Patent Description:
With continuous development of communications systems, a service based architecture (SBA) is widely applied. In the service based architecture, a network entity that can provide a specific network function is referred to as a network function (NF) module, and a network function may be provided as a service.

In the service based architecture, any two network function modules may interact with each other by invoking a network function service through a service based interface. Because protocol stacks for all service based interfaces are the same, to be specific, a network function service provided by a network function module with a service based interface may be invoked by any other network function module, there is a threat of network function service abuse, and security performance is relatively poor.

Therefore, a solution needs to be provided to resolve a problem of relatively poor security performance that exists when a network function service is invoked in the service based architecture.

The proposal "<NPL> discloses a security call flow for service based architecture in which a NRF generate a session key for a NF-<NUM> and a NF-<NUM>, and the NF-<NUM> and a NF-<NUM> communicate by using the session key. This document provides a solution addressing KI <NUM> on security of service based architecture.

This solution present a method which makes the NRF is capable of discovering the requested NF and issuing session key to related NFs. In order to access to a requested type NF and no associated NF(s) stored on the requester NF, the requester NF initiates the NF discovery by providing the type of the NF (e.g. SMF, PCF) and other service parameters to discover the target NF. The detail service parameter(s) used for specific NF discovery refer to the related NF discovery and selection clause. The NRF provides the IP address or the FQDN of NF instance(s) to the requester NF for target NF instance selection. Based on that information, the requester NF can select one NF instance. NF-<NUM> is a network function that needs to communicate with NF-<NUM>. As NF-<NUM> does not have the IP address or FQDN of NF-<NUM>, it must communicate with NRF to find the right NF-<NUM>. Document <CIT> describes a method including receiving a request from a requestor to a given resource, which requestor is registered to access a set of one or more resources. The request includes a ticket that includes signature data generated by an authenticating entity in response to authenticating the requestor. The signature data may be decrypted to provide a decrypted signature. The ticket may be validated in response to the request based on evaluating the decrypted signature. A response can be provided to the requestor based on the validation, and the response can grant the requestor access to the given resource if the validation determines the ticket to be authentic and authorized for the given resource or the response can deny the requestor access to the given resource if the validation determines to reject the ticket.

The document "<NPL>, discloses a dynamic authorization by operator and a method for authorizing a service raised by a UE. This document discusses the threats, potential requirements and solutions for the security of next generation mobile networks. In particular, this document includes collection, analysis and further investigation of potential security threats and requirements for the next generation systems, based on the service, architectural and radio related requirements for the next generation mobile networks. Moreover, this document relates to investigation of the security architecture and access security. Document <NPL>, proposes to add security procedures of authorization of NF service access for Service Based Architecture in TS <NUM>. According to this document, the NRF checks whether the access can be permitted according to the maintained authorization information. If the service can be authorized, NRF sends the result along with a token that proves this authorization. The token should include the NF type and NF instance ID of NF service consumer, the NF type and NF instance ID of NF service producer, the NF service name that can be accessed, and a credential such as MAC (Message Authentication Code) or digital signature. If the token can be reused within a period of time, the expiration date should also be included. The NF service producer can verify the token by itself. It may also send the token to NRF to verify if it does not have enough information, such as the key material. The NRF informs NF service producer the verification result. Token Verification Request and Response could introduce much overhead, thus it is recommended to verify the token by NF service producer itself. If token is verified successfully and the NF service Request is consistent with the information in the token, NF service producer executes the requested service and response to NF service consumer.

The present invention is set out by the set of appended claims. Preferred embodiments are specified by the dependent claims. In the following, parts of the description and drawing referring to examples or implementations, which are not covered by the claims are not presented as embodiments of the invention, but as illustrative examples useful for understanding the invention. The embodiments of the invention are provided by the appended claims.

The following describes technical solutions of this disclosure with reference to accompanying drawings.

<FIG> is a schematic block diagram of a service based architecture according to an example of this disclosure. The network architecture is based on a service, to obtain a plurality of different types of network function modules. The network function modules interact with each other by invoking a network function service through a service based interface.

It should be understood that, the network function module in this example of this disclosure has a particular function and a network interface, and may be a network element on dedicated hardware, a software instance that runs on dedicated hardware, or a virtual function instance on a related platform (for example, a cloud infrastructure). This is not limited in this example of this disclosure. The following describes various modules in the service based architecture with reference to <FIG>.

A radio access network (RAN) module <NUM> is responsible for access of user equipment (UE) <NUM>. It may be understood that, in an actual expression process, a RAN may also be abbreviated as an AN.

Optionally, the UE in this example of this disclosure may be mobile or fixed. The UE may be an access terminal, a terminal device, a mobile terminal, a subscriber unit, a subscriber station, a mobile station, a mobile console, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communications device, a user agent, a user apparatus, or the like. The access terminal may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device having a wireless communication function, a computing device, another processing device connected to a wireless modem, an in-vehicle device, a wearable device, or user equipment in a future 5th generation (<NUM>) system or a new radio (NR) system.

An access and mobility management function (AMF) module <NUM> has a function similar to mobility management in an existing mobile management entity (MME), and is configured to control access of the UE to a network resource and manage movement of the UE. The AMF module <NUM> communicates with the RAN module <NUM>, to process an access network control plane, where N2 is not a service based interface.

An authentication server function (AUSF) module <NUM> is responsible for generation of a key and mutual authentication with the UE <NUM>.

A session management function (SMF) module <NUM> is responsible for managing a session of the UE, including session establishment, modification, and release.

A network exposure function (NEF) module <NUM> is responsible for securely providing a network function service in a core network for an external network entity service, conversion between internal information and external information, and so on.

A network function data repository function (NRF) module <NUM> is responsible for functions such as service discovery.

A policy control function (PCF) module <NUM> is responsible for managing a unified policy framework of network behavior, providing a policy rule for a control plane for execution, and so on.

A unified data management (UDM) module <NUM> includes a front end (front end, FE) and a user data repository (UDR). The FE is responsible for functions such as credit rating processing, location management, and subscription management, and may access user subscription data stored in the UDR. The UDR is a user subscription data storage server, and is responsible for providing user subscription data for the front end.

An application function (AF) module <NUM> provides an application service.

As shown in <FIG>, the AMF module <NUM> has a service based interface NAMF, the SMF module <NUM> has a service based interface NSMF, the AUSF module <NUM> has a service based interface NAUSF, the NEF module <NUM> has a service based interface NNEF, the NRF module <NUM> has a service based interface NNRF, the PCF module <NUM> has a service based interface NPCF, the UDM module <NUM> has a service based interface NUDM, and the AF module <NUM> has a service based interface NAF.

It should be understood that, the service based interface of each network function module in this example of this disclosure may further have another name. This is not limited in this example of this disclosure.

In the service based architecture, the network function modules invoke network function services through the service based interfaces. Service based interfaces in an entire network support a same communication protocol. This means that a network function module having a service based interface can be accessed by any other network function module having a service based interface. That is, a network function service provided by a network function module having a service based interface can be invoked by any other network function module having a service based interface. In this way, there may be a problem of network function service abuse in the service based architecture, leading to relatively poor security performance.

For example, in a conventional network architecture, there is no communications interface between an AF and a UDM. That is, the AF cannot directly access the UDM. However, in the service based architecture, the AF has a capability of invoking a network function service in the UDM. Because the UDM stores sensitive information related to a user, the AF can randomly invoke the network function service in the UDM through the service based interface. This may cause leakage of user information.

A network function service invocation method provided in the examples of this disclosure can improve security of invoking a network function service.

<FIG> is a schematic flowchart of a network function service invocation method <NUM> according to an example of this disclosure. The method <NUM> may be applied to the network architecture shown in <FIG>.

A first network function module sends a first request message to an authorization module, where the first request message is used to request a permission to invoke a first network function service provided by a second network function module, the first request message carries first information, second information, and third information, the first information is used to indicate the first network function module, the second information is used to indicate the second network function module, and the third information is used to indicate the first network function service. Correspondingly, the authorization module receives the first request message sent by the first network function module.

It should be understood that, the first network function module can provide at least one network function service, the second network function module can provide at least one network function service, and the network function service provided by the first network function module is different from the network function service provided by the second network function module.

Optionally, for example, the authorization module may be the NRF module shown in <FIG>, and the first network function module and the second network function module may be any two network function modules other than the NRF module, the RAN, and the UE shown in <FIG>. For example, the first network function module may be the NEF module in <FIG>, and the second network function module may be the AF module in <FIG>. This is not limited in this example of this disclosure.

Optionally, the first information may include a type and/or an identifier of the first network function module, the second information may include a type and/or an identifier of the second network function module, and the third information may include an identifier of the first network function service. This is not limited in this example of this disclosure.

Optionally, a type of a network function module in this example of this disclosure may include an AMF, an SMF, an NRF, an NEF, an AF, or the like. This is not limited in this example of this disclosure.

Optionally, an identifier of the network function module in this example of this disclosure may include a name, an ID (identification), a serial number, a domain name, a network access identifier (NAI), a network protocol (IP) address, or the like. This is not limited in this example of this disclosure.

Optionally, an identifier of a network function service in this example of this disclosure may include a name, an ID, a serial number, or the like of the network function service. This is not limited in this example of this disclosure.

The authorization module determines, based on the first information, the second information, and the third information, whether the first network function module has the permission to invoke the first network function service.

In an optional example, when the first information includes the type of the first network function module, the second information includes the type of the first network function module, and the third information includes the identifier of the first network function service, the authorization module may determine, based on the type of the first network function module, the type of the second network function module, the identifier of the first network function service, and pre-configured first authorization information, whether the first network function module has the permission to invoke the first network function service. The first authorization information is used to indicate at least one type of network function module that is allowed to invoke the first network function service.

Specifically, the authorization module may obtain the first authorization information based on the type of the second network function module and the identifier of the first network function service. When the at least one type indicated by the first authorization information includes the type of the first network function module, the authorization module determines that the first network function module has the permission to invoke the first network function service. Alternatively, when the at least one type indicated by the first authorization information does not include the type of the first network function module, the authorization module determines that the first network function module does not have the permission to invoke the first network function service.

Optionally, the first authorization information may include the at least one type of network function module that is allowed to invoke the first network function service.

In another optional example, when the first information includes the identifier of the first network function module, and the second information includes the identifier of the second network function module and the identifier of the third network function module, the authorization module may determine, based on the identifier of the first network function module, the identifier of the second network function, the identifier of the first network function service, and pre-configured second authorization information, whether to grant the permission to invoke the first network function service. The second authorization information is used to indicate at least one network function module that is allowed to invoke the first network function service.

Specifically, the authorization module may obtain the second authorization information based on the identifier of the second network function module and the identifier of the first network function service. When the at least one network function module indicated by the second authorization information includes the first network function module, the authorization module determines that the first network function module has the permission to invoke the first network function service. Alternatively, when the at least one network function module indicated by the second authorization information does not include the first network function module, the authorization module determines that the first network function module does not have the permission to invoke the first network function service.

Optionally, the second authorization information may include an identifier of each of the at least one network function module that is allowed to invoke the first network function service.

In still another example, when the first information includes the type of the first network function module and the identifier of the first network function module, the second network function module includes the type of the second network function module and the identifier of the second network function module, and the third information includes the identifier of the first network function service, the authorization module may determine, based on the type of the first network function module, the identifier of the first network function module, the type of the second network function module, the identifier of the second network function module, and pre-configured third authorization information, whether the first network function module has the permission to invoke the first network function service. The third authorization information is used to indicate at least one type of network function module that is allowed to invoke the first network function service and at least one network function module corresponding to each of the at least one type.

Specifically, the authorization module may obtain the third authorization information based on the type of the second network function module, the identifier of the second network function module, and the identifier of the first network function service. When the at least one type indicated by the third authorization information includes the type of the first network function module, and the at least one network function module includes the first network function module, the authorization module determining that the first network function module has the permission to invoke the first network function service. Alternatively, when the at least one type does not include the type of the first network function module, or when the at least one network function module indicated by the third authorization information does not include the first network function module, the authorization module determines that the first network function module does not have the permission to invoke the first network function service.

Optionally, the third authorization information may include the at least one type of network function module that is allowed to invoke the first network function service and an identifier of each of the at least one network function module corresponding to each type.

Optionally, the first request message may further carry at least one of an identifier of a network slice to which the first network function module belongs, an identifier of an operator providing a service for the first network function module, and a service request parameter of the first network function module. This is not limited in this example of this disclosure.

It should be understood that, the network slice may be understood as a logical network that can provide a particular network capability and network characteristic, and one network slice may include a plurality of network function modules.

Optionally, the identifier of the network slice in this example of this disclosure may be a name, a domain name, an ID, a serial number, and the like of the network slice, and the identifier of the operator may be a public land mobile network (public land mobile network, PLMN) ID, a name, a serial number, and the like. This is not limited in this example of this disclosure. Correspondingly, S220 may be: determining, by the authorization module based on the first information, the second information, the third information, and at least one of the identifier of the network slice to which the first network function module belongs, the identifier of the operator providing the service for the first network function module, and the service request parameter of the first network function module, whether the first network function module has the permission to invoke the first network function service.

It should be understood that, the first network function module may have different permissions when invoking the first network function service to provide a service for different user equipments. Because the authorization module stores no authorization policy related to the user equipment, the network architecture provided in this example of this disclosure may further include a user data management module, and the authorization module may request, from the user data management module, an authorization policy of the first network function service corresponding to the user equipment.

Optionally, the user data management module may be the UDM shown in <FIG>. This is not limited in this example of this disclosure.

Optionally, when the first network function service serves user equipment, before S220, the authorization module may send a second request message to the user data management module. The second request message is used to request an authorization policy of the first network function service corresponding to the user equipment, the second request message carries an identifier of the user equipment, and the authorization policy is used to indicate whether to grant, to the first network function module, the permission to invoke the first network function service corresponding to the user equipment. The authorization module receives the authorization policy sent by the user data management module based on the identifier of the user equipment. Correspondingly, S220 may be: determining, by the authorization module based on the first information, the second information, the third information, and the authorization policy, whether the first network function module has the permission to invoke the first network function service. Optionally, the user data management module may preconfigure an authorization policy or an authorization rule of at least one network function service corresponding to each of at least one user equipment in a network. This is not limited in this example of this disclosure.

The authorization module sends a token to the first network function module when determining that the first network function module has the permission to invoke the first network function service, where the token is used to indicate that the first network function module has the permission to invoke the first network function service of the second network function module. Correspondingly, the first network function module receives the token sent by the authorization module.

Optionally, before S230, the method further includes: generating, by the authorization module, the token.

Optionally, before S230, the authorization module may perform identity authentication on the first network function module. S230 may be: sending, by the authorization module, the token to the first network function module when determining that the identity authentication succeeds and that the first network function module has the permission to invoke the first network function service. According to the network function service invocation method provided in this example of this disclosure, the authorization module sends the token to the first network function module when the identity authentication on the first network function module succeeds, thereby improving authorization security.

Optionally, the first network function module may further perform identity authentication on the authorization module, thereby further improving communication security.

Optionally, an identity authentication method in this example of this disclosure may include a symmetric key-based encryption algorithm or an asymmetric key-based encryption algorithm. This is not limited in this example of this disclosure.

<FIG> is a schematic diagram of a format of a token according to an example of this disclosure.

As shown in <FIG>, the token may carry fourth information, fifth information, and sixth information, the fourth information is used to indicate that a network function module requesting to invoke a network function service is the first network function module, the fifth information is used to indicate that a network function module providing a network function service is the second network function module, the sixth information is used to indicate at least one network function service that the first network function module has a permission to invoke and that is provided by the second network function module, and the at least one network function service includes the first network function service.

Optionally, the fourth information may include a type and/or an identifier of the network function module requesting to invoke a network function service, the fifth information may include a type and/or an identifier of the network function module providing a network function service, and the sixth information may include an identifier of each of the at least one network function service. This is not limited in this example of this disclosure.

As shown in <FIG>, the token may further carry an identifier of the token, a message verification code (a digital signature), and an algorithm for the message verification code (the digital signature). For example, a calculation method of the message verification code may be MAC (info, K), where info includes information (except the message verification code and the digital signature) recorded in the token, K is a symmetric key shared by the authorization module and the first network function module, and MAC is a calculation function of the message verification code, for example, a keyed-hash message authentication code (HMAC) algorithm.

For another example, a calculation method of the digital signature may be E(PRAS, info), where info includes information (except the message verification code and the digital signature) recorded in the token, PRAS is a private key of the authorization module, and E is an asymmetric encryption algorithm, for example, an RSA (Rivest-Shamir-Adleman) algorithm.

As shown in <FIG>, the token may further carry a validity period or at least one of an effective time and a failure time of the token. When the token carries the effective time or the failure time, the token may further carry validity duration.

For example, in this example of this disclosure, the effective time of the token is <NUM>:<NUM>:<NUM>, January <NUM>, <NUM> and may be expressed as<CIT> and may be expressed as <CIT> to <NUM>:<NUM>:<NUM>, February <NUM>, <NUM>) and may be expressed as <CIT>-<CIT>, and the validity duration may be a time difference between the failure time and the effective time (to be specific, one month, two hours two minutes and thirty seconds) and may be expressed as <NUM>.

As shown in <FIG>, the token may further carry the identifier (for example, the PLMN ID) of the operator or an identifier of the authorization module issuing the token. This is not limited in this example of this disclosure.

<FIG> is a schematic flowchart of a network function service invocation method <NUM> according to an example of this disclosure. For example, the method <NUM> may be applied to the network architecture shown in <FIG>.

A first network function module sends a fourth request message to a second network function module, where the fourth request message is used to request to invoke a first network function service provided by the second network function module, the fourth request message carries first information, second information, third information, and a token, the first information is used to indicate the first network function module, the second information is used to indicate the second network function module, the third information is used to indicate the first network function service, the token carries fourth information, fifth information, and sixth information, the fourth information is used to indicate a network function module requesting to invoke a network function service, the fifth information is used to indicate a network function module providing a network function service, and the sixth information is used to indicate at least one network function service that the first network function module has a permission to invoke and that is provided by the second network function module. Correspondingly, the second network function module receives the fourth request message sent by the first network function module.

Optionally, an identifier of the network function module in this example of this disclosure may include a name, an ID, a serial number, a domain name, an NAI, an IP address, or the like. This is not limited in this example of this disclosure.

Optionally, an identifier of the network function service in this example of this disclosure may include a name, an ID, a serial number, or the like of the network function service. This is not limited in this example of this disclosure.

The second network function module determines whether the network function module indicated by the fourth information is the same as the first network function module, whether the network function module indicated by the fifth information is the same as the second network function module, and whether the at least one network function service indicated by the sixth information includes the first network function service.

Specifically, the second network function module may match information in the fourth request message with information in the token, to be specific, match the first information in the fourth request message with the fourth information in the token, match the second information in the fourth request message with the fifth information in the token, and match the third information in the fourth request message with the sixth information in the token, to obtain a matching result. The second network function module sends a service response message of the first network function service to the first network function module when determining that the network function module indicated by the fourth information is the same as the first network function module, that the network function module indicated by the fifth information is the same as the second network function module, and that the at least one network function service indicated by the sixth information includes the first network function service.

Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service.

Optionally, for example, the authorization module may be the NRF module shown in <FIG>, and the first network function module and the second network function module may be any two network function modules other than the NRF module, the UE, and the RAN shown in <FIG>. For example, the first network function module may be the NEF module in <FIG>, and the second network function module may be the AF module in <FIG>. This is not limited in this example of this disclosure.

It should be understood that, when the authorization module finds that a network function module is invaded or accessed without authorization, or when an operator needs to disable an access permission of the network function module due to adjustment of a network management policy, the authorization module can revoke a token issued for a network function service in the network function module. That is, the authorization module needs to confirm at least one token that has been revoked.

Optionally, the authorization module may indicate, to the second network function module, the at least one token that has been revoked, and the second network function module verifies validity of the token. Alternatively, the second network function module may send the token to the authorization module, request the authorization module to verify validity of the token, to obtain a verification result, and send the verification result to the second network function module. This is not limited in this example of this disclosure.

Optionally, the token may include an identifier of the token.

In an optional example, before S430, the second network function module may send the third request message to the authorization module, where the third request message carries the token. The authorization module may verify validity of the token based on the identifier of the token and an identifier of at least one locally stored token that has been revoked, to obtain a first verification result, and send the first verification result to the second network function module. Correspondingly, the second network function module receives the first verification result sent by the authorization module based on the third request message, where the first verification result includes validity or invalidity. S430 may be: sending, by the second network function module, the service response message of the first network function service to the first network function module when determining that the first verification result is validity, that the network function module requesting authorization is the same as the first network function module, that the network function module that is authorized is the same as the second network function module, and that the at least one network function service that is authorized includes the first network function service. Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the first verification result is invalidity, that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service.

Optionally, that the second network function module verifies the validity of the token based on the identifier of the token and the identifier of the locally stored at least one token that has been revoked, to obtain the first verification result may be: determining, by the second network function module, whether the identifier of the at least one token includes the identifier of the token; and determining that the first verification result is invalidity when the identifier of the at least one token includes the identifier of the token; or determining that the first verification result is validity when the identifier of the at least one token does not include the identifier of the token.

Optionally, the authorization module may indicate the first verification result by using at least one bit. This is not limited in this example of this disclosure.

For example, the authorization module may indicate the first verification result by using one bit. The one bit being <NUM> indicates validity, and the one bit being <NUM> indicates invalidity.

In another optional example, before S430, the second network function module may receive seventh information sent by the authorization module, where the seventh information includes an identifier of at least one token that has been revoked; and determine whether the identifier of the at least one token includes the identifier of the token. S430 may be: sending, by the second network function module, the service response message of the first network function service to the first network function module when determining that the identifier of the at least one token does not include the identifier of the token, that the network function module requesting authorization is the same as the first network function module, that the network function module that is authorized is the same as the second network function module, and that the at least one network function service that is authorized includes the first network function service.

Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the identifier of the at least one token includes the identifier of the token, that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service.

Optionally, the authorization module may periodically send the seventh information to the second network function module, or the authorization module may send the seventh information to the second network function module based on a request of the second network module. This is not limited in this example of this disclosure.

According to the network function service invocation method provided in this example of this disclosure, the authorization module or the second network function module determines, based on whether the identifier of the at least one token that has been revoked includes the identifier of the token used to invoke the first network function service, whether the token has been revoked. This can prevent an invalid token that has been revoked from being used to invoke a network function service, thereby improving security of invoking the network function service.

In addition, the authorization module indicates the at least one token that has been revoked to the second network function module, so that the second network function module can confirm the validity of the token, without a need to send the token to the authorization module for confirmation each time, thereby reducing signaling overheads.

Optionally, the token may further carry at least one of a message verification code and a digital signature.

In an optional example, before S430, the second network function module may verify the message verification code and/or the digital signature, to obtain a second verification result, where the second verification result may indicate a success or a failure. S430 may be: sending, by the second network function module, the service response message of the first network function service to the first network function module when determining that the second verification result indicates a success, that the network function module requesting authorization is the same as the first network function module, that the network function module that is authorized is the same as the second network function module, and that the at least one network function service that is authorized includes the first network function service.

Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the second verification result indicates a failure, that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service.

Optionally, the second network function module may indicate the second verification result by using at least one bit.

For example, the second network module may indicate the second verification result by using one bit. The one bit being <NUM> indicates a success, and the one bit being <NUM> indicates a failure.

According to the network function service invocation method provided in this example of this disclosure, the second network function module verifies the message verification code or the digital signature, and provides the first network function service for the first network function module only after the verification succeeds, thereby improving security of invoking a network function service.

Optionally, the token further carries a validity period or at least one of an effective time and a failure time of the token. When the token carries the effective time or the failure time, the token may further carry validity duration.

It should be understood that, the validity period of the token may be represented by the effective time plus the failure time, or the effective time plus the validity duration.

In an optional example, before S430, the second network function module may verify the validity period of the token based on the validity period or at least one of the effective time and the failure time of the token, to obtain a third verification result, where the third verification result may be validity or invalidity. S430 may be: sending, by the second network function module, the service response message of the first network function service to the first network function module when determining that the third verification result is validity, that the network function module requesting authorization is the same as the first network function module, that the network function module that is authorized is the same as the second network function module, and that the at least one network function service that is authorized includes the first network function service.

In an optional example, the authorization module may determine that the token is valid based on a case in which a current time is later than the effective time of the token and earlier than the failure time of the token.

In another optional example, the authorization module may determine that the token is valid based on a case in which a current time is within the validity period of the token.

Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the third verification result is invalidity, that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service.

According to the network function service invocation method provided in this example of this disclosure, the second network function module verifies, based on the validity period or at least one of the effective time and the failure time of the token that is in the token, whether the token is valid. This can prevent an expired invalid token from being used to invoke a network function service, thereby improving security of invoking the network function service.

Optionally, before S430, the second network function module may perform identity authentication on the first network function module. S430 may be: sending, by the second network function module, the service response message of the first network function service to the first network function module when the identity authentication succeeds, the network function module requesting authorization is the same as the first network function module, the network function module that is authorized is the same as the second network function module, and the at least one network function service that is authorized includes the first network function service. Correspondingly, the second network function module rejects sending the service response message of the first network function service to the first network function module when determining that the identity authentication fails, that the network function module requesting authorization is different from the first network function module, that the network function module that is authorized is different from the second network function module, or that the at least one network function service that is authorized does not include the first network function service. According to the network function service invocation method provided in this example of this disclosure, the second network function module sends the service response message to the first network function module when the identity authentication on the first network function module succeeds, thereby improving security of invoking a network function service.

Optionally, the first network function module may further perform identity authentication on the second network function module, thereby further improving communication security. Optionally, an identity authentication method in this example of this disclosure may include a symmetric key-based encryption algorithm or an asymmetric key-based encryption algorithm. This is not limited in this example of this disclosure.

It should be understood that, the second network function module may determine, in one or more of the foregoing manners, whether to send the service response message to the first network function module. This is not limited in this example of this disclosure.

It should be understood that, the token in this example of this disclosure may be repeatedly used within the validity period, without a need to obtain the token each time when a network function service is requested, thereby reducing signaling overheads. A start time of the validity period may be the effective time of the token, and an end time of the validity period may be the failure time of the token. This is not limited in this example of this disclosure.

It should further be understood that, the token in this example of this disclosure carries the sixth information, where the sixth information is used to indicate the at least one network function service that is authorized. When the first network function module requests any one of the at least one network function service, there is no need to request the token from the authorization module again, thereby further reducing signaling overheads.

For example, when the at least one network function service indicated by the sixth information includes a second network function service provided by the second network function module, the first network function module may further use the token to invoke the second network function service.

For another example, within the validity period, the first network function module may use the token for a plurality of times to invoke the at least one network function service that is authorized.

The first network function module sends a first request message to the authorization module, where the first request message is used to request a permission to invoke a first network function service provided by a second network function module, the first request message carries first information, second information, and third information, the first information is used to indicate the first network function module, the second information is used to indicate the second network function module, and the third information is used to indicate the first network function service. Correspondingly, the authorization module receives the first request message sent by the first network function module.

Optionally, for example, the first network function module may be the AMF module shown in <FIG>, the second network function module may be the AUSF module shown in <FIG>, and the authorization module may be the NRF module shown in <FIG>. This is not limited in this embodiment of this application.

For example, the AMF module may send the first request message to the NRF module, where the first request message is used to request a user authentication (NAUSF_UE Authentication) service provided by the AUSF module, and the first request message carries an ID of the AMF module, an ID of the AUSF module, and an ID of the UE authentication service.

The authorization module determines, based on the first information, the second information, and the third information, whether the first network function module has the permission to invoke the first network function service.

For example, the NRF module may determine, based on the ID of the AMF module, the ID of the AUSF module, and the ID of the UE authentication service, whether the AMF has a permission to invoke the UE authentication service.

Optionally, it is assumed that the ID of the AMF module is amf0.5gc. mcc460.3gppnetwork. org, the ID of the second network function module is ausf1.5gc. mcc460.3gppnetwork. org, and the ID of the UE authentication service is NAUDF_UE Authentication. The authorization information may be, for example, an authorization table of the UE authentication service.

Specifically, the NRF module may obtain an authorization table shown in <FIG> from a plurality of locally stored authorization tables based on the ID of the AUSF module and the ID of the UE authentication service. The NRF module may determine, based on a case in which an identifier of at least one network function module in the authorization table includes the identifier of the AMF module, that the AMF module has the permission to invoke the UE authentication service.

It should be understood that, the authorization table shown in <FIG> is only an optional representation of the authorization information, and the authorization information may alternatively be a mapping table, a mapping diagram, or the like that can represent a form of the authorization information. This is not limited in this example of this disclosure.

The authorization module sends a token to the first network function module when determining that the first network function module has the permission to invoke the first network function service, where the token carries fourth information, fifth information, and sixth information, the fourth information is used to indicate that a network function module requesting to invoke a network function service is the first network function module, the fifth information is used to indicate that a network function module providing a network function service is the second network function module, the sixth information is used to indicate at least one network function service that the first network function module has a permission to invoke and that is provided by the second network function module, and the at least one network function service includes the first network function service. Correspondingly, the first network function module receives the token sent by the authorization module.

The first network function module sends a second request message to the second network function module, where the second request message is used to request to invoke the first network function service, and the second request message carries the first information, the second information, the third information, and the token. Correspondingly, the second network function module receives the second request message sent by the first network function module.

For example, the AMF module may send the second request message to the AUSF module, where the second request message is used to request the UE authentication service, and the second request message carries the ID of the AMF module, the ID of the AUSF module, the ID of the UE authentication service, and the token shown in <FIG>.

The second network function module determines whether the network function module indicated by the fourth information is the same as the first network function module, whether the network function module indicated by the fifth information is the same as the second network function module, and whether the at least one network function service indicated by the sixth information includes the first network function service.

Specifically, the second network function module may match information in the second request message with information in the token, to obtain a matching result.

The second network function module sends a service response message of the first network function service to the first network function module when determining that the network function module indicated by the fourth information is the same as the first network function module, that the network function module indicated by the fifth information is the same as the second network function module, and that the at least one network function service indicated by the sixth information includes the first network function service. Correspondingly, the first network function module receives the service response message sent by the second network function module.

For example, as shown in <FIG>, the AUSF module sends a service response message of the UE authentication service to the first network function module based on a case in which an identifier of the network function module requesting to invoke a network function service is the same as the ID of the AMF module, an identifier of the network function module providing a network function service is the same as the ID of the AUSF module, and a network function service list includes the ID of the UE authentication service.

Optionally, the service response message of the UE authentication service may include information related to a UE authentication service request, or an ACK (ACKnowledgement) fed back after the UE authentication service is executed. This is not limited in this example of this disclosure.

<FIG> shows a network function service invocation method according to an example of this disclosure. For example, the method may be applied to the network architecture shown in <FIG>. A first network function module sends a first request message to a second network function module, where the first request message is used to request to invoke a first network function service provided by the second network function module, the first request message carries first information, second information, and third information, the first information is used to indicate the first network function module, the second information is used to indicate the second network function module, and the third information is used to indicate the first network function service. Correspondingly, the second network function module receives the first request message sent by the first network function module.

Optionally, for example, the first network function module may be the AMF module shown in <FIG>, the second network function module may be the AUSF module shown in <FIG>, and an authorization module may be the NRF module shown in <FIG>. This is not limited in this embodiment of this application.

For example, the AMF module may send the first request message to the AUSF module, where the first request message is used to request a user authentication (NAUSF_UE Authentication) service provided by the AUSF module, and the first request message carries an identifier (identification, ID) of the AMF module, an ID of the AUSF module, and an ID of the UE authentication service. The second network function module sends a second request message to the authorization module based on the first information, the second information, and the third information, where the second request message is used to request to verify a permission of the first network function module to invoke the first network function service, and the second request message carries the first information, the second information, and the third information. Correspondingly, the authorization module receives the second request message sent by the second network function module.

For example, the AUSF module may send the second request message to the NRF module based on the first request message, where the second request message is used to request to verify a permission of the AMF module to invoke the UE authentication service, and the second request message carries the ID of the AMF module, the ID of the AUSF module, and the ID of the UE authentication service.

The authorization module verifies, based on the first information, the second information, and the third information, whether the first network function module has the permission to invoke the first network function service, to obtain a verification result, where the verification result includes that the first network function module has the permission to invoke the first network function service or that the first network function module does not have the permission to invoke the first network function service.

Optionally, the authorization module may indicate the verification result by using at least one bit. This is not limited in this example of this disclosure.

In an optional example, the authorization module may indicate the verification result by using one bit. For example, the bit being <NUM> indicates that the first network function module has the permission to invoke the first network function service, and the bit being <NUM> indicates that the first network function module does not have the permission to invoke the first network function service.

For example, the NRF module may obtain an authorization table shown in <FIG> from a plurality of locally stored authorization tables based on the ID of the AUSF module and the ID of the UE authentication service. The NRF module may determine, based on a case in which an identifier of at least one network function module in the authorization table includes the identifier of the AMF module, that the AMF module has the permission to invoke the UE authentication service.

The authorization module sends the verification result to the second network function module. Correspondingly, the second network function module receives the verification result sent by the authorization module.

For example, the NRF module sends the verification result to the AUSF module, where the verification result is used to indicate that the AMF module has the permission to invoke the UE authentication service.

When the verification result is that the first network function module has the permission to invoke the first network function service, the second network function module sends a service response message of the first network function service to the first network function module. Correspondingly, the first network function module receives the service response message sent by the second network function module.

For example, the AUSF module sends a service response message of the UE authentication service to the AMF module based on a case in which the verification result indicates that the AMF module has the permission to invoke the UE authentication service.

The foregoing describes the network function service invocation method provided in the examples of this disclosure in detail with reference to <FIG>. The following describes a network function service invocation apparatus provided in the examples of this disclosure with reference to <FIG>.

<FIG> shows a network function service invocation apparatus <NUM> according to an example of this disclosure. The apparatus <NUM> includes:.

Optionally, the token carries fourth information, fifth information, and sixth information, the fourth information is used to indicate that a network function module requesting to invoke a network function service is the first network function module, the fifth information is used to indicate that a network function module providing a network function service is the second network function module, the sixth information is used to indicate at least one network function service that the first network function module has a permission to invoke and that is provided by the second network function module, and the at least one network function service includes the first network function service.

Optionally, the first network function service serves user equipment. The sending module is further configured to send a second request message to a user data management module, where the second request message is used to request an authorization policy of the first network function service corresponding to the user equipment, the second request message carries an identifier of the user equipment, and the authorization policy is used to indicate whether to grant, to the first network function module, the permission to invoke the first network function service corresponding to the user equipment. The receiving unit is further configured to receive the authorization policy sent by the user data management module based on the identifier of the user equipment. The processing unit is specifically configured to determine, based on the first information, the second information, the third information, and the authorization policy, whether the first network function module has the permission to invoke the first network function service.

Optionally, the sending unit is further configured to send seventh information to the second network function module, where the seventh information includes an identifier of at least one token that has been revoked.

Optionally, the token further carries an identifier of the token. The receiving unit is further configured to receive a third request message sent by the second network function module, where the third request message carries the token. The processing unit is further configured to verify validity of the token based on the identifier of the token, to obtain a verification result. The sending unit is further configured to send the verification result to the second network function module. It should be understood that, the apparatus <NUM> herein is represented in a form of a functional unit. The term "unit" herein may be an application-specific integrated circuit (ASIC), an electronic circuit, a processor for performing one or more software or firmware programs (for example, a shared processor, a dedicated processor, or a packet processor) and a memory, a combined logic circuit, and/or another proper component that supports the described functions. In an optional example, a person skilled in the art may understand that, the apparatus <NUM> may be specifically the authorization module in the examples of the method <NUM> to the method <NUM>. The apparatus <NUM> may be configured to perform various procedures and/or steps corresponding to the authorization module in the examples of the method <NUM> to the method <NUM>. To avoid repetition, details are not described herein again.

Optionally, the token carries fourth information, fifth information, and sixth information, where the fourth information is used to indicate a network function module requesting to invoke a network function service, the fifth information is used to indicate a network function module providing a network function service, and the sixth information is used to indicate at least one network function service that the first network function module has a permission to invoke and that is provided by the second network function module.

Optionally, before sending the fourth request message to the second network function module, the sending unit is further configured to send a first request message to an authorization module, where the first request message is used to request the permission to invoke the first network function service, and the first request message carries the first information, the second information, and the third information. The receiving unit is further configured to receive the token sent by the authorization module, where the token is sent based on the first information, the second information, and the third information.

It should be understood that, the apparatus <NUM> herein is represented in a form of a functional unit. The term "unit" herein may be an ASIC, an electronic circuit, a processor for performing one or more software or firmware programs (for example, a shared processor, a dedicated processor, or a packet processor) and a memory, a combined logic circuit, and/or another proper component that supports the described functions. In an optional example, a person skilled in the art may understand that, the apparatus <NUM> may be specifically the second network node in the examples of the method <NUM> to the method <NUM>. The apparatus <NUM> may be configured to perform various procedures and/or steps corresponding to the first network function module in the examples of the method <NUM> to the method <NUM>. To avoid repetition, details are not described herein again.

Optionally, the token further carries an identifier of the token. The receiving unit is further configured to receive seventh information sent by the authorization module, where the seventh information includes an identifier of at least one token that has been revoked. The processing unit is further configured to determine whether the identifier of the at least one token includes the identifier of the token. The sending unit is specifically configured to send the service response message of the first network function service to the first network function module when it is determined that the identifier of the at least one token does not include the identifier of the token, that the network function module indicated by the fourth information is the same as the first network function module, that the network function module indicated by the fifth information is the same as the second network function module, and that the at least one network function service indicated by the sixth information includes the first network function service.

Optionally, the token further carries an identifier of the token. The sending unit is further configured to send a third request message to the authorization module, where the third request message is used to request to verify validity of the token, and the third request message carries the token. The receiving unit is further configured to receive a verification result sent by the authorization module based on the identifier of the token, where the verification result is validity or invalidity. The sending unit is specifically configured to send the service response message of the first network function service to the first network function module when it is determined that the verification result is validity, that the network function module indicated by the fourth information is the same as the first network function module, that the network function module indicated by the fifth information is the same as the second network function module, and that the at least one network function service indicated by the sixth information includes the first network function service.

It should be understood that, the apparatus <NUM> herein is represented in a form of a functional unit. The term "unit" herein may be an ASIC, an electronic circuit, a processor for performing one or more software or firmware programs (for example, a shared processor, a dedicated processor, or a packet processor) and a memory, a combined logic circuit, and/or another proper component that supports the described functions. In an optional example, a person skilled in the art may understand that, the apparatus <NUM> may be specifically the second network function module in the examples of the method <NUM> to the method <NUM>. The apparatus <NUM> may be configured to perform various procedures and/or steps corresponding to the second network function module in the examples of the method <NUM> to the method <NUM>. To avoid repetition, details are not described herein again.

<FIG> shows a network function service invocation apparatus <NUM> according to an example of this disclosure. The apparatus <NUM> may be the authorization module in <FIG>. The authorization module may use a hardware architecture shown in <FIG>. The authorization module may include a processor <NUM>, a transceiver <NUM>, and a memory <NUM>. The processor <NUM>, the transceiver <NUM>, and the memory <NUM> communicate with each other through an internal connection path. A related function implemented by the processing unit <NUM> in <FIG> may be implemented by the processor <NUM>, and related functions implemented by the receiving unit <NUM> and the sending unit <NUM> may be implemented by the processor <NUM> controlling the transceiver <NUM>.

The processor <NUM> may include one or more central processing units (CPU). When the processor is one CPU, the CPU may be a single-core CPU or a multi-core CPU.

The transceiver <NUM> is configured to send and receive data and/or a signal. The transceiver may include a transmitter and a receiver, where the transmitter is configured to send data and/or a signal, and the receiver is configured to receive data and/or a signal.

The memory <NUM> includes but is not limited to a random access memory (random access memory, RAM), a read-only memory (read-only memory, ROM), an erasable programmable memory (erasable programmable read only memory, EPROM), and a compact disc read-only memory (compact disc read-only memory, CD-ROM). The memory <NUM> is configured to store related instructions and data.

The memory <NUM> is configured to store program code and data of the authorization module, and may be an independent component or be integrated into the processor <NUM>.

Specifically, the processor <NUM> is configured to control the transceiver to communicate with a first network function module and/or a second network function module. For details, refer to the descriptions in the method examples.

It may be understood that <FIG> shows merely a simplified design of the authorization module. In an actual application, the authorization module may further include other necessary components, including but not limited to any quantity of transceivers, processors, controllers, memories, and the like.

In a possible design, the apparatus <NUM> may be a chip, for example, may be a communications chip that can be used in the authorization module, configured to implement a related function of the processor <NUM> of the authorization module. The chip may be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, or a microcontroller that implements the related function, or may use a programmable controller or another integrated chip. Optionally, the chip may include one or more memories, configured to store program code. When the code is executed, the processor implements a corresponding function.

<FIG> shows a network function service invocation apparatus <NUM> according to an example of this disclosure. The apparatus <NUM> may be the first network function module in <FIG>. The first network function module may use a hardware architecture shown in <FIG>. The first network function module may include a processor <NUM>, a transceiver <NUM>, and a memory <NUM>. The processor <NUM>, the transceiver <NUM>, and the memory <NUM> communicate with each other through an internal connection path. Related functions implemented by the sending unit <NUM> and the receiving unit <NUM> in <FIG> may be implemented by the processor <NUM> controlling the transceiver <NUM>.

The processor <NUM> may include one or more processors, for example, may include one or more CPUs. When the processor is one CPU, the CPU may be a single-core CPU or a multi-core CPU. The transceiver <NUM> is configured to send and receive data and/or a signal, and receive data and/or a signal. The transceiver may include a transmitter and a receiver, where the transmitter is configured to send data and/or a signal, and the receiver is configured to receive data and/or a signal.

The memory <NUM> includes but is not limited to a RAM, a ROM, an EPROM, and a CD-ROM. The memory <NUM> is configured to store related instructions and data.

The memory <NUM> is configured to store program code and data of the first network function module, and may be an independent component or be integrated into the processor <NUM>.

Specifically, the processor <NUM> is configured to control the transceiver to communicate with an authorization module and/or a second network function module. For details, refer to the descriptions in the method examples.

It may be understood that <FIG> shows merely a simplified design of the first network function module. In an actual application, the first network function module may further include other necessary components, including but not limited to any quantity of transceivers, processors, controllers, memories, and the like.

In a possible design, the apparatus <NUM> may be a chip, for example, may be a communications chip that can be used in the first network function module, configured to implement a related function of the processor <NUM> of the first network function module. The chip may be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, or a microcontroller that implements the related function, or may use a programmable controller or another integrated chip. Optionally, the chip may include one or more memories, configured to store program code. When the code is executed, the processor implements a corresponding function.

<FIG> shows a network function service invocation apparatus <NUM> according to an example of this disclosure. The apparatus <NUM> may be the second network function module in <FIG>. The second network function module may use a hardware architecture shown in <FIG>. The second network function module may include a processor <NUM>, a transceiver <NUM>, and a memory <NUM>. The processor <NUM>, the transceiver <NUM>, and the memory <NUM> communicate with each other through an internal connection path. A related function implemented by the processing unit <NUM> in <FIG> may be implemented by the processor <NUM>, and related functions implemented by the receiving unit <NUM> and the sending unit <NUM> may be implemented by the processor <NUM> controlling the transceiver <NUM>.

The memory <NUM> is configured to store program code and data of the second network function module, and may be an independent component or be integrated into the processor <NUM>.

Specifically, the processor <NUM> is configured to control the transceiver to communicate with an authorization module and/or a first network function module. For details, refer to the descriptions in the method examples.

It may be understood that <FIG> shows merely a simplified design of the second network function module. In an actual application, the second network function module may further include other necessary components, including but not limited to any quantity of transceivers, processors, controllers, memories, and the like.

In a possible design, the apparatus <NUM> may be a chip, for example, may be a communications chip that can be used in the second network function module, configured to implement a related function of the processor <NUM> of the second network function module. The chip may be a field programmable gate array, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, or a microcontroller that implements the related function, or may use a programmable controller or another integrated chip. Optionally, the chip may include one or more memories, configured to store program code. When the code is executed, the processor implements a corresponding function.

<FIG> is a schematic block diagram of a network function service invocation system <NUM> according to an example of this disclosure. The system <NUM> includes a first network function module <NUM>, an authorization module <NUM>, and a second network function module <NUM>.

Optionally, the first network function module <NUM> can implement, for example, a function implemented by the first network function module in the examples of the method <NUM> to the method <NUM>, the authorization module <NUM> can implement, for example, a function implemented by the authorization module in the examples of the method <NUM> to the method <NUM>, and the second network function module <NUM> can implement, for example, a function implemented by the second network function module in the examples of the method <NUM> to the method <NUM>. To avoid repetition, details are not described herein again.

Optionally, the first network function module <NUM> can implement, for example, a function implemented by the first network function module in the example of the method <NUM>, the authorization module <NUM> can implement, for example, a function implemented by the authorization module in the example of the method <NUM>, and the second network function module <NUM> can implement, for example, a function implemented by the second network function module in the example of the method <NUM>. To avoid repetition, details are not described herein again.

It should be understood that, the first network function module, the second network function module, and the authorization module in this example of this disclosure each have a particular function and a network interface, and may be different network elements on same dedicated hardware, different software instances that run on same dedicated hardware, or different virtual function instances on a same related platform (for example, a cloud infrastructure). This is not limited in this example of this disclosure.

All or some of the foregoing examples may be implemented by using software, hardware, firmware, or any combination thereof. When software is used to implement the examples, the examples may be implemented completely or partially in a form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedure or functions according to the examples of this disclosure are all or partially generated. The computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable apparatuses. The computer instruction may be stored in a computer readable storage medium, or may be transmitted by using the computer readable storage medium. The computer instruction may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (digital subscriber line, DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a digital versatile disc (digital versatile disc, DVD)), a semiconductor medium (for example, an SSD), or the like.

A person of ordinary skill in the art may understand that all or some of the processes of the methods in the examples may be implemented by a computer program instructing related hardware. The program may be stored in a computer readable storage medium. When the program is executed, the processes of the methods in the examples are performed. The foregoing storage medium includes various media that can store program code, such as a ROM, a RAM, a magnetic disk, or an optical disc.

A person of ordinary skill in the art may be aware that, in combination with the examples described in the examples disclosed in this specification, units and algorithm steps can be implemented by electronic hardware or a combination of computer software and electronic hardware. A person skilled in the art may use different methods to implement the described functions for each particular application.

It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method examples.

In the several examples provided in this disclosure, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus examples are merely examples.

Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the examples.

In addition, functional units in the examples of this disclosure may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.

Claim 1:
A network function service invocation system in core network, the network function service invocation system comprising a first network function module (<NUM>) and an authorization module (<NUM>) according to claim <NUM>, wherein
the first network function module (<NUM>) is configured to send the first request message to the authorization module (<NUM>), wherein
the first network function module (<NUM>) is further configured to: receive the token from the authorization module (<NUM>),
wherein one network function module is one network element on dedicated hardware, a software instance that runs on dedicated hardware, or a virtual function instance on a related platform.