# US 2023/0155832 A1 · Network security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0155832 A1 - Document ID: US20230155832A1 - Status: Published application - Kind: A1 - Application number: 18/047,434 - Filed: 2022-10-18 - Published: 2023-05-18 - Earliest claimed: 2021-11-12 - Assignees: Nokia Technologies Oy - Applicants: Nokia Technologies Oy - Inventors: Chaitanya AGGARWAL; Anja Jerichow; Saurabh Khare; Georgios Gkellas - Web page: https://patentgrep.com/patent/US20230155832A1 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04L 2209/80: Wireless - H04W 88/182: {Network node acting on behalf of an other network entity, e.g. proxy} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract According to an example aspect of the present invention, there is provided an apparatus configured to process a request for an access token authorizing access for a network function consumer to a service provided by a network function producer, the request being received in the apparatus from a service communication proxy, wherein the processing comprises one or more of the following verification: verification that a credential data element comprised in the request, cryptographically signed by the network function consumer, identifies the request, the service or a type of the service, and verification with reference to a further node, or to a profile of the network function consumer, that the service communication proxy is authorized to act on behalf of the network function consumer, and transmit, responsive to at least one of the verifications being successful, the requested access token, the access token comprising an indication of the service communication proxy. ## Claims ### Claim 1 An apparatus comprising at least one processor, at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: process a request for an access token authorizing access for a network function consumer to a service provided by a network function producer, the request being received in the apparatus from a service communication proxy, wherein the processing comprises one or more of the following verification: verification that a credential data element comprised in the request, cryptographically signed by the network function consumer, identifies the request, the service or a type of the service, or verification with reference to a further node, or to a profile of the network function consumer, that the service communication proxy is authorized to act on behalf of the network function consumer, and transmit, responsive to at least one of the verifications being successful, the requested access token, the access token comprising an indication of the service communication proxy. ### Claim 2 (depends on 1) The apparatus according to claim 1, wherein the apparatus is configured to perform the verification with reference to the further node, wherein the further node comprises an operations, administration and maintenance node or a subscriber information database. ### Claim 3 (depends on 2) The apparatus according to claim 2, wherein the apparatus is configured to request from the operations, administration and maintenance node information concerning the network function consumer, and to use the information concerning the network function consumer to verify the request and/or the profile of the network function when acting as producer. ### Claim 4 (depends on 1) The apparatus according to claim 1, wherein the apparatus is configured to perform the verification with reference to the profile of the network function consumer, wherein the apparatus has established the profile of the network function consumer prior to processing the request, when the network function consumer acts in a role of a second network function producer. ### Claim 5 (depends on 1) The apparatus according to claim 1, wherein the apparatus is configured to perform as a network repository function and to cryptographically sign the access token using a private key of the network repository function. ### Claim 6 An apparatus comprising at least one processor, at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: process a request for access for a network function consumer to a service provided by a network function producer, the request being received in the apparatus from a service communication proxy, wherein the processing comprises one or more of the following verification: verification that a credential data element comprised in the request, cryptographically signed by the network function consumer, identifies the request, the service or a type of the service, or verification that an access token comprised in the request indicates that the service communication proxy is authorized to act on behalf of the network function consumer, and provide, responsive to at least one of the verifications being successful, the network function consumer with access to the service. ### Claim 7 (depends on 6) The apparatus according to claim 6, wherein the apparatus is configured to perform the verification that the access token indicates that the service communication proxy is authorized to act on behalf of the network function consumer by comparing the indication in the access token with information in a credential data element, comprised in the request, which is cryptographically signed by the service communication proxy. ### Claim 8 (depends on 6) The apparatus according to claim 6, wherein the apparatus is configured to establish a profile of itself in a network repository function, the profile identifying at least one service communication proxy as authorised to act on behalf of the apparatus when the apparatus acts in a role of a second network function consumer. ### Claim 9 (depends on 6) The apparatus according to claim 6, wherein the apparatus is configured to refuse to provide the service, or abstain from providing the service, responsive to a determination that none of the one or more verification comprised in the processing is successful. ### Claim 10 (depends on 6) The apparatus according to claim 6, wherein the apparatus is configured to perform as the network function producer or as a producer side service communication proxy. ### Claim 11 An apparatus comprising at least one processor, at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to: function as a network function consumer, and transmit, to a service communication proxy, a request for a service provided by a network function producer, the request comprising a credential data element, cryptographically signed by the apparatus, which identifies the request and/or the service of the network function producer. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the credential data element identifies the service, wherein the credential data element comprises a service identifier of the service. ### Claim 13 (depends on 11) The apparatus according to claim 11, wherein the credential data element identifies the request, wherein the credential data element comprises at least one of a request identifier of the request and a time indication identifying a time instant, when the apparatus transmits the request.