# US 12,015,920 B2 · Secure access control in communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,920 B2 - Document ID: US12015920B2 - Status: Granted - Kind: B2 - Application number: 17/618,015 - Filed: 2020-06-09 - Published: 2022-08-04 - Granted: 2024-06-18 - Earliest claimed: 2019-06-15 - Applicants: Nokia Technologies Oy - Inventors: Nagendra Bykampadi; Laurent Thiebaut; Anja Jerichow; Suresh Nair - Web page: https://patentgrep.com/patent/US12015920B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04W 12/08: Access security - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04W 48/18: Selecting a network or a communication service - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Improved techniques for secure access control in communication systems are provided. In one example, in accordance with an authorization server function, a method comprises receiving a request from a service consumer in a communication system for access to a service type and one or more resources associated with the service type. The method determines whether the service consumer is authorized to access the service type and the one or more resources associated with the service type. The method generates an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the service consumer is authorized to access, and sends the access token to the service consumer. The service consumer can then use the access token to access the one or more services and one or more resources. In addition to such resource level access authorization, target network function group access authorization can be performed. ## Claims ### Claim 1 Apparatus comprising: at least one processor; at least one memory including computer program code; the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: receive a request from a service consumer in a communication system for access to a service type and one or more resources associated with the service type; determine whether the service consumer is authorized to access the service type and the one or more resources associated with the service type; generate an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the service consumer is authorized to access; and send the access token to the service consumer; wherein the at least one processor, the at least one memory and the computer program code are part of an authorization server function in the communication system. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the one or more resources comprise one or more data sets. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the determining step further comprises the apparatus performing a service level authorization and a resource level authorization to determine access permissions that the access token will contain. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the at least one memory and the computer program code being further configured to, with the at least one processor, cause the apparatus to send a rejection message to the service consumer when one or more of the service level authorization and the resource level authorization are unsuccessful. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the service consumer is a network function (NF) and the authorization server function is a network repository function (NRF) in a 5G System. ### Claim 6 A method comprising: receiving a request from a service consumer in a communication system for access to a service type and one or more resources associated with the service type; determining whether the service consumer is authorized to access the service type and the one or more resources associated with the service type; generating an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the service consumer is authorized to access; and sending the access token to the service consumer; wherein the steps of the method are performed by an authorization server function in the communication system. ### Claim 7 (depends on 6) The method of claim 6, wherein the one or more resources comprise one or more data sets. ### Claim 8 (depends on 6) The method of claim 6, wherein the determining step further comprises performing a service level authorization and a resource level authorization to determine access permissions that the access token will contain. ### Claim 9 (depends on 6) An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by the processor associated with the authorization server function causes the authorization server function to perform the steps of claim 6. ### Claim 10 Apparatus comprising: at least one processor; at least one memory including computer program code; the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to: send a request to an authorization server function in a communication system for access to a service type and one or more resources associated with the service type; receive an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the apparatus is authorized to access; and use the access token to access the service type and the one or more resources associated with the service type at a service producer in the communication system; wherein the at least one processor, the at least one memory and the computer program code are part of a service consumer in the communication system. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the one or more resources comprise one or more data sets. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein the access token contains access permissions determined by a service level authorization and a resource level authorization. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the at least one memory and the computer program code being further configured to, with the at least one processor, cause the apparatus to receive a rejection message when one or more of the service level authorization and the resource level authorization are unsuccessful. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the service consumer is a network function (NF) and the authorization server function is a network repository function (NRF) in a 5G System. ### Claim 15 A method comprising: sending a request to an authorization server function in a communication system for access to a service type and one or more resources associated with the service type; receiving an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type for which access is authorized; and using the access token to access the service type and the one or more resources associated with the service type at a service producer in the communication system; wherein the steps of the method are performed by a service consumer of the communication system. ### Claim 16 (depends on 15) The method of claim 15, wherein the one or more resources comprise one or more data sets. ### Claim 17 (depends on 15) The method of claim 15, wherein the access token contains access permissions determined by a service level authorization and a resource level authorization. ### Claim 18 (depends on 15) An article of manufacture comprising a non-transitory computer-readable storage medium having embodied therein executable program code that when executed by the processor associated with the service consumer causes the service consumer to perform the steps of claim 15.