Representation tokens in indirect communication

Patent metadata

Field	Value
Publication number	US-2023412589-A1
Application number	US-202117913889-A
Country	US
Kind code	A1
Filing date	Mar 16, 2021
Priority date	Mar 31, 2020
Publication date	Dec 21, 2023
Grant date	—

Abstract

A method comprises receiving an access token request from a first network entity for granting access to a network function, NF, service producer. The method further comprises determining whether an access token can be granted for the first network entity. Responsive to determining that the access token can be granted, the method further comprises generating the access token that includes an identifier of a NF consumer associated with the first network entity and an identifier of each network entity in a communication path between the first network entity and the NF service producer and transmitting the access token towards the first network entity.

First claim

1 . A method performed by a network equipment, the method comprising:
receiving an access token request from a first network entity for granting access to a network function, NF, service producer; determining whether an access token can be granted for the first network entity; responsive to determining that the access token can be granted:
generating the access token that includes an identifier of a NF consumer associated with the first network entity and an identifier of each network entity in a communication path between the first network entity and the NF service producer; and
transmitting the access token towards the first network entity.

2 . The method of claim 1 , wherein the network equipment implements a Network Repository Function, NRF and the first network entity comprises one of a consumer device user equipment or a service communications proxy, SCP.

3 . The method of claim 1 , wherein receiving the access token request from the first network entity comprises receiving the access token request from the NF consumer associated with the first network entity.

4 . The method of claim 1 , wherein receiving the access token request from the first network entity comprises receiving the access token request from a service communications proxy on behalf of the NF consumer.

5 . A network equipment comprising:
processing circuitry; and memory coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the network equipment to perform operations comprising:
receiving an access token request from a first network entity for granting access to a network function, NF, service producer;
determining whether an access token can be granted for the first network entity;
responsive to determining that the access token can be granted:
generating the access token that includes an identifier of a consumer associated with the first network entity and an identifier of each network entity in a path between the first network entity and the NF service producer; and
transmitting the access token towards the first network entity.

6 . The network equipment of claim 5 , wherein the memory includes instructions that when executed by the processing circuitry causes the network equipment to implement a network resource function, NRF.

7 . The network equipment of claim 5 , wherein in receiving the access token request from the first network entity, the memory includes further instructions that when executed by the processing circuitry causes the network equipment to perform operations comprising:
receiving the access token request from a network function, NF, consumer associated with the first network entity.

8 . The network equipment of claim 5 , wherein in receiving the access token request from the first network entity, the memory includes further instructions that when executed by the processing circuitry causes the network equipment to perform operations comprising:
receiving the access token request from a service communication proxy on behalf of a network function, NF, consumer.

9 - 10 . (canceled)

11 . A method performed by a network equipment, the method comprising:
receiving a service request from a first network entity, the service request comprising an access token that includes an identifier of a NF consumer associated with the first network entity and an identifier of each network entity in a path between the first network entity and the NF service producer; verifying a signature of the access token with a public key of a network resource function, NRF, node; determining whether an identifier of a last hop network entity that transmitted the service request is included in the access token; and responsive to the identifier of the last hop network entity being included in the access token and the signature being valid, determining that the NF consumer is allowed to access a service provided by the network equipment.

12 . The method of claim 11 wherein the network equipment implements a network function, NF, service producer.

13 . The method of claim 11 , further comprising:
verifying whether or not the access token has expired; and wherein determining that the NF consumer is allowed to access a service provided by the network equipment comprises responsive to the identifier of the last hop network entity is included in the access token and the signature is valid and the access token has not expired, determining that the NF consumer is allowed to access a service provided by the network equipment.

14 . The method of claim 11 , further comprising:
responsive to the identifier of the last hop network entity not being included in the access token or the signature is not valid, determining that the NF consumer is not allowed to access a service provided by the network equipment.

15 . (canceled)

16 . The method of claim 11 , further comprising:
responsive to the identifier of the last hop network entity is included in the access token and the signature is valid, transmitting a service request response indicating the NF consumer can access the service.

17 - 18 . (canceled)

19 . A network equipment comprising:
processing circuitry; and memory coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the network equipment to perform operations comprising:
receiving a service request from a first network entity, the service request comprising an access token that includes an identifier of a NF consumer associated with the first network entity and an identifier of each network entity in a path between the first network entity and an NF service producer;
verifying a signature of the access token with a public key of a network resource function, NRF, node;
determining whether an identifier of a last hop network entity that transmitted the service request is included in the access token; and
responsive to the identifier of the last hop network entity is included in the access token and the signature is valid, determining that the NF consumer is allowed to access a service provided by the NF service producer.

20 . The network equipment of claim 19 wherein the wherein the memory includes instructions that when executed by the processing circuitry causes the network equipment to implement an NF service producer.

21 . The network equipment of claim 19 , further comprising:
verifying whether or not the access token has expired; and wherein determining that the NF consumer is allowed to access a service provided by the network node/function comprises responsive to the identifier of the last hop network entity is included in the access token and the signature is valid and the access token has not expired, determining that the NF consumer is allowed to access a service provided by the network equipment.

22 . The network equipment of claim 19 , wherein the memory includes further instructions that when executed by the processing circuitry causes the NF service producer node to perform further operations comprising:
responsive to the identifier of the last hop network entity not being included in the access token or the signature is not valid, determining that the NF consumer is not allowed to access a service provided by the NF service producer.

23 . (canceled)

24 . The network equipment of claim 19 , wherein the memory includes further instructions that when executed by the processing circuitry

Assignees

• Ericsson Telefon Ab L M

Inventors

• Jost Christine
• Karakoc Ferhat

Classifications

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title