Abstract: Communication equipment is configured to invoke an application programming interface (API) to access a service. The communication equipment transmits, from the communication equipment to API exposing equipment configured to expose the API, a request to invoke the API. The communication equipment also transmits, from the communication equipment to the API exposing equipment, an access token that indicates whether a resource owner authorizes the communication equipment to access a protected resource of the resource owner. The API exposing equipment may verify the request based on the access token, e.g., by verifying the request against one or more claims in the access token. The API exposing equipment may then accept or reject the request depending on that verification.

Abstract: Embodiments include methods for a consumer network function (NFc). Such methods include sending, to a network repository function (NRF), a first request for an access token associated with a machine learning (ML) model. The first request includes an analytics identifier (ID) associated with the ML model. Such methods include receiving from the NRF a first response that includes the access token, which includes a vendor ID associated with the NFc. Such methods include sending, to a producer NF (NFp), a second request for the ML model. The second request includes the access token and the analytics ID associated with the ML model. Such methods include receiving from the NFp a second response that includes the ML model or a one-time-use universal resource locator (URL) associated with a second NF, from which the ML model can be obtained. Other embodiments include complementary methods for the NFp, the NRF, and an ADRF.

Abstract: According to a first aspect there is a method performed by a detector node in a communications network, wherein the detector node is for monitoring messages sent between a first client node, a second client node and a Federated Learning, FL, server, as part of a FL process wherein, as part of the FL process, the first client node sends a local model update to the second client node for forwarding to the FL server. The method comprising: receiving first information relating to the local model update sent from the first client node to the second client node; receiving second information relating to the local model update as received or forwarded by the second client node; and comparing the first information to the second information to determine whether the second client node correctly received or forwarded the first information relating to the local model.

Abstract: Embodiments include methods for a consumer network function (NFc). Such methods include sending, to a network repository function (NRF), a first request for a first access token associated with a machine learning (ML) model produced, owned, and/or maintained by a producer NF (NFp). The first request includes an analytics ID associated with the ML model, a vendor ID associated with the NFc, and an ID associated with the NFp. Such methods include receiving from the NRF a first response that includes the first access token and sending to the NFp a second request for the ML model, including the first access token, the analytics ID, the vendor ID associated with the NFc, and a client credentials assertion (CCA) associated with the NFc. Such methods include receiving from the NFp a second response that includes a URL associated with a second NF, from which the ML model can be obtained.

Abstract: Embodiments include methods for a consumer network function (NFc). Such methods include registering the following with a network repository function (NRF): a vendor identifier (ID) associated with the NFc; and one or more analytics IDs associated with ML models supported by the NFc, including a first analytics ID associated with a first ML model produced, owned, and/or maintained by a producer NF (NFp). Such methods include sending a request for the first ML model to the NFp. The request includes the first analytics ID and the vendor ID associated with the NFc. Such methods include receiving from the NFp a response including a universal resource locator associated with a second NF, from which the ML model can be obtained. Other embodiments include complementary methods for an NFp, an NRF, and an ADRF of the communication network, as well as network nodes or functions configured to perform such methods.

Abstract: Embodiments include methods for a first network function, NF, configured to operate as a server of a federated learning, FL, group in a communication network. Such methods include registering the following information in a network repository function, NRF, of the communication network: a vendor ID associated with the first NF, and an interoperability ID that corresponds to one or more vendor IDs associated with further NFs authorized to join the FL group as clients. Such methods include receiving an indication of a second NF, of the communication network, that is a candidate client for the FL group, and creating or updating the FL group including the second NF as a client, based on one of the following: a first token indicating that the first NF is authorized to add the second NF to the FL group as a client; or a second token indicating that the second NF is authorized to join the FL group as a client.

Abstract: Embodiments include methods performed by a client in an edge data network. Such methods include obtaining an initial access token before accessing the edge data network. The initial access token is based on an identifier of the client. Such methods include establishing a first connection with a server of the edge data network based on transport layer security (TLS) and authenticating the server based on a server certificate received from the server via the first connection. Such methods include providing the initial access token to the server, via the first connection, for authentication of the client and subsequently receiving a second access token from the server via the first connection. The second access token is based on the identifier of the client. Other embodiments include complementary methods performed by a server in an edge data network, as well as apparatus (e.g., user equipment and servers) configured to perform such methods.

Abstract: Embodiments include methods for a consumer network function (NFc) of a communication network. Such methods include sending, to a first NF of the communication network, a first request for a first access token associated with a machine learning (ML) model. The first request includes at least one of the following associated with the ML model: an analytics identifier (ID), and an interoperability ID. Such methods include receiving from the first NF a first response that includes the first access token and sending, to a producer NF (NFp) of the communication network, a second request for the ML model. The second request includes the first access token and at least one of the analytics ID and the interoperability ID. Such methods include receiving from the NFp a second response that includes one or more of the following: the ML model; an identifier of the ML model; and an address of a storage resource associated with a second NF of the communication network, from which the ML model can be obtained.

Abstract: There is provided a method for handling a request to initiate a call. The method is performed by a server entity. In response to receiving a first request for a first client entity to initiate a call to a second client entity without the second client entity rendering a notification of the call, transmission of a first message is initiated towards one or more third client entities to inform the one or more third client entities of the first request. The first client entity is authorised to initiate the call only if a second message, acknowledging the first request, is received from at least one of the one or more third client entities.

Abstract: Methods for a first network function (NF) configured to operate as a server of a federated learning (FL) group in a communication network. Such methods include registering, in a network repository function (NRF) of the communication network, information associated with the FL group. The FL group includes the first NF and one or more further NFs configured to operations as clients in the FL group. The registered information includes authorization information for additional NFs to join the FL group as clients. Such methods include receiving an indication of a second NF, of the communication network, that is a candidate client for the FL group and obtaining an indication that the second NF is authorized to join the FL group as a client. The indication is based on the registered authorization information. Such methods include, based on the indication, updating the FL group to include the second NF as a client.

Abstract: Embodiments described herein provide methods and apparatuses for performing federated learning, FL.

Abstract: Embodiments include methods for application programming interface (API) invoking entity of a communication network. Such methods include sending, to a common API framework (CAPIF) core function (CCF) of the communication network, a request for an access token granting the API invoking entity permission to access a resource, in the communication network, that is owned by a resource owner. The request includes an indication related to the resource owner. Such methods include receiving, from the CCF, an access token in accordance with the request. The access token includes the following: a first identifier associated with the resource owner; and a second identifier associated with the API invoking entity. Such methods include invoking, via an API exposing function (AEF), an API for the resource using the access token. Other embodiments include complementary methods for a CCF and for an AEF.

Abstract: Embodiments include methods performed by a client in an edge data network. Such methods include obtaining an initial access token before accessing the edge data network. The initial access token is based on an identifier of the client. Such methods include establishing a first connection with a server of the edge data network based on transport layer security (TLS) and authenticating the server based on a server certificate received from the server via the first connection. Such methods include providing the initial access token to the server, via the first connection, for authentication of the client. Other embodiments include complementary methods performed by a server in an edge data network, as well as apparatus (e.g., user equipment and servers) configured to perform such methods.

Abstract: Embodiments include methods for a data consumer network function (NF) of a communication network. These methods include sending, to a network repository function (NRF) of the communication network, a request for an access token for the following: a service provided by a 5 data collection coordination function (DCCF) of the communication network, and data to be collected via the DCCF service. These methods include receiving from the NRF at least one access token for the DCCF service and for the data to be collected via the DCCF service and, using the at least one access token, collecting the data from a data producer NF of the communication network via the DCCF service. Other embodiments include complementary methods for DCCFs 0 and NRFs, as well as data consumer NFs, DCCFs, and NRFs configured to perform such methods.

Abstract: Embodiments include methods for a data consumer network function (NFc) of a communication network. Such methods include sending, to a data producer network function (NFp) of the communication network, a first request for first data produced by the NFp and stored in a data repository function (DRF) of the communication network and receiving, from the NFp, a response that includes information that authorizes the NFc to access the first data stored in the DRF. Such methods include sending, to the DRF, a second request for the first data. The second request includes the information that authorizes the NFc to access the first data stored in the DRF. Such methods include receiving the first data from the DRF in response to the second request. Other embodiments include complementary methods for an NFp and a DRF, as well as network functions configured to perform such methods.

Abstract: Network equipment implements a network function in a wireless communication network. The network equipment obtains integrity verification information that is a function of only a portion of a message. The message is either a request for a service to be consumed by the network function or a response to a request for a service provided by the network function. The network equipment digitally signs an assertion that includes the integrity verification information, and then sends the message and the digitally signed assertion to a service communication proxy. Other network equipment that receives the message and the digitally signed assertion may check an integrity of the portion of the message, based on integrity verification information that the other network equipment obtains and on the integrity verification information included in the digitally signed assertion.

Abstract: Communication equipment (16) is configured to invoke an application programming interface (API) (14) to access a service. The communication equipment (16) transmits, from the communication equipment (16) to API exposing equipment (12) configured to expose the API (14), a request (18) to invoke the API (14). The communication equipment (16) also transmits, from the communication equipment (16) to the API exposing equipment (12), an access token (20) that indicates whether a resource owner (24) consents (26) to the communication equipment (16) accessing a protected resource (22) of the API (14). The API exposing equipment (12) may verify the request (18) based on the access token (20), e.g., by verifying the request (18) against one or more claims in the access token (20). The API exposing equipment (12) may then accept or reject the request (18) depending on that verification.

Abstract: Embodiments of the present disclosure includes methods for a client in an edge data network. Such methods include obtaining an initial access credential for a server in the edge data network, before accessing the server; providing the initial access credential to the server for authentication of the client; and obtaining an updated access credential for the server based on expiration of one of the following: the initial access credential, or a further access credential provided by the server; and providing the updated access credential to the server for authentication of the client. Other embodiments include complementary methods for a server and for a credential provider, as well as UEs, network nodes, and/or computing systems configured to perform such methods.

Abstract: Embodiments include methods for a certificate authority (CA) associated with a communication network, including first and/or second sets of operations. The first set includes receiving a first message about a network function (NF) lifecycle management (LCM) event performed by a first NF of the communication network. The first message includes an identifier of a second NF associated with the NF LCM event, and an event type associated with the NF LCM event. The first operations include performing a first certificate LCM event for certificate(s) associated with the second NF, based on the event type. The second set includes performing a second certificate LCM event for the certificate(s) associated with the second NF and sending the first NF a second message about the second certificate LCM event. The second message includes an identifier of the second NF and an event type associated with the certificate LCM event.

Abstract: The invention relates to a method for a data consumer network function, NF, of a communication network to collect data from a data producer NF, the method comprising: ?sending (810), to a network repository function, NRF, in the communication network, a request for an access token for a service provided by a data collection coordination function, DCCF, in the communication network; ?receiving (820), from the NRF, at least one access token for the service provided by the DCCF; and ?using (830) the at least one access token, collecting data from the data producer NF in the communication network via the DCCF service.