JP7819296B2 - Communication device, network node device, and authorization control method - Google Patents

Description

The present invention relates to API calls from external applications to network node devices.

The 3GPP (3rd Generation Partnership Project) is currently studying a wireless communication system known as 5G or NR (New Radio) (hereinafter referred to as "5G" or "NR") to achieve even greater system capacity, faster data transmission speeds, and lower latency in wireless sections. Various wireless technologies are being studied for 5G to meet the requirements of achieving a throughput of 10 Gbps or more while keeping wireless latency to 1 ms or less.

NR is considering a network architecture including 5GC (5G Core Network), which corresponds to EPC (Evolved Packet Core), the core network in the LTE (Long Term Evolution) network architecture, and NG-RAN (Next Generation - Radio Access Network), which corresponds to E-UTRAN (Evolved Universal Terrestrial Radio Access Network), the RAN (Radio Access Network) in the LTE network architecture (e.g., Non-Patent Document 1).

In addition, for example, an architecture is being considered in which the northbound interface between the NEF (Network Exposure Function) and the AF (Application Function) in a 5G system is configured using CAPIF (Common API Framework) (for example, Non-Patent Document 2 and Non-Patent Document 3).

3GPP TS 23.501 V17.2.0 (2021-09) 3GPP TS 29.522 V17.3.0 (2021-09) 3GPP TS 23.222 V17.5.0 (2021-06)

In the 3GPP core network, network node devices open APIs (Application Programming Interfaces) to external applications, allowing APIs to be called from third-party applications to network node devices, for example.

It is also possible to authorize API calls, i.e., only authorized API calls are allowed, and unauthorized API calls are rejected.

However, conventional technology does not provide a mechanism for revoking authorization for an API call once it has been approved, which could result in unnecessary API calls being made, potentially having unexpected effects on the user.

The present invention has been made in consideration of the above points and aims to provide technology that makes it possible to revoke authorization for authorized API calls.

According to the disclosed technology, a control unit that determines whether an event that satisfies a condition for revoking authorization for an API call has occurred;
a transmitter configured to transmit, when it is determined that the event has occurred, a request to revoke authorization for calling the API to a network node device.

The disclosed technology provides a technology that allows for the revocation of authorization for authorized API calls.

FIG. 1 is a diagram illustrating an example of a communication system. FIG. 1 is a diagram illustrating an example of a communication system in a roaming environment. FIG. 10 illustrates an example of an API call. FIG. 1 is a diagram for explaining a problem. FIG. 1 is a diagram for explaining an outline of a processing procedure according to an embodiment of the present invention. FIG. 10 is a sequence diagram showing a specific example of a processing procedure according to an embodiment of the present invention. FIG. 10 is a sequence diagram showing a variation of the processing procedure according to the embodiment of the present invention. 1 is a diagram illustrating an example of a system according to an embodiment of the present invention. 1 is a diagram illustrating an example of a system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a functional configuration of a base station 10 (and a network node device 30, an authorization server 35, and a resource holder client 40) according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a functional configuration of the terminal 20 (and the resource holder client 40) according to the embodiment of the present invention. FIG. 1 illustrates an example of a hardware configuration of an apparatus according to an embodiment of the present invention. 1 is a diagram showing an example of a configuration of a vehicle according to an embodiment of the present invention.

The following describes an embodiment of the present invention with reference to the drawings. Note that the embodiment described below is an example, and the embodiments to which the present invention can be applied are not limited to the following embodiment.

Existing technologies are used as appropriate when operating the wireless communication system of an embodiment of the present invention. Such existing technologies include, for example, existing LTE or existing NR (5G), but are not limited to existing LTE or existing NR.

Furthermore, in an embodiment of the present invention, "configuring" radio parameters, etc. may mean that predetermined values are pre-configured, or that radio parameters notified from the network node device 30 or terminal 20 are set.

Figure 1 is a diagram illustrating an example of a communication system. As shown in Figure 1, the communication system is composed of a UE, which is a terminal 20, and multiple network node devices 30. Below, it is assumed that one network node device 30 corresponds to each function, but multiple functions may be realized by one network node device 30, or multiple network node devices 30 may realize one function. Furthermore, the "connection" described below may be a logical connection or a physical connection.

Furthermore, the base station 10, terminal 20, and network node device 30 may all be referred to as "communication devices."

The RAN (Radio Access Network) is a network node device 30 with radio access functionality, which may include a base station 10, and is connected to UEs, an AMF (Access and Mobility Management Function), and a UPF (User plane function). The AMF is a network node device 30 with functions such as terminating the RAN interface, terminating the NAS (Non-Access Stratum), registration management, connection management, reachability management, and mobility management. The UPF is a network node device 30 with functions such as a PDU (Protocol Data Unit) session point to the outside that interconnects with the DN (Data Network), packet routing and forwarding, and user plane QoS (Quality of Service) handling. The UPF and DN constitute a network slice. In the wireless communication network of an embodiment of the present invention, multiple network slices are constructed.

The AMF is connected to the UE, RAN, SMF (Session Management function), NSSF (Network Slice Selection Function), NEF (Network Exposure Function), NRF (Network Repository Function), UDM (Unified Data Management), AUSF (Authentication Server Function), PCF (Policy Control Function), and AF (Application Function). The AMF, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, and AF are network node devices 30 that are interconnected via interfaces based on their respective services: Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

The SMF is a network node device 30 that has functions such as session management, UE IP (Internet Protocol) address allocation and management, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, and roaming function. The NEF is a network node device 30 that has the function of notifying other NFs (Network Functions) of capabilities and events. The NSSF is a network node device 30 that has functions such as selecting the network slice to which the UE connects, determining the allowed NSSAI (Network Slice Selection Assistance Information), determining the NSSAI to be set, and determining the AMF set to which the UE connects. The PCF is a network node device 30 that has the function of controlling network policies. The AF is a network node device 30 that has the function of controlling application servers. The NRF is a network node device 30 that has the function of discovering NF instances that provide services. The UDM is a network node device 30 that manages subscriber data and authentication data. The UDM is connected to a UDR (User Data Repository) that holds the data.

Figure 2 is a diagram illustrating an example of a communication system in a roaming environment. As shown in Figure 2, the network is composed of a terminal 20 (UE) and multiple network node devices 30. Below, it is assumed that one network node device 30 corresponds to each function, but multiple functions may be realized by one network node device 30, or multiple network node devices 30 may realize one function. Furthermore, the "connection" described below may be a logical connection or a physical connection.

The RAN is a network node device 30 with radio access functions, and is connected to the UE, AMF, and UPF. The AMF is a network node device 30 with functions such as RAN interface termination, NAS termination, registration management, connection management, reachability management, and mobility management. The UPF is a network node device 30 with functions such as a PDU session point to the outside that interconnects with the DN, packet routing and forwarding, and user plane QoS handling. The UPF and DN constitute a network slice. In the wireless communication network of an embodiment of the present invention, multiple network slices are constructed.

The AMF is connected to the UE, RAN, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, AF, and SEPP (Security Edge Protection Proxy). The AMF, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, and AF are network node devices 30 that are interconnected via their respective service-based interfaces: Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

The SMF is a network node device 30 that has functions such as session management, UE IP address allocation and management, DHCP function, ARP proxy, and roaming function. The NEF is a network node device 30 that has the function of notifying other NFs of capabilities and events. The NSSF is a network node device 30 that has functions such as selecting the network slice to which the UE connects, determining the allowed NSSAI, determining the configured NSSAI, and determining the AMF set to which the UE connects. The PCF is a network node device 30 that has the function of controlling network policies. The AF is a network node device 30 that has the function of controlling application servers. The NRF is a network node device 30 that has the function of discovering NF instances that provide services. The SEPP is a non-transparent proxy that filters control plane messages between PLMNs (Public Land Mobile Networks). The vSEPP shown in FIG. 2 is a SEPP in the visited network, and the hSEPP is a SEPP in the home network.

As shown in Figure 2, the UE is in a roaming environment connected to the RAN and AMF in the Visited PLMN (VPLMN). The VPLMN and Home PLMN (HPLMN) are connected via vSEPP and hSEPP. The UE can communicate with the UDM of the HPLMN, for example, via the AMF of the VPLMN.

The operation of this embodiment may be performed in either the configuration shown in Figure 1 or Figure 2. Furthermore, the operation of this embodiment may be performed in a configuration other than the configuration shown in Figure 1 or Figure 2.

In the above-mentioned NEF, APIs (Application Programming Interfaces) that can be called from the AF can be implemented by applying the CAPIF (Common API Framework) architecture. The CAPIF architecture provides a mechanism to support service API operations, for example, allowing an API invoker to discover service APIs provided by an API provider and enabling communication using those service APIs. The CAPIF architecture also has a mechanism to hide the topology of the PLMN trust domain from an API invoker accessing a service API from outside the PLMN trust domain.

Note that the API caller application 30A described below may be provided in the above-mentioned AF, and the API providing function (AEF) 30C may be provided in the NEF, but this is not limited to this, and the API caller application 30A and AEF 30C may each be provided in any network node device 30. The AEF 30C may be provided in the base station 10. Furthermore, the API caller application 30A may be provided in the terminal 20.

Furthermore, the resource holder client 40 (resource owner) described below may be a network node device 30, a terminal 20, a base station 10, or any other device.

Figure 3 shows an example of an API call. The 3GPP core network opens APIs to external applications, allowing third-party applications to call APIs on the network node device 30. When an API is called, the CAPIF Core Function (CCF) within the core network authenticates and/or authorizes the calling application 30A (API invoker) and manages which applications can call the API.

As shown in Figure 3, an application 30A that calls an API is pre-registered with the CAPIF core function 30B using the CAPIF-API. The CAPIF core function 30B authenticates and authorizes the third-party application 30A. Also, as shown in Figure 3, a service API is opened to the authenticated and authorized application 30A by the API providing function (also referred to as API Exposing Function, AEF) 30C, and the application 30A that calls the API can use the functions of the API by calling the API.

The APF (API Publishing Function) 30D has the function of publishing the API provider's service API information to the CAPIF core function 30B. The AMF (API Management Function) 30E has various management functions related to API calls.

In addition, CAPIF can be extended so that the resource holder client 40 can authorize an API call to the API call source application 30A via the authorization server 35. The resource holder client 40 may also be referred to as a network node device, terminal, resource holder client device, resource owner, communication device, etc.

(Regarding the issues)
The resource holder client 40 can grant authorization for an API call request from an API caller application 30A (API invoker), but once authorization has been granted, there is a possibility that the API caller application 30A will request an additional API call unless the authorization is revoked. The following describes the problems that arise from the fact that additional API calls are possible unless the authorization is revoked.

For example, suppose a resource holder client 40 grants authorization to call a QoS change API for temporary use in a competitive game. If the authorization is forgotten to be revoked after the game ends, the API caller application 30A (API invoker) will continue to be able to freely change the QoS of the resource holder client 40. It is undesirable for settings related to the end user's communication quality, such as QoS, to be changed without the authorization of the end user (resource holder).

It is desirable for the resource holder client 40 to be able to revoke authorization at an appropriate time for operations related to the end user's communication quality, such as changing the QoS, as well as operations related to privacy, such as obtaining location information, and operations related to billing, such as incurring usage fees for each API.

Figure 4 is a diagram for explaining the above situation. Note that the configuration in Figure 4 itself shows the configuration of a communication system relating to an embodiment of the present invention, and each device shown in the figure is capable of performing data communication with other devices via a network.

In Figure 4, API caller application 30A is authorized to call a certain API. Specifically, for example, it receives an access token from authorization server 35 to call the API. Information related to authorization is stored in database 50.

By using the access token, the API caller application 30A can call the API to the AEF 30C as long as the authorization is not revoked, as long as the access token is within its validity period. This causes the above-mentioned problem, so as shown in Figure 4, it is necessary to revoke the authorization when it is no longer necessary.

Below, we will explain an example of operation of this embodiment to solve this problem.

(Configuration and Operation Example According to the Embodiment)
In this embodiment, as shown in FIG. 5, the above-mentioned authorization can be revoked in a system configuration having an authorization server 35, a resource holder client 40, and a database 50.

The authorization server 35 is a type of network node device. The authorization server 35 may include the functions of the AEF 30C, may include the functions of the CAPIF core function 30B, may be a network node device that includes both the AEF 30C and the CAPIF core function 30B, or may be a network node device that is neither the AEF 30C nor the CAPIF core function 30B.

The database 50 is a device that stores authorization information and is a type of network node device. The database 50 may be provided external to the authorization server 35 or may be provided internally to the authorization server 35. The authorization information stored in the database 50 is, for example, information that associates an access token (character string), an API ID, and information indicating whether the call to that API is authorized. This information is registered in the database 50 by the authorization server 35.

An example of operation is explained with reference to Figure 5.

First, as a prerequisite, the resource holder client 40 has granted authorization for a specific API call to the API caller application 30A. Specifically, in this state, the database 50 stores an access token, the ID of the specific API, and information indicating that the call to the specific API is authorized, and the API caller application 30A holds this access token.

As a preliminary step, conditions for revoking API call authorization are set in advance in the resource holder client 40.

As shown in Figure 5, when the resource holder client 40 detects the occurrence of an event that satisfies the above conditions, it sends an authorization revocation request to the authorization server 35.

When the authorization server 35 receives the authorization revocation request, it authenticates the resource holder client 40, and if the authentication (specifically, verification of authentication information) is successful, the authorization server 35 revokes the authorization for the given API call.

For example, the authorization server 35 deletes the access token of the corresponding entry in the database 50. In other words, if the entry information is {access token, API ID, callable}, it deletes "{access token, API ID, callable}".

Alternatively, the authorization server 35 may revoke authorization by changing {access token, API ID, callable} to {access token, API ID, not callable}. In other words, authorization may be revoked by making the access token unusable.

<Conditions for revocation of approval>
Conditions that trigger transmission of an authorization revocation request include, for example, the following conditions (1) to (5): Note that the following conditions (1) to (5) are all examples, and the conditions that trigger transmission of an authorization revocation request are not limited to the following conditions (1) to (5).

(1) Application Status For example, the resource holder client 40 may revoke authorization for a QoS change API call when the competitive game application is terminated. Thereafter, the resource holder client 40 may re-authorize a QoS change API call when the competitive game application is started.

(2) Time/Time For example, the resource holder client 40 revokes the authorization for an API call when a preset time has elapsed since the time when the API call was authorized.

Also, for example, the resource holder client 40 may revoke API call authorization at a predetermined time.

(3) Location Information For example, when the resource holder client 40 detects that it has moved to a preset location (position) (e.g., moved outside Tokyo), it revokes authorization for API invocation.

The resource holder client 40 may determine that it is located at a specific location using location information obtained using a GPS function, or based on the cell ID of the cell in which it is located, or from images obtained by a camera it holds, or from sounds obtained by a microphone it holds, or may use other methods.

(4) Communication Quality For example, the resource holder client 40 measures the communication delay to a specific server, and when it detects that the delay value is greater than a preset reference value, it revokes authorization for API invocation.

In addition, the resource holder client 40 may work in cooperation with an external server to detect an event (an event indicating that a condition has been met).

For example, if the condition is that "the communication delay to a certain server exceeds a threshold," it is possible to confirm whether the condition is met by the round-trip time it takes for a resource holder client 40 to send a packet to a specific server and for the packet to return to the resource holder client 40.

(5) Wireless Quality For example, if the resource holder client 40 detects that the strength of the radio waves received from the base station has fallen below a predetermined reference value for a predetermined period of time, the resource holder client 40 revokes authorization for API calls.

In the examples (1) to (5) above, the resource holder client 40 itself holds the conditions for revoking authorization and determines whether an event that satisfies the conditions has occurred, but this is just an example. Another entity external to the resource holder client 40 (called the external server 60) may hold the conditions for revoking authorization and determine whether an event that satisfies the conditions has occurred.

When the external server 60 detects that an event that satisfies the conditions for revoking authorization has occurred, it notifies the resource holder client 40 that an event that satisfies the conditions for revoking authorization has occurred. Then, as in the process described above, the resource holder client 40 sends a revocation request to the authorization server 35. Alternatively, when the external server 60 detects that an event that satisfies the conditions for revoking authorization has occurred, the external server 60 itself may send a revocation request to the authorization server 35.

<Multiple APIs>
When there are multiple authorized APIs, the resource holder client 40 holds the conditions for each API, and when it detects that the conditions corresponding to a certain API have been satisfied, it transmits a request to revoke authorization for that API.

In this case, the resource holder client 40 stores information (table) in the format, for example, "(API_1, condition 1), (API_2, condition 2), ..., (API_n, condition n)" as conditions.

<Regarding reauthorization>
It is also possible to re-authorize an API call after revoking the authorization as described above. In this case, for example, the resource holder client 40 transmits an API call authorization request to the authorization server 35.

When the authorization server 35 receives the authorization request, it authenticates the resource holder client 40, and if the authentication (specifically, verification of authentication information) is successful, the authorization server 35 validates the authorization for the API call. For example, the authorization server 35 changes the corresponding entry in the database 50 from {access token, API ID, not callable} to {access token, API ID, callable}. Furthermore, if the entry has been deleted, the authorization server 35 generates a new entry, i.e., {access token, API ID, callable}, and issues the access token to the API caller application 30A.

When re-authorization is performed, similar to the cancellation described above, the resource holder client 40 may send an API call authorization request to the authorization server 35 when it detects the occurrence of an event that meets the conditions previously set as the re-authorization conditions.

(Example sequence)
Next, a more detailed example of the operation of this embodiment will be described with reference to the sequence diagram in Fig. 6. As a prerequisite for the following operation, it is assumed that a call to a certain API is authorized. Furthermore, the resource holder client 40 holds a condition for requesting the revocation of authorization.

Note that there are two types of tokens: access tokens and refresh tokens. In the following, these will be collectively referred to as "tokens." Tokens may also be called "access permission information."

As shown in S101, the API caller application 30A holds a token, and the database 50 stores information about the token. The information about the token is, for example, {token, API ID, callable} information.

In S102, the resource holder client 40 detects an event that meets pre-set conditions.

In S103, the resource holder client 40 sends an authorization revocation request to the authorization server 35. This request message includes, for example, the ID of the target API and information indicating that it is a revocation request.

In S104, the authorization server 35 authenticates the resource holder client 40. Any authentication method may be used; for example, the authorization server 35 may request an ID/password from the resource holder client 40, and the resource holder client 40 may send the ID/password to the authorization server 35 to perform authentication. Here, it is assumed that authentication is successful.

In S105, the authorization server 35 sends a token deletion request to the database 50. This request message includes, for example, the ID of the target API. In S106, the database 50 deletes the token corresponding to the target API. Alternatively, as described above, the token may not be deleted and may be managed as "uncallable."

In S107, the database 50 returns a deletion response to the authorization server 35. In S108, the authorization server 35 returns a response to the resource holder client 40 indicating that the call authorization for the target API has been revoked.

Then, in S109, the API caller application 30A sends a call request for the target API to the AEF 30C using an old token (a token that has been deleted or is no longer callable). The AEF 30C accesses the database 50 and attempts to reference information about the token, but fails to do so. Alternatively, the AEF 30C checks the information about the token and determines that it is "uncallable." In S111, the AEF 30C sends an API call refusal message to the API caller application 30A.

<Sequence variations>
As described above, the external server 60 may detect an event that satisfies the cancellation condition. An example of a sequence in which the external server 60 detects an event that satisfies the cancellation condition is shown in Fig. 7. In the following, the same parts as those in Fig. 6 will be omitted or simply explained.

As shown in FIG. 7, communication is possible between the resource holder client 40 and the external server 60, and the external server 60 can obtain the information necessary to detect events that satisfy the cancellation conditions from the resource holder client 40 at any time. Note that if events that satisfy the cancellation conditions can be detected without using information from the resource holder client 40, it is not necessary to obtain information from the resource holder client 40.

In S102, the external server 60 detects an event that meets pre-set conditions.

In S103, the external server 60 sends an authorization revocation request to the authorization server 35. This request message includes, for example, information indicating the resource holder client 40 (such as an IP address), the ID of the target API, and information indicating that this is a revocation request. In S104, the authorization server 35 authenticates the resource holder client 40.

After steps S105 to S107, in S108 the authorization server 35 returns a response to the external server 60 indicating that the call authorization for the target API has been revoked. After S108, the external server may notify the API caller application 30A of information indicating that the call authorization for the target API has been revoked.

(Example of a specific system configuration)
Fig. 8 shows a specific example of the configuration of a system according to this embodiment, assuming a 5G system. Fig. 8 shows, as an example, a case where a UE (terminal) 20 is a resource holder client 40, and a CCF 30B is an authorization server 35. A database 50 may also be included in the CCF 30B.

In the example of Figure 8, the trusted domain PLMN (PLMN Trust domain) includes CCF 30B including the CAPIF-API, AEF 30C including the service API, APF (API Publishing Function) 30D, AMF (API Management Function) 30E, UE 20 (e.g., resource holder client 40), core network, and access network. On the other hand, outside the PLMN exists an API caller application 30A (e.g., a game server).

As shown in FIG. 8, UE 20 may be connected to API caller application 30A, AEF 30C, and CCF 30B via an access network and a core network.

Figure 9 is a diagram showing another example of a system configuration. As shown in Figure 9, the PLMN, which is a trusted domain, includes CCF30B including the CAPIF-API, AEF30C including the service API, APF30D, AMF30E, UE20-1, UE20-2, the core network, and the access network. UE20-1, for example, has an application that is the source of the API call request. UE20-2, for example, is a resource holder client 40. Note that the application and resource holder client functions may be provided in the same device (terminal, etc.).

As shown in FIG. 9, UE 20-1 may be connected to CCF 30B and AEF 30C via an access network and a core network. UE 20-2 may also be connected to CCF 30B and AEF 30C via an access network and a core network.

Note that Figures 8 and 9 show examples of system configurations and are not limited to these. For example, AEF30C, APF30D, and AMF30E may be located outside the trusted PLMN domain.

(Effects of the embodiment)
The technology described above makes it possible to prevent API calls from being inadvertently allowed by setting conditions for revoking authorization in advance for the resource holder client 40 (terminal held by the resource holder).

The existing OAuth 2.0 specification allows the token itself to have an expiration date, but the technology in this embodiment goes beyond that and makes it possible to more flexibly control the revocation of authorization based on dynamic information such as the device's location, the app's status, and real-time communication quality.

This allows API calls to be allowed only under certain conditions, and to be canceled otherwise, automatically, rather than manually by the terminal user.

(Device configuration)
Next, a description will be given of examples of functional configurations of the base station 10, network node device 30, resource holder client 40, database 50, and terminal 20 that perform the processes and operations described above. The authorization server 35, database 50, and external server 60 are all types of network node device 30. The authorization server 35 may include the database 50.

In addition, the base station 10, network node device 30, resource holder client 40, database 50, external server 60, and terminal 20 may all be referred to as "communication devices."

<Base Station 10 and Network Node Device 30>
Fig. 10 is a diagram showing an example of the functional configuration of the base station 10. As shown in Fig. 10, the base station 10 has a transmitting unit 110, a receiving unit 120, a setting unit 130, and a control unit 140. The functional configuration shown in Fig. 10 is merely an example. The names of the functional divisions and functional units may be any as long as they can perform the operations according to the embodiment of the present invention.

The network node device 30 (e.g., a network node device 30 having the functionality of AEF30C, an authorization server 35, a database 50, an external server 60, etc.) may have the same functional configuration as the base station 10 shown in FIG. 10. Furthermore, a network node device 30 having multiple different functions in the system architecture may be composed of multiple network node devices 30 separated by function. Furthermore, the network node device 30 is not limited to a network node device existing in a core network or an access network, but may correspond to a network node device belonging to a PLMN domain. Furthermore, the resource holder client 40 may also have the functional configuration shown in FIG. 10.

The transmitter 110 has the function of generating signals to be transmitted to the terminal 20 or other network node devices 30 and transmitting the signals via wired or wireless communication. The receiver 120 has the function of receiving various signals transmitted from the terminal 20 or other network node devices 30 and obtaining, for example, information at higher layers from the received signals.

The setting unit 130 stores various setting information in a storage device and reads it from the storage device as needed.

The control unit 140 controls the entire device. The functional units related to signal transmission in the control unit 140 may be included in the transmitting unit 110, and the functional units related to signal reception in the control unit 140 may be included in the receiving unit 120.

<Terminal 20>
Fig. 11 is a diagram showing an example of the functional configuration of the terminal 20. As shown in Fig. 11, the terminal 20 has a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240. The functional configuration shown in Fig. 11 is merely an example. The names of the functional divisions and functional units may be any as long as they can perform the operations related to the embodiment of the present invention. The terminal 20 may function as a resource holder client 40.

The transmitter 210 creates a transmission signal from the transmission data and transmits the transmission signal wirelessly. The receiver 220 receives various signals wirelessly and acquires higher layer signals from the received physical layer signals. The receiver 220 also has the function of receiving NR-PSS, NR-SSS, NR-PBCH, DL/UL control signals, reference signals, etc. transmitted from the base station 10 or network node device 30.

The setting unit 230 stores various setting information received from the base station 10 or network node device 30 by the receiving unit 220 in a storage device and reads it from the storage device as needed. The storage device also stores the conditions for revoking authorization.

The control unit 240 performs, for example, processing related to connection control to the network and network slices. The functional unit related to signal transmission in the control unit 240 may be included in the transmitting unit 210, and the functional unit related to signal reception in the control unit 240 may be included in the receiving unit 220. When the terminal 20 functions as a resource holder client 40, the terminal 20 may be equipped with a display capable of input and output, similar to a smartphone, etc.

<Additional Notes>
This embodiment provides at least a communication device, a network node device, and an authorization control method as shown in Supplementary Items 1 to 6 below.
(Additional note 1)
a control unit that determines whether an event that satisfies a condition for revoking authorization for an API call has occurred;
a transmission unit that, when it is determined that the event has occurred, transmits a request to a network node device to revoke authorization for calling the API.
(Additional note 2)
The communication device according to claim 1, wherein the condition is any one of a plurality of conditions including at least a condition related to an application state, a condition related to time, a condition related to a location, a condition related to communication quality, and a condition related to wireless quality.
(Additional note 3)
a receiving unit that receives a request to revoke authorization for an API call from a communication device that has detected an event that satisfies a condition for revoking authorization for the API call;
a control unit that executes a process of canceling authorization for calling the API based on the request.
(Additional note 4)
The network node device according to supplementary item 3, wherein the control unit deletes the access permission information used to call the API from a database, or makes the access permission information unusable.
(Additional note 5)
determining whether an event has occurred that satisfies a condition for revoking authorization for the API call;
When it is determined that the event has occurred, transmitting a request to the network node device to revoke authorization for calling the API;
An authorization control method performed by a communication device.
(Additional note 6)
receiving a request to revoke authorization for an API call from a communication device that has detected an event that satisfies a condition for revoking authorization for the API call;
Based on the request, execute a process to revoke authorization for calling the API.
An authorization control method executed by a network node device.

All of Supplementary Items 1 to 6 provide technology that allows for the revocation of authorization for an API call that has already been authorized. Supplementary Item 2 enables judgment based on various conditions. Supplementary Item 4 allows for the appropriate execution of the process for revoking authorization for an API call.

(Hardware configuration)
The block diagrams (FIGS. 10 and 11) used to explain the above embodiments show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method for realizing each functional block is not particularly limited. That is, each functional block may be realized using a single device that is physically or logically coupled, or may be realized using two or more physically or logically separated devices that are directly or indirectly connected (e.g., using wires, wirelessly, etc.) and these multiple devices. The functional block may also be realized by combining software with the single device or multiple devices.

Functions include, but are not limited to, judgment, determination, assessment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, election, establishment, comparison, assumption, expectation, regard, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assignment. For example, a functional block (component) that performs transmission functions is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on how these functions are implemented.

For example, the network node device 30, terminal 20, etc. in one embodiment of the present disclosure may function as a computer that performs processing of the wireless communication method of the present disclosure. Figure 12 is a diagram showing an example of the hardware configuration of a base station 10, terminal 20, network node device 30, authorization server 35, resource holder client 40, external server 60, etc. in one embodiment of the present disclosure. Each of the above-mentioned devices may be physically configured as a computer device including a processor 1001, a memory device 1002, an auxiliary memory device 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc.

In the following description, the term "apparatus" can be interpreted as a circuit, device, unit, etc. The hardware configuration of the base station 10, terminal 20, network node apparatus 30, authorization server 35, resource holder client 40, etc. may be configured to include one or more of the apparatuses shown in the figure, or may be configured to exclude some of the apparatuses.

Each function in the base station 10, terminal 20, network node device 30, authorization server 35, resource holder client 40, external server 60, etc. is realized by loading specified software (programs) onto hardware such as the processor 1001 and memory device 1002, causing the processor 1001 to perform calculations, control communication by the communication device 1004, and control at least one of reading and writing data in the memory device 1002 and auxiliary memory device 1003.

The processor 1001, for example, runs an operating system to control the entire computer. The processor 1001 may be configured as a central processing unit (CPU) including an interface with peripheral devices, a control unit, an arithmetic unit, registers, etc. For example, the above-mentioned control unit 140, control unit 240, etc. may be realized by the processor 1001.

The processor 1001 also reads programs (program code), software modules, data, etc. from at least one of the auxiliary storage device 1003 and the communication device 1004 into the storage device 1002, and executes various processes in accordance with these. The program used is a program that causes a computer to execute at least some of the operations described in the above-mentioned embodiments. For example, the control unit 140 shown in FIG. 10 may be stored in the storage device 1002 and implemented by a control program running on the processor 1001. For example, the control unit 240 shown in FIG. 11 may be stored in the storage device 1002 and implemented by a control program running on the processor 1001. While the various processes described above have been described as being executed by one processor 1001, they may also be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented on one or more chips. The program may also be transmitted from a network via a telecommunications line.

The storage device 1002 is a computer-readable recording medium and may be composed of, for example, at least one of ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), RAM (Random Access Memory), etc. The storage device 1002 may also be called a register, cache, main memory, etc. The storage device 1002 can store executable programs (program code), software modules, etc. for implementing a communication method according to one embodiment of the present disclosure.

The auxiliary storage device 1003 is a computer-readable recording medium, and may be composed of, for example, at least one of an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy (registered trademark) disk, a magnetic strip, etc. The above-mentioned storage medium may be, for example, a database, a server, or other suitable medium that includes at least one of the storage device 1002 and the auxiliary storage device 1003.

The communication device 1004 is hardware (transmitting/receiving device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, network controller, network card, or communication module. The communication device 1004 may be configured to include a high-frequency switch, duplexer, filter, frequency synthesizer, etc. to realize at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, the transmitting/receiving antenna, amplifier, transmitting/receiving unit, transmission path interface, etc. may be realized by the communication device 1004. The transmitting/receiving unit may be implemented as a physically or logically separated transmitting unit and receiving unit.

The input device 1005 is an input device (e.g., a keyboard, mouse, microphone, switch, button, sensor, etc.) that accepts input from the outside. The output device 1006 is an output device (e.g., a display, speaker, LED lamp, etc.) that outputs to the outside. Note that the input device 1005 and the output device 1006 may be integrated into one structure (e.g., a touch panel).

Furthermore, each device, such as the processor 1001 and the storage device 1002, is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses between each device.

Furthermore, the base station 10, terminal 20, network node device 30, authorization server 35, resource holder client 40, external server 35, etc. may be configured to include hardware such as a microprocessor, digital signal processor (DSP), application specific integrated circuit (ASIC), programmable logic device (PLD), field programmable gate array (FPGA), etc., and some or all of the functional blocks may be realized by such hardware. For example, the processor 1001 may be implemented using at least one of these pieces of hardware.

Furthermore, the vehicle 2001 may be provided with each of the terminal 20, base station 10, network node device 30, authorization server 35, resource holder client 40, and external server 60, or any one or more of these. Figure 13 shows an example configuration of the vehicle 2001. As shown in Figure 13, the vehicle 2001 is provided with a drive unit 2002, a steering unit 2003, an accelerator pedal 2004, a brake pedal 2005, a shift lever 2006, front wheels 2007, rear wheels 2008, an axle 2009, an electronic control unit 2010, various sensors 2021-2029, an information service unit 2012, and a communication module 2013. Each aspect/embodiment described in the present disclosure may be applied to a communication device installed in the vehicle 2001, for example, to the communication module 2013. All or any of the functions of the terminal 20, the base station 10, the network node device 30, the authorization server 35, and the resource holder client 40 may be installed in the communication module 2013.

The drive unit 2002 is composed of, for example, an engine, a motor, or a hybrid of an engine and a motor. The steering unit 2003 includes at least a steering wheel (also called a handle) and is configured to steer at least one of the front wheels and rear wheels based on the operation of the steering wheel operated by the user.

The electronic control unit 2010 is composed of a microprocessor 2031, memory (ROM, RAM) 2032, and a communication port (IO port) 2033. Signals are input to the electronic control unit 2010 from various sensors 2021 to 2029 provided in the vehicle 2001. The electronic control unit 2010 may also be called an ECU (Electronic Control Unit).

Signals from the various sensors 2021 to 2029 include a current signal from a current sensor 2021 that senses the motor current, a front and rear wheel rotation speed signal obtained by a rotation speed sensor 2022, a front and rear wheel air pressure signal obtained by an air pressure sensor 2023, a vehicle speed signal obtained by a vehicle speed sensor 2024, an acceleration signal obtained by an acceleration sensor 2025, an accelerator pedal depression amount signal obtained by an accelerator pedal sensor 2029, a brake pedal depression amount signal obtained by a brake pedal sensor 2026, a shift lever operation signal obtained by a shift lever sensor 2027, and a detection signal for detecting obstacles, vehicles, pedestrians, etc. obtained by an object detection sensor 2028.

The information service unit 2012 is composed of various devices, such as a car navigation system, audio system, speakers, television, and radio, for providing various types of information such as driving information, traffic information, and entertainment information, as well as one or more ECUs that control these devices. The information service unit 2012 uses information obtained from external devices via the communication module 2013, etc., to provide various types of multimedia information and multimedia services to the occupants of the vehicle 2001.

The driving assistance system unit 2030 is composed of various devices that provide functions to prevent accidents and reduce the driver's driving burden, such as millimeter-wave radar, LiDAR (Light Detection and Ranging), cameras, positioning locators (e.g., GNSS, etc.), map information (e.g., high-definition (HD) maps, autonomous vehicle (AV) maps, etc.), gyro systems (e.g., IMU (Inertial Measurement Unit), INS (Inertial Navigation System), etc.), AI (Artificial Intelligence) chips, and AI processors, as well as one or more ECUs that control these devices. The driving assistance system unit 2030 also transmits and receives various information via the communication module 2013 to realize driving assistance functions or autonomous driving functions.

The communication module 2013 can communicate with the microprocessor 2031 and components of the vehicle 2001 via the communication port. For example, the communication module 2013 transmits and receives data via the communication port 2033 between the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axle 2009, microprocessor 2031 and memory (ROM, RAM) 2032 in the electronic control unit 2010, and sensors 2021-29, all of which are provided on the vehicle 2001.

The communication module 2013 is a communication device that can be controlled by the microprocessor 2031 of the electronic control unit 2010 and can communicate with an external device. For example, it transmits and receives various information to and from the external device via wireless communication. The communication module 2013 may be located either inside or outside the electronic control unit 2010. The external device may be, for example, a base station, a mobile station, etc.

The communication module 2013 transmits current signals from the current sensors input to the electronic control unit 2010 to external devices via wireless communication. The communication module 2013 also transmits to external devices via wireless communication the following signals input to the electronic control unit 2010: front and rear wheel rotation speed signals acquired by the rotation speed sensor 2022, front and rear wheel air pressure signals acquired by the air pressure sensor 2023, vehicle speed signals acquired by the vehicle speed sensor 2024, acceleration signals acquired by the acceleration sensor 2025, accelerator pedal depression amount signals acquired by the accelerator pedal sensor 2029, brake pedal depression amount signals acquired by the brake pedal sensor 2026, shift lever operation signals acquired by the shift lever sensor 2027, and detection signals for detecting obstacles, vehicles, pedestrians, etc. acquired by the object detection sensor 2028.

The communication module 2013 receives various information (traffic information, traffic signal information, vehicle distance information, etc.) transmitted from external devices and displays it on the information service unit 2012 provided in the vehicle 2001. The communication module 2013 also stores the various information received from external devices in memory 2032 that can be used by the microprocessor 2031. Based on the information stored in memory 2032, the microprocessor 2031 may control the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axles 2009, sensors 2021-2029, etc. provided in the vehicle 2001.

(Supplementary explanation of the embodiment)
Although the embodiments of the present invention have been described above, the disclosed invention is not limited to such embodiments, and those skilled in the art will understand various modifications, alterations, alternatives, and substitutions. While specific numerical examples have been used to facilitate understanding of the invention, unless otherwise specified, these numerical values are merely examples, and any appropriate values may be used. The division of items in the above description is not essential to the present invention; items described in two or more items may be used in combination as needed, and items described in one item may apply to items described in another item (as long as there is no contradiction). Boundaries between functional units or processing units in a functional block diagram do not necessarily correspond to physical component boundaries. The operations of multiple functional units may be performed by a single physical component, or the operations of one functional unit may be performed by multiple physical components. The order of the processing procedures described in the embodiments may be reversed as long as there is no contradiction. For convenience of describing the processes, the base station 10, terminal 20, network node device 30, authorization server 35, resource holder client 40, etc. have been described using functional block diagrams, but such devices may be realized by hardware, software, or a combination thereof. Software operated by a processor included in the base station 10, terminal 20, network node device 30, authorization server 35, resource holder client 40, etc. according to the embodiments of the present invention may each be stored in any appropriate storage medium, such as random access memory (RAM), flash memory, read-only memory (ROM), EPROM, EEPROM, register, hard disk (HDD), removable disk, CD-ROM, database, server, etc.

Furthermore, the notification of information is not limited to the aspects/embodiments described in the present disclosure, and may be performed using other methods. For example, the notification of information may be performed by physical layer signaling (e.g., Downlink Control Information (DCI), Uplink Control Information (UCI)), higher layer signaling (e.g., Radio Resource Control (RRC) signaling, Medium Access Control (MAC) signaling), broadcast information (Master Information Block (MIB), System Information Block (SIB)), other signals, or a combination thereof. Furthermore, RRC signaling may be referred to as an RRC message, and may be, for example, an RRC Connection Setup message, an RRC Connection Reconfiguration message, etc.

Each aspect/embodiment described in this disclosure may be applied to at least one of systems utilizing LTE (Long Term Evolution), LTE-Advanced (LTE-A), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), FRA (Future Radio Access), NR (new Radio), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, UWB (Ultra-WideBand), Bluetooth (registered trademark), or other suitable systems, and next generation systems enhanced based on these. In addition, multiple systems may be combined (for example, a combination of at least one of LTE and LTE-A with 5G, etc.).

The order of the procedures, sequences, flowcharts, etc. of each aspect/embodiment described herein may be rearranged unless inconsistent. For example, the methods described in this disclosure present elements of various steps using an example order and are not limited to the particular order presented.

Specific operations described herein as being performed by the base station 10 may also be performed by its upper node in some cases. In a network consisting of one or more network nodes including a base station 10, it is clear that various operations performed for communication with a terminal 20 may be performed by at least one of the base station 10 and other network nodes other than the base station 10 (such as, but not limited to, an MME or S-GW). While the above example illustrates a case where there is one other network node other than the base station 10, the other network node may also be a combination of multiple other network nodes (for example, an MME and an S-GW).

The information or signals described in this disclosure may be output from a higher layer (or a lower layer) to a lower layer (or a higher layer). They may also be input and output via multiple network nodes.

Input and output information may be stored in a specific location (e.g., memory) or may be managed using a management table. Input and output information may be overwritten, updated, or added to. Output information may be deleted. Input information may be sent to another device.

In this disclosure, the determination may be made based on a value represented by one bit (0 or 1), a Boolean value (true or false), or a numerical comparison (e.g., comparison with a predetermined value).

Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

Software, instructions, information, etc. may also be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using wired technologies (such as coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL)), and/or wireless technologies (such as infrared, microwave), these wired and/or wireless technologies are included within the definition of transmission media.

The information, signals, etc. described in this disclosure may be represented using any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

Note that terms explained in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol may be a signal (signaling). Furthermore, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, a cell, a frequency carrier, etc.

As used in this disclosure, the terms "system" and "network" are used interchangeably.

Furthermore, the information, parameters, etc. described in this disclosure may be expressed using absolute values, relative values from a predetermined value, or other corresponding information. For example, radio resources may be indicated by an index.

The names used for the above-described parameters are not intended to be limiting in any way. Furthermore, the mathematical formulas, etc. using these parameters may differ from those explicitly disclosed in this disclosure. The various channels (e.g., PUCCH, PDCCH, etc.) and information elements may be identified by any suitable names, and therefore the various names assigned to these various channels and information elements are not intended to be limiting in any way.

In this disclosure, terms such as "base station (BS)," "radio base station," "base station," "fixed station," "NodeB," "eNodeB (eNB)," "gNodeB (gNB)," "access point," "transmission point," "reception point," "transmission/reception point," "cell," "sector," "cell group," "carrier," and "component carrier" may be used interchangeably. Base stations may also be referred to by terms such as macrocell, small cell, femtocell, and picocell.

A base station can accommodate one or more (e.g., three) cells. When a base station accommodates multiple cells, the entire coverage area of the base station can be divided into multiple smaller areas, and each smaller area can also be provided with communication services by a base station subsystem (e.g., a small indoor base station (RRH: Remote Radio Head)). The terms "cell" or "sector" refer to part or all of the coverage area of a base station and/or base station subsystem that provides communication services within this coverage area.

In this disclosure, terms such as "Mobile Station (MS)," "user terminal," "User Equipment (UE)," and "terminal" may be used interchangeably.

A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other suitable terminology.

At least one of the base station and the mobile station may be referred to as a transmitting device, a receiving device, a communication device, etc. At least one of the base station and the mobile station may be a device mounted on a mobile body, or the mobile body itself. The mobile body may be a vehicle (e.g., a car, an airplane, etc.), an unmanned mobile body (e.g., a drone, an autonomous vehicle, etc.), or a robot (manned or unmanned). At least one of the base station and the mobile station may also include devices that do not necessarily move during communication operations. For example, at least one of the base station and the mobile station may be an IoT (Internet of Things) device such as a sensor.

Furthermore, the term "base station" in the present disclosure may be read as "terminal." For example, each aspect/embodiment of the present disclosure may be applied to a configuration in which communication between a base station and a terminal is replaced with communication between multiple terminals 20 (which may be referred to as, for example, D2D (Device-to-Device) or V2X (Vehicle-to-Everything)). In this case, the terminal 20 may be configured to have the functions possessed by the base station 10 described above. Furthermore, terms such as "uplink" and "downlink" may be read as terms corresponding to communication between terminals (for example, "side"). For example, terms such as "uplink channel" and "downlink channel" may be read as "side channel."

Similarly, the term "terminal" in this disclosure may be interpreted as "base station." In this case, the base station may be configured to have the functions of the terminal described above.

As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of actions. "Determining" and "determining" may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching a table, database, or other data structure), and ascertaining something that is considered a "determination." Also, "determining" and "determining" may include receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, accessing (e.g., accessing data in memory), and other actions that are considered a "determination." Furthermore, "judgment" and "decision" can include regarding resolving, selecting, choosing, establishing, comparing, etc. as having been "judged" or "decided." In other words, "judgment" and "decision" can include regarding some action as having been "judged" or "decided." Furthermore, "judgment (decision)" can be interpreted as "assuming," "expecting," "considering," etc.

The terms "connected," "coupled," or any variation thereof, refer to any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are "connected" or "coupled" to each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, "connected" may be read as "access." As used in this disclosure, two elements may be considered to be "connected" or "coupled" to each other using one or more wires, cables, and/or printed electrical connections, as well as electromagnetic energy having wavelengths in the radio frequency range, microwave range, and optical (both visible and invisible) range, as some non-limiting and non-exhaustive examples.

The reference signal may also be abbreviated as RS (Reference Signal) or may be called a pilot depending on the applicable standard.

As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

As used in this disclosure, any reference to an element using a designation such as "first," "second," etc. does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient method of distinguishing between two or more elements. Thus, a reference to a first and a second element does not imply that only two elements may be employed or that the first element must in some way precede the second element.

The "means" in the configuration of each of the above devices may be replaced with "part," "circuit," "device," etc.

When the terms "include," "including," and variations thereof are used in this disclosure, these terms are intended to be inclusive, similar to the term "comprising." Furthermore, when the term "or" is used in this disclosure, it is not intended to be an exclusive or.

A radio frame may be composed of one or more frames in the time domain. Each of the one or more frames in the time domain may be called a subframe. A subframe may further be composed of one or more slots in the time domain. A subframe may have a fixed time length (e.g., 1 ms) that is independent of numerology.

Numerology may be a communication parameter that applies to at least one of the transmission and reception of a signal or channel. Numerology may indicate, for example, at least one of the following: subcarrier spacing (SCS), bandwidth, symbol length, cyclic prefix length, transmission time interval (TTI), number of symbols per TTI, radio frame structure, specific filtering operations performed by the transceiver in the frequency domain, and specific windowing operations performed by the transceiver in the time domain.

A slot may consist of one or more symbols in the time domain (such as an Orthogonal Frequency Division Multiplexing (OFDM) symbol or a Single Carrier Frequency Division Multiple Access (SC-FDMA) symbol). A slot may also be a time unit based on numerology.

A slot may include multiple minislots. Each minislot may consist of one or more symbols in the time domain. A minislot may also be called a subslot. A minislot may consist of fewer symbols than a slot. A PDSCH (or PUSCH) transmitted in a time unit larger than a minislot may be called PDSCH (or PUSCH) mapping type A. A PDSCH (or PUSCH) transmitted using a minislot may be called PDSCH (or PUSCH) mapping type B.

Radio frame, subframe, slot, minislot, and symbol all represent time units for transmitting signals. Other names may also be used for radio frame, subframe, slot, minislot, and symbol.

For example, one subframe may be called a transmission time interval (TTI), multiple consecutive subframes may be called a TTI, or one slot or one minislot may be called a TTI. In other words, at least one of the subframe and the TTI may be a subframe (1 ms) in existing LTE, a period shorter than 1 ms (e.g., 1-13 symbols), or a period longer than 1 ms. Note that the unit representing the TTI may be called a slot, minislot, etc. instead of a subframe. One slot may also be called a unit time. The unit time may differ for each cell depending on the numerology.

Here, TTI refers to, for example, the smallest time unit for scheduling in wireless communication. For example, in an LTE system, a base station schedules each terminal 20 by allocating radio resources (such as frequency bandwidth and transmission power that can be used by each terminal 20) in TTI units. Note that the definition of TTI is not limited to this.

A TTI may be a transmission time unit for a channel-coded data packet (transport block), code block, code word, etc., or may be a processing unit for scheduling, link adaptation, etc. Note that when a TTI is given, the time interval (e.g., the number of symbols) to which a transport block, code block, code word, etc. is actually mapped may be shorter than the TTI.

Note that when one slot or one minislot is referred to as a TTI, one or more TTIs (i.e., one or more slots or one or more minislots) may be the smallest time unit for scheduling. Furthermore, the number of slots (minislots) that constitute the smallest time unit for scheduling may be controlled.

A TTI with a time length of 1 ms may be referred to as a regular TTI (TTI in LTE Rel. 8-12), normal TTI, long TTI, regular subframe, normal subframe, long subframe, slot, etc. A TTI shorter than a regular TTI may be referred to as a shortened TTI, short TTI, partial TTI (partial or fractional TTI), shortened subframe, short subframe, minislot, subslot, slot, etc.

Note that a long TTI (e.g., a normal TTI, a subframe, etc.) may be interpreted as a TTI having a time length of more than 1 ms, and a short TTI (e.g., a shortened TTI, etc.) may be interpreted as a TTI having a TTI length shorter than that of a long TTI and greater than or equal to 1 ms.

A resource block (RB) is a resource allocation unit in the time and frequency domains, and may include one or more consecutive subcarriers in the frequency domain. The number of subcarriers included in an RB may be the same regardless of numerology, for example, 12. The number of subcarriers included in an RB may also be determined based on numerology.

Furthermore, the time domain of an RB may include one or more symbols and may be one slot, one minislot, one subframe, or one TTI in length. One TTI, one subframe, etc. may each consist of one or more resource blocks.

In addition, one or more RBs may also be referred to as a physical resource block (PRB), a sub-carrier group (SCG), a resource element group (REG), a PRB pair, an RB pair, etc.

A resource block may also be composed of one or more resource elements (REs). For example, one RE may be a radio resource region of one subcarrier and one symbol.

A Bandwidth Part (BWP) (which may also be referred to as a partial bandwidth) may represent a subset of contiguous common resource blocks (RBs) for a given numerology on a given carrier, where the common RBs may be identified by their index relative to a Common Reference Point of the carrier. PRBs may be defined in a BWP and numbered within that BWP.

BWPs may include a BWP for the UL (UL BWP) and a BWP for the DL (DL BWP). One or more BWPs may be configured for a UE within one carrier.

At least one of the configured BWPs may be active, and the UE may not expect to transmit or receive a given signal/channel outside the active BWP. Note that the terms "cell," "carrier," etc. in this disclosure may be read as "BWP."

The above-described structures of radio frames, subframes, slots, minislots, and symbols are merely examples. For example, the number of subframes included in a radio frame, the number of slots per subframe or radio frame, the number of minislots included in a slot, the number of symbols and RBs included in a slot or minislot, the number of subcarriers included in an RB, as well as the number of symbols in a TTI, symbol length, and cyclic prefix (CP) length can be varied in various ways.

In this disclosure, where articles are added by translation, such as a, an, and the in English, this disclosure may include the noun following these articles being plural.

In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combined" may also be interpreted in the same way as "different."

Each aspect/embodiment described in this disclosure may be used alone, in combination, or switched between depending on the implementation. Furthermore, notification of specified information (e.g., notification that "X is true") is not limited to being done explicitly, but may also be done implicitly (e.g., not notifying the specified information).

Although the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended to be illustrative and does not have any limiting meaning on the present disclosure.

10 Base station 110 Transmitter 120 Receiver 130 Setting unit 140 Control unit 20 Terminal 210 Transmitter 220 Receiver 230 Setting unit 240 Control unit 30 Network node 35 Authorization server 40 Resource holder client 50 Database 60 External server 1001 Processor 1002 Storage device 1003 Auxiliary storage device 1004 Communication device 1005 Input device 1006 Output device 2001 Vehicle 2002 Drive unit 2003 Steering unit 2004 Accelerator pedal 2005 Brake pedal 2006 Shift lever 2007 Front wheel 2008 Rear wheel 2009 Axle 2010 Electronic control unit 2012 Information service unit 2013 Communication module 2021 Current sensor 2022 Rotation speed sensor 2023 Air pressure sensor 2024 Vehicle speed sensor 2025 Acceleration sensor 2026 Brake pedal sensor 2027, shift lever sensor 2028, object detection sensor 2029, accelerator pedal sensor 2030, driving assistance system unit 2031, microprocessor 2032, memory (ROM, RAM)
2033 Communication port (IO port)

Claims (6)

a control unit that determines whether an event that satisfies a condition for revoking authorization for an API call has occurred;
a transmission unit that, when it is determined that the event has occurred, transmits a request to a network node device to revoke authorization for calling the API. The communication device according to claim 1 , wherein the condition is any one of a plurality of conditions including at least a condition related to an application state, a condition related to time, a condition related to a location, a condition related to communication quality, and a condition related to wireless quality. a receiving unit that receives a request to revoke authorization for an API call from a communication device that has detected an event that satisfies a condition for revoking authorization for the API call;
a control unit that executes a process of canceling authorization for calling the API based on the request. The network node device according to claim 3 , wherein the control unit deletes the access permission information used to call the API from a database, or makes the access permission information unusable. determining whether an event has occurred that satisfies a condition for revoking authorization for the API call;
When it is determined that the event has occurred, transmitting a request to the network node device to revoke authorization for calling the API;
An authorization control method performed by a communication device. receiving a request to revoke authorization for an API call from a communication device that has detected an event that satisfies a condition for revoking authorization for the API call;
Based on the request, execute a process to revoke authorization for calling the API.
An authorization control method executed by a network node device.