Network node and communication method

Abstract

This network node comprises: a reception unit that receives, from a specific network node, an authentication proxy request including a certificate storing personal data of a user; a control unit that executes authentication processing using the certificate; and a transmission unit that transmits the authentication results to the specific network node.

Description

Network node and communication method

[0001] The present invention relates to a network node in a communication system and a communication method.

[0002] 3GPP (registered trademark) (3rd Generation Partnership Project) has introduced a wireless communication system called 5G or NR (New Radio) (hereinafter, the wireless communication system will be referred to as "5G" or "NR") in order to achieve a larger system capacity, a higher data transmission speed, and a lower latency in wireless sections. 5G introduces various wireless technologies to meet the requirement of achieving a throughput of 10 Gbps or more while reducing latency in wireless sections to 1 ms or less. Furthermore, 6G, a future communication system, is also being studied.

[0003] In recent years, a new approach to identity management has been under consideration, namely the concept of Self-Sovereign Identity (SSI), in which users manage their own identifiers and identities and control who provides them, without relying on centralized identity providers (ID providers), and the technologies to realize this (W3C Decentralized Identifiers (DID), W3C Verifiable Credentials (VC), etc.).

[0004] In the world of SSI, for example, a user can present an attribute / credentials certificate that certifies attribute information and qualification information to a service provider, and the service provider can then make decisions about providing services to the user.

[0005] In addition, an architecture is being considered in which the northbound interface between the network exposure function (NEF) and the application function (AF) in the 5G system is configured using the common API framework (CAPIF).

[0006] Additionally, ID federation technology, which enables centralized management of ID information, is attracting attention. OpenID® Connect is commonly used for ID federation. The introduction of OpenID® Connect into 5G systems by extending the CAPIF core functions is also being considered.

[0007] 3GPP TS 23.502 V18.3.0 (2023-09)W3C Decentralized Identifiers (DIDs) v1.0, https: / / www.w3.org / TR / did-core / W3C Verifiable Credentials Data Model v1.1, https: / / www.w3.org / TR / vc-data-model /

[0008] In ID federation technologies such as OpenID (registered trademark) Connect, an identity provider (NW IdP) performs user authentication on behalf of a service provider, thereby allowing the user to use the services of the service provider.

[0009] However, the functions of the network IdPs that have been considered so far do not support attribute / credential-based user authentication based on the SSI concept, and therefore cannot meet the requirements of external services that wish to perform SSI-based user authentication.

[0010] The present invention has been made in view of the above points, and has as its object to provide a technique for realizing proxy authentication based on attributes / credentials.

[0011] According to the disclosed technology, a network node is provided that includes: a receiving unit that receives an authentication proxy request including a certificate storing personal data of a user from a specific network node; a control unit that executes authentication processing using the certificate; and a transmitting unit that transmits an authentication result to the specific network node.

[0012] The disclosed technology provides a technique for implementing attribute / credential-based authentication delegation.

[0013] FIG. 1 is a diagram for explaining an example of a communication system. FIG. 2 is a diagram for explaining an example of a communication system in a roaming environment. FIG. 3 is a diagram for explaining an example of a system configuration common to the first and second embodiments. FIG. 4 is a diagram for explaining a processing procedure in the first embodiment. FIG. 5 is a diagram for explaining a processing procedure in the first embodiment. FIG. 6 is a diagram for explaining an example of an authentication process. FIG. 7 is a diagram for explaining an example of the functional configuration of a network node 100 in an embodiment of the present invention. FIG. 8 is a diagram for explaining an example of the functional configuration of a terminal 20 in an embodiment of the present invention. FIG. 9 is a diagram for explaining an example of the hardware configuration of a terminal 20 and a network node 100 in an embodiment of the present invention. FIG. 10 is a diagram for explaining an example of the configuration of a vehicle 2001 in an embodiment of the present invention.

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the embodiment described below is an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0015] In the operation of the wireless communication system according to the embodiment of the present invention, existing technologies are used as appropriate. However, the existing technologies include, but are not limited to, the existing LTE or the existing NR.

[0016] In the following, we will first explain an example of the configuration of a 5G core network, which is an example of a network in which attribute / credential certificate-based authentication is performed in this embodiment, and then explain the configuration and operation related to this embodiment.

[0017] Fig. 1 is a diagram illustrating an example of a communication system corresponding to a core network. As shown in Fig. 1, this communication system is composed of a UE (terminal 20) and multiple network nodes. Hereinafter, it is assumed that one network node corresponds to each function, but multiple functions may be realized by one network node, or multiple network nodes may realize one function. Furthermore, the "connection" described below may be a logical connection or a physical connection.

[0018] The (R)AN (Radio) Access Network) is a network node having a radio access function, which may include a base station 10, and is connected to a UE 20, an Access and Mobility Management Function (AMF) 30, and a User plane function (UPF) 220. The AMF 30 is a network node having functions such as terminating the RAN interface, terminating the Non-Access Stratum (NAS), registration management, connection management, reachability management, and mobility management. The UPF is a network node having functions such as a Protocol Data Unit (PDU) session point to the outside that interconnects with a Data Network (DN), packet routing and forwarding, and user plane Quality of Service (QoS) handling. The UPF 220 and the DN constitute a network slice.

[0019] The AMF 30 is connected to the UE 20, the (R)AN 10, an SMF (Session Management function), an NSSF (Network Slice Selection Function), an NEF (Network Exposure Function), an NRF (Network Repository Function), an UDM (Unified Data Management), an AUSF (Authentication Server Function), a PCF (Policy Control Function), and an AF (Application Function) 90. The AMF 30, the SMF, the NSSF, the NEF, the NRF, the UDM 40, the AUSF, the PCF, and the AF 90 are network nodes connected to each other via interfaces, Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf, based on their respective services.

[0020] The SMF is a network node having functions such as session management, IP (Internet Protocol) address allocation and management for UE 20, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, and roaming function. The SMF may also be called a session management node. The NEF is a network node having a function of notifying other NFs (Network Functions) of capabilities and events. The NSSF is a network node having functions such as selecting a network slice to which UE 20 connects, determining the allowed NSSAI (Network Slice Selection Assistance Information), determining the NSSAI to be set, and determining the AMF set to which UE 20 connects. The PCF is a network node having a function of controlling network policies. The AF 90 is a network node having a function of controlling application servers. The NRF is a network node having a function of discovering NF instances that provide services. The UDM 40 is a network node that manages subscriber data and authentication data. The UDM 40 is connected to a UDR (User Data Repository) that holds the data. The UDM 40 may also be called a data management node.

[0021] 2 is a diagram for explaining an example of a communication system in a roaming environment. As shown in Fig. 2, the network is made up of a UE, which is a terminal 20, and a plurality of network nodes.

[0022] The SEPP is a non-transparent proxy that filters control plane messages between PLMNs (Public Land Mobile Networks). The vSEPP shown in Figure 2 is a SEPP in a visited network, and the hSEPP is a SEPP in a home network.

[0023] As shown in Fig. 2, the UE 20 is in a roaming environment connected to an (R)AN and an AMF 30 in a Visited PLMN (VPLMN). The VPLMN and the Home PLMN (HPLMN) are connected via a vSEPP and an hSEPP. The UE 20 can communicate with the UDM of the HPLMN via the AMF 30 of the VPLMN, for example.

[0024] (About SSI) As mentioned above, in recent years, the concept of Self-Sovereign Identity (SSI) and the technologies to realize it (W3C Decentralized Identifiers (DID), W3C Verifiable Credentials (VC), etc.) have been considered as a new approach to identity management, in which users manage their own identifiers and identities and control who provides them, without relying on centralized identity providers (ID providers).

[0025] In the world of SSI, there are three parties: Holder, Issuer, and Verifier. A Holder is a user who manages / possesses their own digital identity. An Issuer certifies attribute information (name, age, address, etc.) and qualification information (employee of a company, membership of a service, etc.) to a user, and then issues an attribute / qualification certificate (e.g., VC). A Verifier verifies the Holder's attributes and qualifications by requesting and receiving the attribute / qualification certificate required to provide a service from the Holder, and makes decisions about providing the service.

[0026] An example of an attribute / credential certificate is a VC (Verifiable Credentials). A VC is a signed document that stores personal data. The above attribute information and credential information are examples of personal data. An attribute / credential certificate may also be called a certificate that stores personal data. Furthermore, a certificate that stores personal data does not necessarily need to contain information that can uniquely identify an individual; for example, something like a membership card issued anonymously also falls under the category of a certificate that stores personal data.

[0027] Furthermore, for example, DIDs (Decentralized Identifiers) are used as identifiers for issuers and holders. DIDs are registered in a distributed ledger and are easily accessible but difficult to tamper with.

[0028] As mentioned above, in ID federation technologies such as OpenID (registered trademark) Connect, an identity provider (NW IdP) performs user authentication on behalf of a service provider, allowing users to use services provided by the service provider.

[0029] However, the NW IdP functions currently under consideration do not support attribute / credential-based user authentication based on the SSI concept, and therefore cannot meet the requirements of external services that require SSI-based user authentication.

[0030] (Outline of the embodiment) In this embodiment, in order to solve the above-mentioned problems, the following functions are added and new operations are performed. Note that, although a 3GPP network is assumed as the NW (network) below, the NW to which the technology according to the present invention can be applied is not limited to the 3GPP network.

[0031] The network is provided with an authentication function based on attributes / credentials.

[0032] The authentication function may be a new network node, an extended AUSF, or an extension of an existing node other than the AUSF.

[0033] The network is provided with a function for accepting an authentication proxy request message based on attributes / credentials from an external service (AF).

[0034] This function may be a new network node, or the CAPIF authorization function may be made to take on this function by extending the CAPIF authorization function. Note that in existing technologies, the CAPIF authorization function performs authentication and authorization for the API invoker that is the caller of the service API.

[0035] - When the above function receives an authentication proxy request message, if the authentication proxy request message includes attributes / credentials, the authentication function performs verification processing of the attributes / credentials based on the attributes / credentials and responds with the verification results to the external service.

[0036] In this embodiment, an "external service" is a network node (such as an application server) that provides a service to a user. An "external service" may also be called an external service node, a service providing device, or the like.

[0037] Furthermore, since the attribute / credential verification process corresponds to the authentication process for authenticating a user, the "verification process" may be called the "authentication process" and the "verification result" may be called the "authentication result."

[0038] - When the above function receives an authentication proxy request message, if the authentication proxy request message does not include an attribute / credentials, the authentication function sends a message to UE 20 requesting an attribute / credentials that can be used for service authentication, and after receiving the attribute / credentials from UE 20, performs a verification process for the attribute / credentials based on the attribute / credentials, and responds with the verification result to the external service.

[0039] "Service authentication" in this embodiment refers to user authentication required for an external service to provide a service to a user.

[0040] (System Configuration Example) An example of a system configuration according to this embodiment is shown in Fig. 3. This system configuration is common to the first and second embodiments described below.

[0041] As shown in Fig. 3, the communication system according to this embodiment includes a UE 20, an (R)AN 10, an AMF 30, an authentication function 60 that performs authentication based on attributes / credentials, a UDM / UDR (40), a Verifiable Data Registry (VDR) 70, a CAPIF authorization function 80, and an external service (AF) 90. Note that the UDM 40 is described as UDM / UDR because it is used together with the UDR. The "authentication function 60" shown here may be a newly defined device (network node) or may be an extension of the function of an existing device (e.g., AUSF).

[0042] The UE 20 includes a management function 21 that manages attributes / credentials. The UE 20 may also be called a terminal 20. The management function 21 may also include a digital identity wallet (hereinafter referred to as a wallet) that manages user identifiers, attributes / credentials, public keys / private keys linked to the identifiers, and the like. The wallet of the UE 20 may be provided inside the UE 20 or may be provided outside the UE 20.

[0043] As shown in FIG. 3, the UDM / UDR ( 40 ) includes a network information database (DB) 41 , a certificate information DB 42 , and a correspondence information DB 43 .

[0044] The NW information DB 41 stores the identifier of the NW, the public key of the NW, and the private key of the NW. The information stored in the NW information DB 41 is used when detecting NW spoofing based on the public key and private key of the NW and encrypting communication from the external service 90 / UE 20 to the NW during communication between the NW and the external service 90 and between the NW and the UE 20. If the above-mentioned NW spoofing detection and communication encryption are not performed, the NW information DB 41 may not be provided.

[0045] The NW is a 3GPP NW, and for example, when referring to a "NW identifier" (the same applies to a NW public key and a NW private key), the identifier may be common to multiple network nodes in the 3GPP NW, or may be an identifier used for a specific network node in the 3GPP NW.

[0046] The certificate information DB 42 stores certificate information (conditions, etc., described later) that can be used for service authentication. The correspondence information DB 43 stores correspondence information between user contact point linking identifiers and user contact point information.

[0047] The user contact link identifier is, for example, one or more of a DID, a phone number, a SUPI, etc. The user contact information is, for example, communication endpoint information of the user's wallet, a phone number for sending SMS, etc.

[0048] In this embodiment, the VDR 70 is located outside the 3GPP network. The VDR 70 is a device that can be realized by a web server, a distributed ledger, etc. The VDR 70 includes a user information DB 71, an issuer information DB 72, a definition information DB 73, and a management information DB 74.

[0049] The user information DB 71 stores user identifiers and user public keys. The issuer information DB 72 stores identifiers of issuers of attribute / credential certificates used for service authentication and the public keys of those issuers. The definition information DB 73 stores schemas and definition information of attribute / credential certificates. The management information DB 74 stores management information indicating the validity / invalidation of attribute / credential certificates.

[0050] The VDR 70 is not limited to being arranged outside the 3GPP network as shown in FIG. 3 , but may be provided within the 3GPP network. Also, multiple types of VDRs 70 may be provided. For example, when a DID is used as a user identifier, a VDR 70 may be provided for each DID method. Also, a separate VDR 70 may be provided for each certificate.

[0051] In this embodiment, "user" and "UE" (or "terminal") may be used synonymously. Unless a contradiction occurs in the context, "user" described below may be replaced with "UE" or "terminal". Conversely, "UE" or "terminal" may be replaced with "user".

[0052] First Embodiment First, a first embodiment will be described. The first embodiment is an embodiment in which a 3GPP network receives a user identifier and an attribute / credential certificate from an external service 90 and performs only the verification process (on behalf of the external service 90).

[0053] The above user identifier is used to verify that the attribute / credentials belong to the user who sent the attribute / credentials (used as information linking the attribute / credentials to the attribute / credentials), and is, for example, a DID. For example, if service authentication using anonymous attribute / credentials is permitted, a user identifier may not be used.

[0054] The processing procedure of the first embodiment will be described with reference to Fig. 4. In the following processing procedure, it is assumed that the UE 20 has a wallet, and that the UE 20 reads attributes / credentials and the like from the wallet.

[0055] <S101> In S101 (step 101), the external service 90 acquires a user identifier and attributes / credentials from the UE 20.

[0056] <S102> In S102, the external service 90 sends an authentication delegation request including a user identifier and attributes / credentials to the CAPIF authorization function 80. The authentication delegation request is a request to have the authentication function 60 perform the authentication required to provide a service to the user on behalf of the external service 90.

[0057] <S103> In S103, the CAPIF authorization function 80 transfers the authentication proxy request to the authentication function 60.

[0058] <S104> In S104, the authentication function 60 verifies the "validity, legitimacy, and eligibility" of the user identifier and attribute / credentials by using the VDR 70. A specific example of the verification will be described later.

[0059] <S105> In S105, the authentication function 60 responds to the CAPIF authorization function 80 with the verification result (OK / NG, etc.).

[0060] <S106> In S106, the CAPIF authorization function 80 responds to the external service 90 with the verification result (OK / NG, etc.).

[0061] <S107> In S107, if the external service 90 confirms that the verification result is OK, it determines that the service authentication has been successful and provides the service to the user (UE 20).

[0062] According to the first embodiment described above, it is possible to realize proxy authentication based on attributes / credentials.

[0063] Second Embodiment Next, a second embodiment will be described. In the second embodiment, the authentication function 60 receives an authentication proxy request including an identifier linked to a user's contact information, accesses the user based on the identifier, obtains an attribute / credential certificate from the user, and performs a verification process.

[0064] The processing procedure of the second embodiment will be described with reference to FIG.

[0065] <S201> In S201, the external service 90 acquires the user identifier from the UE 20.

[0066] <S202> In S202, the external service 90 sends an authentication proxy request including a user contact point linking identifier to the CAPIF authorization function 80. This user contact point linking identifier is an identifier used to extract the same user on the external service 90 and the NW side. As the identifier, a telephone number, SUPI, or the like can be used in addition to the DID.

[0067] Regarding the above-mentioned user contact point linking identifier, the user identifier acquired by the external service 90 from the UE 20 in S201 may be the user contact point linking identifier itself. Alternatively, the external service 90 may hold a DB for association in advance, and extract the user contact point linking identifier from the DB based on the user identifier acquired in S201.

[0068] In S202, the external service 90 may include, in the proxy authentication request, certificate information (conditions, etc.) that can be used for service authentication. The certificate information is used by the authentication function 60 to request an attribute / credential certificate from the user and to verify the attribute / credential certificate.

[0069] When the authentication proxy request does not include certificate information, for example, certificate information (conditions, etc.) that can be used for service authentication agreed upon in advance between the NW and the external service 90 is stored in the NW (for example, the UDM / UDR 40). The NW can store this certificate information for each external service.

[0070] Regarding the determination of the conditions for the attribute / credential certificate to be used for service authentication, the NW may determine the conditions, or the external service 90 may determine the conditions. Examples of conditions are as follows. The conditions include any one or more of the following five pieces of information. The conditions may also include information other than the following five pieces of information. Note that the My Number VC is assumed to be information equivalent to the current My Number converted into VC format.

[0071] - Certificate type (My Number VC, etc.) - Certificate data format / encoding format (W3C VC, JWT, etc.) - Information to be included in the certificate (name, age, etc.) - Signature algorithm or signature format - Version <S203> In S203, the CAPIF authorization function 80 transfers the authentication proxy request to the authentication function 60.

[0072] <S204> In S204, the authentication function 60 refers to the correspondence information DB 43 to identify the user's contact information (e.g., a phone number capable of sending SMS, a communication endpoint of the user's wallet, etc.) from the user contact information linking identifier. Note that the user contact information linking identifier itself may be information indicating the user's contact information. In this case, the authentication function 60 accesses the user using the user contact information linking identifier itself.

[0073] <S205> In S205, the authentication function 60 uses the contact information identified in S204 to request attributes / credentials that can be used for service authentication from the user (UE 20 in the example of FIG. 5).

[0074] <S206, S207> In S206, it is assumed that the request is confirmed by the user (person) and consent (approval) is obtained to provide the attribute / credentials certificate. Note that S206 may not be performed.

[0075] In S207, the UE 20 responds with the requested attributes / credentials to the authentication function 60. The authentication function 60 receives the attributes / credentials.

[0076] In addition, in S205, the authentication function 60 may additionally request from the UE 20 a user identifier (e.g., DID) linked to the attribute / credentials certificate, which is used to verify that the attribute / credentials certificate received in S207 belongs to the user of the communication partner.

[0077] <S208> In S208, the authentication function 60 verifies the "validity, legitimacy, and eligibility" of the user identifier and attribute / credentials by using the VDR 70. A specific example of the verification will be described later.

[0078] <S209> In S209, the authentication function 60 responds to the CAPIF authorization function 80 with the verification result (OK / NG, etc.).

[0079] <S210> In S210, the CAPIF authorization function 80 responds to the external service 90 with the verification result (OK / NG, etc.).

[0080] In addition, in S209, the authentication function 60 includes the user's attribute / credentials or the user's identifier (or both the attribute / credentials and the identifier) ​​in a response message to the CAPIF authorization function 80, and in S210, the CAPIF authorization function 80 may include the user's attribute / credentials or the user's identifier (or both the attribute / credentials and the identifier) ​​received from the authentication function 60 in a response message to the external service 90.

[0081] <S211> In S211, if the external service 90 confirms that the verification result is OK, it determines that the service authentication has been successful and provides the service to the user.

[0082] <Additional Information Regarding S205 to S207> More specifically, the following procedure may be executed regarding S205 to S207.

[0083] In S205, the authentication device 60 sends a message requesting attributes / credentials to the AMF 30. The AMF 30 forwards the message received from the authentication device 60 to the (R)AN 10, which forwards the message to the UE 20. The message includes attribute / credential conditions required for service authentication.

[0084] At S206, the UE 20 displays the information contained in the message received from the (R)AN 10 on a display, and the user of the UE 20 confirms the conditions of the requested attributes / credentials.

[0085] If the user agrees to provide the information, a response message including the requested attributes / credentials (e.g., VC) is sent in S207, with a signature (e.g., VP) generated by the UE 20 using a private key corresponding to the user's identifier.

[0086] In the above example, the user (person) checks the conditions, but the UE 20 may automatically check the conditions.

[0087] The (R)AN 10 that has received the response message transfers the response message to the AMF 30, and the AMF 30 transfers the response message to the authentication function 60.

[0088] The processing procedure of the second embodiment has been described above. In the above description, it is assumed that the user is a subscriber of the 3GPP network, but the user does not necessarily have to be a subscriber of the 3GPP network. If the user is a non-subscriber, for example, the external service 90 sends the authentication proxy request message in S202 including the user's contact information, such as the user's telephone number or a wallet communication endpoint. This allows the authentication function 60 in the 3GPP network to identify the user's contact information.

[0089] According to the second embodiment described above, it is possible to realize proxy authentication based on attributes / credentials.

[0090] (Specific Example of Authentication / Verification Processing) A specific example of the authentication / verification processing of attributes / credentials executed by the authentication function 60 in S104 in the first embodiment and S208 in the second embodiment will be described with reference to FIG. 6. Here, as an example of authentication / verification processing logic, verification of attributes / credentials in W3C DID / VC / VP format is assumed. However, using verification logic for attributes / credentials in W3C DID / VC / VP format is merely an example, and authentication / verification processing may be performed using logic other than this.

[0091] When the authentication process using attributes / credentials starts, in S1, the authentication function 60 requests the VDR 70 for a public key corresponding to the identifier of the certificate issuer (Issuer) and a public key corresponding to the identifier of the user. In S2, the VDR 70 responds with these public keys to the authentication function 60.

[0092] In S3, the authentication function 60 verifies the authenticity of the certificate issuer's signature and the user's signature, and verifies that the message has not been tampered with.

[0093] Note that communication between the authentication function 60 in the 3GPP network and the VDR 70 outside the 3GPP network may be via a node (e.g., NEF, SCEF) that mediates communication between the authentication function 60 in the 3GPP network and the VDR 70 outside the 3GPP network.

[0094] Regarding S1 to S3, in more detail, in S1 and S2, the authentication function 60 receives as input DID0 (certificate issuer identifier) ​​and DID1 (user identifier) ​​included in the received VP / VC, and uses an arbitrary DID Method to obtain (resolve) the DID Document (public key) corresponding to DID0 and the DID Document (public key) corresponding to DID1 from the VDR 70. In S3, the authentication function 60 verifies that the VP holder signature and the VC issuer signature are each signatures made with private keys linked to the corresponding public keys (validity of the signatures, no tampering with the messages).

[0095] In S4, the authentication function 60 requests information regarding the certificate format and status (such as revocation status) from the VDR 70. In S5, the VDR 70 responds with the certificate format and status information. In S6, the authentication function 60 verifies the validity of the certificate.

[0096] Regarding S4 to S6, in more detail, the authentication function 60 acquires the VC schema, definition information, etc. from the VDR 70 and verifies that the VC syntax, etc. is correct. The authentication function 60 also acquires VC validity information / revocation information from the VDR 70 and verifies that the received VC is valid.

[0097] In S7, the authentication function 60 requests certificate information usable for service authentication from the UDM / UDR (40), and in S8, the UDM / UDR (40) responds with the certificate information. In S9, the authentication function 60 performs eligibility verification of the certificate. More specifically, the authentication function 60 verifies that the conditions for a VC usable for service authentication (e.g., that it is a My Number VC and that it contains necessary information (e.g., name, address)) are met. Note that, if the external service 90 includes certificate information in the authentication proxy request, or if the authentication function 60 can obtain the certificate information by a method other than S7 and S8, S7 and S8 may be omitted.

[0098] If the authentication function 60 determines that all of the above verification results are OK, it determines that the authentication has been successful.

[0099] (Device Configuration) Next, an example of the functional configuration of the terminal 20 (UE 20) and the "authentication function 60, CAPIF authorization function, etc." that perform the processes and operations described above will be described. Hereinafter, the network nodes of the authentication function 60, CAPIF authorization function, etc. will be collectively referred to as the "network node 100."

[0100] <Network Node 100> FIG. 7 is a diagram showing an example of the functional configuration of the network node 100. As shown in FIG.

[0101] As shown in Fig. 7, the network node 100 includes a transmitting unit 110, a receiving unit 120, a setting unit 130, and a control unit 140. The functional configuration shown in Fig. 7 is merely an example. The names of the functional divisions and functional units may be any names as long as they can perform the operations according to the embodiment of the present invention.

[0102] The transmitter 110 has a function of generating a signal to be transmitted to the terminal 20 or another network node and transmitting the signal via a wired or wireless connection. The receiver 120 has a function of receiving various signals transmitted from the terminal 20 or another network node and acquiring, for example, information of a higher layer from the received signal. A communication unit including the transmitter 110 and the receiver 120 may be configured.

[0103] The setting unit 130 stores pre-set setting information and various setting information to be transmitted to the terminal 20 in a storage device, and reads out the information from the storage device as needed. The control unit 140 controls the network node 100. The function unit related to signal transmission in the control unit 140 may be included in the transmitting unit 110, and the function unit related to signal reception in the control unit 140 may be included in the receiving unit 120. The transmitting unit 110 and the receiving unit 120 may be called a transmitter and a receiver, respectively.

[0104] <Terminal 20> Fig. 8 is a diagram showing an example of the functional configuration of the terminal 20. As shown in Fig. 8, the terminal 20 has a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240. The functional configuration shown in Fig. 8 is merely an example. The names of the functional divisions and functional units may be any as long as they can perform the operations related to the embodiment of the present invention.

[0105] The transmitter 210 creates a transmission signal from transmission data and transmits the transmission signal wirelessly. The receiver 220 receives various signals wirelessly and acquires higher layer signals from the received physical layer signals. The receiver 220 also has a function of receiving NR-PSS, NR-SSS, NR-PBCH, DL / UL control signals, reference signals, and the like transmitted from a base station. A communication unit including the transmitter 210 and the receiver 220 may be configured.

[0106] The setting unit 230 stores various setting information received from a base station or the like by the receiving unit 220 in a storage device, and reads it out from the storage device as needed. The setting unit 230 also stores setting information that is set in advance.

[0107] The control unit 240 controls the terminal 20. The functional unit in the control unit 240 related to signal transmission may be included in the transmitting unit 210, and the functional unit in the control unit 240 related to signal reception may be included in the receiving unit 220. The transmitting unit 210 and the receiving unit 220 may be called a transmitter and a receiver, respectively.

[0108] (Hardware Configuration) The block diagrams (FIGS. 7 and 8) used to explain the above embodiments show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method for realizing each functional block is not particularly limited. That is, each functional block may be realized using a single device that is physically or logically coupled, or may be realized using two or more physically or logically separated devices that are directly or indirectly connected (for example, using wires, wirelessly, etc.) and these multiple devices. The functional block may also be realized by combining software with the single device or the multiple devices.

[0109] Functions include, but are not limited to, judgment, determination, assessment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, consideration, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assignment. For example, a functional block (component) that performs transmission is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on how these functions are implemented.

[0110] For example, the network node 100 and the terminal 20 according to an embodiment of the present disclosure may function as a computer that performs processing of the communication method of the present disclosure. Fig. 9 is a diagram illustrating an example of the hardware configuration of the network node 100 and the terminal 20 according to an embodiment of the present disclosure. The EES 30 and the terminal 20 described above may be physically configured as a computer device including a processor 1001, a storage device 1002, an auxiliary storage device 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc.

[0111] In the following description, the term "apparatus" can be read as a circuit, a device, a unit, etc. The hardware configuration of the network node 100 and the terminal 20 may be configured to include one or more of the apparatuses shown in the figure, or may be configured to exclude some of the apparatuses.

[0112] Each function in the network node 100 and the terminal 20 is realized by loading specified software (programs) onto hardware such as the processor 1001, the memory device 1002, etc., so that the processor 1001 performs calculations, controls communication via the communication device 1004, and controls at least one of reading and writing data in the memory device 1002 and the auxiliary memory device 1003.

[0113] The processor 1001 controls the entire computer by running, for example, an operating system. The processor 1001 may be configured as a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc. For example, the above-mentioned control unit 140, control unit 240, etc. may be realized by the processor 1001.

[0114] The processor 1001 also reads programs (program codes), software modules, data, etc. from at least one of the auxiliary storage device 1003 and the communication device 1004 into the storage device 1002 and executes various processes in accordance with the programs. The programs used are those that cause a computer to execute at least some of the operations described in the above-described embodiments. For example, the control unit 140 of the network node 100 shown in FIG. 7 may be implemented by a control program stored in the storage device 1002 and running on the processor 1001. For example, the control unit 240 of the terminal 20 shown in FIG. 8 may be implemented by a control program stored in the storage device 1002 and running on the processor 1001. While the above-described various processes have been described as being executed by one processor 1001, they may also be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The programs may also be transmitted from a network via a telecommunications line.

[0115] The storage device 1002 is a computer-readable recording medium and may be configured, for example, by at least one of a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a random access memory (RAM), etc. The storage device 1002 may also be called a register, a cache, a main memory, etc. The storage device 1002 can store executable programs (program codes), software modules, etc. for implementing a communication method according to an embodiment of the present disclosure.

[0116] The secondary storage device 1003 is a computer-readable recording medium, and may be, for example, at least one of an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy (registered trademark) disk, a magnetic strip, etc. The above-mentioned storage medium may be, for example, a database, a server, or other appropriate medium including at least one of the storage device 1002 and the secondary storage device 1003.

[0117] The communication device 1004 is hardware (transmission / reception device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, a network controller, a network card, or a communication module. The communication device 1004 may be configured to include a high-frequency switch, a duplexer, a filter, a frequency synthesizer, etc. to realize at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, a transmission / reception antenna, an amplifier unit, a transmission / reception unit, a transmission path interface, etc. may be realized by the communication device 1004. The transmission / reception unit may be implemented as a transmission unit and a reception unit that are physically or logically separated.

[0118] The input device 1005 is an input device (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that receives input from the outside. The output device 1006 is an output device (e.g., a display, a speaker, an LED lamp, etc.) that outputs to the outside. Note that the input device 1005 and the output device 1006 may be integrated into one device (e.g., a touch panel).

[0119] Furthermore, each device such as the processor 1001 and the storage device 1002 is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses between each device.

[0120] Furthermore, the network node 100 and the terminal 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA), and some or all of the functional blocks may be realized by the hardware. For example, the processor 1001 may be implemented using at least one of these pieces of hardware.

[0121] 10 shows an example configuration of a vehicle 2001. As shown in FIG. 10 , the vehicle 2001 includes a drive unit 2002, a steering unit 2003, an accelerator pedal 2004, a brake pedal 2005, a shift lever 2006, front wheels 2007, rear wheels 2008, an axle 2009, an electronic control unit 2010, various sensors 2021 to 2029, an information service unit 2012, and a communication module 2013. Each aspect / embodiment described in the present disclosure may be applied to a communication device mounted on the vehicle 2001, and may be applied to the communication module 2013, for example. For example, the network node 100 or the terminal 20 may be included in the communication module 2013.

[0122] The drive unit 2002 is configured, for example, by an engine, a motor, or a hybrid of an engine and a motor. The steering unit 2003 includes at least a steering wheel (also called a handle) and is configured to steer at least one of the front wheels and the rear wheels based on the operation of the steering wheel operated by the user.

[0123] The electronic control unit 2010 is composed of a microprocessor 2031, a memory (ROM, RAM) 2032, and a communication port (IO port) 2033. Signals are input to the electronic control unit 2010 from various sensors 2021 to 2029 provided in the vehicle 2001. The electronic control unit 2010 may also be called an ECU (Electronic Control Unit).

[0124] The signals from the various sensors 2021 to 2029 include a current signal from a current sensor 2021 that senses the current of the motor, a rotation speed signal of the front and rear wheels obtained by a rotation speed sensor 2022, an air pressure signal of the front and rear wheels obtained by an air pressure sensor 2023, a vehicle speed signal obtained by a vehicle speed sensor 2024, an acceleration signal obtained by an acceleration sensor 2025, an accelerator pedal depression amount signal obtained by an accelerator pedal sensor 2029, a brake pedal depression amount signal obtained by a brake pedal sensor 2026, a shift lever operation signal obtained by a shift lever sensor 2027, and a detection signal for detecting obstacles, vehicles, pedestrians, etc. obtained by an object detection sensor 2028.

[0125] The information service unit 2012 is composed of various devices, such as a car navigation system, an audio system, speakers, a television, and a radio, for providing (outputting) various types of information, such as driving information, traffic information, and entertainment information, and one or more ECUs for controlling these devices. The information service unit 2012 uses information acquired from external devices via the communication module 2013 or the like to provide various types of multimedia information and multimedia services to the occupants of the vehicle 2001. The information service unit 2012 may include input devices (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, a touch panel, etc.) that accept input from the outside, and may also include output devices (e.g., a display, a speaker, an LED lamp, a touch panel, etc.) that output information to the outside.

[0126] The driving assistance system unit 2030 is composed of various devices that provide functions for preventing accidents and reducing the driving burden on the driver, such as millimeter-wave radar, LiDAR (Light Detection and Ranging), cameras, positioning locators (e.g., GNSS, etc.), map information (e.g., high-definition (HD) maps, autonomous vehicle (AV) maps, etc.), gyro systems (e.g., IMU (Inertial Measurement Unit), INS (Inertial Navigation System), etc.), AI (Artificial Intelligence) chips, and AI processors, as well as one or more ECUs that control these devices. In addition, the driving assistance system unit 2030 transmits and receives various information via the communication module 2013 to realize the driving assistance function or the autonomous driving function.

[0127] The communication module 2013 can communicate with the microprocessor 2031 and components of the vehicle 2001 via the communication port. For example, the communication module 2013 transmits and receives data via the communication port 2033 to and from the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axle 2009, microprocessor 2031 and memory (ROM, RAM) 2032 in the electronic control unit 2010, and sensors 2021 to 29, which are provided in the vehicle 2001.

[0128] The communication module 2013 is a communication device that can be controlled by the microprocessor 2031 of the electronic control unit 2010 and can communicate with an external device. For example, it transmits and receives various information to and from the external device via wireless communication. The communication module 2013 may be located either inside or outside the electronic control unit 2010. The external device may be, for example, a base station, a terminal, a network node, or the like.

[0129] The communication module 2013 may transmit, via wireless communication, to an external device at least one of signals from the various sensors 2021-2028 input to the electronic control unit 2010, information obtained based on the signals, and information based on input from the outside (user) obtained via the information service unit 2012. The electronic control unit 2010, the various sensors 2021-2028, the information service unit 2012, etc. may be referred to as input units that accept input.

[0130] The communication module 2013 receives various information (traffic information, traffic signal information, vehicle-to-vehicle information, etc.) transmitted from external devices and displays it on an information service unit 2012 provided in the vehicle 2001. The information service unit 2012 may be called an output unit that outputs information (for example, outputs information to a device such as a display or speaker based on the PDSCH (or data / information decoded from the PDSCH) received by the communication module 2013). The communication module 2013 also stores the various information received from external devices in a memory 2032 that can be used by the microprocessor 2031. Based on the information stored in the memory 2032, the microprocessor 2031 may control the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axles 2009, sensors 2021 to 2029, etc. provided in the vehicle 2001.

[0131] Furthermore, when the communication module 2013 includes the network node 100 (or the terminal 20), the communication module 2013 can perform the operations of the network node 100 (or the terminal 20) described above.

[0132] This specification discloses at least the configurations described in the appendices below.

[0133] <Additional Notes> (Additional Item 1) A network node comprising: a receiving unit that receives, from a specific network node, an authentication proxy request including a certificate storing personal data of a user; a control unit that executes authentication processing using the certificate; and a transmitting unit that transmits an authentication result to the specific network node. (Additional Item 2) The network node according to Additional Item 1, wherein the authentication proxy request is a request to have the network node perform authentication for providing a service to the user on behalf of an external service node. (Additional Item 3) A network node comprising: a receiving unit that receives, from a specific network node, an authentication proxy request regarding authentication for providing a service to a user; a control unit that executes authentication processing using a certificate storing personal data of the user, obtained based on the request to the user; and a transmitting unit that transmits the authentication result to the specific network node. (Additional Item 4) The network node according to Additional Item 3, wherein the control unit obtains contact information for the user using an identifier included in the authentication proxy request, and transmits the request to the user using the contact information. (Supplementary Item 5) A communication method executed by a network node, comprising the steps of: receiving, from a specific network node, an authentication proxy request including a certificate storing personal data of a user, performing authentication processing using the certificate, and transmitting the authentication result to the specific network node. (Supplementary Item 6) A communication method executed by a network node, comprising the steps of: receiving, from a specific network node, an authentication proxy request regarding authentication for providing a service to a user, performing authentication processing using a certificate storing personal data of the user, obtained based on the request to the user, and transmitting the authentication result to the specific network node.

[0134] All of Supplementary Items 1 to 6 provide techniques for realizing attribute / credential-based authentication delegation. Supplementary Item 2 allows authentication delegation to be performed based on a clear authentication delegation request. Supplementary Item 4 allows a network node to obtain a certificate from a user.

[0135] (Supplementary Notes on the Embodiments) Although the embodiments of the present invention have been described above, the disclosed invention is not limited to such embodiments, and those skilled in the art will understand various modifications, alterations, alternatives, and substitutions. While specific numerical examples have been used to facilitate understanding of the invention, unless otherwise specified, these numerical values ​​are merely examples, and any appropriate values ​​may be used. The division of items in the above description is not essential to the present invention; matters described in two or more items may be used in combination as needed, and matters described in one item may apply to matters described in another item (as long as there is no contradiction). Boundaries between functional units or processing units in functional block diagrams do not necessarily correspond to boundaries between physical components. The operations of multiple functional units may be performed physically by a single component, or the operations of a single functional unit may be performed physically by multiple components. The order of processing procedures described in the embodiments may be reversed as long as there is no contradiction. For convenience of processing description, the network node 100 and the terminal 20 have been described using functional block diagrams. However, such devices may be realized by hardware, software, or a combination thereof. The software operated by the processor of the EES 30 in accordance with an embodiment of the present invention and the software operated by the processor of the terminal 20 in accordance with an embodiment of the present invention may each be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM, EEPROM, registers, hard disk (HDD), removable disk, CD-ROM, database, server, or any other suitable storage medium.

[0136] Furthermore, the notification of information is not limited to the aspects / embodiments described in the present disclosure, and may be performed using other methods. For example, the notification of information may be performed by physical layer signaling (e.g., Downlink Control Information (DCI), Uplink Control Information (UCI)), higher layer signaling (e.g., Radio Resource Control (RRC) signaling, Medium Access Control (MAC) signaling), broadcast information (Master Information Block (MIB), System Information Block (SIB)), other signals, or a combination thereof. Furthermore, the RRC signaling may be referred to as an RRC message, and may be, for example, an RRC Connection Setup message, an RRC Connection Reconfiguration message, or the like.

[0137] Each aspect / embodiment described in the present disclosure may be implemented using any of the following standards: LTE (Long Term Evolution), LTE-Advanced (LTE-A), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (x is, for example, an integer or a decimal number)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.17 (WiMAX (registered trademark)), IEEE 802.19 (WiMAX (registered trademark)), IEEE 802.20 (WiMAX (registered trademark)), IEEE 802.21 (Wi-Fi (registered trademark)), IEEE 802.22 (WiMAX (registered trademark)), IEEE 802.23 (WiMAX (registered trademark)), IEEE 802.24 (WiMAX (registered trademark)), IEEE 802.25 (WiMAX (registered trademark)), IEEE 802.26 (WiMAX (registered trademark)), IEEE 802.27 (WiMAX (registered trademark)), IEEE 802.28 (WiMAX (registered trademark)), IEEE 802.29 (WiMAX (registered trademark)), IEEE 802.30 (WiMAX (registered trademark)), IEEE 802.31 (Wi-Fi (registered trademark)), IEEE 802.32 (WiMAX (registered trademark)), IEEE 802.33 (WiMAX (registered trademark)), IEEE 802.34 ( The present invention may be applied to at least one of systems using 802.20, UWB (Ultra-Wide Band), Bluetooth (registered trademark), or other suitable systems, and next-generation systems that are extended, modified, created, or defined based on these systems. The present invention may also be applied to a combination of multiple systems (e.g., a combination of LTE and / or LTE-A with 5G).

[0138] The order of the procedures, sequences, flowcharts, etc. of each aspect / embodiment described herein may be rearranged unless it is consistent. For example, the methods described in this disclosure present elements of various steps using an example order and are not limited to the particular order presented.

[0139] In this specification, a specific operation described as being performed by the base station 10 ((R)AN 10) may also be performed by its upper node in some cases. In a network consisting of one or more network nodes having a base station 10, it is clear that various operations performed for communication with a terminal 20 may be performed by at least one of the base station 10 and another network node other than the base station 10 (such as, but not limited to, an MME or an S-GW). Although the above example illustrates a case where there is one other network node other than the base station 10, the other network node may be a combination of multiple other network nodes (for example, an MME and an S-GW).

[0140] The information, signals, etc. described in the present disclosure may be output from a higher layer (or a lower layer) to a lower layer (or a higher layer), or may be input / output via multiple network nodes.

[0141] Input and output information may be stored in a specific location (for example, memory) or may be managed using a management table. Input and output information may be overwritten, updated, or added to. Output information may be deleted. Input information may be transmitted to another device.

[0142] In the present disclosure, the determination may be made by a value represented by one bit (0 or 1), by a Boolean value (true or false), or by a comparison of numerical values ​​(e.g., comparison with a predetermined value).

[0143] Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0144] Software, instructions, information, etc. may also be transmitted or received over a transmission medium. For example, if software is transmitted from a website, server, or other remote source using wired technologies (such as coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL)), and / or wireless technologies (such as infrared, microwave), then these wired and / or wireless technologies are included within the definition of transmission media.

[0145] The information, signals, etc. described in this disclosure may be represented using any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0146] Note that terms described in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol may be a signal (signaling). Furthermore, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, a cell, a frequency carrier, etc.

[0147] As used in this disclosure, the terms "system" and "network" are used interchangeably.

[0148] Furthermore, the information, parameters, etc. described in the present disclosure may be expressed using absolute values, may be expressed using relative values ​​from a predetermined value, or may be expressed using other corresponding information. For example, a radio resource may be indicated by an index.

[0149] The names used for the above-described parameters are not intended to be limiting in any way. Furthermore, the mathematical expressions using these parameters may differ from those explicitly disclosed in this disclosure. The various channels (e.g., PUCCH, PDCCH, etc.) and information elements may be identified by any suitable names, and therefore the various names assigned to these various channels and information elements are not intended to be limiting in any way.

[0150] In the present disclosure, terms such as "base station (BS)," "radio base station," "base station device," "fixed station," "NodeB," "eNodeB (eNB)," "gNodeB (gNB)," "access point," "transmission point," "reception point," "transmission / reception point," "cell," "sector," "cell group," "carrier," and "component carrier" may be used interchangeably. A base station may also be referred to by terms such as a macrocell, a small cell, a femtocell, and a picocell.

[0151] A base station can accommodate one or more (e.g., three) cells. When a base station accommodates multiple cells, the overall coverage area of ​​the base station can be partitioned into multiple smaller areas, and each smaller area can also be provided with communication services by a base station subsystem (e.g., a small indoor base station (RRH: Remote Radio Head)). The terms "cell" or "sector" refer to part or all of the coverage area of ​​a base station and / or base station subsystem that provides communication services within that coverage.

[0152] In the present disclosure, the base station transmitting information to a terminal may be interpreted as the base station instructing the terminal to control or operate based on the information.

[0153] In this disclosure, the terms "Mobile Station (MS)," "user terminal," "User Equipment (UE)," "terminal," and the like may be used interchangeably.

[0154] A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other suitable terminology.

[0155] At least one of the base station and the mobile station (terminal 20) may be referred to as a transmitting device, a receiving device, a communication device, etc. At least one of the base station and the mobile station may be a device mounted on a mobile object, the mobile object itself, etc. The mobile object refers to a movable object, and may move at any speed. Naturally, this also includes cases where the mobile object is stationary. Examples of the mobile object include, but are not limited to, vehicles, transport vehicles, automobiles, motorcycles, bicycles, connected cars, excavators, bulldozers, wheel loaders, dump trucks, forklifts, trains, buses, handcars, rickshaws, ships and other watercraft, airplanes, rockets, satellites, drones (registered trademark), multicopters, quadcopters, balloons, and objects mounted thereon. The mobile object may also be an autonomous mobile object operating based on an operational command. It may be a vehicle (e.g., a car, an airplane, etc.), an unmanned mobile object (e.g., a drone, an autonomous vehicle, etc.), or a robot (manned or unmanned). At least one of the base station and the mobile station may be a device that does not necessarily move during communication operations. For example, at least one of the base station and the mobile station may be an IoT (Internet of Things) device such as a sensor.

[0156] Furthermore, a base station in the present disclosure may be read as a user terminal. For example, the aspects / embodiments of the present disclosure may be applied to a configuration in which communication between a base station and a user terminal is replaced with communication between multiple terminals 20 (which may be called, for example, Device-to-Device (D2D) or Vehicle-to-Everything (V2X)). In this case, the terminal 20 may be configured to have the functions of the base station 10 described above. Furthermore, terms such as "uplink" and "downlink" may be read as terms corresponding to terminal-to-terminal communication (for example, "side"). For example, terms such as an uplink channel and a downlink channel may be read as a side channel.

[0157] Similarly, the user terminal in the present disclosure may be read as a base station, in which case the base station may be configured to have the functions of the user terminal described above.

[0158] As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of actions. "Determining" and "determining" may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching in a table, database, or other data structure), ascertaining, and the like. "Determining" and "determining" may also include receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, accessing (e.g., accessing data in memory), and the like. Furthermore, "judgment" and "decision" can include regarding resolving, selecting, choosing, establishing, comparing, etc. as having been "judged" or "decided." In other words, "judgment" and "decision" can include regarding some action as having been "judged" or "decided." Furthermore, "judgment (decision)" can be interpreted as "assuming," "expecting," "considering," etc.

[0159] The terms "connected," "coupled," or any variation thereof, refer to any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are "connected" or "coupled" to each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, "connected" may be read as "access." As used in this disclosure, two elements may be considered to be "connected" or "coupled" to each other using one or more wires, cables, and / or printed electrical connections, as well as electromagnetic energy having wavelengths in the radio frequency range, microwave range, and optical (both visible and invisible) range, as some non-limiting and non-exhaustive examples.

[0160] The reference signal may be abbreviated as RS (Reference Signal) or may be called a pilot depending on the applicable standard.

[0161] As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

[0162] As used in this disclosure, any reference to an element using a designation such as "first," "second," etc. does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient method of distinguishing between two or more elements. Thus, a reference to a first and a second element does not imply that only two elements may be employed or that the first element must in some way precede the second element.

[0163] The "means" in the configuration of each of the above devices may be replaced with "part," "circuit," "device," etc.

[0164] When the terms "include," "including," and variations thereof are used in this disclosure, these terms are intended to be inclusive, similar to the term "comprising." Furthermore, when the term "or" is used in this disclosure, it is not intended to be an exclusive or.

[0165] In this disclosure, where articles are added by translation, such as a, an, and the in English, the disclosure may include that the nouns following these articles are in the plural form.

[0166] In the present disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "coupled" may also be interpreted in the same way as "different."

[0167] The aspects / embodiments described in this disclosure may be used alone, in combination, or switched depending on the implementation. Notification of predetermined information (e.g., notification that "X is true") is not limited to explicit notification, but may be implicit (e.g., not notifying the predetermined information).

[0168] Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended to be illustrative and does not have any limiting meaning on the present disclosure.

[0169] DESCRIPTION OF SYMBOLS 10 Base station ((R)AN) 20 Terminal (UE) 21 Management function 30 AMF 40 UDM 41 NW information DB 42 Certificate information DB 43 Correspondence information DB 60 Authentication function 70 VDR 71 User information DB 72 Issuer information DB 73 Definition information DB 74 Management information DB 80 CAPIF authorization function 100 Network node 110 Transmission unit 120 Reception unit 130 Setting unit 140 Control unit 210 Transmission unit 220 Reception unit 230 Setting unit 240 Control unit 1001 Processor 1002 Storage device 1003 Auxiliary storage device 1004 Communication device 1005 Input device 1006 Output device

Claims

1. A network node comprising: a receiving unit that receives an authentication agency request including a certificate storing personal data of a user from a specific network node; a control unit that executes an authentication process using the certificate; and a transmitting unit that transmits an authentication result to the specific network node.

2. The network node according to claim 1, wherein the authentication agency request is a request for causing the network node to perform authentication on behalf of an external service node for service provision to the user.

3. A network node comprising: a receiving unit that receives an authentication agency request regarding authentication for service provision to a user from a specific network node; a control unit that executes an authentication process using a certificate storing personal data of the user obtained based on a request to the user; and a transmitting unit that transmits an authentication result to the specific network node.

4. The network node according to claim 3, wherein the control unit obtains a contact address of the user using an identifier included in the authentication agency request and transmits the request to the user using the contact address.

5. A communication method executed by a network node, comprising: receiving an authentication agency request including a certificate storing personal data of a user from a specific network node; executing an authentication process using the certificate; and transmitting an authentication result to the specific network node.

6. A communication method executed by a network node, comprising: receiving an authentication agency request regarding authentication for service provision to a user from a specific network node; executing an authentication process using a certificate storing personal data of the user obtained based on a request to the user; and transmitting an authentication result to the specific network node.

Images