Business management method, device, system and storage medium

Abstract

The present invention discloses a service management method, device, system and storage medium. The service management method includes: receiving authentication request information of a generic bootstrapping architecture (GBA) sent by a network application function (NAF) network element, wherein the authentication request information includes: an application service identifier; and performing authorization verification on the GBA access rights of an application server based on the application service identifier. The embodiment of the present invention verifies the GBA access rights of an application server based on the application service identifier carried in the authentication request information of the GBA sent by the NAF network element, thereby realizing server-level service authorization management, preventing the GBA from being arbitrarily called by an external application server, and thus improving the ability of the GBA system to provide external security services.

Description

Technical Field

[0001] The present invention relates to the field of business management, and in particular to a business management method, device, system and storage medium. Background Art

[0002] In order to facilitate the management of open services, the 3GPP (3rd Generation Partnership Project) organization proposed GBA (Generic Bootstrapping Architecture). GBA describes how to use a mechanism based on authentication and key agreement (AKA) in a mobile context environment to provide shared keys for communications between user devices and network application entities. For example, it can provide complete security authentication and encryption services for application layer services.

[0003] The GBA system can be built on a 4G or 5G network. The network architecture of the GBA system in a 4G network environment is as follows: Figure 1 As shown in the figure, the GBA system includes: User Equipment (UE), Bootstrapping Server Function (BSF), Home Subscriber Server (HSS), and Network Application Function (NAF). The system architecture under the 5G network is similar to it, except that HSS is replaced by Unified Data Management (UDM). Among them, the BSF network element has the ability to authenticate the UE and generate GBA session keys. The NAF network element deployed on the external application server side interacts with the BSF network element deployed on the mobile communication network side through the Zn interface to obtain the GBA session key generated by the BSF network element, thereby establishing a security association with the UE. In the existing GBA system architecture, the network directly opens the GBA security capabilities to external service providers (i.e., application servers). Once the Zn interface is opened, the service provider can freely call the operator's network capabilities through the NAF network element to obtain services. In addition, the operator cannot control the user's business behavior, and cannot implement business management operations such as business activation, authorization, statistics, billing, and auditing. Summary of the invention

[0004] In view of this, embodiments of the present invention provide a service management method, device, system and storage medium, aiming to improve the management capability of managing services based on GBA.

[0005] The technical solution of the embodiment of the present invention is achieved as follows:

[0006] An embodiment of the present invention provides a service management method, including:

[0007] Receiving authentication request information of a general bootstrapping architecture (GBA) sent by a network application function (NAF) network element, wherein the authentication request information includes: an application service identifier;

[0008] Authorization verification is performed on the GBA access right of the application server based on the application service identifier.

[0009] The embodiment of the present invention further provides a service management device, including:

[0010] A receiving module, configured to receive GBA authentication request information sent by a NAF network element, wherein the authentication request information includes: an application service identifier;

[0011] The verification module is used to perform authorization verification on the GBA access rights of the application server based on the application service identifier.

[0012] An embodiment of the present invention further provides a business management device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of the method described in any embodiment of the present invention when running the computer program.

[0013] The embodiment of the present invention further provides a GBA system, comprising: a BSF network element, a NAF network element and the service management device according to the embodiment of the present invention, wherein the service management device is communicatively connected with the BSF network element and the NAF network element respectively.

[0014] An embodiment of the present invention further provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in the embodiment of the present invention are implemented.

[0015] The technical solution provided by the embodiment of the present invention verifies the GBA access rights of the application server based on the application service identifier carried in the GBA authentication request information sent by the NAF network element, so as to realize server-level service authorization management, prevent the GBA from being arbitrarily called by the external application server, and thus improve the ability of the GBA system to provide external business services securely. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of the network architecture of an existing GBA system;

[0017] Figure 2 A schematic diagram of the network architecture of the GBA system according to an embodiment of the present invention;

[0018] Figure 3A schematic diagram of a process flow of a service management method according to an embodiment of the present invention;

[0019] Figure 4 A flowchart of a service management method according to an embodiment of the present invention;

[0020] Figure 5 The structure of the service management device according to the embodiment of the present invention is shown;

[0021] Figure 6 A schematic diagram of the structure of a service management device according to an embodiment of the present invention;

[0022] Figure 7 It is a schematic diagram of the structure of the GBA system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0025] Before introducing the service management method according to the embodiment of the present invention, the GBA system involved in the embodiment of the present invention is first described. Figure 2 As shown, the GBA system of the embodiment of the present invention is Figure 1 A GBA service management platform is introduced on the basis of the GBA system shown. The GBA service management platform interacts with the BSF network element and the NAF network element through the Zn interface, and is responsible for forwarding Zn interface messages between the NAF network element and the BSF network element, without affecting the Zn interface implementation of the existing BSF network element and the NAF network element.

[0026] It should be noted that Figure 2 The NAF network element shown is deployed outside the operator's mobile communication network, and the NAF network element may also be deployed within the operator's mobile communication network, that is, the deployment location of the NAF network element does not affect the implementation of the service management method of the embodiment of the present invention.

[0027] like Figure 3 As shown, an embodiment of the present invention provides a service management method, which is applied to a GBA service management platform. The service management method includes:

[0028] Step 301, receiving GBA authentication request information sent by a NAF network element, wherein the authentication request information includes: an application service identifier;

[0029] Here, after receiving the service request sent by the user equipment, the NAF network element sends authentication request information to the GBA service management platform based on the received service request, and the authentication request information may be a bootstrapping-Info Request (BIR) information. Exemplarily, the BIR information may include: a bootstrapping temporary identification (B-TID) and a network application function identifier (NAF_ID); wherein the service request sent by the user equipment carries the B-TID, and the B-TID is used as temporary identification information to protect the identity information of the user equipment from being leaked, and the B-TID is allocated to the user equipment by the BSF network element.

[0030] In actual applications, the implementation of GBA includes three stages: initialization, bootstrapping, and security association. The initialization stage is used for the user equipment and the application server to confirm that GBA is used for authentication; the bootstrapping stage is the actual stage for completing GBA authentication and generating session keys; and the security association stage is the stage in which the NAF network element obtains the session key from the operator network. Specifically, in the initialization stage, the user equipment sends the first access request to the NAF network element on the application server side, and the NAF network element instructs the user equipment to complete authentication based on GBA; in the bootstrapping stage, the user equipment can interact with the BSF network element, and the user equipment and the BSF network element complete two-way verification, generate a GBA transaction identity B-TID for the user, and the user equipment and the BSF network element derive the GBA session intermediate key Ks respectively; the BSF network element derives Ks based on the user's authentication vector AV. If the BSF network element does not store the user's authentication vector AV, it obtains it from the HSS network element through the Zh interface. B-TID is a temporary identity assigned by the BSF network element to the user equipment. In some embodiments, B-TID is composed of a random number and the domain name of the BSF, and does not contain the identity information of the user terminal, that is, B-TID is not associated with the user's mobile phone number, IMSI (International Mobile Subscriber Identity), etc., so the anonymity of the user identity can be maintained for the application server; in the security association stage, once Ks is obtained, the user equipment and the BSF network element can generate a session key Ks_NAF for a specific application. When the user accesses the NAF network element of the application server, the NAF network element can obtain the Ks_NAF from the BSF network element through a secure channel (such as TLS, dedicated line); using Ks_NAF as the application layer session key and B-TID as the user's temporary identity, user identity authentication, communication channel security encryption, and subsequent service interaction can be performed. It can be understood that the session key Ks_NAF is the GBA session key.

[0031] Step 302: Authorization verification is performed on the GBA access rights of the application server based on the application service identifier.

[0032] The service management method of the embodiment of the present invention verifies the GBA access right of the application server based on the application service identifier carried in the GBA authentication request information sent by the NAF network element, so as to realize server-level service authorization management, prevent the GBA from being arbitrarily called by the external application server, and thus improve the ability of the GBA system to provide external service security.

[0033] In some embodiments, the application service identifier is NAF_ID, and the authorization verification of the GBA access right of the application server based on the application service identifier includes:

[0034] Obtaining the fully qualified domain name (FQDN) of the application server based on the NAF_ID;

[0035] The GBA access authority of the application server is authorized and verified based on the FQDN of the application server.

[0036] In actual applications, the GBA service management platform can determine whether the application server has the authority to access and use GBA-related services based on the service activation status of the application server. Specifically, the GBA service management platform can pre-configure the corresponding relationship between the FQDN of the application server and the service activation status, for example, configure a status table of the service activation status, and the GBA service management platform can query the corresponding service activation status in the status table based on the obtained FQDN of the application server. If the service activation status is activated, it is determined that the application server has passed the authorization verification; if the service activation status is not activated, it is determined that the application server has not passed the authorization verification. In this way, server-level service authorization management can be implemented to prevent GBA from being arbitrarily called by external application servers, thereby improving the ability of the GBA system to provide external business services securely.

[0037] It should be noted that the GBA service management platform cannot perform service authorization management at the user device level at this time because it cannot obtain the identity of the user device.

[0038] In some embodiments, the service management method further includes:

[0039] Determine that the application server passes the authorization verification, and send the authentication request information to the BSF network element; or,

[0040] Determine that the application server fails the authorization verification, and return first response information of rejecting the authentication request to the NAF network element.

[0041] Here, if the application server passes the authorization verification, the GBA service management platform sends the authentication request information to the BSF network element, that is, sends the BIR information to the BSF network element to obtain the authentication response information corresponding to the boot temporary identifier; if the application server fails the authorization verification, the GBA service management platform returns the first response information of rejecting the authentication request to the NAF network element, rejecting the service request of the application server.

[0042] In order to further enhance the service management capability of the GBA service management platform, in some embodiments, the authentication request information further includes: a bootstrap temporary identifier, and after sending the authentication request information to the BSF network element, the method further includes:

[0043] receiving authentication response information returned by the BSF network element, wherein the authentication response information includes: user security configuration information;

[0044] Acquire a terminal identifier of a user equipment corresponding to the bootstrap temporary identifier based on the user security configuration information;

[0045] Authorization verification is performed on the GBA access authority of the user equipment based on the terminal identification.

[0046] It is understandable that after receiving the authentication request information, the BSF network element can determine the user security configuration information corresponding to the authentication request information based on the bootstrap temporary identifier of the authentication request information, and generate a Ks_NAF application layer session key for the NAF.

[0047] Here, the authentication response information returned by the BSF network element received by the GBA service management platform is the BIA (Bootstrapping-Info Answer) information corresponding to the BIR information. The BIA information may include: user security configuration information ussList; wherein the ussList contains the IMPU (Public User ID) information of the user equipment. The GBA service management platform can extract the IMPU information of the user equipment from the ussList, and perform authorization verification on the GBA access rights of the user equipment based on the IMPU information of the user equipment.

[0048] In some embodiments, the authentication response information also includes: a session key, that is, a GBA session key determined by the BSF network element. The GBA service management platform determines that the user equipment has passed the authorization verification, and forwards the authentication response information including the GBA session key to the NAF network element. In this way, the NAF network element can use the GBA session key as the application layer session key and the B-TID as the user's temporary identity to perform user identity authentication, communication channel security encryption, and subsequent service interaction.

[0049] In actual applications, the GBA service management platform can determine whether the user device has the authority to access and use GBA-related services based on the service activation status of the user device. Specifically, the GBA service management platform can pre-configure the corresponding relationship between the IMPU information of the user device and the service activation status. For example, a status table of the service activation status is configured. The GBA service management platform can query the corresponding service activation status in the status table based on the IMPU information of the user device obtained. If the service activation status is activated, it is determined that the user device has passed the authorization verification; if the service activation status is not activated, it is determined that the user device has not passed the authorization verification. In this way, terminal-level service authorization management can be implemented to prevent GBA from being arbitrarily called by external user devices, thereby improving the ability of the GBA system to provide external security services.

[0050] In some embodiments, the service management method further includes:

[0051] Determine that the user equipment passes the authorization verification, and send the authentication response information to the NAF network element; or,

[0052] Determine that the user equipment fails the authorization verification, and return second response information of rejecting the authentication request to the NAF network element.

[0053] Here, if the user equipment passes the authorization verification, the GBA service management platform forwards the BIA information to the NAF network element, so that the application server can obtain the GBA session key, which facilitates the application server and the user equipment to perform identity authentication, communication channel security encryption, and subsequent service interaction based on the GBA session key; if the user equipment fails to pass the authorization verification, the GBA service management platform returns a second response message rejecting the authentication request to the NAF network element, thereby avoiding abuse of GBA.

[0054] In this way, the service management method of the embodiment of the present invention, the GBA service management platform can implement the GBA-related service authorization management at the server level and the terminal level, thereby realizing the service control of the GBA network security capability open to the outside, and can effectively prevent the service provider from arbitrarily calling the operator's network capability through the NAF network element after the Zn interface is opened. The GBA service management platform can strengthen the control of GBA-related services and improve the ability of the GBA system to provide business services to the outside in a secure manner.

[0055] In some embodiments, the service management method further includes at least one of the following:

[0056] Collect statistics on GBA-related services that have passed authorization verification;

[0057] Billing for GBA-related services that have passed authorization verification;

[0058] Audit GBA-related businesses that have passed authorization verification.

[0059] Here, the GBA service management platform can perform service management operations such as statistics, billing and / or auditing on GBA-related services managed through server-level and terminal-level service authorization, so as to provide new value-added services to the outside world, thereby enriching the service capabilities of the existing GBA system. The application server side still cannot obtain the terminal identification of the user device, which can well meet the privacy protection needs of user information.

[0060] The present invention is further described in detail below in conjunction with application examples.

[0061] like Figure 4 As shown, in the GBA security association phase, the GBA service management platform can obtain the identity information of the user device and perform service authorization and statistics on the GBA network security capability call request according to the user's service status. Figure 4 As shown, the business management method includes:

[0062] Step 401: The NAF network element receives a service request;

[0063] Here, after the NAF network element receives the HTTP GET request sent by the user equipment, the NAF network element sends a BIR message to the GBA service management platform to request information such as the GBA session key and user security configuration.

[0064] Step 402: The GBA service management platform receives the BIR message;

[0065] Here, the BIR message includes information such as B-TID and NAF_ID;

[0066] Step 403, extract the FQDN and authorize the server request according to the business authority;

[0067] Here, the GBA service management platform extracts the FQDN of the Server (application server) from the NAF-ID, and authorizes and counts the GBA service request according to the service authority of the service provider, thereby realizing service-level service authorization. For example, the GBA service management platform can determine whether the NAF or Server of the service provider has the authority to access and use the GBA service according to the service activation status. At this time, since the user terminal identifier cannot be obtained, the terminal's service authority is not authorized or counted. If the authorization is passed, step 404 is executed; if the authorization is not passed, step 405 is executed.

[0068] Step 404, the GBA service management platform sends a BIR message;

[0069] If the authorization is passed, the GBA service management platform forwards the BIR message to the BSF network element.

[0070] Step 405: The GBA service management platform returns a first response message;

[0071] If the authorization fails, a DIAMETER_ERROR_NOT_AUTHORIZED (5402) message is sent to reject the service request of the NAF network element.

[0072] Step 406, the GBA service management platform receives the BIA message;

[0073] After the BSF network element receives the BIR message forwarded by the GBA service management platform, the BSF network element sends a BIA message to the GBA service management platform. The BIA message includes the session key KeyMaterial and user security configuration information ussList. The ussList includes the IMPU information of the user equipment.

[0074] Step 407, extracting IMPU, authorizing the terminal request according to the service authority, and counting;

[0075] The GBA service management platform extracts IMPU from the ussList, authorizes and counts the GBA service request according to the service rights of the user equipment, and implements terminal-level service authorization. For example, the GBA service management platform can determine whether the user equipment has the right to access and use the GBA service according to the service activation status of the user equipment. If the authorization is passed, step 408 is executed; if the authorization is not passed, step 409 is executed.

[0076] Step 408, the GBA service management platform forwards the BIA message;

[0077] If the authorization is successful, the GBA service management platform forwards the BIA message to the NAF network element.

[0078] Step 409: The GBA service management platform returns a second response message.

[0079] If the authorization fails, a DIAMETER_ERROR_IDENTITY_UNKNOWN (5401) message is sent to the NAF network element to reject the terminal's service request.

[0080] In order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides a business management device, which corresponds to the above-mentioned business management method, and each step in the above-mentioned business management method embodiment is also completely applicable to the embodiment of the business management device.

[0081] like Figure 5As shown, the service management device 500 includes: a receiving module 501 and a verification module 502, wherein the receiving module 501 is used to receive the GBA authentication request information sent by the NAF network element, and the authentication request information includes: an application service identifier; the verification module 502 is used to perform authorization verification on the GBA access rights of the application server based on the application service identifier.

[0082] In some embodiments, the application service identifier is a network application function identifier (NAF_ID), and the verification module 502 is specifically used to:

[0083] Obtaining the fully qualified domain name (FQDN) of the application server based on the NAF_ID;

[0084] The GBA access authority of the application server is authorized and verified based on the FQDN of the application server.

[0085] In some embodiments, the service management device 500 further includes a sending module 503, and the sending module 503 is used to:

[0086] Determine that the application server passes the authorization verification, and send the authentication request information to the bootstrapping service function BSF network element; or,

[0087] Determine that the application server fails the authorization verification, and return first response information of rejecting the authentication request to the NAF network element.

[0088] In some embodiments, the authentication request information also includes: a boot temporary identifier, and the receiving module 501 is also used to: receive the authentication response information returned by the BSF network element, and the authentication response information includes: user security configuration information; the verification module 502 is also used to: obtain the terminal identifier of the user equipment based on the user security configuration information; and perform authorization verification on the GBA access rights of the user equipment based on the terminal identifier.

[0089] In some embodiments, the authentication response information further includes: a session key. Here, the session key is a GBA session key.

[0090] In some embodiments, the sending module 503 is further used to:

[0091] Determine that the user equipment passes the authorization verification, and send the authentication response information to the NAF network element; or,

[0092] Determine that the user equipment fails the authorization verification, and return second response information of rejecting the authentication request to the NAF network element.

[0093] In some embodiments, the service management device 500 further includes a service management module 504, which is used for at least one of the following:

[0094] Collect statistics on GBA-related services that have passed authorization verification;

[0095] Billing for GBA-related services that have passed authorization verification;

[0096] Audit GBA-related businesses that have passed authorization verification.

[0097] In actual application, the receiving module 501, the verification module 502, the sending module 503 and the service management module 504 can be implemented by a processor in the service management device 500. Of course, the processor needs to run the computer program in the memory to implement its functions.

[0098] It should be noted that: the business management device provided in the above embodiment only uses the division of the above program modules as an example when performing business management. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the business management device provided in the above embodiment and the business management method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0099] Based on the hardware implementation of the above program modules and in order to implement the method of the embodiment of the present invention, the embodiment of the present invention further provides a service management device (ie the aforementioned GBA service management platform). Figure 6 Only an exemplary structure of the service management device is shown, not the entire structure, and can be implemented as needed. Figure 6 Partial or complete structure shown.

[0100] like Figure 6 As shown, the service management device 600 provided in the embodiment of the present invention includes: at least one processor 601, a memory 602, a user interface 603 and at least one network interface 604. The various components in the service management device 600 are coupled together through a bus system 605. It can be understood that the bus system 605 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 605 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 605 is not shown in FIG. Figure 6 Various buses are labeled as bus system 605 .

[0101] The user interface 603 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0102] The memory 602 in the embodiment of the present invention is used to store various types of data to support the operation of the service management device. Examples of such data include: any computer program used to operate on the service management device.

[0103] The service management method disclosed in the embodiment of the present invention can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the service management method can be completed by the hardware integrated logic circuit in the processor 601 or the instruction in the form of software. The above-mentioned processor 601 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 601 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 602. The processor 601 reads the information in the memory 602 and completes the steps of the service management method provided in the embodiment of the present invention in combination with its hardware.

[0104] In an exemplary embodiment, the business management device can be implemented by one or more application-specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general-purpose processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0105] It can be understood that the memory 602 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memories.

[0106] The embodiment of the present invention further provides a GBA system, such as Figure 7 As shown, the GBA system includes: a BSF network element 701, a NAF network element 702 and the service management device 600 described in the above embodiment, and the service management device 600 is respectively connected to the BSF network element 701 and the NAF network element 702 in communication. In actual application, the service management device 600 is respectively connected to the BSF network element 701 and the NAF network element 702 in communication through the Zn interface, the BSF network element 701 is connected to the HSS network element 704 through the Zh interface, the BSF network element 701 is connected to the user equipment (UE) 703 through the Ub interface, and the NAF network element 702 is connected to the user equipment 703 through the Ua interface. The service management method performed by the service management device 600 can refer to the above method embodiment, and will not be repeated here.

[0107] It should be noted that Figure 7 The NAF network element 702 shown is deployed outside the operator's mobile communication network. The NAF network element 702 may also be deployed within the operator's mobile communication network, that is, the deployment location of the NAF network element 702 does not affect the implementation of the service management method of the embodiment of the present invention.

[0108] In an exemplary embodiment, the embodiment of the present invention further provides a storage medium, namely a computer storage medium, which can be a computer-readable storage medium, for example, a memory 602 storing a computer program, and the computer program can be executed by a processor 601 of a service management device 600 to complete the steps described in the method of the embodiment of the present invention. The computer-readable storage medium can be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0109] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0110] In addition, the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0111] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A business management method, characterized in that: Applied to a service management device, the service management device is respectively connected to a bootstrap service function BSF network element and a network application function NAF network element for communication, the method comprising: Receiving authentication request information of a general bootstrapping architecture (GBA) sent by the NAF network element, wherein the authentication request information includes: an application service identifier; Performing authorization verification on the GBA access rights of the application server based on the application service identifier; The method further comprises: Determine that the application server passes the authorization verification, and send the authentication request information to the BSF network element; or, Determine that the application server fails the authorization verification, and return first response information of rejecting the authentication request to the NAF network element.

2. The method according to claim 1, characterized in that The application service identifier is a network application function identifier NAF_ID, and the authorization verification of the GBA access right of the application server based on the application service identifier includes: Obtain the fully qualified domain name FQDN of the application server based on the NAF_ID; The GBA access authority of the application server is authorized and verified based on the FQDN of the application server.

3. The method according to claim 1, characterized in that The authentication request information further includes: a bootstrap temporary identifier. After sending the authentication request information to the BSF network element, the method further includes: receiving authentication response information returned by the BSF network element, wherein the authentication response information includes: user security configuration information; Acquire a terminal identification of a user device based on the user security configuration information; Authorization verification is performed on the GBA access authority of the user equipment based on the terminal identification.

4. The method according to claim 3, characterized in that The method further comprises: Determine that the user equipment passes the authorization verification, and send the authentication response information to the NAF network element; or, Determine that the user equipment fails the authorization verification, and return second response information of rejecting the authentication request to the NAF network element.

5. The method according to claim 3, characterized in that: The authentication response information also includes: a session key.

6. The method according to claim 4, characterized in that The method further comprises at least one of the following: Collect statistics on GBA-related services that have passed authorization verification; Billing for GBA-related services that have passed authorization verification; Audit GBA-related businesses that have passed authorization verification.

7. A service management device, characterized in that: Applied to a service management device, the service management device is respectively connected to a BSF network element and a NAF network element for communication, and the service management device comprises: A receiving module, configured to receive the GBA authentication request information sent by the NAF network element, wherein the authentication request information includes: an application service identifier; A verification module, used for performing authorization verification on the GBA access rights of the application server based on the application service identifier; a sending module, configured to determine that the application server passes the authorization verification and send the authentication request information to the BSF network element; or, Determine that the application server fails the authorization verification, and return first response information of rejecting the authentication request to the NAF network element.

8. A service management device, characterized in that: The service management device is respectively connected to the BSF network element and the NAF network element for communication, and the service management device includes: a processor and a memory for storing a computer program that can be run on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 1 to 6 when running a computer program.

9. A GBA system, characterized in that: include: A BSF network element, a NAF network element and the service management device according to claim 8, wherein the service management device is communicatively connected with the BSF network element and the NAF network element respectively.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images