METHOD FOR TOKEN-BASED AUTHORIZATION FOR INDIRECT COMMUNICATION BETWEEN NETWORK FUNCTIONS

A method performed by a first network node having a network repository function. The method comprises: receiving an authorization token request from a service communication proxy, SCP; determining whether or not a network function, NF, service consumer device allows the SCP to represent the NF service consumer device; and responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP. A further method, network nodes, computer program and a non-transitory storage medium are also disclosed.

TECHNICAL FIELD

The disclosure relates to methods performed by a network node having a network repository function, NRF. The disclosure also relates to network nodes, computer program and a non-transitory storage medium.

BACKGROUND

Service based architecture was introduced in Release 15 of the 3GPP specifications. One of the security mechanisms introduced in Release 15 is token-based authorization, specified also in Release 16 in clause 13.4.1 of TS 33.501 V16.1.0 and clauses 5.4 and 6.3 of TS 29.510 V16.2.0. It is based on the OAuth 2.0 framework as specified in Internet Engineering Task Force (IETF) RFC 6749. The NRF (Network Repository Function, sometimes referred to as NF (Network Function) Repository Function or Network Resource Function) performs the role of an OAuth 2.0 Authorization server in a 3GPP-specified network. An NF (network function) service consumer performs the role of an OAuth 2.0 client and an NF service producer performs the role of an OAuth 2.0 resource server. Before accessing a service at the NF service producer, the NF service consumer needs to obtain an access token from the NRF. The token request may be for a specific NF producer instance or for a type of NF producers. The NRF may grant tokens for access of a type of NF producers, a list of NF instances, or a single NF instance. This information on the type of NF producers, the list of NF instances or the single NF instance is stored in the token audience (see e.g. Table 6.3.5.2.4-1 of TS 29.510 V16.2.0). After the NF service consumer has obtained the token from the NRF, the NF service consumer presents the token to the NF service producer in a service request, and the NF service producer checks whether the token is valid before granting access and/or performing the service.

A procedure that often needs to be performed before service access is service discovery, as described in clause 4.17.4 of TS 23.502 V16.3.0, and clauses 5.3 and 6.2 of TS 29.510 V16.2.0. Service discovery is used to discover producers and services offered by NF service producers in the network. The NF service consumer sends a discovery request to the NRF, and the NRF responds with a set of NF service producer instances. The consumer may send the token request to obtain an access token before the discovery or afterwards. If the NF service consumer has already discovered the NF service producers before sending the token request, the NF service consumer may use the information of available NF service producers when sending the token request.

In Release 16, in addition to the direct communication scenarios of Release15, indirect communication scenarios were introduced. They are described as Scenarios/Communication models C and Din Annex E of TS 23.501 V16.3.0. In Scenario D (indirect communication with delegated discovery), a proxy called SCP (Service Communication Proxy) performs discovery on behalf of the NF service consumer. This is described in clauses 4.17.9 and 4.17.10 of TS 23.502 V16.3.0.

Token-based authorization for indirect communication with delegated discovery is not specified yet, but one possible solution under discussion is that the SCP requests the authorization token on behalf of the NF consumer (Solution #21 in TR 33.855 V1.8.0). The SCP is called SeCoP or SECOP in SA3 documents, i.e. TR 33.855 V1.8.0 and TS 33.501 V16.1.0.

SUMMARY

An object of the invention is to improve security in a wireless communication network.

A first aspect of the invention relates to a method performed by a first network node having a network repository function. The method comprises: receiving an authorization token request from an SCP; determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP. Hereby is enabled that the SCP is permitted to act on behalf of the NF service consumer device only after the first network node has checked that the SCP is allowed to act on behalf of the NF Service consumer device. The first network node/NRF is thus enabled to verify that the authorization token request from the SCP really is on behalf of the NF service consumer device.

The SCP is in an embodiment of the first aspect implemented in a core network node. In an embodiment of the first aspect, the authorization token request identifies an NF service producer device. In this embodiment, the determining whether or not the NF service consumer device allows the SCP to represent the NF service consumer device comprises:

responsive to no consumer identifier being in the authorization token request:determining which NF service consumer devices are allowed to be represented by the SCP;determining whether any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP; andresponsive to any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP,determining that the NF service consumer device allows the SCP to represent the NF service consumer device;
responsive to there being the consumer identifier being in the authorization token request:determining whether the SCP is allowed to represent a NF service consumer device identified by the consumer identifier;determining whether the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device; andresponsive to determining that the SCP is allowed to represent a NF service consumer device identified by the consumer identifier and that the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device, determining that the NF service consumer device allows the SCP to represent the NF service consumer device.

The method is in one embodiment, wherein the authorization token request identifies an NF service producer device, comprising:determining whether or not the NF service producer device identified allows the SCP to represent NF service consumer devices; andwherein responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP comprises responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device and determining that the NF service producer device identified allows the SCP to represent NF service consumer devices, transmitting the authorization token to the SCP.

An embodiment of the method comprises: receiving provision information indicating whether or not SCPs are allowed to represent NF service consumer devices; and responsive to the provision information indicating that SCPs are allowed to represent the NF service consumer devices.

A second aspect relates to a method performed by a first network node having a network repository function. The method comprises: receiving an authorization token request from an SCP; determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; determining whether or not an NF service producer device identified in the authorization token allows the SCP to represent NF service consumer devices; and responsive to determining that the NF service producer device identified in the authorization token allows the SCP to represent NF service consumer devices and that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

In an embodiment of the method according to the second aspect, the determining whether or not the NF service consumer device allows the SCP to represent the NF service consumer device comprises:responsive to no consumer identifier being in the authorization token request:determining which NF service consumer devices are allowed to be represented by the SCP;determining whether any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP; andresponsive to any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP, determining that the NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to there being the consumer identifier being in the authorization token request:determining whether the SCP is allowed to represent a NF service consumer device identified by the consumer identifier;determining whether the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device; andresponsive to determining the SCP is allowed to represent a NF service consumer device identified by the consumer identifier and that the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device, determining that the NF service consumer device allows the SCP to represent the NF service consumer device.

An embodiment of the method according to the second aspect comprises receiving provision information indicating whether or not SCPs are allowed to represent NF service consumer devices; and responsive to the provision information indicating that SCPs are allowed to represent the NF service consumer devices, determining which SCPs are allowed to represent the NF service consumer devices. This embodiment and other embodiments disclosed enable the NF service consumer device and the NF service producer device to influence whether SCPs, and which SCPs, are allowed to represent NF service consumer devices. The embodiment allows the first network node to use this provisioning information from a sender when determining whether the first network node/NRF should issue an authorization token for the SCP.

In an embodiment of the first and second aspects, the method may comprise determining whether there is a consumer identifier in the authorization token request.

In an embodiment of the methods according to the first and second aspects, the method comprises: transmitting a provision information acknowledgement message to NF service providers identified in the provision information; receiving a response to the provision information acknowledgement message; responsive to the response indicating an approval to allow SCPs, determining that the NF service producer device allows the SCP to represent the NF service consumer device; and responsive to the response indicating a denial to allow SCPs, determining that the NF service producer device does not allow the SCP to represent the NF service consumer device.

In an embodiment of the methods according to the first and second aspects, the method comprises: transmitting a provision information acknowledgement message to NF service consumer devices identified in the provision information; receiving a response to the provision information acknowledgement message; responsive to the response indicating an approval to allow SCPs, determining that the NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to the response indicating a denial to allow SCPs, determining that the NF service consumer device does not allow the SCP to represent the NF service consumer device.

In an embodiment according to the first and second aspects, the method comprises transmitting a provision information acknowledgement message to a sender of the provision information.

In an embodiment of the first and second aspects, the method comprises: receiving a response to the provision information acknowledgement message transmitted to the sender; responsive to the response indicating an approval to allow SCPs, determining that the SCP is allowed to represent the NF service consumer device; and responsive to the response indicating a denial to allow SCPs, determining that the SCP is not allowed to represent the NF service consumer device.

A third aspect relates to a first network node which comprises a network repository function, processing circuitry, and memory coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the first network node to perform operations comprising:

receiving an authorization token request from an SCP;
determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; and
responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

The memory includes instructions that when executed by the processing circuitry causes the first network node to perform operations according to any one of the described embodiments of the method according to the first and second aspects.

A fourth aspect relates to a computer program comprising program code to be executed by a processing circuitry of a first network node having a network repository function, whereby execution of the program code causes the first network node to perform operations comprising: receiving an authorization token request from an SCP; determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

A fifth aspect relates to a non-transitory storage medium including program code to be executed by processing circuitry of a first network node comprising a network function repository, whereby execution of the program code causes the first network node to perform operations comprising: receiving an authorization token request from an SCP; determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

A sixth aspect relates to a first network node having a network repository function adapted to perform operations comprising: receiving an authorization token request from an SCP; determining whether or not an NF service consumer device allows the SCP to represent the NF service consumer device; and responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

In an embodiment of the first network node, wherein the authorization token request identifies an NF service producer device and in determining whether or not the NF service consumer device allows the SCP to represent the NF service consumer device, the first network node is adapted to perform operations comprising:

responsive to no consumer identifier being in the authorization token request:determining which NF service consumer devices are allowed to be represented by the SCP;determining whether any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP; andresponsive to any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP, determining that the NF service consumer device allows the SCP to represent the NF service consumer device; and
responsive to there being the consumer identifier in the authorization token request:determining whether the SCP is allowed to represent a NF service consumer device identified by the consumer identifier;determining whether the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device; andresponsive to determining the SCP is allowed to represent a NF service consumer device identified by the consumer identifier and that the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device, determining that the NF service consumer device allows the SCP to represent the NF service consumer device.

In an embodiment of the first network node, wherein the authorization token request identifies an NF service producer device, the first network node is adapted to perform operations comprising: determining whether or not the NF service producer device identified allows the SCP to represent NF service consumer devices and wherein responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP comprises responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device and determining that the NF service producer device identified allows the SCP to represent NF service consumer devices, transmitting the authorization token to the SCP.

A seventh aspect relates to a first network node having a network repository function. The first network node is adapted to perform operations comprising: receiving an authorization token request from an SCP; determining whether or not a Network Function, NF, service consumer device allows the SCP to represent the NF service consumer device; determining whether or not an NF service producer device identified in the authorization token allows the SCP to represent NF service consumer devices; and responsive to determining that the NF service producer device identified in the authorization token allows the SCP to represent NF service consumer devices and that the NF service consumer device allows the SCP to represent the NF service consumer device, transmitting an authorization token to the SCP.

The first network node of the seventh aspect is in one embodiment, wherein in determining whether or not the NF service consumer device allows the SCP to represent the NF service consumer device, adapted to perform further operations comprising:

responsive to no consumer identifier being in the authorization token request:determining which NF service consumer devices are allowed to be represented by the SCP;determining whether any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP; andresponsive to any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP, determining that the NF service consumer device allows the SCP to represent the NF service consumer device;
responsive to there being the consumer identifier being in the authorization token request:determining whether the SCP is allowed to represent an NF service consumer device identified by the consumer identifier;determining whether the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device; andresponsive to determining the SCP is allowed to represent a NF service consumer device identified by the consumer identifier and that the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device, determining that the NF service consumer device allows the SCP to represent the NF service consumer device.

The first network node according to the sixth and seventh aspects is in an embodiment adapted to perform operations comprising: determining whether there is a consumer identifier in the authorization token request.

The first network node according to the sixth and seventh aspect is in one embodiment adapted to perform operations comprising: receiving provision information indicating whether or not SCPs are allowed to represent NF service consumer devices; and responsive to the provision information indicating that SCPs are allowed to represent the NF service consumer devices, determining which SCPs are allowed to represent the NF service consumer devices.

The first network node is in one embodiment according to the sixth and seventh aspects adapted to perform operations comprising:

transmitting a provision information acknowledgement message to NF service consumer devices identified in the provision information;
receiving a response to the provision information acknowledgement message;
responsive to the response indicating an approval to allow SCPs, determining that the NF service consumer device allows the SCP to represent the NF service consumer device; and
responsive to the response indicating a denial to allow SCPs, determining that the NF service consumer device does not allow the SCP to represent the NF service consumer device.

The first network node is in one embodiment according to the sixth and seventh aspects adapted to perform operations comprising:

transmitting a provision information acknowledgement message to NF service providers identified in the provision information;
receiving a response to the provision information acknowledgement message;
responsive to the response indicating an approval to allow SCPs, determining that the NF service producer device allows the SCP to represent the NF service consumer device; and
responsive to the response indicating a denial to allow SCPs, determining that the NF service producer device does not allow the SCP to represent the NF service consumer device.

The first network node is in an embodiment of the sixth and seventh aspects adapted to perform operations comprising: transmitting a provision information acknowledgement message to a sender of the provision information.

The first network node is in an embodiment of the sixth and seventh aspects adapted to perform operations comprising: receiving a response to the provision information acknowledgement message transmitted to the sender; responsive to the response indicating an approval to allow SCPs, determining that the SCP is allowed to represent the NF service consumer device; and responsive to the response indicating a denial to allow SCPs, determining that the SCP is not allowed to represent the NF service consumer device.

DETAILED DESCRIPTION

FIG.1is a signaling diagram illustrating signals transmitted to and from a Network Function, NF, service consumer device100and a first network node102which implements a Network Repository Function, NRF, (and thus can also be referred to as the first network function or just ‘NRF’) The NF service consumer device100is in other words a device which is on the consuming end of a network function service provided by an NF in a wireless communication network, such as a 5G network or any future corresponding network, like a future 6G network. The NF service consumer device is in an embodiment a core network node, such as a 5G Core network node provided with a network function. The first network node102is an apparatus which runs the NRF in the wireless communication network, in which the apparatus may be positioned in a core network of the wireless communication network, such as in a 5G core network or any future network, such as a core network for a 6G network or a mesh network of a possible 6G network. Operations mentioned as being performed by the first network node102below are to be seen as operations enabled by the NRF, i.e. it can equally be said that the NRF performs the operations/actions/steps described below whenever the first network node performs the operations.

In operation 1 illustrated with the arrow 1 inFIG.1, the first network node102, in a configuration step, receives provision information indicating whether one or more second network nodes, e.g. Service Communication Proxies, SCPs104are allowed to represent an NF service consumer associated with the NF service consumer device100, or in other words represent the NF service consumer device100, and if yes (i.e. SCPs are allowed to represent the NF service consumers) which SCPs104. The term SCP is here also attributed to a computer running SCP software, e.g. being an SCP server or an SCP node. The SCP104may in an embodiment be comprised in a separate device/node/server, but may in other embodiments be at least partly comprised in a core network device also hosting one or more network functions. The SCP may for example be at least partly comprised, e.g. in the form of an SCP agent, in the NF service consumer device100. The provision information is received from one of the NF service consumer device100, an NRF service producer, an O&M system, or an enrollment agent. Thus, provision information could be sent by the NF service consumer device or an NF service producer device106itself, e.g. in their profile. It could also be sent in the O&M system. Thirdly, it could also be an enrollment agent that enrolls new network functions in the network.

In operation 2 illustrated with arrow 2, the first network node102in some embodiments may send a provision information acknowledgment message to the sender of the provision information and/or to the NF service consumer device and/or to the NF service producer device. The provision information acknowledgment message in some of these embodiments requests that the NF service consumer device and/or the NF service producer device approves the allowance of the SCP representing the NF service consumer device. In these embodiments, responsive to receiving the provision information acknowledgment message, the NF service consumer device and/or NF service producer device in operation 3, illustrated by arrow 3, transmits an approval message or a denial message to the first network node102. The first network node102determines whether or not the NF service producer device allows and whether or not the NF service consumer device allows an SCP104to represent the NF service consumer device.

Turning toFIG.2, in some embodiments, the second network node, here in the form of the SCP104may transmit one or more authorization token requests to the first network node102on behalf of NF service consumer devices. In operation 1 ofFIG.2, the first network node102receives an authorization token request from an SCP104. The authorization token request may or may not include an identifier of the NF service consumer device the SCP104represents. The transmission of the authorization token request may be made with a Hypertext Transfer Protocol message, in which case the SCP is or comprises an HTTP proxy.

In operation 2 ofFIG.2, the first network node102checks whether or not the desired NF service producer device allows that any SPC104, or at least this SCP104, represents NF service consumer devices.

In operation 3 ofFIG.2, the first network node102, if there was no NF service consumer device identifier sent in operation 1, checks which NF service consumer devices are allowed to be represented by this SCP104. The NRF of the first network node102then checks whether any of the NF service consumer devices that are authorized to invoke the NF service producer devices' services also is authorized to be represented by this or any SCP104. If an NF service consumer device identifier was sent in step1, the NRF checks whether the SCP104is allowed to represent this NF service consumer device, and whether the NF service consumer device is authorized to invoke the NF service producer device's services.

Operations 2 and 3 may occur in any order. Operation 3 may in other words happen before Operation 2.

In operation 4, if the checks in step2and3were successful, the first network node102transmits an authorization token back to the SCP104. The authorization token may be issued for the SCP104, the NF service consumer device, or the SCP104on behalf of the NF service consumer device. The transmission of the authorization token response may be made with a Hypertext Transfer Protocol message.

FIG.3is a block diagram illustrating elements of an embodiment of an NF service consumer device100configured to provide wireless communication according to embodiments. As shown, NF service consumer device100may include a transceiver circuitry301(also referred to as a transceiver) including a transmitter and a receiver configured to provide communications with an SCP(s). The NF service consumer device100also includes a processing circuitry302(also referred to as a processor) coupled to the transceiver circuitry, and memory circuitry303(also referred to as memory) coupled to the processing circuitry. The memory circuitry303may include computer readable program code that when executed by the processing circuitry323causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry302may be defined to include memory so that separate memory circuitry is not required. NF service consumer device100may also include an interface (such as a user interface) coupled with processing circuitry302.

As discussed herein, operations of NF service consumer device100may be performed by processing circuitry302and/or transceiver circuitry301. For example, processing circuitry302may control transceiver circuitry301to transmit communications through transceiver circuitry301over a radio interface to a radio access network node (also referred to as a base station) and/or to receive communications through transceiver circuitry301from a RAN node such as over a radio interface. Moreover, modules may be stored in memory circuitry303, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry302, processing circuitry302performs respective operations (e.g., operations discussed below with respect to Example Embodiments relating to NF service consumer devices). The NF service consumer device may for example be a network device which comprises and acts as anyone of Access and Mobility Management Function (AMF), Session Management Functions (SMF), Authentication Server Functions (AUSF), Security Anchor Functions (SEAF), Authentication credential Repository and Processing Function (ARPF), Unified Data Management (UDM), and Subscription Identifier De-concealing Function, (SIDF).FIG.4is a block diagram illustrating elements of the first network node102. As shown, the first network node02may include transceiver circuitry401(also referred to as a transceiver, e.g., corresponding to portions of interface4190ofFIG.11) including a transmitter and a receiver configured to provide uplink and downlink radio communications with mobile terminals. The first network node may include network interface circuitry402(also referred to as a network interface, e.g., corresponding to portions of interface4190ofFIG.11) configured to provide communications with other nodes (e.g., with other SCP nodes) of the RAN and/or core network CN. The first network node102also includes a processing circuitry403(also referred to as a processor, e.g., corresponding to processing circuitry4170) coupled to the transceiver circuitry, and a non-transitory storage medium404memory circuitry405(also referred to as memory, e.g., corresponding to device readable medium4180ofFIG.11) coupled to the processing circuitry. The memory circuitry405may include a computer program406with computer readable program code that when executed by the processing circuitry403causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry403may be defined to include memory so that a separate memory circuitry is not required.

As discussed herein, operations of the first network node102may be performed by processing circuitry403, network interface402, and/or transceiver401. For example, processing circuitry403may control transceiver401to transmit downlink communications through transceiver401over a radio interface to one or more NF consumer devices and other terminals and/or to receive uplink communications through transceiver401from one or more NF consumer devices over a radio interface. Similarly, processing circuitry403may control network interface402to transmit communications through network interface402to one or more other network nodes and/or to receive communications through network interface from one or more other network nodes. Moreover, modules may be stored in memory405, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry403, processing circuitry403performs respective operations (e.g., operations discussed below with respect to Example Embodiments relating to the first network node).

According to some other embodiments, the first network node may be implemented as a core network CN node without the transceiver.

FIG.5is a block diagram illustrating elements of the SCP104of a communication network configured to provide cellular communication according to embodiments. As shown, the SCP104may include network interface circuitry501(also referred to as a network interface) configured to provide communications with other nodes of the core network and/or the radio access network RAN. The SCP104also includes a processing circuitry502(also referred to as a processor) coupled to the network interface circuitry, and memory circuitry503(also referred to as memory) coupled to the processing circuitry. The memory circuitry503may include computer readable program code that when executed by the processing circuitry502causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry502may be defined to include memory so that a separate memory circuitry is not required.

As discussed herein, operations of the SCP104may be performed by processing circuitry502and/or the network interface501. Processing circuitry502may control network interface501to transmit communications through network interface501to one or more other network nodes and/or to receive communications through network interface from one or more other network nodes. Moreover, modules may be stored in memory503, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry502, processing circuitry502performs respective operations (e.g., operations discussed below with respect to Example Embodiments relating to second network node/functions).

As indicated above, the first network node102and the SCP104may have the following problem: There is no direct authentication between the NF service consumer device and the first network node102when the SCP104is allowed to request authentication tokens on behalf of the NF service consumer device100. Hence, the first network node102has no way of verifying that the authorization token request is on behalf of the NF service consumer device or whether the SCP node is authorized to request authorization tokens on behalf of the NF service consumer device.

In some embodiments, the consumer and/or producer register information at the first network node102that indicates whether SCPs are allowed to represent consumers, and if yes, which SCPs. The first network node102uses this information when determining whether it should issue an authorization token for the SCP104when an authorization request is received by the first network node102. One advantage that may be achieved by these embodiments is that the NF service consumer device and NF service producer devices can influence whether SCPs are allowed to represent NF service consumer devices, and if allowed, determine which SCPs are to be allowed to represent the NF service consumer devices.

Operations of the first network node102(implemented using the structure of the block diagram ofFIG.4) will now be discussed with reference to the flow chart ofFIG.6according to some embodiments. For example, modules may be stored in memory503ofFIG.4, and these modules may provide instructions so that when the instructions of a module are executed by respective wireless device processing circuitry502, processing circuitry502performs respective operations of the flow chart.

Turning now toFIG.6, in block601, the processing circuitry403, via network interface circuitry402or transceiver circuitry401, may receive provision information indicating whether or not SCPs are allowed to represent NF service consumers/NF service consumer devices. The provision information may also include a listing of the SCPs that are allowed to represent NF service consumers devices. The first network node102is a network repository function, NRF, node/function. In other words, the first network node102implements an NRF.

In block603, the processing circuitry403may, responsive to the provision information indicating that SCPs104are allowed to represent the NF service consumer devices determine which SCPs104are allowed to represent the NF service consumer devices.

In block605, the processing circuitry403may receive an authorization token request from the SCP104. The authorization token request in some embodiments includes a consumer identifier. In block607, the processing circuitry403may determine whether or not an NF service consumer device allows the SCP to represent the NF service consumer device. The authorization token request may also include an identification of an NF service producer device. Turning now toFIGS.7A and7B, in block701, processing circuitry403determines whether there is a consumer identifier in the authorization token request. If there is no consumer identifier in the request, the processing circuitry403may determine, in block705, which NF service consumer devices are allowed to be represented by the SCP. In block707, the processing circuitry403may determine whether any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer devices are authorized to be represented by the SCP. In block709, responsive to any of the NF service consumer devices that are authorized to invoke services provided by the NF service producer device are authorized to be represented by the SCP, the processing circuitry403may determine that the NF service consumer device allows the SCP to represent the NF service consumer device.

If there is a consumer identifier in the authorization token request, the processing circuitry403may determine in block711whether the SCP is allowed to represent an NF service consumer device identified by the consumer identifier. In block713, the processing circuitry403may determine whether the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device.

In block715, responsive to determining the SCP is allowed to representing the NF service consumer device identified by the consumer identifier and that the NF service consumer device identified by the consumer identifier is authorized to invoke the services provided by the NF service producer device, the processing circuitry403may determine that the NF service consumer device allows the SCP to represent the NF service consumer device.

In some embodiments, there is always a consumer identifier in the authorization token request. In these embodiments, the processing circuitry403performs blocks711,713, and715and does not need to perform blocks701,705,707, and709. In other embodiments, there is no consumer identifier in the authorization token. In these other embodiments, the processing circuitry403performs blocks705,707, and709and does not need to perform blocks701,711,713, and715.

Returning toFIG.6, in block609, processing circuitry403may determine whether or not the NF service producer device identified allows the SCP to represent NF service consumer devices. In block611, the processing circuitry403may, responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device, transmit an authorization token to the SCP. In embodiments where the first network node determines whether or not the NF service producer device identified allows the SCP to represent NF service consumer devices, the first network node transmits the authorization token to the SCP responsive to determining that the NF service consumer device allows the SCP to represent the NF service consumer device and that the NF service producer device identified allows the SCP to represent NF service consumer devices.

Various operations from the flow chart ofFIG.6may be optional with respect to some embodiments of first network node and related methods. Regarding methods of example embodiment 1 (set forth below), for example, operations of blocks601,602, and609ofFIG.6may be optional.

In some embodiments, the first network node102may transmit a provision information acknowledgment message to NF service consumer devices identified in the provision information received. The allows the NF service consumer devices to allow or deny a second network node/function, here an SCP to act on the behalf of the NF service consumer devices. Turning toFIG.8, processing circuitry403may transmit a provision information acknowledgment message to NF service consumer devices identified in the provision information in block801. In block803, the processing circuitry403may receive a response to the provision information acknowledgment message. In block805, processing circuitry403determines whether the response indicates an approval or a denial to allow SCPs to represent the NF service consumer device. In block807, responsive to the response indicating an approval to allow SCPs, the processing circuitry403may determine that the NF service consumer device allows the SCP to represent the NF service consumer device. In block809, the processing circuitry may, responsive to the response indicating a denial to allow SCP, determine that the NF service consumer device does not allow the SCP to represent the NF service consumer device.

In other embodiments, the first network node102may transmit a provision information acknowledgment message to NF service producer devices identified in the provision information received. Turning toFIG.9, processing circuitry403may transmit a provision information acknowledgment message to NF service producer devices identified in the provision information in block901. In block903, the processing circuitry403may receive a response to the provision information acknowledgment message. In block905, processing circuitry403determines whether the response indicates an approval or a denial to allow SCPs to represent the NF service consumer device. In block907, responsive to the response indicating an approval to allow SCPs, the processing circuitry403may determine that the NF service producer device allows the SCP to represent the NF service consumer device. In block909, the processing circuitry may, responsive to the response indicating a denial to allow SCPs, determine that the NF service producer device does not allow the SCP to represent the NF service consumer device.

In some embodiments, the NF service consumer device or the NF service producer device may not have a direct secure channel to the first network node. In such cases, an O& M system or an enrollment agent may act on behalf of the NF service consumer device or the NF service producer device and send the provision information to the first network node. Turning toFIG.10, in these embodiments, the receiving circuitry403may transmit a provision information acknowledgment message to a sender of the provision information in block1001. In block1003, the processing circuitry403may receive a response to the provision information acknowledgment message that was transmitted to the sender.

In block1005, processing circuitry403may determine whether the response indicates an approval or denial to allow SCPs to represent the NF service consumer device. Responsive to the response indicating an approval to allow SCPs, the processing circuitry403may determine that the SCP is allowed to represent the NF service consumer device. In block1009, the processing circuitry may, responsive to the response indicating a denial to allow SCPs, determine that the SCP is not allowed to represent the NF service consumer device.

Example embodiments within this disclosure are discussed below.

1. A method performed by a first network node/function, the method comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a network function, NF consumer allows the second network node/function to represent the NF consumer; and

responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.

2. The method of Embodiment 1 wherein the first network node implements a Network Repository Function, NRF and the second network node implements a service communication proxy, SCP.
3. The method of any of Embodiments 1-2, wherein the authorization token request identifies an NF service producer and wherein determining whether or not the NF consumer allows the second network node to represent the NF consumer comprises:

responsive,703, to no consumer identifier being in the authorization token request:determining,705, which NF consumers are allowed to be represented by the second network node;determining,707, whether any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node; andresponsive to any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node, determining,709, that the NF consumer allows the second network node to represent the NF consumer;
responsive,703, to there being the consumer identifier being in the authorization token:determining,711, whether the second network node is allowed to represent a NF consumer identified by the consumer identifier;determining,713, whether the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer; andresponsive to determining the second network node is allowed to represent a NF consumer identified by the consumer identifier and that the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer, determining,715, that the NF consumer allows the second network node to represent the NF consumer.
4. The method of Embodiment 3, further comprising:

determining,701, whether there is a consumer identifier in the authorization token request;

5. The method of any of Embodiments 1-4, wherein the authorization token request identifies an NF service producer, the method further comprising:

determining,609, whether or not the NF service producer identified allows the second network node to represent NF consumers; and

wherein responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node comprises responsive to determining that the NF consumer allows the second network node to represent the NF consumer and determining that the NF service producer identified allows the second network node to represent NF consumers, transmitting the authorization token to the second network node.

6. The method of any of Embodiments 1-5, further comprising:

receiving,601, provision information indicating whether or not second network nodes are allowed to represent NF consumers; and

responsive to the provision information indicating that second network nodes are allowed to represent the NF consumers, determining,603, which second network nodes are allowed to represent the NF consumers.

7. The method of Embodiment 6, further comprising:

transmitting,801, a provision information acknowledgement message to NF consumers identified in the provision information;

receiving,803, a response to the provision information acknowledgement message;

responsive,805, to the response indicating an approval to allow second network nodes, determining,807, that the NF consumer allows the second network node to represent the NF consumer; and

responsive,805, to the response indicating a denial to allow second network nodes, determining,809, that the NF consumer does not allow the second network node to represent the NF consumer.

8. The method of any of Embodiments 6-7, further comprising:

transmitting,901, a provision information acknowledgement message to NF service providers identified in the provision information;

receiving,903, a response to the provision information acknowledgement message;

responsive,905, to the response indicating an approval to allow second network nodes, determining,907, that the NF service producer allows the second network node to represent the NF consumer; and

responsive,905, to the response indicating a denial to allow second network nodes, determining,909, that the NF service producer does not allow the second network node to represent the NF consumer.

9. The method of any of Embodiments 6-8, further comprising:

transmitting,1001, a provision information acknowledgement message to a sender of the provision information.

10. The method of Embodiment 9, further comprising:

receiving,1003, a response to the provision information acknowledgement message transmitted to the sender;

responsive,1005, to the response indicating an approval to allow second network nodes, determining,1007, that the second network node is allowed to represent the NF consumer; and

responsive,1005, to the response indicating a denial to allow second network nodes, determining,1009, that the second network node is not allowed to represent the NF consumer.

11. A method performed by a first network node102, the method comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a Network Function, NF, consumer allows the second network node to represent the NF consumer;

determining,609, whether or not an NF service producer identified in the authorization token allows the second network node to represent NF consumers; and

responsive to determining that the NF service producer identified in the authorization token allows the second network node to represent NF consumers and that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.

12. The method of Embodiment 10 wherein the first network node implements a Network Repository Function, NRF and the second network node implements a service communication proxy, SCP.
13. The method of any of Embodiments 11-12, wherein determining whether or not the NF consumer allows the second network node to represent the NF consumer comprises:

responsive,703, to no consumer identifier being in the authorization token request:determining,705, which NF consumers are allowed to be represented by the second network node;determining,707, whether any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node; andresponsive to any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node, determining,709, that the NF consumer allows the second network node to represent the NF consumer;

responsive,703, to there being the consumer identifier being in the authorization token:determining,711, whether the second network node is allowed to represent a NF consumer identified by the consumer identifier;determining,713, whether the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer; andresponsive to determining the second network node is allowed to represent a NF consumer identified by the consumer identifier and that the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer, determining,715, that the NF consumer allows the second network node to represent the NF consumer.
14. The method of Embodiment 13, further comprising:determining,701, whether there is a consumer identifier in the authorization token request.
15. The method of any of Embodiments 13-14, further comprising:

receiving,601, provision information indicating whether or not second network nodes are allowed to represent NF consumers; and

responsive to the provision information indicating that second network nodes are allowed to represent the NF consumers, determining,603, which second network nodes are allowed to represent the NF consumers.

16. The method of Embodiment 15, further comprising:

transmitting,801, a provision information acknowledgement message to NF consumers identified in the provision information;

receiving,803, a response to the provision information acknowledgement message;

responsive,805, to the response indicating an approval to allow second network nodes, determining,807, that the NF consumer allows the second network node to represent the NF consumer; and

responsive,805, to the response indicating a denial to allow second network nodes, determining,809, that the NF consumer does not allow the second network node to represent the NF consumer.

17. The method of any of Embodiments 15-16, further comprising:

transmitting,901, a provision information acknowledgement message to NF service providers identified in the provision information;

receiving,903, a response to the provision information acknowledgement message;

responsive,905, to the response indicating an approval to allow second network nodes, determining,907, that the NF service producer allows the second network node to represent the NF consumer; and

responsive,905, to the response indicating a denial to allow second network nodes, determining,909, that the NF service producer does not allow the second network node to represent the NF consumer.

18. The method of any of Embodiments 15-17, further comprising:

transmitting,1001, a provision information acknowledgement message to a sender of the provision information.

19. The method of Embodiment 18, further comprising:

receiving,1003, a response to the provision information acknowledgement message transmitted to the sender;

responsive,1005, to the response indicating an approval to allow second network nodes, determining,1007, that the second network node is allowed to represent the NF consumer; and

responsive,1005, to the response indicating a denial to allow second network nodes, determining,1009. that the second network node is not allowed to represent the NF consumer.

20. A first network node102comprising:

processing circuitry403; and

memory405coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the service communication proxy to perform operations comprising:receiving,605, an authorization token request from a second network node;determining,607, whether or not a network function, NF consumer allows the second network node to represent the NF consumer; andresponsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.
21. The first network node function according to Embodiment 20 wherein the first network node comprises a network resource function, NRF, node and the second network node comprises a service communication proxy, SCP, node.
22. The first network node102according to any of Embodiments 20-21 wherein the memory includes instructions that when executed by the processing circuitry causes the service communication proxy to perform operations according to any of Embodiments 2-19.
23. A computer program comprising program code to be executed by processing circuitry403of a first network node102, whereby execution of the program code causes the first network node102to perform operations comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a network function, NF consumer allows the second network node to represent the NF consumer; and

responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.

24. The computer program according to Embodiment 23 whereby execution of the program code causes the first network node102to perform operations any of Embodiments 2-19.
25. A computer program product comprising a non-transitory storage medium including program code to be executed by processing circuitry403of a network function repository, first network node102, whereby execution of the program code causes the first network node102to perform operations comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a network function, NF consumer allows the second network node to represent the NF consumer; and

responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611an authorization token to the second network node.

26. The computer program product according to embodiment 25 whereby execution of the program code causes the first network node102to perform further operations the according to any of Embodiments 2-19.
27. A first network node102adapted to perform operations comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a network function, NF consumer allows the second network node to represent the NF consumer; and

responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.

28. The first network node102of Embodiment 27 wherein the first network node102implements a Network Repository Function, NRF and the second network node implements a service communication proxy, SCP.
29. The first network node102of any of Embodiments 27-28 wherein the authorization token request identifies an NF service producer and in determining whether or not the NF consumer allows the second network node to represent the NF consumer the first network node102is further adapted to perform operations comprising:

responsive,703, to no consumer identifier being in the authorization token request:determining,705, which NF consumers are allowed to be represented by the second network node;determining,707, whether any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node; andresponsive to any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node, determining,709, that the NF consumer allows the second network node to represent the NF consumer;

responsive,703, to there being the consumer identifier in the authorization token:determining,711, whether the second network node is allowed to represent a NF consumer identified by the consumer identifier;determining,713, whether the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer; andresponsive to determining the second network node is allowed to represent a NF consumer identified by the consumer identifier and that the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer, determining,715, that the NF consumer allows the second network node to represent the NF consumer.
30. The first network node102of Embodiment 29, wherein the first network node102is further adapted to perform operations comprising:

determining701whether there is a consumer identifier in the authorization token request.

31. The first network node102of any of Embodiments 27-30, wherein the authorization token request identifies an NF service producer, wherein the first network node102is further adapted to perform operations comprising:

determining,609. whether or not the NF service producer identified allows the second network node to represent NF consumers and

wherein responsive to determining that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node comprises responsive to determining that the NF consumer allows the second network node to represent the NF consumer and determining that the NF service producer identified allows the second network node to represent NF consumers, transmitting the authorization token to the second network node.

32. The first network node102of any of Embodiments 27-31, wherein the first network node102is further adapted to perform operations comprising:

receiving,601, provision information indicating whether or not second network nodes are allowed to represent NF consumers; and

responsive to the provision information indicating that second network nodes are allowed to represent the NF consumers, determining,603, which second network nodes are allowed to represent the NF consumers.

33. The first network node102of Embodiment 32, wherein the first network node102is further adapted to perform operations comprising:

Transmitting,801, a provision information acknowledgement message to NF consumers identified in the provision information;

receiving,803, a response to the provision information acknowledgement message;

responsive,805, to the response indicating an approval to allow second network nodes, determining,807, that the NF consumer allows the second network node to represent the NF consumer; and

responsive,805, to the response indicating a denial to allow second network nodes, determining,809, that the NF consumer does not allow the second network node to represent the NF consumer.

34. The first network node102of any of Embodiments 32-33, wherein the first network node102is further adapted to perform operations comprising:

transmitting,901, a provision information acknowledgement message to NF service providers identified in the provision information;

receiving,903, a response to the provision information acknowledgement message;

responsive,905, to the response indicating an approval to allow second network nodes, determining,907, that the NF service producer allows the second network node to represent the NF consumer; and

responsive,905, to the response indicating a denial to allow second network nodes, determining,909, that the NF service producer does not allow the second network node to represent the NF consumer.

35. The first network node102of any of Embodiments 32-34, wherein the first network node102is further adapted to perform operations comprising:

transmitting,1001a provision information acknowledgement message to a sender of the provision information.

36. The first network node102of Embodiment 35 wherein the first network node102is further adapted to perform operations comprising:

receiving,1003, a response to the provision information acknowledgement message transmitted to the sender;

responsive,1005, to the response indicating an approval to allow second network nodes, determining,1007, that the second network node is allowed to represent the NF consumer; and

responsive,1005, to the response indicating a denial to allow second network nodes, determining,1009, that the second network node is not allowed to represent the NF consumer.

37. A first network node102adapted to perform operations comprising:

receiving,605, an authorization token request from a second network node;

determining,607, whether or not a Network Function, NF, consumer allows the second network node to represent the NF consumer;

determining,609, whether or not an NF service producer identified in the authorization token allows the second network node to represent NF consumers; and

responsive to determining that the NF service producer identified in the authorization token allows the second network node to represent NF consumers and that the NF consumer allows the second network node to represent the NF consumer, transmitting,611, an authorization token to the second network node.

38. The first network node102of Embodiment 37 wherein the first network node102implements a Network Repository Function, NRF and the second network node implements a service communication proxy, SCP.
39. The first network node102of any of Embodiments 37-38, wherein in determining whether or not the NF consumer allows the second network node to represent the NF consumer, the first network node102is adapted to perform further operations comprising:

responsive,703to no consumer identifier being in the authorization token request:determining,705, which NF consumers are allowed to be represented by the second network node;determining,707, whether any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node; andresponsive to any of the NF consumers that are authorized to invoke services provided by the NF service producer are authorized to be represented by the second network node, determining,709, that the NF consumer allows the second network node to represent the NF consumer;

responsive,703, to there being the consumer identifier being in the authorization token:determining,711, whether the second network node is allowed to represent a NF consumer identified by the consumer identifier;determining,713, whether the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer; andresponsive to determining the second network node is allowed to represent a NF consumer identified by the consumer identifier and that the NF consumer identified by the consumer identifier is authorized to invoke the services provided by the NF service producer, determining,715, that the NF consumer allows the second network node to represent the NF consumer.
40. The first network node102of Embodiment 39, wherein the first network node102is adapted to perform further operations comprising:

determining,701, whether there is a consumer identifier in the authorization token request.

41. The first network node102of any of Embodiments 37-40, wherein the first network node102is adapted to perform further operations comprising:receiving,601, provision information indicating whether or not second network nodes are allowed to represent NF consumers; andresponsive to the provision information indicating that second network nodes are allowed to represent the NF consumers, determining,603, which second network nodes are allowed to represent the NF consumers.
42. The first network node102of Embodiment 41, wherein the first network node102is adapted to perform further operations comprising:

transmitting,801, a provision information acknowledgement message to NF consumers identified in the provision information;

receiving,803, a response to the provision information acknowledgement message;

responsive,805, to the response indicating an approval to allow second network nodes, determining,807, that the NF consumer allows the second network node to represent the NF consumer; and

responsive,805, to the response indicating a denial to allow second network nodes, determining,809, that the NF consumer does not allow the second network node to represent the NF consumer.

43. The first network node102of any of Embodiments 41-42, wherein the first network node102is adapted to perform further operations comprising:

transmitting,901, a provision information acknowledgement message to NF service providers identified in the provision information;

receiving,903. a response to the provision information acknowledgement message;

responsive,905, to the response indicating an approval to allow second network nodes, determining,907, that the NF service producer allows the second network node to represent the NF consumer; and

responsive,905, to the response indicating a denial to allow second network nodes, determining,909, that the NF service producer does not allow the second network node to represent the NF consumer.

44. The first network node102of any of Embodiments 41-43, wherein the first network node102is adapted to perform further operations comprising:

transmitting,1001, a provision information acknowledgement message to a sender of the provision information.

45. The first network node102of Embodiment 44, wherein the first network node102is adapted to perform further operations comprising

receiving,1003, a response to the provision information acknowledgement message transmitted to the sender;

responsive,1005, to the response indicating an approval to allow second network nodes, determining,1007, that the second network node is allowed to represent the NF consumer; and

responsive,1005, to the response indicating a denial to allow second network nodes, determining,1009, that the second network node is not allowed to represent the NF consumer.

Explanations are provided below for various abbreviations/acronyms used in the present disclosure.

AbbreviationExplanation3GPP3rd Generation Partnership ProjectNFNetwork FunctionNRFNetwork Repository_ Function, also referred to as NFRepository Function or Network Resource FunctionO&MOperation and MaintenanceSCPService Communication ProxySeCoPService Communication ProxySECOPService Communication Proxy

Additional explanation is provided below.

FIG.11illustrates the wireless communication network in accordance with some embodiments.

InFIG.11, network node4160includes processing circuitry4170, device readable medium4180, interface4190, auxiliary equipment4184, power source4186, power circuitry4187, and antenna4162. Although network node4160illustrated in the example wireless network ofFIG.11may represent a device that includes the illustrated combination of hardware components, other embodiments may comprise network nodes with different combinations of components. It is to be understood that a network node comprises any suitable combination of hardware and/or software needed to perform the tasks, features, functions and methods disclosed herein. Moreover, while the components of network node4160are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, a network node may comprise multiple different physical components that make up a single illustrated component (e.g., device readable medium4180may comprise multiple separate hard drives as well as multiple RAM modules).

Processing circuitry4170may comprise a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application-specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software and/or encoded logic operable to provide, either alone or in conjunction with other network node4160components, such as device readable medium4180, network node4160functionality. For example, processing circuitry4170may execute instructions stored in device readable medium4180or in memory within processing circuitry4170. Such functionality may include providing any of the various wireless features, functions, or benefits discussed herein. In some embodiments, processing circuitry4170may include a system on a chip (SOC).

In some embodiments, processing circuitry4170may include one or more of radio frequency (RF) transceiver circuitry4172and baseband processing circuitry4174. In some embodiments, radio frequency (RF) transceiver circuitry4172and baseband processing circuitry4174may be on separate chips (or sets of chips), boards, or units, such as radio units and digital units. In alternative embodiments, part or all of RF transceiver circuitry4172and baseband processing circuitry4174may be on the same chip or set of chips, boards, or units

In certain embodiments, some or all of the functionality described herein as being provided by a network node may be performed by processing circuitry4170executing instructions stored on device readable medium4180or memory within processing circuitry4170. In alternative embodiments, some or all of the functionality may be provided by processing circuitry4170without executing instructions stored on a separate or discrete device readable medium, such as in a hard-wired manner. In any of those embodiments, whether executing instructions stored on a device readable storage medium or not, processing circuitry4170can be configured to perform the described functionality. The benefits provided by such functionality are not limited to processing circuitry4170alone or to other components of network node4160, but are enjoyed by network node4160as a whole, and/or by end users and the wireless network generally.

Device readable medium4180may comprise any form of volatile or non-volatile computer readable memory including, without limitation, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (for example, a hard disk), removable storage media (for example, a flash drive, a Compact Disk (CD) or a Digital Video Disk (DVD)), and/or any other volatile or non-volatile, non-transitory device readable and/or computer-executable memory devices that store information, data, and/or instructions that may be used by processing circuitry4170. Device readable medium4180may store any suitable instructions, data or information, including a computer program, software, an application including one or more of logic, rules, code, tables, etc. and/or other instructions capable of being executed by processing circuitry4170and, utilized by network node4160. Device readable medium4180may be used to store any calculations made by processing circuitry4170and/or any data received via interface4190. In some embodiments, processing circuitry4170and device readable medium4180may be considered to be integrated.

Interface4190is used in the wired or wireless communication of signalling and/or data between network node4160, network4106, and/or WDs4110. As illustrated, interface4190comprises port(s)/terminal(s)4194to send and receive data, for example to and from network4106over a wired connection. Interface4190also includes radio front end circuitry4192that may be coupled to, or in certain embodiments a part of, antenna4162. Radio front end circuitry4192comprises filters4198and amplifiers4196. Radio front end circuitry4192may be connected to antenna4162and processing circuitry4170. Radio front end circuitry may be configured to condition signals communicated between antenna4162and processing circuitry4170. Radio front end circuitry4192may receive digital data that is to be sent out to other network nodes or WDs via a wireless connection. Radio front end circuitry4192may convert the digital data into a radio signal having the appropriate channel and bandwidth parameters using a combination of filters4198and/or amplifiers4196. The radio signal may then be transmitted via antenna4162. Similarly, when receiving data, antenna4162may collect radio signals which are then converted into digital data by radio front end circuitry4192. The digital data may be passed to processing circuitry4170. In other embodiments, the interface may comprise different components and/or different combinations of components.

Power circuitry4187may comprise, or be coupled to, power management circuitry and is configured to supply the components of network node4160with power for performing the functionality described herein. Power circuitry4187may receive power from power source4186. Power source4186and/or power circuitry4187may be configured to provide power to the various components of network node4160in a form suitable for the respective components (e.g., at a voltage and current level needed for each respective component). Power source4186may either be included in, or external to, power circuitry4187and/or network node4160. For example, network node4160may be connectable to an external power source (e.g., an electricity outlet) via an input circuitry or interface such as an electrical cable, whereby the external power source supplies power to power circuitry4187. As a further example, power source4186may comprise a source of power in the form of a battery or battery pack which is connected to, or integrated in, power circuitry4187. The battery may provide backup power should the external power source fail. Other types of power sources, such as photovoltaic devices, may also be used.

Alternative embodiments of network node4160may include additional components beyond those shown inFIG.11that may be responsible for providing certain aspects of the network node's functionality, including any of the functionality described herein and/or any functionality necessary to support the subject matter described herein. For example, network node4160may include user interface equipment to allow input of information into network node4160and to allow output of information from network node4160. This may allow a user to perform diagnostic, maintenance, repair, and other administrative functions for network node4160.

FIG.12illustrates a virtualization environment in accordance with some embodiments.

FIG.12is a schematic block diagram illustrating a virtualization environment4300in which functions implemented by some embodiments may be virtualized. In the present context, virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to a node or to a device or components thereof and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines or containers executing on one or more physical processing nodes in one or more networks).

The functions may be implemented by one or more applications4320(which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) operative to implement some of the features, functions, and/or benefits of some of the embodiments disclosed herein. Applications4320are run in virtualization environment4300which provides hardware4330comprising processing circuitry4360and memory4390. Memory4390contains instructions4395executable by processing circuitry4360whereby application4320is operative to provide one or more of the features, benefits, and/or functions disclosed herein.

Virtualization environment4300, comprises general-purpose or special-purpose network hardware devices4330comprising a set of one or more processors or processing circuitry4360, which may be commercial off-the-shelf (COTS) processors, dedicated Application Specific Integrated Circuits (ASICs), or any other type of processing circuitry including digital or analog hardware components or special purpose processors. Each hardware device may comprise memory4390-1which may be non-persistent memory for temporarily storing instructions4395or software executed by processing circuitry4360. Each hardware device may comprise one or more network interface controllers (NICs)4370, also known as network interface cards, which include physical network interface4380. Each hardware device may also include non-transitory, persistent, machine-readable storage media4390-2having stored therein software4395and/or instructions executable by processing circuitry4360. Software4395may include any type of software including software for instantiating one or more virtualization layers4350(also referred to as hypervisors), software to execute virtual machines4340as well as software allowing it to execute functions, features and/or benefits described in relation with some embodiments described herein.

Virtual machines4340comprise virtual processing, virtual memory, virtual networking or interface and virtual storage, and may be run by a corresponding virtualization layer4350or hypervisor. Different embodiments of the instance of virtual appliance4320may be implemented on one or more of virtual machines4340, and the implementations may be made in different ways.

During operation, processing circuitry4360executes software4395to instantiate the hypervisor or virtualization layer4350, which may sometimes be referred to as a virtual machine monitor (VMM). Virtualization layer4350may present a virtual operating platform that appears like networking hardware to virtual machine4340.

As shown inFIG.12, hardware4330may be a standalone network node with generic or specific components. Hardware4330may comprise antenna43225and may implement some functions via virtualization. Alternatively, hardware4330may be part of a larger cluster of hardware (e.g. such as in a data center or customer premise equipment (CPE)) where many hardware nodes work together and are managed via management and orchestration (MANO)43100, which, among others, oversees lifecycle management of applications4320.

In the context of NFV, virtual machine4340may be a software implementation of a physical machine that runs programs as if they were executing on a physical, non-virtualized machine. Each of virtual machines4340, and that part of hardware4330that executes that virtual machine, be it hardware dedicated to that virtual machine and/or hardware shared by that virtual machine with others of the virtual machines4340, forms a separate virtual network elements (VNE).

Still in the context of NFV, Virtual Network Function (VNF) is responsible for handling specific network functions that run in one or more virtual machines4340on top of hardware networking infrastructure4330and corresponds to application4320inFIG.12.

In some embodiments, one or more radio units43200that each include one or more transmitters43220and one or more receivers43210may be coupled to one or more antennas43225. Radio units43200may communicate directly with hardware nodes4330via one or more appropriate network interfaces and may be used in combination with the virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station.

In some embodiments, some signalling can be effected with the use of control system43230which may alternatively be used for communication between the hardware nodes4330and radio units43200.

Further definitions and embodiments are discussed below.

It should also be noted that in some alternate implementations, the functions/acts noted in the blocks may occur out of the order noted in the flowcharts. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Moreover, the functionality of a given block of the flowcharts and/or block diagrams may be separated into multiple blocks and/or the functionality of two or more blocks of the flowcharts and/or block diagrams may be at least partially integrated. Finally, other blocks may be added/inserted between the blocks that are illustrated, and/or blocks/operations may be omitted without departing from the scope of inventive concepts. Moreover, although some of the diagrams include arrows on communication paths to show a primary direction of communication, it is to be understood that communication may occur in the opposite direction to the depicted arrows. Many variations and modifications can be made to the embodiments without substantially departing from the principles of the present inventive concepts. All such variations and modifications are intended to be included herein within the scope of present inventive concepts. Accordingly, the above disclosed subject matter is to be considered illustrative, and not restrictive, and the examples of embodiments are intended to cover all such modifications, enhancements, and other embodiments, which fall within the spirit and scope of present inventive concepts. Thus, to the maximum extent allowed by law, the scope of present inventive concepts are to be determined by the broadest permissible interpretation of the present disclosure including the examples of embodiments and their equivalents, and shall not be restricted or limited by the foregoing detailed description.