping .16 . The first apparatus of any preceding claim, wherein the information on the one or more identi f iers of the revoked access tokens comprises at least one o f : one or more identi fiers , or one or more identi fier ranges .17 . The first apparatus of claim 15 or 16 , wherein the mapped information about the at least one network function consumer comprises at least one of an identity of a network function consumer instance , a type of a network function consumer, slice information, identity of a public land mobile network, or one or moreinformation elements associated with a service request of the network function consumer.

18. The first apparatus of any preceding claim, wherein the first apparatus comprises or is comprised in a network repository function.

19. A second apparatus, comprising: at least one processor; and at least one memory including instructions which, when executed by the at least one processor, cause the second apparatus to: store at least one access token with an associated access token identifier; receive a notification comprising one or more identifiers of revoked access tokens; and determine, for each of the at least one stored access token, that the access token has been revoked, based on the access token identifier associated with the access token matching with an identifier comprised in the one or more identifiers of revoked access tokens.

20. The second apparatus of claim 19, wherein the notification comprises at least one of: one or more identifiers, or one or more identifier ranges.

21. The second apparatus of claim 19 or 20, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the second apparatus to: receive a notification comprising an indication of a time window of timestamps associated with the revoked access tokens; and wherein the access token is determinedto be revoked based on a timestamp of the access token matching with the time window .22 . The second apparatus of claim 21 , wherein the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .23 . A third apparatus , comprising : at least one processor ; and at least one memory including instructions which, when executed by the at least one processor, cause the third apparatus at least to : receive , from a first network entity, one or more identi fiers of revoked access tokens ; receive a service request comprising an access token with an associated access token identi fier ; determine that the access token has been revoked based on the access token identifier associated with the access token matching an identifier comprised in the one or more identi fiers of revoked access tokens ; and rej ect the service request based on the determining that the access token has been revoked .24 . The third apparatus of claim 23 , wherein the one or more identi fiers are received in a message comprising at least one of : one or more identi fiers or one or more identi fier ranges .25 . The third apparatus of claim 23 or 24 , wherein the at least one memory further comprises instructions which, when executed by the at least one processor, cause the third apparatus to :send a request for profile update to the first network entity; and wherein at least one of the one or more identi fiers of revoked access tokens is received in response to the request .26 . The third apparatus of any of claims 23 to 25 , wherein the third apparatus comprises or is comprised in one of : a network function provider, a security edge protection proxy or a service communication proxy .27 . The third apparatus of any of claims 23 to 26 , wherein the at least one memory further comprises instructions which, when executed by the at least one processor, cause the third apparatus to : receive an indication of a time window of timestamps associated with the revoked access tokens ; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window .28 . The third apparatus of claim 27 , wherein the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .29 . A method carried out by a first apparatus , comprising : storing at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; providing an access token with an identi fier of the access token to at least one first network entityauthori zed to access a service of a network function provider, wherein the identifier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; storing a mapping of the provided access tokens and the assigned identi fiers ; receiving an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; and sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens .30 . The method of claim 29 , wherein at least one of the one or more non-overlapping identi fier ranges having integer values is stored as an information element comprising a minimum value of an integer in the range and a maximum value of an integer in the range .31 . The method of claim 29 or 30 , wherein the access token is provided to a first network entity based on a request received from the first network entity .32 . The method of any of claims 29 to 31 , wherein the at least one list is allocated for assigning the unique identi fiers based on a time window and the at least one information element associated with the first network entity comprises a timestamp of the provided access token within the time window .33 . The method of claim 32 , wherein the timestampcomprises a creation time of the access token or an expiry time of the access token .34 . The method of any of claims 29 to 33 , further comprising : sending a noti fication comprising an indication of a time window of timestamps associated with the revoked access tokens .35 . The method of any of claims 29 to 34 , wherein the information element associated with each of the at least one first network entity comprises at least one of an identity of a network function customer instance , a type of a network function customer, an identi fier of a host platform of the network function customer, an identi fier of a source public land mobile network or a service region .36 . The method of any of claims 29 to 35 , wherein the indication comprises at least one of an identity of a network function consumer instance , a type of a network function consumer or an identi fier of a publ ic land mobile network being determined to be a source of malicious or anomalous service requests ; and wherein the at least one list is allocated for assigning identi fiers to access tokens based on at least one of the identi fier of a network function consumer instance , the type of a network function consumer or the identi fier of a public land mobile network being determined to be a source of malicious or anomalous service requests .37 . The method of any of claims 29 to 36 , whereinthe indication comprises a change in authorization to access the service of the network function provider; and the at least one list is allocated for assigning identifiers to access tokens based on information affected by the authorization change.

38. The method of claim 37, wherein the indication comprises a request for profile update from the network function provider.

39. The method of claim 37, wherein the indication comprises a request for policy change.

40. The method of claim 39, wherein the indication comprising a request for policy change is received from an operations, administration and maintenance function.

41. The method of any of claims 29 to 40, wherein each of the at least one first network entity is a network function consumer or a user equipment.

42. The method of any of claims 29 to 41, wherein the at least one second network entity comprises at least one of the network function provider, a security edge protection proxy or a service communication proxy.

43. The method of any of claims 29 to 42, comprising: storing in the mapping information about each of the at least one first network entity, and about the access tokens associated with each of the at least one first network entity; and sending a notification comprising information on the one or more identifiers of the revoked access tokens to one or more of the at least one first networkentity associated with a revoked access token based on the mapping.

44. The method of any of claims 29 to 43, wherein the information on the one or more identifiers of the revoked access tokens comprises at least one of: one or more identifiers, or one or more identifier ranges.

45. The method of claim 43 or 44, wherein the mapped information about the at least one network function consumer comprises at least one of an identity of a network function consumer instance, a type of a network function consumer, slice information, identity of a public land mobile network, or one or more information elements associated with a service request of the network function consumer.

46. The method of any of claims 29 to 45, wherein the first apparatus comprises or is comprised in a network repository function.

47. A method carried out by a second apparatus, comprising : storing at least one access token with an associated access token identifier; receiving a notification comprising one or more identifiers of revoked access tokens; and determining, for each of the at least one stored access token, that the access token has been revoked, based on the access token identifier associated with the access token matching with an identifier comprised in the one or more identifiers of revoked access tokens.

48. The method of claim 47, wherein thenotification comprises at least one of: one or more identifiers, or one or more identifier ranges.

49. The method of 47 or 48, further comprising: receiving a notification comprising an indication of a time window of timestamps associated with the revoked access tokens; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window.

50. The method of claim 49, wherein the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token.

51. A method carried out by a third apparatus, comprising : receiving, from a first network entity, one or more identifiers of revoked access tokens; receiving a service request comprising an access token with an associated access token identifier; determining that the access token has been revoked based on the access token identifier associated with the access token matching an identifier comprised in the one or more identifiers of revoked access tokens; and rejecting the service request based on the determining that the access token has been revoked.

52. The method of claim 51, wherein the one or more identifiers are received in a message comprising at least one of: one or more identifiers or one or more identifier ranges.

53. The method of claim 51 or 52, wherein the atleast one memory further comprises instructions which, when executed by the at least one processor, cause the third apparatus to : send a request for profile update to the first network entity; and wherein at least one of the one or more identi fiers of revoked access tokens is received in response to the request .54 . The method of any of claims 51 to 53 , wherein the third apparatus comprises or is comprised in one of : a network function provider, a security edge protection proxy or a service communication proxy .55 . The method of any of claims 51 to 54 , further comprising : receiving an indication of a time window of timestamps associated with the revoked access tokens ; and wherein the access token is determined to be revoked based on a timestamp of the access token matching with the time window .56 . The method of claim 55 , wherein the timestamp of the access token comprises a creation time of the access token or an expiry time of the access token .57 . A computer readable medium comprising program instructions that , when executed by an apparatus , cause the apparatus to perform at least the method of any of claims 29 to 46 .58 . A computer readable medium comprising programinstructions that , when executed by an apparatus , cause the apparatus to perform at least the method of any of claims 47 to 50 .59 . A computer readable medium comprising program instructions that , when executed by an apparatus , cause the apparatus to perform at least the method of any of claims 51 to 56 .60 . A first apparatus , comprising : means for storing at least one list of nonoverlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; means for providing an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one li st based on at least one information element associated with the at least one first network entity; means for storing a mapping of the provided access tokens and the assigned identi fiers ; means for receiving an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; and means for sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens .61 . A second apparatus , comprising :means for storing at least one access token with an associated access token identi fier ; means for receiving a noti fication comprising one or more identi fiers of revoked access tokens ; and means for determining, for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi f iers of revoked access tokens .62 . A third apparatus , comprising : means for receiving, from a first network entity, one or more identi fiers of revoked access tokens ; means for receiving a service request comprising an access token with an associated access token identi fier ; means for determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi f iers of revoked access tokens ; and means for rej ecting the service request based on the determining that the access token has been revoked .63 . A system, comprising : at least one processor and at least one memory storing instructions that , when executed by the at least one processor, cause the system at least to perform : store at least one list of non-overlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; provide an access token with an identi fier of the access token to at least one first network entityauthori zed to access a service of a network function provider, wherein the identifier is assigned to the access token from the at least one list based on at least one information element associated with the at least one first network entity; store a mapping of the provided access tokens and the assigned identi fiers ; receive an indication that access tokens having an identi fier assigned from one or more o f the lists based on the mapping are to be revoked; send a noti f ication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens ; store at least one access token with an associated access token identi fier ; receive a noti fication comprising one or more identi fiers of revoked access tokens ; determine , for each of the at least one stored access token, that the access token has been revoked, based on the access token identifier associated with the access token matching with an identi fier comprised in the one or more identi fiers of revoked access tokens ; receive , from a third network entity, one or more identi fiers of revoked access tokens ; receive a service request comprising an access token with an associated access token identi fier ; determine that the access token has been revoked based on the access token identifier associated with the access token matching an identifier comprised in the one or more identi fiers of revoked access tokens ; and rej ect the service request based on the determining that the access token has been revoked .64 . A system, comprising :means for storing at least one list of nonoverlapping identi fier ranges having integer values , wherein each list is allocated for assigning unique identi fiers to access tokens based on at least one information element ; means for providing an access token with an identi fier of the access token to at least one first network entity authori zed to access a service of a network function provider, wherein the identi fier is assigned to the access token from the at least one li st based on at least one information element associated with the at least one first network entity; means for storing a mapping of the provided access tokens and the assigned identi fiers ; means for receiving an indication that access tokens having an identi fier assigned from one or more of the lists based on the mapping are to be revoked; means for sending a noti fication to at least one second network entity, wherein the noti fication comprises information on one or more identi fiers of the revoked access tokens ; means for storing at least one access token with an associated access token identi fier ; means for receiving a noti fication comprising one or more identi fiers of revoked access tokens ; means for determining, for each of the at least one stored access token, that the access token has been revoked, based on the access token identi fier associated with the access token matching with an identi fier comprised in the one or more identi f iers of revoked access tokens ; means for receiving, from a third network entity, one or more identi fiers of revoked access tokens ;means for receiving a service request comprising an access token with an associated access token identi fier ; means for determining that the access token has been revoked based on the access token identi fier associated with the access token matching an identi fier comprised in the one or more identi f iers of revoked access tokens ; and means for rej ecting the service request based on the determining that the access token has been revoked .

Images