Patent Description:
<FIG> depicts the Third Generation Partnership Project (3GPP) Fifth Generation (<NUM>) reference architecture. In the <NUM> Core (5GC), the indirect communication model in the Service Based Architecture (SBA) requires that the Network Function (NF) service consumer sends its service requests towards an entity called Service Communication Proxy (SCP) which, in turn, will issue a new service request towards the target NF service producer. The following aspects are also applicable:.

Specifically, as described in 3GPP Technical Specification (TS) <NUM> V16. <NUM>:
If an SCP is deployed, the SCP can be used for indirect communication between NFs and NF services as described in Annex E. SCP does not expose services itself.

Annex E (informative) of 3GPP TS <NUM> V16. <NUM> is as follows:
<IMG>.

As specified in 3GPP TS <NUM> V16. <NUM>, TLS <NUM> shall be supported. Specifically, Section <NUM>. <NUM> of 3GPP TS <NUM> V16. <NUM> states:.

To support communication between a service consumer and a service producer, where at least a SCP may be deployed in between and TLS is used, the TLS association is to be established between the service consumer and the SCP.

3GPP has introduced a 3GPP specific custom Hypertext Transfer Protocol (HTTP) header "3gpp-Sbi-Target-apiRoot" which is set the Uniform Resource Indicator (URI) of the service producer, i.e. for indirect communication with or without delegated discovery, the HTTP client is to include a 3gpp-Sbi-Target-apiRoot header set to the apiRoot of an authority server for the target resource, if available, in requests it sends to the SCP. In other words, it has been agreed that the NF service consumer would convey to the SCP the Application Program Interface (API) root (HTTP schema + authority + API prefix) of the target NF service producer in the HTTP header called 3gpp-Sbi-Target-apiRoot.

The introduction of "3gpp-Sbi-Target-apiRoot" leads to a potential caching problem, as described below. Internet Engineering Task Force (IETF) Request for Comment (RFC) <NUM> specifies that the primary cache key consists of a request method and a target Uniform Resource Indicator (URI). When presented with a request, a cache must not reuse a stored response, unless the presented effective request URI and that of the stored response match. For example:.

This will have the problem of requests sent to UDM1 and UDM2 being identical, from the cache perspective.

In other words, during the CT4#<NUM> meeting, it was proposed that the NF service consumer would set the authority of the Hypertext Transfer Protocol (HTTP) request towards the SCP as the Fully Qualified Domain Name (FQDN) + port of the SCP. This was regarded as problematic since several requests towards different NF service consumers could result into identical HTTP requests towards the SCP, which would make the caching of responses not feasible.

One proposal for addressing this problem is to set the authority of the HTTP request as:
<Label representing the target FQDN>. <FQDN of the SCP>
Given that the cache keys are typically based on the full URI, including the authority part, this solves the issue of collisions between cached responses. Continuing the example from above, one example would be:.

The SCP builds the cache towards consumers based on.

However, the above proposal has the following problems. Assuming that the AMF has implemented a standard HTTP protocol stack:.

Embodiments of an alternative solution are disclosed herein. In Fifth Generation (<NUM>) Core (5GC), where a service consumer needs to communicate with a service producer via a SCP using TLS, the service consumer includes a query parameter, preferably called "cache key" or simply "ck", in the ":path". The value of the ck query parameter is set to a value that is associated with (i.e., linked to) the target NF service producer (e.g., associated with (e.g., linked to) the FQDN of the target NF service producer). For example, continuing the example above, the solution would be:.

Different values are assigned to the ck query parameter to differentiate the responses from different target NF service producers.

The proposed solution solves the caching problem when a service consumer is to communicate with a service producer via a SCP with TLS.

Related solutions can e.g. be found in the 3GPP specification TS <NUM> v16. <NUM><NUM> of September <NUM>. This document is directed to the technical specification of the core network and terminals in the <NUM> System, in particular the technical stage <NUM> realization of the service based architecture. The document specifies the technical realization of the 5GC Service Based Architecture, protocols supported over the Service Based Interfaces, and the functionalities supported in the Service Based Architecture.

Other related solutions can e.g. be found in the patent document <CIT>. This document is directed to a shared computing infrastructure has associated therewith a portal application through which users access the infrastructure and provision one or more services, such as content storage and delivery. The portal comprises a security policy editor, a web-based configuration tool that is intended for use by customers to generate and apply security policies to their media content. The security policy editor provides the user the ability to create and manage security policies, to assign policies so created to desired media content and/or player components, and to view information regarding all of the customer's current policy assignments. The editor provides a unified interface to configure all media security services that are available to the CDN customer from a single interface, and to enable the configured security features to be promptly propagated and enforced throughout the overlay network infrastructure. The editor advantageously enables security features to be configured independently of a delivery configuration.

Core Network Node: As used herein, a "core network node" is any type of node in a core network or any node that implements a core network function. Some examples of a core network node include, e.g., a Mobility Management Entity (MME), a Packet Data Network Gateway (P-GW), a Service Capability Exposure Function (SCEF), a Home Subscriber Server (HSS), or the like. Some other examples of a core network node include a node implementing a Access and Mobility Function (AMF), a User Plane Function (UPF), a Session Management Function (SMF), an Authentication Server Function (AUSF), a Network Slice Selection Function (NSSF), a Network Exposure Function (NEF), a Network Function (NF) Repository Function (NRF), a Policy Control Function (PCF), a Unified Data Management (UDM), or the like.

Embodiments of a solution for indirect communication between a NF service consumer and a NF service consumer using a Service Communication Proxy (SCP) with Transport Layer Security (TLS) are disclosed herein. In <NUM> Core (5GC), where a service consumer needs to communicate with a service producer via a SCP using TLS, the service consumer includes an query parameter, preferably called "cache key" or simply "ck", in the ":path". The value of the ck query parameter is set to a value that is associated with (i.e., linked to) the target NF service producer (e.g., associated with (e.g., linked to) the Fully Qualified Domain Name (FQDN) of the target NF service producer).

Some aspects applicable to this ck query parameter are:.

Example: The AMF needs to send a GET request to the UDM to the following Uniform Resource Identifiers (URIs):.

The requests are then sent to the SCP as follows:.

This example shows how those two requests, that would have been otherwise identical, are now differentiated by the inclusion of the ck query parameter. When the cache system is configured to use such parameter as an additional key, it can differentiate between responses to be reused towards NF service consumers.

<FIG> illustrates one example of a cellular communications system <NUM> in which embodiments of the present disclosure may be implemented. In the embodiments described herein, the cellular communications system <NUM> is a <NUM> System (5GS) including a NR Radio Access Network (RAN) or LTE RAN (i.e., Evolved Universal Terrestrial Radio Access (E-UTRA) RAN). In this example, the RAN includes base stations <NUM>-<NUM> and <NUM>-<NUM>, which in <NUM> are referred to as gNBs or LTE RAN nodes connected to 5GC (which are referred to as gn-eNBs), controlling corresponding (macro) cells <NUM>-<NUM> and <NUM>-<NUM>. The base stations <NUM>-<NUM> and <NUM>-<NUM> are generally referred to herein collectively as base stations <NUM> and individually as base station <NUM>. Likewise, the (macro) cells <NUM>-<NUM> and <NUM>-<NUM> are generally referred to herein collectively as (macro) cells <NUM> and individually as (macro) cell <NUM>. The RAN may also include a number of low power nodes <NUM>-<NUM> through <NUM>-<NUM> controlling corresponding small cells <NUM>-<NUM> through <NUM>-<NUM>. The low power nodes <NUM>-<NUM> through <NUM>-<NUM> can be small base stations (such as pico or femto base stations) or Remote Radio Heads (RRHs), or the like. Notably, while not illustrated, one or more of the small cells <NUM>-<NUM> through <NUM>-<NUM> may alternatively be provided by the base stations <NUM>. The low power nodes <NUM>-<NUM> through <NUM>-<NUM> are generally referred to herein collectively as low power nodes <NUM> and individually as low power node <NUM>. Likewise, the small cells <NUM>-<NUM> through <NUM>-<NUM> are generally referred to herein collectively as small cells <NUM> and individually as small cell <NUM>. The cellular communications system <NUM> also includes a core network <NUM>, which in the 5GS is referred to as the 5GC. The base stations <NUM> (and optionally the low power nodes <NUM>) are connected to the core network <NUM>.

<FIG> illustrates a wireless communication system represented as a <NUM> network architecture composed of core NFs, where interaction between any two NFs is represented by a point-to-point reference point/interface. <FIG> can be viewed as one particular implementation of the system <NUM> of <FIG>.

Seen from the access side the <NUM> network architecture shown in <FIG> comprises a plurality of UEs connected to either a RAN or an Access Network (AN) as well as an AMF. Typically, the (R)AN comprises base stations, e.g. such as eNBs or gNBs or similar. Seen from the core network side, the <NUM> core NFs shown in <FIG> include a NSSF, an AUSF, a UDM, an AMF, a SMF, a PCF, and an Application Function (AF).

Reference point representations of the <NUM> network architecture are used to develop detailed call flows in the normative standardization. The N1 reference point is defined to carry signaling between the UE and AMF. The reference points for connecting between the AN and AMF and between the AN and UPF are defined as N2 and N3, respectively. There is a reference point, N11, between the AMF and SMF, which implies that the SMF is at least partly controlled by the AMF. N4 is used by the SMF and UPF so that the UPF can be set using the control signal generated by the SMF, and the UPF can report its state to the SMF. N9 is the reference point for the connection between different UPFs, and N14 is the reference point connecting between different AMFs, respectively. N15 and N7 are defined since the PCF applies policy to the AMF and SMP, respectively. N12 is required for the AMF to perform authentication of the UE. N8 and N10 are defined because the subscription data of the UE is required for the AMF and SMF.

The 5GC network aims at separating user plane and control plane. The user plane carries user traffic while the control plane carries signaling in the network. In <FIG>, the UPF is in the user plane and all other NFs, i.e., the AMF, SMF, PCF, AF, AUSF, and UDM, are in the control plane. Separating the user and control planes guarantees each plane resource to be scaled independently. It also allows UPFs to be deployed separately from control plane functions in a distributed fashion. In this architecture, UPFs may be deployed very close to UEs to shorten the Round Trip Time (RTT) between UEs and data network for some applications requiring low latency.

The core <NUM> network architecture is composed of modularized functions. For example, the AMF and SMF are independent functions in the control plane. Separated AMF and SMF allow independent evolution and scaling. Other control plane functions like the PCF and AUSF can be separated as shown in <FIG>. Modularized function design enables the 5GC network to support various services flexibly.

<FIG> illustrates a <NUM> network architecture using service-based interfaces between the NFs in the control plane, instead of the point-to-point reference points/interfaces used in the <NUM> network architecture of <FIG>. However, the NFs described above with reference to <FIG> correspond to the NFs shown in <FIG>. The service(s) etc. that a NF provides to other authorized NFs can be exposed to the authorized NFs through the service-based interface. In <FIG> the service based interfaces are indicated by the letter "N" followed by the name of the NF, e.g. Namf for the service based interface of the AMF and Nsmf for the service based interface of the SMF etc. The NEF and the NRF in <FIG> are not shown in <FIG> discussed above. However, it should be clarified that all NFs depicted in <FIG> can interact with the NEF and the NRF of <FIG> as necessary, though not explicitly indicated in <FIG>.

Some properties of the NFs shown in <FIG> and <FIG> may be described in the following manner. The AMF provides UE-based authentication, authorization, mobility management, etc. A UE even using multiple access technologies is basically connected to a single AMF because the AMF is independent of the access technologies. The SMF is responsible for session management and allocates Internet Protocol (IP) addresses to UEs. It also selects and controls the UPF for data transfer. If a UE has multiple sessions, different SMFs may be allocated to each session to manage them individually and possibly provide different functionalities per session. The AF provides information on the packet flow to the PCF responsible for policy control in order to support Quality of Service (QoS). Based on the information, the PCF determines policies about mobility and session management to make the AMF and SMF operate properly. The AUSF supports authentication function for UEs or similar and thus stores data for authentication of UEs or similar while the UDM stores subscription data of the UE. The Data Network (DN), not part of the 5GC network, provides Internet access or operator services and similar.

<FIG> illustrates a system <NUM> for indirect communication between a NF service consumer <NUM> (e.g., an AMF) and a NF service producer (e.g., a UDM), represented by a first NF service producer instance <NUM>-<NUM> (also referred to herein as NF service producer instance <NUM>) via a SCP <NUM> using TLS. Indirect communication via the SCP <NUM> using TLS may also be provided between the NF service consumer <NUM> and one or more additional instances of the NF service producer (e.g., an NF service producer instance <NUM>-<NUM>, which is also referred to herein as NF service producer instance <NUM>). The NF service consumer <NUM> includes a Hypertext Transfer Protocol (HTTP) client <NUM>. The NF service producer instances <NUM>-<NUM> and <NUM>-<NUM> include HTTP servers <NUM>-<NUM> and <NUM>-<NUM>, respectively.

<FIG> and <FIG> illustrates the operation of the system <NUM> in accordance with embodiments of the present disclosure. Optional steps are represented by dashed lines or dashed boxes. Note that while this example uses the HTTP GET request, the query parameter discussed below can be used with any HTTP message (e.g., HTTP GET, HTTP POST, HTTP PUT, HTTP DELETE, etc.).

In some embodiments, the NF service consumer <NUM> builds and maintains a cache in an associated caching system. The cache uses the ck query parameter as described herein. In the illustrated example, the NF service consumer <NUM> desires to send an HTTP GET request to the first NF service producer instance <NUM>-<NUM> via the SCP <NUM>. In embodiments in which the NF service consumer <NUM> builds and maintains a cache, the NF service consumer <NUM> uses a query parameter, referred to herein as "cache key" or simply "ck", set to a value (referred to in this example as "value1") associated with the NF service producer instance <NUM>-<NUM> to determine whether there is a hit in the associated caching system for the HTTP GET request (step <NUM>). If there is a hit, the NF service consumer <NUM> obtains an HTTP response for the HTTP GET request from the associated cache system; otherwise, the NF service consumer <NUM> sends the HTTP GET request to the SCP <NUM> as described below.

When no caching is implemented at the NF service consumer <NUM> or when caching is implemented at the NF service consumer <NUM> but there is a cache miss, the NF service consumer <NUM> (more specifically the HTTP client <NUM>) sends the HTTP GET request to the SCP <NUM> using a FQDN of the SCP <NUM> and a path that includes the ck query parameter set to a value ("value1") of the NF service producer instance <NUM>-<NUM> (step <NUM>). The HTTP client <NUM> also includes a 3gpp-Sbi-Target-apiRoot header set to the apiRoot containing the authority component of the URIs of the server for the target resource, which in this case is that of the NF service producer instance <NUM>-<NUM>. For example, assuming that the NF service consumer <NUM> is an AMF and the NF service producer instance <NUM>-<NUM> is a UDM instance (UDM1), the GET request may be, e.g.,:.

Note that the value of the ck query parameter can be calculated or otherwise determined using any suitable mechanism that associates the value to the FQDN (or apiRoot) of the NF servicer consumer instance. For example, the value may be computed as a hash (e.g., SHA-<NUM>) of the apiRoot, and then potentially truncated to fewer bits than the full length of the hash (e.g., for efficiency). Of course, other ways of calculating the value of the ck query parameter can be used as long as the value is associated with (e.g., linked to) the NF service producer instance.

In some embodiments, the SCP <NUM> builds and maintains a cache in an associated cache system using the query parameter. If the SCP <NUM> does build and maintain a cache, the SCP <NUM> determines whether there is a cache hit (i.e., a matching cache object) for the GET request using the ck query parameter (step <NUM>). If the SCP <NUM> does not have a previous response to this GET request (i.e., a matching cache objected) cached in its cache system (where the ck query parameter is used by the cache system to distinguish cache objects) (i.e., if there is a cache miss), the SCP <NUM> optionally removes the ck parameter from the path (step <NUM>) and forwards the HTTP GET request to the NF service producer instance <NUM>-<NUM> using a FQDN of the NF service producer instance <NUM> (step <NUM>). Continuing the example from above, the SCP <NUM> sends the following GET request to UDM1:
https://udm1. com/api-prefix/nudm-sdm/v1/{supi}/nssai
The NF service producer instance <NUM>-<NUM> sends a corresponding HTTP response to the SCP <NUM> (step <NUM>). The SCP <NUM> caches the HTTP response using the ck query parameter (e.g., as part of the key of the corresponding cache object in the cache system) (step <NUM>).

Returning to step <NUM>, if upon receiving the HTTP GET request in step <NUM> the SCP <NUM> determines that there is a cache hit (i.e., there is a matching cache object stored in its cache system), the SCP <NUM> obtains the HTTP response from its associated cache rather than from the NF service producer instance <NUM>-<NUM> (i.e., no need to forward the request to and receive the response from the NF service producer instance <NUM>-<NUM>).

Note that if caching is not implemented at the SCP <NUM>, upon receiving the HTTP GET request in step <NUM>, the SCP <NUM> optionally removes the ck parameter from the path (step <NUM>) and forwards the HTTP GET request to the NF service producer instance <NUM>-<NUM> using a FQDN of the NF service producer instance <NUM> (step <NUM>) (i.e., does not need to check for a cache hit before sending the HTTP GET request to the first NF service producer instance <NUM>-<NUM>).

Once the SCP <NUM> has obtained the HTTP response either from the NF service producer instance <NUM>-<NUM> in step <NUM> or from cache, the SCP <NUM> returns the HTTP response to the NF service consumer <NUM> (step <NUM>). Optionally, if caching is implemented at the NF service consumer <NUM>, the NF service consumer <NUM> adds the HTTP response to the associated cache system using the ck query parameter (set to the value associated with the NF service producer instance <NUM>-<NUM>).

Optionally, similar steps may additionally or alternatively be performed with respect to the NF service producer instance <NUM>-<NUM> (steps <NUM> through <NUM>). However, in this case, the ck query parameter in the HTTP GET request of step <NUM> is set to a value (referred to here as "value2") that is linked to the NF service producer instance <NUM>-<NUM> and is different than that used for the ck query parameter in the HTTP GET request of step <NUM> (which is linked to the NF service producer instance <NUM>-<NUM>). Using these different ck query parameter values, the SCP <NUM> is able to differentiate the HTTP responses from the different NF service producer instances in its cache system.

<FIG> is a schematic block diagram of a network node <NUM> according to some embodiments of the present disclosure. The network node <NUM> is a network node that implements one or more core network functions in accordance with any of the embodiments disclosed herein. For example, the network node <NUM> may implement a network function such as, e.g., the NF service consumer <NUM> or the NF service producer instance <NUM>-<NUM> or <NUM>-<NUM> of <FIG> and <FIG>. As illustrated, the network node <NUM> includes one or more processors <NUM> (e.g., Central Processing Unit (CPUs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), and/or the like), memory <NUM>, and a network interface <NUM>. The one or more processors <NUM> are also referred to herein as processing circuitry. The one or more processors <NUM> operate to provide one or more functions of core network function as described herein. In some embodiments, the function(s) are implemented in software that is stored, e.g., in the memory <NUM> and executed by the one or more processors <NUM>.

<FIG> is a schematic block diagram that illustrates a virtualized embodiment of the network node <NUM> according to some embodiments of the present disclosure. As used herein, a "virtualized" network node is an implementation of the network node <NUM> in which at least a portion of the functionality of the network node <NUM> is implemented as a virtual component(s) (e.g., via a virtual machine(s) executing on a physical processing node(s) in a network(s)). As illustrated, in this example, the network node <NUM> includes one or more processing nodes <NUM> coupled to or included as part of a network(s) <NUM> via the network interface <NUM>. Each processing node <NUM> includes one or more processors <NUM> (e.g., CPUs, ASICs, FPGAs, and/or the like), memory <NUM>, and a network interface <NUM>.

In this example, functions <NUM> of the network node <NUM> (e.g., the functions of the core network function(s)) described herein such as, e.g., the functions of the NF service consumer <NUM> or the NF service producer instance <NUM>-<NUM> or <NUM>-<NUM> of <FIG> and <FIG>) are implemented at the one or more processing nodes <NUM> or distributed across the one or more processing nodes <NUM> in any desired manner. In some particular embodiments, some or all of the functions <NUM> of the network node <NUM> described herein are implemented as virtual components executed by one or more virtual machines implemented in a virtual environment(s) hosted by the processing node(s) <NUM>.

In some embodiments, a computer program including instructions which, when executed by at least one processor, causes the at least one processor to carry out the functionality of network node <NUM> or a node (e.g., a processing node <NUM>) implementing one or more of the functions <NUM> of the network node <NUM> in a virtual environment according to any of the embodiments described herein is provided.

<FIG> is a schematic block diagram of the network node <NUM> according to some other embodiments of the present disclosure. The network node <NUM> includes one or more modules <NUM>, each of which is implemented in software. The module(s) <NUM> provide the functionality of the network node <NUM> described herein and, in particular, the functionality of the core network function(s) described herein (e.g., the functionality of the NF service consumer <NUM> or the NF service producer instance <NUM>-<NUM> or <NUM>-<NUM> of <FIG> and <FIG>).

These functional units may be implemented via processing circuitry, which may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include Digital Signal Processors (DSPs), special-purpose digital logic, and the like.

Once example implementation of at least some aspects of the embodiments disclosed herein as a Change Request (CR) to 3GPP Technical Specification (TS) <NUM> V16. <NUM> is as follows.

Claim 1:
A method performed by a Service Communication Proxy, SCP, (<NUM>) for indirect communication in a core network of a wireless communication system with a Transport Layer Security, TLS, association established between the SCP and a Network Function, NF, service consumer (<NUM>), the method comprising:
receiving (<NUM>), from the NF service consumer (<NUM>), a Hypertext Transfer Protocol, HTTP, GET request that is intended for a first NF service producer instance (<NUM>-<NUM>), the HTTP request using a Fully Qualified Domain Name, FQDN, of the SCP (<NUM>) and having a path that includes a cache key set to a first value associated with the first NF service producer instance (<NUM>-<NUM>);
determining (<NUM>) whether there is a cache hit for the HTTP request in a cache system of the SCP (<NUM>) based, at least in part, on the received cache key parameter;
obtaining a HTTP response for the HTTP request from a cache system of the SCP (<NUM>) when there is a cache hit for the HTTP request in the cache system, otherwise:
obtaining the HTTP response for the HTTP request from the first NF service producer instance (<NUM>-<NUM>) by;
a) sending (<NUM>) the HTTP request to the first NF service producer instance (<NUM>-<NUM>) with or without the cache key; and
b) receiving (<NUM>) the HTTP response from the first NF service producer instance (<NUM>-<NUM>); and
c) caching (<NUM>) the HTTP response in the cache system of the SCP (<NUM>) using the first value of the cache key that is associated with the first NF service producer instance (<NUM>-<NUM>); and then
sending (<NUM>) the obtained HTTP response to the NF service consumer (<NUM>).