Method and apparatus for authentication between core network devices in mobile communication system

A communication method of a network function (NF) consumer in a wireless communication system according to an embodiment of the disclosure may include: receiving, from an NF repository function (NRF), a discovery response message in a discovery procedure, the discovery response message including NF set information including NF instance identifiers (IDs) for providing a service; transmitting, to the NRF, an access token request message including an NF producer instance ID; receiving, from the NRF, an access token response message including an access token; transmitting, to a service communication proxy (SCP), a service request message to be transmitted to an NF producer instance, the service request message including the token received from the NRF, a client credentials assertion (CCA) of the NF consumer, and the NF set information; and receiving, from the SCP, a service response message including a CCA of the NF producer instance.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is based on and claims priority under 35 U.S.C. § 119 to Korean Patent Application Nos. 10-2021-0051321 and 10-2021-0059580, filed on Apr. 20, 2021, and May 7, 2021, in the Korean Intellectual Property Office, the disclosures of which are herein incorporated by reference in their entirety.

BACKGROUND

The disclosure relates to a method and an apparatus for authentication between network devices in a mobile communication system and, more particularly, to a method and an apparatus for authentication and authority management of a network device in a connection between network devices.

2. Description of Related Art

SUMMARY

The disclosure relates to a method for authentication and authority management of a network device to be notified of data of a UE in connection between network devices in a mobile communication system for network access and data reception management of a mobile communication system UE.

A communication method of a network function (NF) consumer in a wireless communication system according to an embodiment of the disclosure may include: receiving, from an NF repository function (NRF), a discovery response message in a discovery procedure, the discovery response message including NF set information including NF instance identifiers (IDs) for providing a service; transmitting, to the NRF, an access token request message including an NF producer instance ID; receiving, from the NRF, an access token response message including an access token; transmitting, to a service communication proxy (SCP), a service request message to be transmitted to an NF producer instance, the service request message including the token received from the NRF, a client credentials assertion (CCA) of the NF consumer, and the NF set information; and receiving, from the SCP, a service response message including a CCA of the NF producer instance.

A method for relaying communication between a network function (NF) consumer and an NF producer by a service communication proxy (SCP) in a mobile communication system according to an embodiment of the disclosure may include: receiving, from the NF consumer, a service request message to be transmitted to the NF producer, the service request message including an NF set including NF producer instance identifications (IDs); transmitting, to the NF producer, the service request message; receiving, from the NF producer instance, a service response message including a client credentials assertion (CCA) of an NF producer instance; and transmitting, to the NF consumer, the service response message.

An apparatus according to an embodiment of the disclosure corresponds to a network function (NF) consumer in a wireless communication system and may include: a network interface configured to communicate with at least one NF; a memory; and at least one processor configured to perform control to receive, from an NF repository function (NRF), a discovery response message in a discovery procedure, the discovery response message including NF set information including NF instance identifiers (IDs) for providing a service, transmit, to the NRF, an access token request message including an NF producer instance ID, receive, from the NRF, an access token response message including an access token, transmit, to a service communication proxy (SCP), a service request message to be transmitted to an NF producer instance, the service request message including the token received from the NRF, a client credentials assertion (CCA) of the NF consumer, and the NF set information, and receive, from the SCP, a service response message including a CCA of the NF producer instance.

An apparatus according to an embodiment of the disclosure corresponds to a service communication proxy (SCP) for relaying communication between a network function (NF) consumer and an NF producer in a mobile communication system and may include: a network interface configured to communicate with at least one NF; a memory; and at least one processor configured to perform control to receive, from the NF consumer, a service request message to be transmitted to the NF producer, the service request message including an NF set including NF producer instance identifications (IDs), transmit, to the NF producer, the service request message, receive, from the NF producer instance, a service response message including a client credentials assertion (CCA) of an NF producer instance, and transmit, to the NF consumer, the service response message.

According to the disclosure, a service may be requested between network devices through a subscription and notification model, and authentication and authorization for the service may be performed. In particular, a service consumer may directly request a service from a service provider, and the service provider may request a service from a second service provider as a service consumer.

DETAILED DESCRIPTION

Hereinafter, various embodiments will be described in detail with reference to the accompanying drawings. Here, it should be noted that like components are denoted by like reference numerals in the accompanying drawings if possible. It should be also noted that the drawings of the disclosure attached below are provided to assist understanding of the disclosure, and the disclosure is not limited to forms or arrangements illustrated in the drawings of the disclosure. In addition, detailed descriptions of well-known functions and components that may make the gist of the disclosure unclear will be omitted. It should be noted that in the following description, only parts necessary for understanding operations according to various embodiments of the disclosure are described, and descriptions of other parts will be omitted so as not to obscure the gist of the disclosure.

FIG.1is a structural diagram of a 5G mobile communication system according to an embodiment of the present disclosure.

Before referring toFIG.1, a unit performing each function in a core network of the 5G mobile communication system may be defined as a network function (NF). A network function may be configured in a specific server or network device. When a network function is configured in a specific server or network device, two or more network functions may be mounted in one specific server (or network device). A network function being mounted may mean that the network function operates as a device that performs the network function. When a network function is mounted in a server, two or more different network functions performing the same function may be mounted. Two or more different network functions may be network functions controlling the same operation, or may be different network functions.

In an illustrative case where two or more identical network functions are included in one server, two or more user plane functions (UPFs) providing user data to a user equipment (UE) may exist in one server. In another illustrative case where different network functions are mounted in one server, a UPF and a session management function (SMF) may be mounted in one server.

In still another example, one network function may be configured by two or more different servers (or network devices). For example, one UPF may be configured through two or more servers.

As described above, network functions of the 5G core network described in this specification are terms for referring to one entity that performs a specific operation within the network, and it should be noted that a network function may be configured as a server or network device rather than a simple function.

Referring toFIG.1, a UE10may be a terminal capable of accessing at least the 5G network. The UE10may access various networks, such as a 4G network and/or a Wi-Fi network, in other wireless access modes. The UE10may have various forms. For example, the UE10may be configured as a terminal providing only an IoT function, may be a smart or tablet computer, or may be configured as a wearable-type device, such as a smart watch or smart glasses. In the disclosure, the UE10is not particularly limited in configured type.

A radio access node ((R)AN)20may be a network node that transmits and receives a signal or data on air to and from the UE10in a 5G radio access mode. The (R)AN20may collectively refer to a new radio access network supporting both evolved E-UTRA (E-UTRA) as an evolved version of 4G radio access technology, and new radio access technology (new radio: NR) (e.g., gNB).

Next, NFs forming the 5G core network are described. The NFs illustrated inFIG.1may include a user plane function (UPF)110, an authentication server function (AUSF)111, an access and mobility management function (AMF)112, a session management function (SMF)113, a service communication proxy (SCP)114, a network slice selection function (NSSF)115, a network exposure function (NEF)116, an NF repository function (NRF)117, a policy and control function (PCF)118, a unified data management (UDM)119, and an application function (AF)120.

The UPF110may transmit a downlink protocol data unit (PDU) received from a DN130to the UE10via the (R)AN20, and may transmit an uplink PDU received from the UE10via the (R)AN20to the DN130. Specifically, the UPF110may support an anchor point for intra/inter RAT mobility, an external PDU session point of interconnection to a data network, packet routing and forwarding, a user plane part of packet inspection and policy rule enforcement, lawful interception, traffic usage reporting, an uplink classifier for supporting routing of traffic flow to a data network, a branching point for supporting a multi-homed PDU session, QoS handling for a user plane (e.g. packet filtering, gating, and uplink/downlink rate implementation), uplink traffic verification (SDF mapping between service data flow (SDF) and QoS flow), transport-level packet marking in an uplink and a downlink, and a downlink packet buffering and downlink data notification triggering functions.

The AUSF111may process and store data for authentication of the UE10. Further, the AUSF111may perform authentication of the UE10in a 3rdgeneration partnership project (3GPP) access network and a non-3GPP access network.

The AMF112may provide a function for access and mobility management in UE units, and may basically be connected to one AMF per UE. Specifically, the AMF112may support functions of signaling between CN nodes for mobility between 3GPP access networks, termination of a radio access network (RAN) CP interface (i.e., an N2 interface), termination of NAS signaling (N1), NAS signaling security (NAS ciphering and integrity protection), AS security control, registration management (registration area management), connection management, idle mode UE reachability (including control and conduction of paging retransmission), mobility management control (subscription and policy), intra-system mobility and inter-system mobility support, network slicing support, SMF selection, lawful interception (for an AMF event and interface to an LI system), transmission and provision of a session management (SM) message between the UE and the SMF, a transparent proxy for SM message routing, access authentication, access authorization including a roaming authority check, transmission and provision of an SMS message between the UE and a short message service function (SMSF), a security anchor function (SAF), and/or security context management (SCM). Some function(s) or all functions of the AMF112may be supported within a single AMF instance operating as one AMF. Further, the AMF112may include a security anchor function (SEAF) responsible for a security-related function of the UE10.

The SMF113may provide a session management function, and when the UE10has a plurality of sessions, each session may be managed by a different SMF. Specifically, the SMF113may support functions of session management (e.g., session establishment, modification, and termination including maintaining a tunnel between a UPF and an AN node), UE IP address allocation and management (optionally including authentication), selection and control of a UP function, configuration of traffic steering for the UPF to route traffic to an appropriate destination, termination of an interface towards policy control functions, implementation of a control part of a policy and quality of service (QoS), lawful interception (for an SM event and an interface to the LI system), termination of an SM part of an NAS message, downlink data notification, an initiator of AN-specific SM information (transmitted to an AN through N2 via the AMF), SSC mode determination of a session, and a roaming function. As described above, some function(s) or all functions of the SMF113may be supported within a single SMF instance operating as one SMF.

The SCP114may provide indirect communication through the SCP114between specific different NFs. Also, the SCP114may perform secure communication, for example, may authorize an NF service consumer to access to an NF service producer API, and may perform load balancing, monitoring, overload control, and the like. That is, the SCP114may provide an indirect communication path between two or more specific different NFs.

The NSSF115may perform selection of a network slice instance set serving the UE10, allowed NSSAI determination and mapping to a subscribed S-NSSAI if necessary, configured NSSAI determination and mapping to a subscribed S-NSSAI if necessary, determination of an AMF set to be used to serve the UE10, and determination of a list of a candidate AMF(s), by querying the NRF117if possible, based on a configuration.

The NEF116may expose an NF capability and an event to an external network. In addition, the NEF116may store and retrieve information as structured data using a standardized interface (Nudr) for a unified data repository (UDR).

The NRF117supports a service retrieval function. The NRF117receives an NF retrieval request from an NF instance or the SCP114and provides retrieved information about an NF instance (target of retrieval) to the NF instance or the SCP114. The NRF117supports P-CSCF discovery and maintains an NF profile of an available NF instance and a supported service. The NRF117notifies a subscribing NF service consumer or the SCP114that has subscribed with an NF service of a newly registered/updated/deregistered NF instance along with an NR service.

The PCF140may receive information about packet flow from an application server and may provide a function of determining a policy, such as mobility management and session management. Specifically, the PCF140may support functions of supporting a unified policy framework for controlling a network operation, providing a policy rule so that a control plane function(s) (e.g., the AMF and the SMF) may enforce the policy rule, and configuring a front end to access relevant subscription information for policy making in the user data repository (UDR).

The UDM170may store subscription data about a user, policy data, and the like. The UDM170may include two parts, that is, an application front end (FE, not shown) and the user data repository (UDR, not shown).

The AF120may interoperate with a 3GPP core network to provide a service (e.g., support functions, such as impact of an application on traffic routing, access to network capability exposure, and an interaction with a policy framework for policy control).

The application function (AF)120interacts with the 3GPP core network to provide a service. For example, the AF120may perform an operation related to traffic routing of an application, access to the NEF116, and an interaction with a policy framework for policy control.

The DN130may refer to, for example, an operator service, Internet access, or a third-party service. The DN130may transmit a downlink protocol data unit (PDU) to the UPF110or may receive a PDU transmitted from the UE10through the UPF110.

The UE10may be provided with a service, such as access to the 5G network and data transmission/reception, through the 5G core network illustrated inFIG.1. The 5G core network may perform communication between the NFs to manage the UE10. Here, the NFs may operate as NF consumers and NF producers to communicate with each other. An NF producer is a server that enables NF consumers to connect and to receive a service from the NF producer. An NF consumer connects to an NF producer and uses a service provided by the NF producer. The NF producer and the NF consumer may perform an operation required for control or management related to the UE10or a network using a service provided by the NF producer.

The NF producer may provide a service in response to a service request from the NF consumer. In addition, when a required condition is satisfied, the NF producer may provide a notification service for providing data. Here, the NF producer may provide the notification service, based on information registered when an NF consumer subscribing to the notification service subscribes to the service.

According to an embodiment of the disclosure, the NF consumer and the NF producer may directly communicate or may communicate via the SCP114. The NF consumer may transmit a service request to the NF producer to the SCP114, and the SCP114may transmit the received service request of the NF consumer to the NF producer upon request. Both communication between an NF and an NF and communication between an NF and the NRF may be performed through the SCP114. Here, since the NF producer does not communicate directly with the NF consumer, the NF consumer may be authenticated through a client credentials assertion (CCA) provided in (or together with) a service request message by the NF consumer.

FIG.2illustrates a system registration procedure of a network device according to an embodiment of the present disclosure.

Referring toFIG.2, as described with reference inFIG.1, a network function (NF)201may be configured as one device or server. The NF201may be any one of the NFs existing in the 5G core network illustrated inFIG.1, or may include the AF120connected via the NEF116.

A procedure for the NF201to register with the NRF117is described inFIG.2. When starting an initial operation (or being activated), the NF201may transmit an NF register request message for registering an NF profile in the NRF117to the NRF117the network as shown in operation221.

The NF profile of the NF may include some or all of the following pieces of information:NF type: May include type information indicating the type of the NF, such as the AMF112and the SMF113;NF Instance ID: May include an ID indicating a network function instance;IP address of NF or fully qualified domain name (FQDN);Information, such as names of supported NF services;Information about a PLMN to which the NF belongs; orID range or ID information of UE or subscriber information managed by the NF.

Among the above pieces of information, the network function instance corresponds to a case in which one specific NF may be configured in the form of an instance. For example, NFs, the AMF112, the SMF113, and the UPF110, forming the 5G core network may include two or more instances performing the same operation. Each instance may perform the same specific function described inFIG.1. For example, two different UPFs110may include UPF instances, and both of the two UPF instances may provide user plane data to the same UE. In this case, each UPF instance may provide different user data. For example, one specific UPF instance may be a UPF that provides a download data service, and the other UPF instance may be a UPF that provides data upload. In another example, one specific UPF instance may provide a movie streaming service, and the other UPF instance may provide a chatting service. Although instance types have been illustrated above, the same may be applied to a case in which two or more different UPFs provide different services to one UE. In another example, two or more UPFs or UPF instances may be configured based on the total amount of data that a UPF can provide.

Referring back toFIG.2, in operation211, the NF201may add URI address information (response URI) for receiving data when the NF receives a service from another NF to the NF profile registered in the NRF117. Further, when the NF201operates as an NF producer that provides a service to a different NF, the NF201may add, to the NF profile, an NF type or an NF instance ID that can operate as an NF consumer to be provided with a service of the NF producer.

When receiving a request message for registering the NF profile received from the NF201, the NRF117may store the NF profile of the NF201in operation212, and may then generate and transmit an NF register response message to the NF201in response to the NF register request in operation213.

FIG.3illustrates a procedure in which an NF consumer obtains access authorization and token from an NRF to receive a service from an NF producer when wishing to receive the service from the NF producer according to an embodiment of the present disclosure.

Before referring toFIG.3, an NF service consumer and an NF consumer have the same meaning, and will be described as the same NF in the following description. Therefore, although mixed, the NF service consumer and the NF consumer will be understood as having the same meaning. An NF service producer and an NF producer have the same meaning, and will be described as the same NF in the following description. Therefore, although mixed, the NF service producer and the NF producer will be understood as having the same meaning.

Referring toFIG.3, in operation311, the NF service consumer300may transmit an access token get request message to the NRF117to request access authorization from the NF producer from which the NF service consumer300wishes to receive a service. Here, the NF consumer300may include all or some of the following information in the access token get request message:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer from which the NF consumer wishes to obtain access authorization.

Further, the NF consumer300may include, in the access token get request message, a response uniform resource identifier (URI) of the NF consumer indicating an address for receiving a response from the NF producer when using a service of the NF producer.

After the NRF117receives the access token get request message from the NF consumer300, the NRF117may determine (or identify or retrieve) the possibility of permission regarding whether the NF consumer300can access the requested service of the NF producer in operation312. Here, when the NF producer has previously registered with the NRF117or there is a list of NF types or NF instant IDs for which the requested service provided by the NF producer is permissible through preset information, the NRF117may identify whether the request is a request for which access authorization is granted using information about whether the NF consumer300is included in the list in operation312.

In addition, the NRF117may determine (or identify) whether the response URI included in the access token get request message is a URI included in a list of response URIs previously registered by the NF consumer300in the NRF117or a URI using a host address indicated by an FQDN or IP address registered by the NF consumer300in operation312, and may check (identify) whether a request included in the access token get request message of the NF consumer300is an appropriate request or a request for which access authorization may be granted.

In another embodiment of the disclosure, the NF consumer300may include an IP address thereof, a FQDN thereof, or URI information to be used for a response URI thereof in an authentication certificate thereof in operation311. Accordingly, the NRF117may receive an access token get request message including the above information from the NF consumer300. Then, in operation312, the NRF117may determine (or identify) whether the information of the response URI included in the access token request message is a URI included in a response URI list included in the authentication certificate of the NF consumer300or a URI using a host address indicated by the FQDN or the IP address included in the authentication certificate and may check whether a request included in the access token get request message of the NF consumer300is an appropriate request or a request for which access authorization may be granted.

When the NRF117determines that an expected service of the NF producer is available for the NF consumer300, the NRF117may issue the NF consumer300with a token including information, such as an NRF ID, an NF instance ID of the NF consumer300, a requested NF producer type, and an NF instance ID of an NF producer if a requested NF producer instance is designated, in operation313. Here, the token may be with an encryption key of the NRF117.

Further, the token issued by the NRF117may include time information indicating the validity period of the token.

In addition, the NRF117may include information, such as the FQDN or IP address and the response URI of the NF consumer300in the token issued to the NF consumer300in operation313, thereby enabling the NF producer to identify the requested response URI is the correct URI of the NF consumer300. Here, the response URI may include the information of the response URI included in the access token get request message of the NF consumer300. When the response URI is not included in the access token get request message of the NF consumer300, the NRF117may include all or part of information of the response URI list previously registered by the NF consumer.

In operation313, the NRF117may transmit a response including the token signed with the encryption key thereof to an access token get request message to the NF consumer300.

FIG.4is a signal flowchart illustrating an authentication and authorization procedure of a service request and response of a subscription-notification model between network devices using a network device authentication certificate according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.4, network functions used in the disclosure will be described. First, an NF consumer401is shown as NFc_1, and an NF producer is shown as a form in which two different NF producers exist. Therefore, the first NF producer402is shown as NFp_1, and a second NF producer403is shown as NFp_2. Further, it is assumed that components of the SCP114and the NRF117described inFIG.1are used. NFp_1 may also operate as a second NF consumer in a specific case. That is, one NF may operate as NFp_1, and may operate as NFc_2 at the same time in a specific case, which will be illustrated inFIG.4and will be further described with reference to the signal flowchart ofFIG.4.

According to the embodiment of the disclosure, an NF consumer may subscribe to a notification service of an NF producer and may then receive the notification service from the NF producer without any request. The NF producer may receive a request for the notification service from the NF consumer, may accept the request, and, if necessary to provide the service in response to the request, may request a different NF producer (referred to as NF Producer_2 in the example ofFIG.4) to provide the notification service to the NF consumer.

For example, an NEF116may request, as an NF consumer, a notification service from a UDM119to provide the notification service with respect to an event, such as a location change and a network connection state change of a specific UE, according to a request of an AF. Here, the UDM119may operate as an NF producer of the notification service. The NEF116may register a URI of the NEF116to transmit the notification service to the UDM119as a response URI. The UDM119may subscribe to a notification service of the AMF112for the event in order to obtain information about the event, such as the network connection state change of the UE, from the AMF112. Here, the UDM119subscribes to the notification service of the AMF112as a different NF consumer (referred to as NF Consumer_2). The AMF112operates as an NF producer (referred to as NF Producer_2). Here, the UDM119may use a response URI of NF Consumer_1, that is, the response URI received from the NEF116, other than a response URI of NF Consumer_2, as a receiver URI of the notification service to the AMF112for the event.

According to the embodiment ofFIG.4, NF Consumer_1410may determine a notification service subscription to NF Producer_1402for a specific event for a specific UE or a group of UEs. The specific event may be represented by an event ID.

For a request for the notification service subscription to the NF producer, NF Consumer_1401may perform authorization and be issued with a token from an NRF117to transmit a service request message in operation411.

In operation412, NF Consumer_1401may generate a CCA certificate of NF Consumer_1401so that the NF producer receiving the service request message may authenticate NF Consumer_1401.

In operation413, NF Consumer_1401may transmit the service request message to the SCP114or may directly transmit the service request message to the NF producer (not shown inFIG.4) in order to request the notification service subscription to the NF producer. The service request message may include the event ID indicating the requested event, UE ID information indicating information about a related UE, the CCA certificate, and the token received from the NRF117.

In the embodiment of the disclosure, the CCA may include an NF instance ID of the NF consumer401, time information indicating the validity period of the certificate, an expected NF type of the NF producer, and a digital certificate of the NF consumer or URL information about the digital certificate. Further, the CCA may include a response to a service request included in the service request message or response URI information about an NF from which a service is provided. The CCA of the NF may be signed with a signature key.

In operation414, the SCP114may transmit the service request message received from NF Consumer_1401to NF Producer_1402.

NF Producer_1402may verify the token and the CCA certificate included in the received service request message to authenticate NF Consumer_1401that has transmitted the service request message, and may check whether NF Consumer_1401is an NF that has received access authorization from the NRF117. NF Producer_1402may check that the response URI included in the service request message and the response URI attached to the CCA certificate are a URI of NF Consumer_1401in operation415.

In another embodiment of the disclosure, when an FQDN or an IP address is included in the digital certificate of the NF producer, NF Producer_1402may check whether the response URI included in the service request message and the CCA uses a host address indicated by the FQDN or the IP address, thereby checking whether the service request message of NF Consumer_1401is an appropriate service request message.

NF Producer_1402may determine to need to request a notification service for the event from a different NF producer, which is NF Producer_2403, in order to provide the notification service for the event included in the service request message received from NF Consumer_1401.

NF Producer_1402is an NF consumer (referred to as NF Consumer_2), and may request a token from the NRF117to request the service from NF Producer_2403in operation415. Here, the token request may include an ID of NF Consumer_2, a requested NF type of NF Producer_2, and requested NF service information.

After receiving the token from the NRF117, NF Consumer_2402may configure a service request message to request a notification service subscription to NF Producer_2403in operation416, and may transmits the service request message to the SCP114or may transmit the service request message directly to NF Producer_2403(direct transmission is not shown inFIG.4) in operation417. The service request message may include the event ID indicating the requested event, the UE ID information indicating the information about the UE related to the event, the CCA certificate, and the token received from the NRF117.

Here, NF Consumer_2402may include, in the service request message, the response URI of NF Consumer_1401as an address for receiving the notification service for the event for which NF Producer_2403associated with the event requested from NF Consumer_1401can provide the notification service. When NF Consumer_2402includes the response URI of NF Consumer_1401in the service request message for requesting the notification service subscription to NF Producer_2403, NF Consumer_2402may attach the CCA certificate of NF Consumer_1401received from NF Consumer_1 to enable NF Consumer_1401as the owner of the response URI to be identified.

The SCP114may transmit the service request message received from NF Consumer_2402to NF Producer_2403in operation418.

NF Producer_2403may verify the service request message received from NF Consumer_2402and the response URI of NF Consumer_1401included therein in operation420, and may reply with acceptance of the service request message when the service request is an appropriate request in operation421.

Here, NF Producer_2403may verify the token and the CCA certificate of NF Consumer_2402included in the service request message received in operation420, thereby authenticating NF Consumer_2402that has transmitted the service request message and checking whether NF Consumer_2402is an NF that has received access authorization from the NRF117. Further, NF Producer_2403may check the CCA certificate of NF Consumer_1401attached with the response URI included in the service request message, thereby identifying whether the owner of the response URI is NF Consumer_1401and checking whether NF Consumer_1401is an NF that has received authorization to receive the notification service of the event provided by the NF Producer_2402.

When the notification service subscription is successful, NF Producer_2403may store the requested UE information, the event ID, and the response URI in order to provide the notification service to the response URI when the event for the UE occurs.

When the request is not acceptable due to various cases, for example, where NF Consumer_1401is an NF type having no authority to receive the notification service or is not authenticated as an appropriate NF, NF Producer_2403may reject the request.

A service response message from NF Producer_2403may be transmitted to NF Consumer_2402via the SCP114or directly in operation421and operation422.

When successfully receiving the service response message, NF Consumer_2 (NF the same as NF Producer_1)402may reply to the service request message of NF Consumer_1401in operation423and operation424.

In another embodiment of the disclosure, NF Producer_1402may receive the service request message from NF Consumer_1401, may successfully verify the authority of NF Consumer_1401, and may reply to NF Consumer_1401with a service response regardless of the service request message exchange with NF Producer_2403

When the requested event for the requested UE occurs, NF Producer_2403may provide the notification service for NF Consumer_1401using the stored response URI in operation425and operation426. Here, the notification service may be transmitted directly to NF Consumer_1401(not shown inFIG.4) or may be transmitted through the SCP.

FIG.5is a signal flowchart according to an authentication and authorization procedure of a service request and response of a subscription-notification model between network devices using system registration information about a network device according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.5, the same reference numerals for respective NFs as those used inFIG.4will be used. Therefore, the same assumption made inFIG.4may also be applied toFIG.5.

In the embodiment of the disclosure, the NFs may register FQDNs or IP addresses of the NFs in an NRF117in advance through an NF registration process (operation510). Here, the NFs may register pieces of response URI information about the NFs in the NRF117in addition to the FQDNs or IP addresses.

According to the embodiment of the disclosure, NF Consumer_1401may determine a notification service subscription to NF Producer_1402for a specific event for a specific UE or a group of UEs. The specific event may be represented by an event ID.

NF Consumer_1401may perform authorization from the NRF117to transmit a service request message for a request for the notification service subscription to the NF producer, and may transmit an access token request message to be issued with a token in operation511. Here, the access token request message may include all or some of the following pieces of information:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer from which the NF consumer wishes to obtain access authorization.

The NF consumer300may include, in the access token get request message, a response URI of the NF consumer indicating an address for receiving a response from the NF producer when using a service of the NF producer.

In operation512, the NRF117may determine authorization for a corresponding token request using the information included in the access token request message and information specified by the expected NF producer (e.g., an NF type of the NF consumer to receive the service) and may issue a token. Here, the NRF117may check whether the request is an appropriate request and may determine the authorization by comparing the response URI included in the access token request message with previously registered information of an FQDN, an IP address, or a response URI of NF Consumer_1.

In operation513, the NRF117may transmit a service response message including issued token information to NF Consumer_1401.

In operation515, NF Consumer_1401may transmit the service request message to a SCP or may directly transmit the service request message to NF Producer_1402(not shown inFIG.5) in order to request the notification service subscription to the NF producer. The service request message may include the event ID indicating the requested event, UE ID information indicating information about a related UE, a CCA certificate, and the token received from the NRF.

In the embodiment of the disclosure, the CCA may include an NF instance ID of the NF consumer, time information indicating the validity period of the certificate, an expected NF type of the NF producer, and a digital certificate of the NF consumer or URL information about the digital certificate. The CCA of the NF may be signed with a signature key.

In operation515, the SCP114transmits the service request message received from NF Consumer_1401to NF Producer_1402.

In operation516, NF Producer_1402may verify the token and the CCA certificate included in the received service request message to authenticate NF Consumer_1401that has transmitted the service request message, and may check whether NF Consumer_1401is an NF that has received access authorization from the NRF117.

In another embodiment of the disclosure, when an FQDN or an IP address is included in a digital certificate of the NF producer, NF Producer_1402may check whether the response URI included in the service request and the CCA uses a host address indicated by the FQDN or the IP address, thereby checking whether the service request message of NF Consumer_1401is an appropriate service request message.

NF Producer_1402may determine to need to request a notification service for the event from a different NF producer (NF Producer_2) in order to provide the notification service for the event included in the service request message received from NF Consumer_1401.

NF Producer_1402is an NF consumer (referred to as NF Consumer_2), and may request a token from the NRF117to request the service from NF Producer_2403in operation517. Here, the token request may include an ID of NF Consumer_2, a requested NF type of NF Producer_2, and requested NF service information. Further, NF Consumer_2402may add the response URI received from NF Consumer_1401to the token request as an address for receiving the notification service from NF Producer_2403. Here, NF Consumer_2402may include information of the CCA or the NF instance ID of NF Consumer_1401received from NF Consumer_1401for notifying the NRF117that the response URI is received from NF Consumer_1401.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message and the information specified by the expected NF producer in operation518and may issue a token in operation519. Here, the NRF117may check NF Consumer_1401using the response URI of NF Consumer_1401included in the access token request message and the CCA information or the NF instance ID information of NF Consumer_1401included in the access token request message, may check whether the request is an appropriate request by comparing with previously registered information of the FQDN, the IP address, or the response URI of NF Consumer_1401, and may determine the authorization for NF Consumer_1401to receive the notification service of NF Producer_2403. Here, the NRF117may include the response URI of NF Consumer_1401in the token as requested by NF Consumer_2.

After receiving the token from the NRF117, NF Consumer_2402may configure a service request message to request a notification service subscription to NF Producer_2403, and may transmits the service request message to the SCP114or may transmit the service request message directly to NF Producer_2403(not shown inFIG.5) in operation520. The service request message may include the event ID indicating the requested event, the UE ID information indicating the information about the UE related to the event, the CCA certificate, and the token received from the NRF.

Here, NF Consumer_2402may include, in the service request, the response URI of NF Consumer_1 as an address for receiving the notification service for the event for which NF Producer_2403can provide the notification service among events associated with the event requested from NF Consumer_1401.

In operation521, the SCP114may transmit the service request message received from NF Consumer_2402to NF Producer_2403.

In operation522, NF Producer_2403may verify the service request message received from NF Consumer_2402and the token and the CCA certificate of NF Consumer_2402included therein, thereby authenticating NF Consumer_2402that has transmitted the service request message and checking whether NF Consumer_2402is an NF that has received access authorization from the NRF117. Here, NF Producer_2403may additionally check that the response URI is a URI authenticated and authorized by the NRF117, and may perform the foregoing procedures, thereby checking whether the service request message is an appropriate request.

In operation523, NF Producer_2403may reply with acceptance of the service request message when the service request is an appropriate request.

When the notification service subscription is successful, NF Producer_2403stores the requested UE information, the event ID, and the response URI in order to provide the notification service to the response URI when the event for the UE occurs.

When the request is not acceptable due to various cases, for example, where NF Consumer_1401is an NF type having no authority to receive the notification service or is not authenticated as an appropriate NF, NF Producer_2403may reject the request.

A service response message from NF Producer_2403may be transmitted to NF Consumer_2402via the SCP114or directly (not shown inFIG.5) as illustrated in operation523and operation525.

When successfully receiving the service response message, NF Consumer_2 (NF the same as NF Producer_1)402may transmit the service response message to NF Consumer_1401in response to the service request of NF Consumer_1401in operation526and operation527.

In another embodiment of the disclosure, NF Producer_1402may receive the service request message from NF Consumer_1401, may successfully verify the authority of NF Consumer_1401, and may reply to NF Consumer_1401with a service response message regardless of the service request message exchange with NF Producer_2403.

When the requested event for the requested UE occurs, NF Producer_2403may provide the notification service for NF Consumer_1401using the stored response URI in operation528and operation529. Here, the notification service may be transmitted directly to NF Consumer_1401(not shown inFIG.5) or may be transmitted through the SCP114as in operation528and operation529ofFIG.5.

FIG.6is a signal flowchart according to an authentication and authorization procedure of a service request and response of a subscription-notification model between network devices using authentication certificate information about a network device according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.6, the same reference numerals for respective NFs as those used inFIG.4will be used. Therefore, the same assumption made inFIG.4may also be applied toFIG.6.

In the embodiment of the disclosure, the NFs may include FQDNs or IP addresses of the NFs in digital certificates of the NFs in operation610. The NFs may further include pieces of response URI information about the NFs in the digital certificates.

According to the embodiment of the disclosure, NF Consumer_1401may determine a notification service subscription to NF Producer_1402for a specific event for a specific UE or a group of UEs. The specific event may be represented by an event ID.

In operation611, NF Consumer_1401may perform authorization from an NRF117to transmit a service request message for a request for the notification service subscription to the NF producer, and may transmit an access token request message to be issued with a token.

Here, the access token request message may include all or some of the following pieces of information:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer from which the NF consumer wishes to obtain access authorization.

The NF consumer300may include, in the access token get request message, a response URI of the NF consumer indicating an address for receiving a response from the NF producer when using a service of the NF producer.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request and information specified by the expected NF producer (e.g., an NF type of the NF consumer to receive the service) in operation612, and may issue a token in operation613. Here, the NRF117may check whether the request is an appropriate request and may determine the authorization by comparing the response URI included in the access token request message with information of the FQDNs, the IP addresses, or the response URIs included in the certificates of the NFs.

In operation614, NF Consumer_1401may transmit the service request message to a SCP114or may directly transmit the service request message to NF Producer_1402(not shown inFIG.6) in order to request the notification service subscription to the NF producer402. The service request message may include the event ID indicating the requested event, UE ID information indicating information about a related UE, a CCA certificate, and the token received from the NRF117.

In the embodiment of the disclosure, the CCA may include an NF instance ID of the NF consumer, time information indicating the validity period of the certificate, an expected NF type of the NF producer, and a digital certificate of the NF consumer or URL information about the digital certificate. The CCA of the NF may be signed with a signature key.

In operation615, the SCP114may transmit the service request message received from NF Consumer_1401to NF Producer_1402.

In operation616, NF Producer_1402may verify the token and the CCA certificate included in the received service request message to authenticate NF Consumer_1401that has transmitted the service request message, and may check whether NF Consumer_1401is an NF that has received access authorization from the NRF117.

In another embodiment of the disclosure, when an FQDN or an IP address is included in a digital certificate of the NF producer, NF Producer_1402may check whether the response URI included in the service request message and the CCA uses a host address indicated by the FQDN or the IP address, thereby checking whether the service request message of NF Consumer_1401is an appropriate service request message.

NF Producer_1402may determine to need to request a notification service for the event from a different NF producer (NF Producer_2)403in order to provide the notification service for the event included in the service request message received from NF Consumer_1401.

NF Producer_1402is an NF consumer (referred to as NF Consumer_2), and may request a token from the NRF117to request the service from NF Producer_2403in operation617. Here, the token request may include an ID of NF Consumer_2, a requested NF type of NF Producer_2, and requested NF service information. Further, NF Consumer_2402may add the response URI received from NF Consumer_1401to the token request as an address for receiving the notification service from NF Producer_2403. Here, NF Consumer_2402may include information of the CCA received from NF Consumer_1 for notifying the NRF117that the response URI is received from Consumer_1.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message and the information specified by the expected NF producer in operation618and may issue a token in operation619. Here, the NRF117may check NF Consumer_1401using the response URI of NF Consumer_1401included in the access token request message and the CCA information of NF Consumer_1401included in the access token request message, may check whether the request is an appropriate request by comparing with information of the FQDN, the IP address, or the response URI of NF Consumer_1401registered in the digital certificate of NF Consumer_1, and may determine the authorization for NF Consumer_1401to receive the notification service of NF Producer_2403. Here, the NRF117may include the response URI of NF Consumer_1401in the token as requested by NF Consumer_2402.

After receiving the token from the NRF117in operation619, NF Consumer_2402may configure a service request message to request a notification service subscription to NF Producer_2403, and may transmits the service request message to the SCP114or may transmit the service request message directly to NF Producer_2403(not shown inFIG.6) in operation620. The service request message may include the event ID indicating the requested event, the UE ID information indicating the information about the UE related to the event, the CCA certificate, and the token received from the NRF117.

In another embodiment of the disclosure, NF Consumer_2402may add information, such as the CCA certificate of NF Consumer_1401, the digital certificate of NF Consumer_1, or the URL of the digital certificate, to the service request message in order to check the response URI included in the service request message.

Here, NF Consumer_2402may include, in the service request message, the response URI of NF Consumer_1401as an address for receiving the notification service for the event for which NF Producer_2403can provide the notification service among events associated with the event requested from NF Consumer_1401.

In operation621, the SCP114may transmit the service request received from NF Consumer_2402to NF Producer_2403.

In operation622, NF Producer_2403may verify the service request message received from NF Consumer_2402and the token and the CCA certificate of NF Consumer_2402included therein, thereby authenticating NF Consumer_2402that has transmitted the service request message and checking whether NF Consumer_2402is an NF that has received access authorization from the NRF117. Here, NF Producer_2403may additionally check that the response URI is a URI authenticated and authorized by the NRF117, and may perform the foregoing procedures, thereby checking whether the service request is an appropriate request.

Further, in operation622, when the CCA certificate of NF Consumer_1401, the digital certificate, or the URL of the digital certificate is included, NF Producer_2403may check NF Consumer_1401by checking the certificate, may check whether the response URI is the response URI of NF Consumer_1401by comparing the information of the FQDN, the IP address, or the response URI included in the certificate of NF Consumer_1401, and may examine whether NF Consumer_1401is authorized to receive the notification service of NF Producer_2403, thereby determining (or identifying) whether the service request is an appropriate request.

In operation623, operation624, operation625, and operation626, NF Producer_2403may reply with acceptance of the service request message when the service request of NF Consumer_2402is an appropriate request.

When the notification service subscription is successful, NF Producer_2403stores the requested UE information, the event ID, and the response URI in order to provide the notification service to the response URI when the event for the UE occurs.

When the request is not acceptable due to various cases, for example, where NF Consumer_1401is an NF type having no authority to receive the notification service or is not authenticated as an appropriate NF, NF Producer_2403may reject the request.

A service response message from NF Producer_2403may be transmitted to NF Consumer_2402via the SCP114or directly (not shown inFIG.6) as described above in operation623.

When successfully receiving the service response message, NF Consumer_2 (NF the same as NF Producer_1)402may transmit the service response message in response to the service request of NF Consumer_1401in operation625and operation626.

In another embodiment of the disclosure, NF Producer_1402may receive the service request message from NF Consumer_1401, may successfully verify the authority of NF Consumer_1401, and may reply to NF Consumer_1401with a service response message regardless of the service request message exchange with NF Producer_2403.

When the requested event for the requested UE occurs, NF Producer_2403may provide the notification service for NF Consumer_1401using the stored response URI in operation627. Here, the notification service may be transmitted directly to NF Consumer_1401(not shown inFIG.6) or may be transmitted through the SCP114as in operation627and operation628.

FIG.7is a signal flowchart according to an authentication and authorization procedure of a service request and response of a subscription-notification model between network devices using token issue information about a network device according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.7, the same reference numerals for respective NFs as those used inFIG.4will be used. Therefore, the same assumption made inFIG.4may also be applied toFIG.7.

According to the embodiment of the disclosure, NF Consumer_1401may determine a notification service subscription to NF Producer_1402for a specific event for a specific UE or a group of UEs. The specific event may be represented by an event ID.

In operation711, NF Consumer_1401may perform authorization from an NRF117to transmit a service request message for a request for the notification service subscription to the NF producer, and may transmit an access token access request message to be issued with a token.

Here, the access token request message may include all or some of the following pieces of information:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer from which the NF consumer wishes to obtain access authorization.

The NF consumer300may include, in the access token get request message, a response URI of the NF consumer indicating an address for receiving a response from the NF producer when using a service of the NF producer.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message and information specified by the expected NF producer (e.g., an NF type of the NF consumer to receive the service) in operation712, and may issue a token in operation713.

Here, the NRF117may check whether the response URI included in the access token request message is a response URI of the NF consumer by comparing the response URI with an FQDN or an IP Address of the NF consumer. In addition, when the response URI is determined as the correct response URI of NF Consumer_1401, the NRF117may store the corresponding information for a certain period of time.

In operation714, NF Consumer_1401may transmit the service request message to a SCP114or may directly transmit the service request message to NF Producer_1402(not shown inFIG.7) in order to request the notification service subscription to the NF producer. The service request message may include the event ID indicating the requested event, UE ID information indicating information about a related UE, a CCA certificate, and the token received from the NRF117.

In the embodiment of the disclosure, the CCA may include an NF instance ID of the NF consumer, time information indicating the validity period of the certificate, an expected NF type of the NF producer, and a digital certificate of the NF consumer or URL information about the digital certificate. The CCA of the NF is signed with a signature key of the NF.

In operation715, the SCP114transmits the service request message received from NF Consumer_1401to NF Producer_1402.

In operation716, NF Producer_1402may verify the token and the CCA certificate included in the received service request message to authenticate NF Consumer_1401that has transmitted the service request message, and may check whether NF Consumer_1401is an NF that has received access authorization from the NRF117.

In addition, NF Producer_1402may compare the response URI included in the service request message with information of the response URI included in the token, thereby determining whether the service request message is an appropriate request.

NF Producer_1402may determine to need to request a notification service for the event from a different NF producer (NF Producer_2)403in order to provide the notification service for the event included in the service request message received from NF Consumer_1401.

NF Producer_1402is an NF consumer (referred to as NF Consumer_2), and may request a token from the NRF117to request the service from NF Producer_2403in operation717. Here, the token request may include an ID of NF Consumer_2, a requested NF type of NF Producer_2, and requested NF service information. Further, NF Consumer_2402may add the response URI received from NF Consumer_1401to the token request as an address for receiving the notification service from NF Producer_2403. Here, NF Consumer_2402may include information of the CCA received from NF Consumer_1401for notifying the NRF117that the response URI is received from NF Consumer_1401.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message and the information specified by the expected NF producer in operation718and may issue a token in operation719. Here, the NRF117may compare the response URI of NF Consumer_1401included in the access token request message and a response URI of NF Consumer_1401previously stored by the NRF117, thereby checking whether the request is an appropriate request and determining the authorization for NF Consumer_1401to receive the notification service of NF Producer_2403by. Here, the NRF117may include the response URI of NF Consumer_1401in the token as requested by NF Consumer_2402.

After receiving the token from the NRF117, NF Consumer_2402may configure a service request message to request a notification service subscription to NF Producer_2, and may transmits the service request message to the SCP114or may transmit the service request message directly to NF Producer_2403(not shown inFIG.7) in operation720. The service request message may include the event ID indicating the requested event, the UE ID information indicating the information about the UE related to the event, the CCA certificate, and the token received from the NRF117.

Here, NF Consumer_2402may include, in the service request message, the response URI of NF Consumer_1401as an address for receiving the notification service for the event for which NF Producer_2403can provide the notification service among events associated with the event requested from NF Consumer_1401.

In operation721, the SCP114may transmit the service request message received from NF Consumer_2402to NF Producer_2403.

In operation721, NF Producer_2403may verify the service request message received from NF Consumer_2402and the token and the CCA certificate of NF Consumer_2402included therein, thereby authenticating NF Consumer_2402that has transmitted the service request message and checking whether NF Consumer_2402is an NF that has received access authorization from the NRF117. Here, NF Producer_2403may additionally check that the response URI is a URI authenticated and authorized by the NRF117, and may perform the foregoing procedures, thereby checking whether the service request message is an appropriate request.

In operation722and operation723, NF Producer_2403may reply with acceptance of the service request message when the service request is an appropriate request.

When the notification service subscription is successful, NF Producer_2403may store the requested UE information, the event ID, and the response URI in order to provide the notification service to the response URI when the event for the UE occurs.

When the service request of NF Consumer_2402is not acceptable due to various cases, for example, where there is an error in checking the token, where there is an error in checking the CCA certificate, or where the service for the event cannot be provided, NF Producer_2403may reject the request.

A service response message from NF Producer_2403may be provided to NF Consumer_2402via the SCP114or may be provided directly to NF Consumer_2402(not shown inFIG.7) in operation722and operation723.

When successfully receiving the service response message, NF Consumer_2 (NF the same as NF Producer_1)402may transmit the service response message to NF Consumer_1401in response to the service request message of NF Consumer_1401in operation725.

In another embodiment of the disclosure, NF Producer_1402may receive the service request message from NF Consumer_1401, may successfully verify the authority of NF Consumer_1401, and may reply to NF Consumer_1401with a service response message regardless of the service request message exchange with NF Producer_2403.

When the requested event for the requested UE occurs, NF Producer_2403may provide the notification service for NF Consumer_1401using the stored response URI in operation726and operation727. Here, the notification service may be transmitted directly to NF Consumer_1401(not shown inFIG.7) or may be transmitted through the SCP114as in operation726and operation727.

FIG.8is a block diagram illustrating the configuration of a network function (NF) device according to various embodiments of the present disclosure.

Referring toFIG.8, the NF device may include a network interface810, an NF controller820, and an NF memory830. The network interface810may provide an interface for communication with other NFs. For example, when an NF is the AlVIF112, the network interface810may provide an interface for communicating with the SMF113. In another example, when the NF is the UPF110, the network interface810may provide an interface for transmitting and receiving various data/signals/messages to from the RNA20and/or the AMF112and/or the DN180.

The NF controller820may control the operation of the corresponding NE For example, the NF controller820may perform control corresponding to the operations of the NRs ofFIG.2toFIG.7described above. Further, the NF controller820may control operations corresponding toFIG.9andFIG.10to be described below. For example, when the NF is the NRF117, the NF controller820may control the operation of the NRF117, when the NF is the NEF116, the NF controller820may control the operation of the NEF116, and when the NF is the SCP114, the NF controller820may control the corresponding operation. In addition, when the NF is NF Consumer_1401, the NF controller820may control the operations of NF Consumer_1401described inFIG.4toFIG.7, and when the NF is NF Consumer_2 and NF Producer_1402at the same time, the NF controller820may control the operations of NF Consumer_2 and NF Producer_1 described inFIG.4toFIG.7. Similarly, when the NF is NF Producer_2403, the NF controller820may control the operations of NF Producer_2403described inFIG.4toFIG.7. In another example, when the NF is an NF consumer901, the NF controller820may control an operation of the NF consumer901described inFIG.9andFIG.10. Further, when the NF is an NF producer902, the NF controller820may control an operation of the NF producer902described inFIG.9andFIG.10.

The NF memory830may store information for controlling the NF, information generated during control, and pieces of information necessary according to the disclosure. In particular, as described above, the NF memory830may store control information for operating as an NF consumer and control information for operating as an NF producer Control information. In addition, the NF memory830may store the foregoing pieces of information to provide a service for a specific UE.

FIG.9is a signal flowchart according to an authentication and authorization procedure of a service request and response of a request-response model between network devices according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.9, network functions used in the disclosure will be described. First, an NF consumer is shown as NFc901, and an NF producer is shown as NFp902. Therefore, in the following description, an NF consumer and NFc may be interchangeably used, and an NF producer and NFp may be interchangeably used. Further, it is assumed that components of the SCP114and the NRF117described inFIG.1are used.

According to the embodiment of the disclosure, an NF consumer may request a specific service for a specific UE10or a group of UEs from an NF Producer, and may receive a response. When receiving the service response, the NF consumer may verify whether an NF having transmitted the service response is the NF producer from which the NF consumer expects to receive the service or an NF included in the same NF set as the NF producer from which the NF consumer expects to receive the service. Here, the NF set may include two or more NFs, and different NFs may provide the same service or may provide different services.

The NF consumer901determines that the NF consumer901needs to receive a service from a different NF, and may transmit an NF discovery request message to the NRF117to obtain information about an NF that is able to provide the service in operation910. The NF discovery request message may include the name of the service requested by the NF consumer901and information about the NF type of the NF to provide the service and may be transmitted to the NRF117.

Upon receiving the NF discovery request message, the NRF117may check the requested service and the NF type in the discovery request message, and may transmit an NF discovery response message including information about NFs that are able to provide the service to the NFc901in operation912. The information about the NF(s) that is able to provide the service included in the NF discovery response message may include an NF instance ID referring to a corresponding NF instance and address information (e.g., an FQDN or an IP address) about NF instances. Further, the information may include NF set ID information indicating an NF set to which the NF instances belong. Although the NF instance has been described for illustration in this disclosure, the NF is not necessarily an NF instance. For example, when the NF is not configured as an instance but one server itself is configured as an NF, a server ID and address information (e.g., an FQDN or an IP address) of the server may be provided. That is, an NF instance may be replaced by an NF server, and one NF server and/or one NF instance may be an independent network entity. Hereinafter, for convenience of explanation, it is assumed that an NF is configured as an instance.

In operation914, the NF consumer901may store the information about the NF instance(s) and/or the information about the NF set included in the NF discovery response message as a list of candidate NF instances and information about a target NF set, respectively. The stored information may be used subsequently to verify whether a service response message to be received in response to this information is from an appropriate NF producer.

In operation916, the NFc901may perform authorization from the NRF117to transmit a service request message and may transmit an access token request message to be issued with a token. Here, the access token request message may include all or some of the following pieces of information:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer902from which the NF consumer wishes to obtain access authorization.

The information of the access token request message may specify information, such as an NF producer instance ID, using the information of the NF instance ID(s) obtained when receiving the NF discovery response message in operation912.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message received in operation916and information specified by the expected NF producer (e.g., an NF type of the NF consumer to receive the service), and may issue a token in operation918. The access token response message including the issued token may be transmitted from the NRF117to the NFc901in operation918.

In another embodiment of the disclosure, a procedure for transmitting the access token request message and receiving the access token response message may be performed before transmitting the NF discovery request message.

The NF consumer901may receive the access token response message in operation918, and may generate a CCA certificate of the NFc901in operation920.

After generating the CCA certificate in operation920, the NF consumer901may transmit a service request message to be transmitted to the NF producer902to the SCP114in operation922. The service request message may include information about the requested service, the CCA certificate, and the token received from the NRF117.

In operation924, the SCP114may select NFp, based on the service request message received in operation922. In operation926, the SCP114may transmit the service request message received from the NF consumer901to NFp selected in operation924. Here, when an NF producer specified in the service request message received from the NF consumer901cannot be identified or the NF producer is not expected to be able to process the service request due to a disconnection from the NF producer, the SCP114may retrieve another candidate NF producer to process the service request and may transmit the service request message to the retrieved candidate NF producer as in operation926.

When retrieving another NF Producer, the SCP114needs to retrieve a candidate NF producer in an NF Instance belonging to the same NF set as the NF producer requested by the NF consumer901.

In operation928, the NF producer902may verify the token and CCA certificate included in the service request message received in operation926, thereby authenticating the NF consumer901having transmitted the service request message and checking whether NF consumer901is an NF that has received access authorization from the NRF. In the disclosure, a normal case, that is, where the NF consumer901having transmitted the service request message is an NF that has received access authorization from the NRF, is assumed.

In operation930, NFp902may generate a CCA certificate of NFp.

The NF producer902may transmit a service response message to the NF consumer901via the SCP to provide the requested service to the NF consumer901(932and934). Here, the NF producer902may additionally transmit the CCA certificate generated to authenticate the NF producer902in operation930to the NF consumer901via the service response message.

In the embodiment of the disclosure, the CCA generated by the NF producer902may include the NF instance ID of the NF consumer901, the NF instance ID of the NF producer902, time information indicating the validity period of the certificate, and a digital certificate of the NF producer or URL information about the digital certificate. The CCA of the NF may be signed with a signature key of the NF.

In operation934, the SCP114may transmit the service response message received from NFp902in operation932to NFc901.

After receiving the service response message, NFc901may authenticate the NF producer902by verifying the CCA certificate of the NF producer902in operation936. Further, during the authentication, NFc901may verify whether the NF producer902is included in the list of candidate NF instances or the target NF set transmitted through the service request message. As a result of the verification, when the NF producer902is included in the list of candidate NF instances or the target NF set transmitted through the service request message, NFc901may authenticate whether the service response message is transmitted by an appropriate NF producer.

In another embodiment of the disclosure, the CCA generated by the NF producer902(CCA of NFp) may include information indicating the SCP114having transmitted the service request message received by the NF producer902. For example, the CCA may include information, such as the NF instance ID of the SCP114.

The SCP114receiving the service response message including the CCA generated by the NF producer902(CCA of NFp) may consider two situations.

In a first case, the SCP114indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114is the SCP114itself. In this case, since the information indicates the SCP114itself, the SCP114may determine that the received service request message is normal.

In a second case, the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114may be a different SCP (SCP_2) other than the SCP114. In this case, a simple method may determine (identify) that the service request message is abnormal. However, even when the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114may be the different SCP (SCP_2) other than the SCP114, the service request message may be normal.

For example, there may be a case where the SCP (SCP_2) requested to transmit the service request message does not directly transmit the service request message to the NF producer902but forwards transmission of the service request message to a different SCP (SCP_1). The SCP (SCP_2) requested to transmit the service request message does not directly transmit the service request message to the NF producer902but forwards transmission of the service request message to a different SCP (SCP_1), because the NF producer902is not located in the area of the SCP (SCP_2) or due to other reasons.

In this case, the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message may indicate SCP_2. Then, SCP_1 may identify whether transmission of the service request message is requested from SCP_2, and may identify using additional information whether the message is an appropriate message when the transmission of the service request message is requested from SCP_2.

Whether the message is an appropriate message may be identified (or verified) using the additional information, for example, by verifying whether the NF consumer901transmits the service request message to the NF producer902and receives a response transmitted from the NF producer902to the NF consumer901.

When at least one of the above procedures fails to be verified, the service response message may be rejected or NFc901may be notified that the service response message has been received from an inappropriate NF producer.

When the NF consumer is notified (informed) from the SCP that the service response has been received from the inappropriate NF producer, the NF consumer determines that the service response is an inappropriate service response, and may then perform a series of required operations.

FIG.10illustrates an authentication and authorization procedure of a service request and response of a request-response model between network devices using selection of a network device in a network device set according to an embodiment of the present disclosure.

Prior to a description with reference toFIG.10, network functions used in the disclosure will be described. First, as inFIG.9, an NF consumer is shown as NFc901, and an NF producer is shown as NFp902. Further, it is assumed that components of the SCP114and the NRF117described inFIG.1are used.

According to the embodiment of the disclosure, an NF consumer901may request a specific service for a specific UE10or a group of UEs from an NF Producer902, and may receive a response. When receiving the service response, the NF consumer901may verify whether an NF having transmitted the service response is the NF producer902from which the NF consumer901expects to receive the service or an NF included in the same NF set as the NF producer902from which the NF consumer901expects to receive the service. Here, the NF set may include two or more NFs, and different NFs may provide the same service or may provide different services.

The NF consumer901determines that the NF consumer901needs to receive a service from a different NF, and may transmit an NF discovery request message to the NRF117to obtain information about an NF that is able to provide the service in operation1010. The NF discovery request message may include the name of the service requested by the NF consumer901and information about the NF type of the NF to provide the service and may be transmitted to the NRF117.

Upon receiving the NF discovery request message, the NRF117may check the requested service and the NF type in the NF discovery request message, and may transmit an NF discovery response message including information about NFs that are able to provide the service to the NFc901in operation1012. The information about the NF(s) that is able to provide the service included in the NF discovery response message may include an NF instance ID referring to a corresponding NF instance and address information (e.g., an FQDN or an IP address) about NF instances. Further, the information may include NF set ID information indicating an NF set to which the NF instances belong. Although the NF instance has been described for illustration in this disclosure, the NF is not necessarily an NF instance. For example, when the NF is not configured as an instance but one server itself is configured as an NF, a server ID and address information (e.g., an FQDN or an IP address) of the server may be provided. That is, an NF instance may be replaced by an NF server, and one NF server and/or one NF instance may be an independent network entity. Hereinafter, for convenience of explanation, it is assumed that an NF is configured as an instance.

In operation1014, the NF consumer901may store the information about the NF instance(s) and/or the information about the NF set included in the NF discovery response message as a list of candidate NF instances and information about a target NF set, respectively. The stored information may be used subsequently to verify whether a service response message to be received in response to this information is from an appropriate NF producer.

In operation1016, the NFc901may perform authorization from the NRF117to transmit a service request message and may transmit an access token request message to be issued with a token. Here, the access token request message may include all or some of the following pieces of information:NF instance ID and NF type of the NF consumer;Information about an NF service for which the NF consumer wishes to obtain access authorization; orInformation about the NF type and the NF producer instance ID of the NF producer902from which the NF consumer wishes to obtain access authorization.

The information of the access token request message may specify information, such as an NF producer instance ID, using the information of the NF instance IDs obtained from the NF discovery response message in operation1012.

The NRF117may determine authorization for a corresponding token request using the information included in the access token request message and information specified by the expected NF producer (e.g., an NF type of the NF consumer to receive the service), and may issue a token in operation918. The access token response message including the issued token may be transmitted from the NRF117to the NFc901in operation1018.

In another embodiment of the disclosure, a procedure for transmitting the access token request message and receiving the access token response message may be performed before transmitting the NF discovery request message.

The NF consumer901may receive the access token response message in operation1018, and may generate a CCA certificate of the NFc901in operation1020.

After generating the CCA certificate in operation1020, the NF consumer901may transmit a service request message to be transmitted to the NF producer902to the SCP114in operation1022. The service request message may include information about the requested service, the CCA certificate, and the token received from the NRF117. Here, the NF consumer901may transmit, to the SCP114, the list of candidate NF instances through the service request message or through a separate message along with the service request message. When the list of candidate NF instances is transmitted through the separate message or through a separate field of the service request message, if not connected to the specified NF producer, the SCP114may select a different NF instance from the list of candidate NF instances and may transmit the service request message to the selected NF instance. That is, in operation1024, the SCP114may select NFp, based on the service request message received in operation1022.

The SCP114may transmit the service request message received from the NF consumer901to the NF producer902. Here, when the NF producer specified in the service request message received from the NF consumer901cannot be identified or the NF producer is not expected to be able to process the service request message due to a disconnection from the NF producer, the SCP114may retrieve another candidate NF producer to process the service request message from the received list of candidate NF instances and may transmit the service request message to the retrieved candidate NF producer as in operation1026.

The NF producer902may verify the token and CCA certificate included in the service request message received in operation1026, thereby authenticating the NF consumer901having transmitted the service request message and checking whether NF consumer901is an NF that has received access authorization from the NRF117. In the disclosure, a normal case, that is, where the NF consumer901having transmitted the service request message is an NF that has received access authorization from the NRF, is assumed.

In operation1030, NFp902may generate a CCA certificate of NFp.

The NF producer902may transmit a service response message to the NF consumer901via the SCP114to provide the requested service to the NF consumer901(1032and1034). Here, the NF producer902may additionally transmit the CCA certificate for authenticating the NF producer902, that is, the certificate generated in operation1030, to the NF consumer901via the service response message.

In the embodiment of the disclosure, the CCA generated by the NF producer902may include the NF instance ID of the NF consumer901, the NF instance ID of the NF producer902, time information indicating the validity period of the certificate, and a digital certificate of the NF producer or URL information about the digital certificate. The CCA of the NF may be signed with a signature key.

In operation1034, the SCP114may transmit the service response received from NFp902in operation1032to NFc901.

After receiving the service response message, NFc901may authenticate the NF producer902by verifying the CCA certificate of the NF producer in operation1036. Further, during the authentication, NFc901may verify whether the NF producer902is included in the list of candidate NF instances or the target NF set transmitted through the service request message. As a result of the verification, when the NF producer902is included in the list of candidate NF instances or the target NF set transmitted through the service request message, NFc901may authenticate whether the service response message is transmitted by an appropriate NF producer.

In another embodiment of the disclosure, the CCA generated by the NF producer may include information indicating the SCP having transmitted the service request received by the NF producer, for example, information, such as the NF instance ID of the SCP.

In another embodiment of the disclosure, the CCA generated by the NF producer902(CCA of NFp) may include information indicating the SCP114having transmitted the service request message received by the NF producer902. For example, the CCA may include information, such as the NF instance ID of the SCP114.

The SCP114receiving the service response message including the CCA generated by the NF producer902(CCA of NFp) may consider two situations.

In a first case, the SCP114indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114is the SCP114itself. In this case, since the information indicates the SCP114itself, the SCP114may determine that the received service request message is normal.

In a second case, the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114may be a different SCP (SCP_2) other than the SCP114. In this case, a simple method may determine (identify) that the service request message is abnormal. However, even when the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message received by the SCP114is the different SCP (SCP_2) other than the SCP114, the service request message may be normal.

For example, there may be a case where the SCP (SCP_2) requested to transmit the service request message does not directly transmit the service request message to the NF producer902but forwards transmission of the service request message to a different SCP (SCP_1). The SCP (SCP_2) requested to transmit the service request message does not directly transmit the service request message to the NF producer902but forwards transmission of the service request message to a different SCP (SCP_1), because the NF producer902is not located in the area of the SCP (SCP_2) or due to other reasons.

In this case, the SCP indicated by the CCA information (CCA of NFp) generated by the NF producer902included in the service response message may indicate SCP_2. Then, SCP_1 may identify whether transmission of the service request message is requested from SCP_2, and may identify using additional information whether the message is an appropriate message when the transmission of the service request message is requested from SCP_2.

Whether the message is an appropriate message may be identified (or verified) using the additional information, for example, by verifying whether the NF consumer901transmits the service request message to the NF producer902and receives a response transmitted from the NF producer902to the NF consumer901.

When at least one of the above procedures fails to be verified, the service response message may be rejected or NFc901may be notified that the service response message has been received from an inappropriate NF producer.

When the NF consumer is notified (informed) from the SCP that the service response has been received from the inappropriate NF producer, the NF consumer determines that the service response is an inappropriate service response, and may then perform a series of required operations.

The embodiments disclosed in the specification and the drawings are merely to provide specific examples in order to easily describe the details of the disclosure and to assist understanding of the disclosure and are not intended to limit the scope of the disclosure. Therefore, the scope of the disclosure should be interpreted to include all changes or modifications derived based on the technical idea of the disclosure in addition to the embodiments disclosed herein.