A service authorization method, communication device and system

Abstract

The application provides a service authorization method, a communication device and a system. The method comprises the following steps: a first network element sends a first token request to a network storage function network element; after the network storage function network element receives the first token request from the first network element, the network storage function network element can complete the legality verification of a network function service consumption entity by verifying whether the first information of the network function service consumption entity carried in the first token request matches the second information in the declared certificate of the network function service consumption entity, and the legality verification of the network function service consumption entity does not need to rely on the configuration file of the network function service consumption entity. Therefore, for the network function service consumption entity whose configuration file is not saved in the network storage function network element, the network storage function network element can also verify the legality of the parameters, and the security of the network function service is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, and in particular to a service authorization method, a communication device and a system. BACKGROUND

[0002] The 3rd generation partnership project (3GPP) proposes to use a service based architecture (SBA) and an enhancement of service based architecture (eSBA) in a 5th generation (5G) mobile communication system.

[0003] In the SBA or eSBA, all network functions (NFs) support a transport layer security (TLS) protocol. Among them, a network function service provider (NFp) entity allows an authorized network function service consumer (NFc) entity to access its services. A network repository function (NRF) network element provides management, discovery and authorization services for NFs.

[0004] The authorization process includes: an NFc entity requests authorization from an NRF network element, for requesting a token corresponding to a service that the NFc entity wants to request; the NRF network element generates a token according to the certificate of the NFc entity, and sends the token to the NFc entity; after the NFc obtains the token, it can request the service from the NFp entity owning the service according to the token.

[0005] In the above authorization process, when the NRF network element receives the token request of the NFc entity, it generally checks the parameters (for example, single-network slice selection assistance information (S-NSSAI)) carried in the token request according to the locally stored profile of the NFc entity, to prevent the NFc entity from reporting its own parameters maliciously to obtain NRF authorization. However, the NRF does not save a part of the profiles of the NFc, so the NRF cannot perform parameter checking on these NFcs. SUMMARY

[0006] The embodiments of the present application provide a service authorization method, device and system, which are used for solving the problem that the NRF cannot check part of the NFc, and effectively improving the reliability and security of the network.

[0007] In a first aspect, the embodiments of the present application provide a service authorization method, which comprises: a first network element sending a first token request to a network storage function network element; wherein the first token request comprises first information of a network function service consumption entity and a declaration of the network function service consumption entity, the declaration comprises a certificate of the network function service consumption entity, and the certificate comprises second information of the network function service consumption entity; after the network storage function network element receives the first token request, checking whether the first information matches the second information, and after determining that the first information matches the second information, generating a token and sending the token to the first network element; and the first network element receiving the token.

[0008] In the above technical solution, after the network storage function network element receives the first token request from the first network element, by checking whether the first information of the network function service consumption entity carried in the first token request matches the second information in the certificate of the declaration of the network function service consumption entity, the legality of the network function service consumption entity can be checked, and the legality of the network function service consumption entity does not need to be checked by relying on the configuration file of the network function service consumption entity, so for the network function service consumption entity whose configuration file is not saved in the network storage function network element, the network storage function network element can also check the legality of the parameters, and the security of the network function service is effectively improved.

[0009] In a possible design, the first information comprises one or more of the following: a first public land mobile network identifier, a first independent non-public network identifier, a first single auxiliary selection slice information identifier, a first network function instance identifier, a second network function type, a first network function service set, and a first uniform resource identifier; and the second information comprises one or more of the following: a second public land mobile network identifier, a second independent non-public network identifier, a second single auxiliary selection slice information identifier, a third network function instance identifier, a second network function type, a second network function service set, and a second uniform resource identifier.

[0010] In the above technical solution, the first information and the second information can comprise parameter information of one or more network function service consumption entities, and the flexibility and reliability of the technical solution are effectively improved.

[0011] It should be noted that the information contained in the first information and the information contained in the second information are one-to-one corresponding.

[0012] For example, when the first information comprises a first network function instance identifier, the second information comprises a second network function instance identifier. For another example, when the first information comprises a first independent non-public network identifier and a first public land mobile network identifier, the second information comprises a second independent non-public network identifier and a second public land mobile network identifier. For yet another example, when the first information comprises a first public land mobile network identifier and a first independent non-public network identifier, a first network function instance identifier, the second information comprises a second public land mobile network identifier and a second independent non-public network identifier, a third network function instance identifier.

[0013] It should be understood that there are multiple specific implementation manners for the network storage function network element to check whether the first information matches the second information, including but not limited to the following two manners:

[0014] Manner 1, if the network storage function network element determines that the first information is the same as the second information, it is determined that the first information matches the second information.

[0015] For example, when the first information is a first public land mobile network identifier and the second information is a second public land mobile network identifier, if the first public land mobile network identifier is the same as the second public land mobile network identifier, for example, both are 1, the network storage function network element determines that the first information matches the second information.

[0016] Manner 2, if the network storage function network element determines that the first information is a subset of the second information, it is determined that the first information matches the second information.

[0017] For example, when the first information is a first independent non-public network identifier and the second information is an independent non-public network identifier, and the first independent non-public network identifier is 1 and the second independent non-public network identifier is {1, 2, 4}, the first independent non-public network identifier is a subset of the second independent non-public network identifier, and the network storage function network element determines that the first information matches the second information.

[0018] In the above technical solutions, the network storage function network element can check the matching relationship between the first information and the second information in multiple manners, further improving the flexibility of the technical solutions provided in the embodiments of the present application.

[0019] In a possible design, after receiving the token, the first network element can further send a first service request to the network function service providing entity; the first service request is used to request the network function service providing entity to provide a service for the network function service consuming entity, and the first service request includes the token and a claim; the token includes a first network function instance identifier, and the claim further includes a second network function instance identifier; after receiving the first service request, the network function service providing entity can check whether the first network function instance identifier and the second network function instance identifier are the same, and provide the service for the network function service consuming entity after determining that the first network function instance identifier and the second network function instance identifier are the same.

[0020] In the technical solution described above, the network function service providing entity checks the network function instance identifier in the token and the network function instance identifier in the claim carried in the service request, so as to ensure that the token and the claim in the service request match, avoid the case that an attacker illegally steals the token and then illegally obtains the network function service, and effectively improve the security of the network function service.

[0021] It should be noted that the first network element described above can be a service communication proxy network element or a network function service consuming entity, and embodiments of the present application do not make specific limitations.

[0022] In a possible design, the first network element is a service communication proxy network element, and before the service communication proxy network element sends the first token request to the network storage function network element, the service communication proxy network element can further receive a second token request or a second service request from the network function service consuming entity; the second token request or the second service request includes a certificate; then the service communication proxy network element obtains a first full domain name (FQDN) and a third network function instance identifier associated with the certificate, and determines that the first FQDN and the third network function instance identifier match.

[0023] In a possible design, the first network element is a service communication proxy network element, and after the service communication proxy network element receives the token, the service communication proxy network element can further: send the token to the network function service consuming entity, and receive a first service request from the network function service consuming entity; the first service request includes a certificate; then the service communication proxy network element obtains a first FQDN and a third network function instance identifier associated with the certificate, and after determining that the first FQDN and the third network function instance identifier match, sends a first service request to the network function service providing entity.

[0024] The service communication proxy network element determines that the first FQDN and the third network function instance identifier match in various manners, including but not limited to the following two manners:

[0025] In a manner 1, the service communication agent network element obtains a binding relationship between the FQDN and the network function instance identifier from the network storage function network element, and determines whether the first FQDN and the third network function instance identifier match according to the binding relationship.

[0026] In a manner 2, the service communication agent network element sends the first full domain name FQDN and the third network function instance identifier to the network storage function network element, and the network storage function network element judges whether the first FQDN and the third network function instance identifier match according to a binding relationship stored locally or obtained from a certificate authority entity.

[0027] In the above technical solution, the service communication agent network element checks the matching relationship between the FQDN associated with the certificate in the declaration of the network function service consumer entity and the third network function instance identifier before sending the service request to the network function service provider entity, and only after the check passes, the service request is sent to the network function service provider entity, so that the situation of illegal use of the declaration by an attacker and then illegal acquisition of the network function service can be avoided, and the security of the network function service use is effectively improved.

[0028] In a possible design, the first network element is a network function service consumer entity, and the specific implementation manner of the first network element sending the first service request to the network function service provider entity can be that the network function service consumer entity sends the first service request to the network function service provider entity through the service communication agent network element; the first service request includes a certificate; the service communication agent network element receives the first service request from the first network element, and after receiving the first service request, the service communication agent network element further obtains a first full domain name FQDN and a third network function instance identifier associated with the certificate, and after determining that the first FQDN and the third network function instance identifier match, the service communication agent network element sends the first service request to the network function service provider entity.

[0029] In the above technical solution, the service communication agent network element checks the matching relationship between the first FQDN associated with the certificate in the declaration of the network function service consumer entity and the third network function instance identifier before sending the service request to the network function service provider entity, and only after the check passes, the service request is sent to the network function service provider entity, so that the situation of illegal use of the declaration by an attacker and then illegal acquisition of the network function service can be avoided, and the security of the network function service use is effectively improved.

[0030] In a possible design, after the network storage function network element receives the first token request, before sending the token to the first network element, the network storage function network element can obtain a first full domain name FQDN and a third network function instance identifier associated with the certificate, and determine that the first FQDN and the third network function instance identifier match, and the first information and the second information match.

[0031] In the technical solution, the network storage function network element first checks the matching relationship between the first FQDN and the third network function instance identifier associated with the certificate in the declaration of the network function service consumption entity, and checks the first information and the second information in the token request, and only returns the token after the check is passed. The service communication agent network element can initiate a service request only after receiving the token, so that the attacker cannot illegally steal the declaration and illegally obtain the network function service, and the security of the network function service is effectively improved.

[0032] In a possible design, the network function service consumption entity can also send a certificate application request to the certificate authority entity before sending the first token request to the network storage function network element; the certificate application request includes a certificate template, and the certificate template includes the first FQDN and the second information; the certificate authority entity can generate a certificate based on the first FQDN and the second information after receiving the certificate application request, and send the certificate to the network function service consumption entity, and the certificate includes the first FQDN.

[0033] In the technical solution, the network function service consumption entity carries the first FQDN and the second information in the certificate application request, so that the certificate contains more information, and the reliability of the certificate information verification is effectively improved.

[0034] In a possible design, the certificate authority entity can also generate and save the binding relationship between the first FQDN and the third network function instance identifier in the first FQDN and the second information in the certificate template.

[0035] In the technical solution, the certificate authority entity generates the binding relationship between the first FQDN and the third network function instance identifier, further improves the reliability of the certificate verification, and effectively avoids the situation that the attacker illegally steals the declaration and illegally obtains the service.

[0036] In a possible design, the network storage function network element can also obtain the binding relationship from the certificate authority entity after receiving the first service request from the network function consumption entity, or after receiving the service registration request from the network function providing entity.

[0037] In the technical solution, the network storage function network element obtains the binding relationship from the certificate authority entity after receiving the first service request from the network function consumption entity, or after receiving the service registration request from the network function providing entity, and does not need to save the binding relationship locally, thereby effectively saving the storage resources of the network storage function network element.

[0038] In a second aspect, a method for authorizing a service is provided. The method can be applied to a network storage function network element or a chip inside the network storage function network element. In an example in which the method is applied to the network storage function network element, the method includes:

[0039] receiving a first token request from a first network element, wherein the first token request includes first information of a network function service consumer entity and a claim of the network function service consumer entity, the claim including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; checking whether the first information matches the second information; and generating a token and sending the token to the first network element after determining that the first information matches the second information.

[0040] In a possible design, after receiving the first token request, before sending the token to the first network element, the network storage function network element can further: obtain a first FQDN and a third network function instance identifier associated with the certificate; and determine that the first FQDN matches the third network function instance identifier and the first information matches the second information.

[0041] In a possible design, the network storage function network element checks whether the first information matches the second information in multiple manners, including but not limited to the following two manners:

[0042] Manner 1: If the first information is the same as the second information, it is determined that the first information matches the second information.

[0043] Manner 2: If it is determined that the first information is a subset of the second information, it is determined that the first information matches the second information.

[0044] In a possible design, after receiving a first service request from a network function consumer entity or a service registration request from a network function provider entity, the network storage function network element can obtain a binding relationship between an FQDN and a network function instance identifier from a certificate authority.

[0045] In a third aspect, a method for authorizing a service is provided. The method can be applied to a first network element or a chip inside the first network element. In an example in which the method is applied to the first network element, the method includes:

[0046] sending a first token request to a network storage function network element, wherein the first token request includes first information of a network function service consumer entity and a claim of the network function service consumer entity, the claim including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; and receiving a token from the network storage function network element.

[0047] In a possible design, after receiving the token, the first network element can further send a first service request to the network function service providing entity; the first service request comprises the token and a claim; the token comprises a first network function instance identifier; the claim further comprises a second network function instance identifier; and the first service request is used to request the network function service providing entity to provide a service for the network function service consuming entity.

[0048] In a possible design, the first network element is a service communication proxy network element, and before sending the first token request to the network storage function network element, the first network element further comprises: receiving a second token request or a second service request from the network function service consuming entity; the second token request or the second service request comprises a certificate; obtaining a first full domain name (FQDN) and a third network function instance identifier associated with the certificate; and determining that the first FQDN and the third network function instance identifier match.

[0049] In a possible design, the first network element is a network function service consuming entity, and after the network function service consuming entity receives the token, the network function service consuming entity can further send the first service request to the network function service providing entity through a service communication proxy network element, where the first service request is used to instruct the network function service providing entity to provide a service for the network function service consuming entity.

[0050] In a possible design, when the first network element is a network function service consuming entity, before sending the first token request to the network storage function network element, the network function service consuming entity can further: send a certificate application request to a certificate authority, where the certificate application request comprises a certificate template, and the certificate template comprises the first FQDN and the second information.

[0051] In a fourth aspect, a method for authorizing a service is provided, which can be applied to a network function service providing entity or a chip inside the network function service providing entity. Taking the network function service providing entity as an example, the method comprises the following steps.

[0052] receiving a first service request from a first network element; the first service request comprises a token and a claim; the token comprises a first network function instance identifier, and the claim comprises a second network function instance identifier; checking whether the first network function instance identifier and the second network function instance identifier match; and providing a service for a network function service consuming entity after determining that the first network function instance identifier and the second network function instance identifier match.

[0053] In a fifth aspect, a communication apparatus is provided, which comprises modules for performing the method in the second aspect or any possible implementation manner of the second aspect.

[0054] As an example, the apparatus can comprise:

[0055] a transceiver unit, configured to receive a first token request from the first network element; the first token request comprises first information of the network function service consuming entity and a claim of the network function service consuming entity, the claim comprises a certificate of the network function service consuming entity, the certificate comprises second information of the network function service consuming entity;

[0056] the processing unit is configured to verify whether the first information matches the second information, and generate a token after determining that the first information matches the second information.

[0057] the transceiver unit is further configured to send the token to the first network element.

[0058] In a possible design, after the transceiver unit receives the first token request and before the transceiver unit sends the token to the first network element, the processing unit is further configured to: obtain a first FQDN associated with the certificate and a third network function instance identifier; and determine that the first FQDN matches the third network function instance identifier and the first information matches the second information.

[0059] In a possible design, when verifying whether the first information matches the second information, the processing unit is specifically configured to: determine that the first information matches the second information if the first information is the same as the second information; or determine that the first information matches the second information if it is determined that the first information is a subset of the second information.

[0060] In a sixth aspect, a communication apparatus is provided, which comprises modules for performing the method in the third aspect or any possible implementation manner of the third aspect.

[0061] As an example, the apparatus can comprise:

[0062] a processing unit, configured to generate a first token request; the first token request comprises first information of the network function service consuming entity and a claim of the network function service consuming entity, the claim comprises a certificate of the network function service consuming entity, the certificate comprises second information of the network function service consuming entity.

[0063] a transceiver unit, configured to send the first token request to a network storage function network element; and receive a token from the network storage function network element.

[0064] In a possible design, after the transceiver unit receives the token, the transceiver unit is further configured to:

[0065] send a first service request to a network function service providing entity, the first service request comprises the token and the claim; the token comprises a first network function instance identifier; and the claim further comprises a second network function instance identifier.

[0066] The first service request is used to request the network function service providing entity to provide a service for the network function service consuming entity.

[0067] In a possible design, the first network element is a service communication proxy network element, and the transceiver is further configured to: receive a second token request or a second service request from the network function service consumption entity before sending the first token request to the network storage function network element; the second token request or the second service request includes the credential; and the processing unit is further configured to: acquire a first full domain name (FQDN) and a third network function instance identifier associated with the credential; and determine that the first FQDN and the third network function instance identifier match.

[0068] In a seventh aspect, a communication apparatus is provided, which includes modules for performing the method in the fourth aspect or any possible implementation manner of the fourth aspect.

[0069] As an example, the apparatus can include:

[0070] The transceiver is configured to receive a first service request from a first network element, and the first service request includes a token and a claim; the token includes a first network function instance identifier, and the claim includes a second network function instance identifier.

[0071] The processing unit is configured to check whether the first network function instance identifier and the second network function instance identifier match, and provide a service for the network function service consumption entity after determining that the first network function instance identifier and the second network function instance identifier match.

[0072] In an eighth aspect, a service authorization system is provided, which includes the communication apparatus in the fifth aspect or any possible implementation manner of the fifth aspect and the communication apparatus in the sixth aspect or any possible implementation manner of the sixth aspect.

[0073] Optionally, the system further includes the communication apparatus in the seventh aspect.

[0074] In a ninth aspect, an electronic device is provided, which includes at least one processor, and a memory and a communication interface connected to the at least one processor in communication; the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the electronic device performs the method in the second aspect or any possible design of the second aspect, or the method in the third aspect or any possible design of the third aspect, or the method in the fourth aspect or any possible design of the fourth aspect.

[0075] In a tenth aspect, a computer-readable storage medium is provided, including a program or instructions, which, when executed on a computer, cause the method in the second aspect or any possible design of the second aspect, or the method in the third aspect or any possible design of the third aspect, or the method in the fourth aspect or any possible design of the fourth aspect to be performed.

[0076] In an eleventh aspect, a chip is provided, which is coupled with a memory, for reading and executing program instructions stored in the memory, so that the method in the second aspect or any possible design of the second aspect, or the method in the third aspect or any possible design of the third aspect, or the method in the fourth aspect or any possible design of the fourth aspect is executed.

[0077] In a twelfth aspect, a computer program instruction is provided, which, when executed on a computer, causes the method in the second aspect or any possible design of the second aspect, or the method in the third aspect or any possible design of the third aspect, or the method in the fourth aspect or any possible design of the fourth aspect to be executed.

[0078] The technical effects that can be achieved by various design schemes in the second aspect to the twelfth aspect above can refer to the technical effects that can be brought by the method in the first aspect or any possible design of the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0079] Figure 1 A structural schematic diagram of a communication system suitable for embodiments of the present application;

[0080] Figure 2 A structural schematic diagram of a specific communication system suitable for embodiments of the present application;

[0081] Figure 3A A schematic diagram of an application scenario suitable for embodiments of the present application;

[0082] Figure 3B A schematic diagram of another application scenario suitable for embodiments of the present application;

[0083] Figure 3C A schematic diagram of another application scenario suitable for embodiments of the present application;

[0084] Figure 4 A flowchart of a service authorization method provided by embodiments of the present application;

[0085] Figure 5 A flowchart of a service authorization method;

[0086] Figure 6 Flowchart of another service authorization method;

[0087] Figure 7 Flowchart of a service authorization method provided by an embodiment of the present application;

[0088] Figure 8 Flowchart of another service authorization method;

[0089] Figure 9 Flowchart of a service authorization method provided by an embodiment of the present application;

[0090] Figure 10 Flowchart of a service authorization method provided by an embodiment of the present application;

[0091] Figure 11 Flowchart of a certificate application provided by an embodiment of the present application;

[0092] Figure 12 Flowchart of a method for NRF to obtain a binding relationship provided by an embodiment of the present application;

[0093] Figure 13 Flowchart of a service authorization method provided by an embodiment of the present application;

[0094] Figure 14 Flowchart of a service authorization method provided by an embodiment of the present application;

[0095] Figure 15 Flowchart of another service authorization method provided by an embodiment of the present application;

[0096] Figure 16 Flowchart of a service authorization method provided by an embodiment of the present application;

[0097] Figure 17 Structural schematic diagram of a communication apparatus provided by an embodiment of the present application;

[0098] Figure 18 Structural schematic diagram of a communication apparatus provided by an embodiment of the present application;

[0099] Figure 19 Structural schematic diagram of a communication apparatus provided by an embodiment of the present application;

[0100] Figure 20 Structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0101] First, some terms involved in the embodiments of the present application are explained to facilitate understanding.

[0102] 1) certificate: refers to a digital certificate, which is a file containing the information of the owner of the public key and the public key, which is digitally signed by the certificate authority (CA), and is used for identity authentication of both parties in communication. The certificate generally contains certificate version number, serial number, signature algorithm identifier, issuer name, subject public key information, validity, etc. It can also contain issuer unique identifier, subject unique identifier and other extension information. The certificate of the NF service consumer entity in the embodiments of the present application can be an application layer certificate, a transport layer security (TLS) certificate, or a certificate shared by the application layer and the transport layer.

[0103] 2) network function service consumer (NFc) entity, referred to as “NFc entity” or “NFc” for short, which can be specifically an NF capable of invoking a function service in a service-oriented architecture, for example, a session management function (SMF) network element, an access and mobility management function (AMF) network element, an authentication server function (AUSF) network element, etc.

[0104] 3) network function service provider (NFp) entity, referred to as “NFp entity” or “NFp” for short, which can be specifically an NF having a function service that can be invoked in a service-oriented architecture, for example, an SMF network element, an AUSF network element, a unified data management (UDM) network element, etc.

[0105] 4) Network Repository Function (NRF) network element, referred to as "NRF network element" or "NRF" for short, is responsible for NF automatic management, selection and expansion, including NF service registration, discovery, state monitoring, service authorization, etc., to achieve on-demand configuration of network functions and services and interconnection between NFs. For example, the NRF has the functions of generating tokens, checking tokens, etc.

[0106] 5) Service Communication Proxy (SCP) network element, referred to as "SCP network element" or "SCP" for short, which can be used for indirect communication between NFs, and can also be used for load balancing and NF selection, and can also have NF registration, discovery and service authorization functions, etc.

[0107] In some possible embodiments, the term "network element" can be replaced by "entity" or "device" and the like. For example, "AMF network element" can also be written as "AMF entity" or "AMF device", "SMF network element" can also be written as "SMF entity" or "SMF device", and the like. For ease of description, "XXX network element" is uniformly abbreviated as "XXX" hereinafter, for example, "AUSF network element" can also be abbreviated as "AUSF", and "SMF network element" can also be abbreviated as "SMF".

[0108] It should be understood that each network element shown in the terms of the present application can be a physical concept, for example, it can be a single device in a physical sense, or at least two network elements can be integrated on the same physical device, or the network element shown in the present application can be a logical concept, for example, it can be a software module or a network function corresponding to the services provided by each network element. The network function can be understood as a virtualized function under virtualization, and can also be understood as a network function providing services under service-oriented architecture.

[0109] The term "at least one" in the embodiments of the present application means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can mean that A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c can mean a, b, c, a and b, a and c, b and c, or a and b and c.

[0110] And, unless otherwise stated, the ordinal numbers "first", "second", etc. mentioned in the embodiments of the present application are used to distinguish different objects, and are not used to limit the order, time sequence, priority or importance of the different objects. For example, the first priority criterion and the second priority criterion are only used to distinguish different criteria, and do not mean that the contents, priorities or importance of the two criteria are different.

[0111] In addition, the terms "comprise" and "have" in the embodiments of the present application and claims and drawings are not exclusive. For example, a process, method, system, product or device comprising a series of steps or modules is not limited to the listed steps or modules, and can also include steps or modules that are not listed.

[0112] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as a fourth generation (4th Generation, 4G) communication system, a fifth generation (5th Generation, 5G) communication system or other future evolution systems, or other various wireless communication systems using wireless access technologies, etc. As long as there is a communication system that requires service authentication or authorization, the technical solutions of the embodiments of the present application can be used. And the various network elements used in the embodiments of the present application can have different names in future communication systems.

[0113] For example, Figure 1 A communication system to which the embodiments of the present application are applicable includes a first network element, an NRF and an NFp.

[0114] The first network element can be an NFc, which can request the service authorization of the NFp from the NRF, for example, request the token corresponding to the NFp, and after obtaining the authorization of the NRF (for example, after obtaining the token), initiate a service request to the NFp.

[0115] The first network element can also be an SCP in communication connection with the NFc, which can proxy part of the functions of the NFc, or in other words, proxy the NFc to execute methods. For example, the SCP can proxy the NFc to request the service authorization of the NFp from the NRF, proxy the NFc to initiate a service request to the NFp, etc.

[0116] It should be understood that in actual application, Figure 1 The communication system shown can also include more network elements.

[0117] For example, Figure 2This application describes a specific communication system to which this communication system applies. The system includes a core network (CN). The CN, acting as a bearer network, provides an interface to the data network (DN), offering terminal devices communication connectivity, authentication, management, policy control, and data service delivery. The CN may include the following network elements: SMF, AMF, UDM, AUSF, policy control function (PCF), user plane function (UPF), network slice selection function (NSSF), network exposure function (NEF), NRF, and application function (AF) elements.

[0118] It should be noted that the aforementioned CN may include one or more CN devices. A CN device may be a network element used to perform the single network function described above, or it may be a network element used to perform multiple network functions described above. When a single CN device is used to perform multiple network functions, the CN device may include one or more functional modules for performing these multiple network functions. These functional modules may be software modules or hardware / software modules; this application embodiment does not impose any limitations on this.

[0119] It should be noted that the aforementioned AMF, SMF, AUSF, UDM, NEF, PCF, AF, and NSSF can interact using service-oriented interfaces. For example, ... Figure 1 As shown, Namf, Nsmf, Nausf, Nudm, Nnef, Npcf, Naf, Nnssf, and Nnrf are the service interfaces exhibited by AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF, and NRF, respectively; N1 and N2 are the service interfaces between SMF, DN, and UPF, respectively.

[0120] Figure 1 The first network element in the process can specifically be Figure 2 SCP, SMF, AMF, etc. in it; Figure 1 The NRF in the context can specifically be... Figure 2 NRF in; Figure 1 NFp in the context can specifically be Figure 2 SMF, DUM, etc.

[0121] It should be understood that Figure 2The communication system can further include more network elements or devices for the ease of understanding, for example, optionally, a terminal device; optionally, a RAN.

[0122] The terminal device, also referred to as a terminal, includes a device that provides voice and / or data connectivity to a user, for example, a hand-held device having wireless connection capability, or a processing device connected to a wireless modem. The terminal device can communicate with a core network via a radio access network (RAN), exchanging voice and / or data with the RAN. The terminal device can include a user equipment (UE), a wireless terminal device, a mobile terminal device, a device-to-device (D2D) terminal device, a V2X terminal device, a machine-to-machine / Machine-Type Communications (M2M / MTC) terminal device, an Internet of Things (IoT) terminal device, a subscriber unit, a subscriber station, a mobile station, a remote station, an access point (AP), a remote terminal, an access terminal, a user terminal, a user agent, or a user device, etc. For example, it can include a mobile telephone (also known as a "cellular" telephone), a computer with mobile termination, a portable, pocket, handheld, computer-included mobile device, etc. For example, a personal communication service (PCS) telephone, a cordless telephone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. It can also include a limited function device, for example, a device with lower power consumption, or a device with limited storage capacity, or a device with limited computing capability, etc. For example, it can include a bar code, a radio frequency identification (RFID), a sensor, a global positioning system (GPS), a laser scanner, etc. information sensing device.

[0123] By way of example and not limitation, in embodiments of the present application, the terminal device can also be a wearable device. The wearable device can also be referred to as a smart wearable device or a smart wearable device, etc., which is a general term for devices that are designed and developed by applying wearable technology to daily wear, such as glasses, gloves, watches, clothing, and shoes, etc. The wearable device is a portable device that is directly worn on the body or integrated into the clothes or accessories of the user. The wearable device is not only a hardware device, but also has strong functions through software support and data interaction, cloud interaction. The general wearable smart device includes a full function, large size, and can realize complete or partial functions without relying on a smart phone, such as a smart watch or smart glasses, etc., and focuses on a certain application function and needs to cooperate with other devices such as a smart phone, such as various smart wristbands, smart helmets, smart jewelry, etc. for monitoring vital signs.

[0124] And various terminal devices as introduced above, if located on a vehicle (for example, placed in or installed in a vehicle), can be considered as a vehicle-mounted terminal device, which is also referred to as an on-board unit (OBU) for example.

[0125] The aforementioned RAN is primarily responsible for UE access. The RAN device is a device located on the network side of the aforementioned communication system and has wireless transceiver capabilities, or a chip that can be installed in the device. The access network equipment includes, but is not limited to: evolved node B (eNB), radio network controller (RNC), node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved node B, or home node B, HNB), baseband unit (BBU), access point (AP), wireless relay node, wireless backhaul node, transmission and reception point (TRP or Transmission Point, TP) in a wireless fidelity (Wi-Fi) system, and can also be a gNB in ​​a 5G system, such as a transmission point (TRP or TP), one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system, or network nodes constituting a gNB or transmission point, such as a baseband unit (BBU) or a distributed unit (DU).

[0126] The embodiments of this application can be applied to scenarios in a service-oriented architecture where the NFc obtains a token from the NRF and then requests services from the corresponding NFp.

[0127] Figures 3A-3C Several possible specific application scenarios are provided for the embodiments of this application.

[0128] like Figure 3A As shown, the SCP agent NFc requests a token from the NRF to request services from NFp; the NRF generates the corresponding token and returns it to NFc via SCP; the SCP agent NFc sends a service request to NFp; NFp receives the service request and returns a service response to NFc via SCP.

[0129] like Figure 3B As shown, NFc sends a service request to SCP, causing SCP agent NFc to initiate a token request to NRF to obtain a token for requesting services from NFp; NRF generates the corresponding token and returns it to SCP; SCP agent NFc sends a service request to NFp; NFp receives the service request and returns a service response to NFc through SCP.

[0130] As shown in Figure 3C , the NFc directly requests a token for requesting a service from the NRF; the NRF generates a corresponding token and returns the token to the NFc; the SCP agent NFc sends a service request to the NFp; the NFp receives the service request and returns a service response to the NFc through the SCP.

[0131] It should be understood that the above several scenarios are only examples and not limitations.

[0132] The service authorization method provided by the embodiments of the present application will be described below with reference to the accompanying drawings.

[0133] In the eSBA or SBA, after receiving the token request of the NFc, the NRF generally verifies the parameters carried in the token request according to the configuration file of the NFc as shown in Table 1, to prevent the NFc from maliciously reporting its own parameters to obtain the authorization of the NRF. For example, the single-network slice selection assistance information (S-NSSAI) carried in the token request is verified to verify the legitimacy of the NFc. However, the NRF does not save the configuration file of a part of NFs (for example, the NFc not registered in the NRF), so the NRF cannot verify the parameters of these NFs.

[0134] Table 1 Configuration file

[0135] Single auxiliary selection slice information identification Full-qualified domain name Independent non-public network identification

[0136] To solve the above technical problems, the embodiments of the present application provide a service authorization method, which can be applied to Figure 1 the communication system as shown in the figure.

[0137] Please refer to Figure 4 , the method includes the following processes:

[0138] S401, the first network element sends a first token request to the NRF, and the NRF receives the first token request from the first network element.

[0139] The first network element in the embodiments of the present application can be the NFc or the SCP, and the embodiments of the present application do not make specific limitations.

[0140] The NFc in the embodiments of the present application can be any network element capable of calling a function service, for example Figure 2 the SMF, AMF, etc. in the figure, which is not limited here.

[0141] The first information of the NFc and an assertion of the NFc including a certificate of the NFc including the second information of the NFc are included in the first token request.

[0142] The first information can include one or more of the following:

[0143] 1) a first public land mobile network identifier (PLMN-ID);

[0144] 2) a first stand-alone non-public network identifier (SNPN-ID);

[0145] 4) a first single-network slice selection assistance information identifier (S-NSSAI ID);

[0146] 4) a first network function instance identifier (NF instance ID);

[0147] 5) a first network function type (NF type);

[0148] 6) a first network function set (NF set);

[0149] 7) a first universal resource locator (URI).

[0150] The second information can include one or more of the following:

[0151] 1) a second PLMN ID;

[0152] 2) a second SNPN ID;

[0153] 4) a second S-NSSAI ID;

[0154] 4) a third NF instance ID;

[0155] 5) a second NF type;

[0156] 6) a second NF set;

[0157] 7) second URI.

[0158] It should be understood that the first PLMN ID and the second PLMN ID are both used to identify the visited network and / or the home network of the NFc; the first SNPN ID and the second SNPN ID are both used to identify the visited network and / or the home network of the NFc; the first S-NSSAI ID and the second S-NSSAI ID are both used to identify the network slice information of the NFc; the first NF instance ID and the third NF instance ID are both used to identify the specific network element of the NFc; the first NF type and the second NF type are both used to identify the function type of the NFp or the NFc; the first NF set and the second NF set are both used to identify the service list provided by the NFp or the NFc; and the first URI and the second URI are both used to identify a string of an Internet resource name.

[0159] It should be noted that each of the first information and the second information can be an identifier (ID) or an ID list, and the embodiments of the present application do not make specific limitations.

[0160] It can be understood that the specific content of the first information and the second information is corresponding.

[0161] For example, when the first information includes the first SNPN ID, the second information includes the second SNPN ID. For another example, when the first information includes the first SNPN ID and the first PLMN ID, the second information includes the second SNPN ID and the second PLMN ID. For another example, when the first information includes the first SNPN ID and the first PLMN ID, the first NF instance ID, the second information includes the second SNPN ID and the second PLMN ID, and the third NF instance ID.

[0162] Optionally, the second information is carried in an extension field of the certificate.

[0163] S402, the NRF checks whether the first information matches the second information.

[0164] Specifically, after receiving the first token request, the NRF performs S402 to check whether the first information matches the second information. When the NRF determines that the first information matches the second information, S403A-S404 are performed; when the NRF determines that the first information does not match the second information, the NRF performs S403B to return response information indicating that the token request fails or to reject the token request of the NFc to the first network element.

[0165] In the embodiments of the present application, the specific implementation of the NRF checking whether the first information and the second information match includes but is not limited to the following two manners:

[0166] Manner 1: The NRF determines that the first information and the second information are the same, and then the NRF determines that the first information and the second information match.

[0167] For example, when the first information is the first PLMN ID and the second information is the second PLMN ID, if the first PLMN ID and the second PLMN ID are the same, for example, both are 1, the NRF determines that the first information and the second information match.

[0168] Manner 2: The NRF determines that the first information is a subset of the second information, and then the NRF determines that the first information and the second information match.

[0169] For example, when the first information is the first SNPN ID, the second information is the SNPN ID, and the first SNPN ID is 1 and the second SNPN ID is {1, 2, 4}, the first SNPN ID is a subset of the second SNPN ID, and the NRF determines that the first information and the second information match.

[0170] It should be understood that when the first information and the second information each contain multiple pieces of information, the NRF determining that the first information and the second information match specifically includes: the NRF determining that the information contained in the first information and the information contained in the second information match one by one.

[0171] For example, when the first information includes the first PLMN ID, the first SNPN ID, the first S-NSSAI ID, and the first NF instance ID; the second information includes the second PLMN ID, the second SNPN ID, the second S-NSSAI ID, and the third NF instance ID; the NRF determines that the first PLMN ID and the second PLMN ID match, the first SNPN ID and the second SNPN ID match, and the first NF instance ID and the third NF instance ID match, and then determines that the first information and the second information match.

[0172] S403A, the NRF generates a token.

[0173] In a possible implementation, the NRF can generate a token according to the first information carried in the token request and the certificate included in the declaration, that is, the generated token can carry the first information and the certificate of the NFc, so that when the token is used by other network elements subsequently, other verification operations can be performed based on the first information and the certificate of the token.

[0174] S403B, the NRF returns a failure response to the first network element, and the first network element receives the failure response, which is used to indicate that the token request fails.

[0175] S404, the NRF sends a token to the first network element, and the first network element receives the token.

[0176] As known from the above, the embodiments of the present application carry the first information in the token request and the second information in the certificate of NFc, so that the NRF can verify the legitimacy of NFc by checking the matching relationship between the first information and the second information, without relying on the configuration file of NFc to verify the legitimacy of NFc. Therefore, for NFc whose configuration file is not saved in the NRF, the NRF can also verify the legitimacy of the parameters of the NFc. Therefore, the embodiments of the present application can effectively improve the security of the use of NF services.

[0177] Please refer to Figure 5 , which gives a schematic diagram of a service authorization method, and the method includes the following steps:

[0178] S501, NFc and NRF discover services.

[0179] Specifically, the NFc initiates a service discovery request to the NRF; the NRF receives the service discovery request and returns information of NF services provided by the corresponding NFp to the NFc.

[0180] S502, the NFc sends a token request to the NRF, and the NRF receives the token request.

[0181] Specifically, after receiving the token request, the NRF generates a token and returns the token to the NFc.

[0182] S503, the NRF sends a token to the NFc, and the NFc receives the token.

[0183] Specifically, after receiving the token, the NFc can execute S501 again to discover the services provided by the NFp, and then execute S504.

[0184] S504, the NFc sends a service request to the NFp through the SCP, and the NFp receives the service request through the SCP, the service request carrying the token and the declaration of the NFc.

[0185] S505, the NFp checks the declaration and the token.

[0186] Specifically, the process of the NFp verifying the token can be verifying whether the regular parameters (e.g., validity period, PLMN ID, etc.) of the token are legal, the process of the NFp verifying the statement can be verifying whether the NF instance ID in the statement and the NF instance ID in the certificate contained in the statement are consistent, or verifying the timestamp, expiration time, network function type of the expected audience, signature, etc. in the statement; when the NFp determines that the regular parameters in the token are legal and the NF instance ID in the statement and the NF instance ID in the certificate contained in the statement are consistent, S506 is performed.

[0187] S506, the NFp returns a service response to the NFc through the SCP, and the NFc receives the service response through the SCP.

[0188] In the above method, when the NFc directly makes a token request to the NRF and the NFc makes a service request to the NFp through the SCP, the NFc will additionally carry a statement in the service request, and the NFp only verifies whether the NF instance ID in the statement and the NF instance ID in the certificate contained in the statement are consistent. Therefore, in the case where the NF instance ID in the token and the NF instance ID in the statement are inconsistent, if an attacker illegally obtains the token of the NFc, the NF service can be illegally obtained.

[0189] As shown in FIG. 6, it is a flow diagram of another service authorization method, which specifically includes the following steps: Figure 6

[0190] S600, the NFc and the NRF discover a service.

[0191] Specifically, the specific implementation of S600 is similar to that of S501. Please refer to the description of S501, which will not be repeated here.

[0192] S601, the NFc sends a token request to the NRF through the SCP, and the NRF receives the token request through the SCP, the token request carrying a statement of the NFc.

[0193] S602, the NRF verifies the statement.

[0194] Specifically, the process of the NRF verifying the statement can be verifying whether the NF instance ID in the statement and the NF instance ID in the certificate contained in the statement are consistent.

[0195] ​S603, the NFp sends the token to the NFc through the SCP, and the NFc receives the token through the SCP.

[0196] S604, the NFc sends a service request to the NFp through the SCP, and the NFp receives the service request through the SCP.

[0197] S605, the NFp checks the token.

[0198] Specifically, the process of the NFp checking the token can be checking the regular parameters (such as the validity period, the PLMN ID, etc.) of the token.

[0199] S606, the NFp returns a service response to the NFc through the SCP, and the NFc receives the service response through the SCP.

[0200] In the above method, when the NFc makes a token request to the NRF through the SCP and makes a service request to the NFp through the SCP, the NFc carries the declaration of the NFc in the token request and the service request, and the NRF and the NFp will check the declaration, but there is still a case that the NF instance ID in the token does not match the NF instance ID in the declaration, so there is still a case that an attacker illegally obtains a token from the NRF and then illegally obtains an NF service.

[0201] To solve the technical problem that an attacker illegally steals the token of the NFc and then illegally obtains an NF service, the embodiments of the present application further provide a service authorization method, which can be applied to Figure 1 the communication system shown in Figure 7 , please refer to

[0202] S701, the first network element sends a service request to the NFp, and the NFp receives the service request.

[0203] It can be understood that the service request is used to request the NFp to provide an NF service for the NFc, and the service request includes a token and a declaration, wherein the token includes a first NF instance ID, and the declaration includes a second NF instance ID.

[0204] The first network element can be the NFc or the SCP, which is not limited here.

[0205] The NFp in the embodiments of the present application can be any network element that has an NF service that can be called, for example Figure 2 the SMF, the UDM, etc. in , which is not limited here.

[0206] S702, the NFp checks whether the declaration and the token match.

[0207] Specifically, the specific process that the NFp checks whether the declaration and the token match can be: the NFp checks whether the first NF instance ID in the token and the second NF instance ID in the declaration are the same, and when the NFp determines that the first NF instance ID and the second NF instance ID are the same, it is determined that the declaration and the token match, and S703A is performed; when the NFp determines that the first NF instance ID and the second NF instance ID are not the same, it is determined that the declaration and the token do not match, and S703B is performed.

[0208] For example, when the first NF instance ID is a universally unique identifier (UUID) and the second NF instance ID is also a UUID, the NFp determines that the first NF instance ID and the second NF instance ID are the same, i.e., it is determined that the declaration and the token match. For another example, when the first NF instance ID is “###134” and the second NF instance ID is also “###134”, the NFp determines that the first NF instance ID and the second NF instance ID are the same, i.e., it is determined that the declaration and the token match.

[0209] S703A, the NFp returns a service response to the first network element, and the first network element receives the service response.

[0210] In one possible implementation, the first network element is an SCP, and after receiving the service response, the SCP sends the service response to the NFc; the service response carries a declaration of the NFp, and the declaration includes a third NF set. After receiving the service response, the NFc checks whether the first NF set requested by the NFc itself matches the third NF set, and if they match, the NFc accesses the corresponding NF service, and if they do not match, the NFc reinitiates a service request to the NFp.

[0211] In another possible implementation, the first network element is the NFc, and the service response carries a declaration of the NFp, and the declaration includes a third NF set. After receiving the service response, the NFc checks whether the first NF set requested by the NFc itself matches the third NF set, and if they match, the NFc accesses the corresponding NF service, and if they do not match, the NFc reinitiates a service request to the NFp.

[0212] The NFc can determine that the first NF set and the third NF set match by determining that the first NF set is the same as the third NF set, or by determining that the first NF set and the third NF set have an intersection. For example, the first NF set is 1, and the third NF set is also 1. The NFc determines that the first NF set and the third NF set match. For another example, the first NF set is {2, 3, 5}, and the third NF set is {1, 2, 4}. The first NF set and the third NF set have an intersection {2}. The NFc determines that the first NF set and the third NF set match.

[0213] In S703B, the NFp returns a failure response to the first network element. The first network element receives the failure response. The failure response is used to indicate that the service request fails.

[0214] In Figure 7 In the service authorization method shown in the figure, the NFp checks the NFinstance ID of the token carried in the service request and the NF instance ID carried in the claim, to ensure that the token and the claim in the service request match, to avoid the case that an attacker illegally steals the token and then illegally obtains the NF service. Therefore, the embodiments of the application can effectively improve the security of the use of the NF service.

[0215] Please refer to Figure 8 is a flowchart of another service authorization method, Figure 8 In S800, the NFc sends a service request to the NRF through the SCP. The NRF receives the service request through the SCP.

[0216] In S800, the NFc sends a service request to the NRF through the SCP. The NRF receives the service request through the SCP.

[0217] Specifically, the NFc carries a claim of the NFc in the service request.

[0218] In S801, the SCP and the NRF discover services.

[0219] Specifically, the SCP initiates a service discovery request to the NRF, and receives information returned by the NRF. According to the information, the NFp provides an NF service registered by the NFp. S802 is performed, that is, a token request is sent to the NRF.

[0220] In S802, the SCP sends a token request to the NRF. The NRF receives the token request.

[0221] Specifically, the SCP carries the claim of the NFc in the token request.

[0222] S803, the NRF checks the claim.

[0223] Specifically, after receiving the token request, the NRF checks the claim in the token request, and generates a token after the check is passed, and performs S804 to send the token to the SCP; if the check is passed, the SCP returns a response information of the token request failure.

[0224] S804, the NRF sends the token to the SCP, and the SCP receives the token.

[0225] S805, the SCP sends a service request to the NFp, and the NFp receives the service request, wherein the service request carries the token and the claim of the NFc.

[0226] S806, the NFp checks the token and the claim.

[0227] The specific implementation of S806 is similar to that of S505, please refer to the description of S505, which will not be repeated here. When the token and the claim are both checked successfully, the NFp performs S807 to return a service response to the NFc through the SCP.

[0228] S807, the NFp returns a service response to the NFc through the SCP, and the NFc receives the service response through the SCP.

[0229] Figure 8 In the service authorization method shown, when the NFc makes a service request to the NFp through the SCP, the NFc carries the claim of the NFc in the service request, and the SCP sends a token request to the NRF triggered by the service request, and the SCP also carries the claim in the token request. When the SCP obtains the token and proxies the NFc to make a service request, the claim is also carried. The NRF and the NFp will check the claim of the NFc, and the whole service request process depends on the claim (for example, the successful check of the claim is a prerequisite for token generation), therefore, there is a situation that an attacker steals the claim of other NFc and illegally obtains NF service.

[0230] To solve the technical problem that an attacker illegally uses the claim of the NFc and illegally obtains NF service, the embodiments of the present application also provide a service authorization method, which can be applied to Figure 1 The communication system shown, please refer to Figure 9 The method comprises the following steps:

[0231] S901, the SCP obtains a first fully qualified domain name (FQDN) and a third NF instance ID associated with the certificate.

[0232] The first FQDN in the embodiments of the present application can be an FQDN in a transport layer certificate of the NFc, and the third NF instance ID can be an NF instance ID in an application layer certificate of the NFc, or the first FQDN and the third NF instance ID can be an FQDN and an NF instance ID in a common certificate (for example, a certificate shared by the transport layer and the application layer) of the NFc.

[0233] In S902, the SCP determines whether the first FQDN and the third NF instance ID match.

[0234] In a possible implementation, the SCP can receive a service request from the NFc, the service request including a certificate of the NFc, the SCP performs S901-S902 to obtain the first FQDN and the third NF instance ID associated with the certificate from the certificate, and when the SCP determines that the first FQDN and the third NF instance ID match, the SCP performs S903 to send the service request to the NFp; if the SCP determines that the first FQDN and the third NF instance ID do not match, the SCP returns a prompt information of service request failure to the NFc.

[0235] In another possible implementation, the SCP can receive a token request from the NFc, the token request including a certificate of the NFc, the SCP performs S901-S902 to obtain the first FQDN and the third NF instance ID associated with the certificate from the certificate, and when the SCP determines that the first FQDN and the third NF instance ID match, the SCP sends the token request to the NRF; if the SCP determines that the first FQDN and the third NF instance ID do not match, the SCP returns a prompt information of token request failure to the NFc.

[0236] In a possible implementation, the SCP can determine whether the first FQDN and the third NF instance ID match according to a binding relationship between the FQDN and the NF instance ID.

[0237] In the embodiments of the present application, the SCP determines whether the first FQDN and the third NF instance ID match according to the above binding relationship, and there are various implementation manners, including but not limited to the following three:

[0238] Manner one: the SCP extracts the first FQDN from the transport layer certificate of the NFc, sends a binding relationship query request to the NRF, and carries the first FQDN in the binding relationship query request; the SCP receives the corresponding NF instance ID returned by the NRF, judges whether the NF instance ID is consistent with the third NF instance ID in the application layer certificate in the claim carried in the token request, if consistent, the SCP determines that the first FQDN and the third NF instance ID match; if not consistent, the SCP determines that the first FQDN and the third NF instance ID do not match.

[0239] Manner two: the SCP extracts the third NF instance ID from the application layer certificate in the claim of the NFc, sends a binding relationship query request to the NRF, and carries the third NF instance ID in the binding relationship query request; the SCP receives the corresponding FQDN returned by the NRF, judges whether the FQDN is consistent with the first FQDN in the transport layer certificate of the NFc, if consistent, the SCP determines that the first FQDN and the third NF instance ID match; if not consistent, the SCP determines that the first FQDN and the third NF instance ID do not match.

[0240] Manner three: the SCP extracts the first FQDN from the transport layer certificate of the NFc, extracts the third NF instance ID from the application layer certificate in the claim of the NFc, sends a binding relationship query request to the NRF, and carries the third NF instance ID and the first FQDN in the binding relationship query request; the SCP receives the matching result returned by the NRF, which can directly indicate whether the first FQDN and the third NF instance ID match.

[0241] Optionally, the binding relationship can be obtained by the SCP from a certification authority / registration authority (CA / RA) entity, or obtained by the NRF from the CA / RA in advance and saved locally, and then obtained by the SCP from the NRF.

[0242] S903, the SCP sends a service request to the NFp, and the NFp receives the service request.

[0243] Specifically, the SCP can carry the declaration and the token of the NFc in the service request, and the NFp can check whether the declaration and the token match after receiving the service request. When it is determined that the declaration and the token match, the NFp performs S904, and returns a service response to the SCP; when it is determined that the declaration and the token do not match, the NFp rejects the service request.

[0244] S904, the NFp returns a service response to the SCP, and the SCP receives the service response.

[0245] Specifically, after receiving the service response, the SCP can also send the service response to the NFc, and the NFc receives the service response.

[0246] In the service authorization method shown in FIG. 10, the SCP checks the matching relationship between the FQDN and the NF instance ID associated with the certificate in the declaration of the NFc before sending the service request to the NFp. Only when the check passes, the service request is sent to the NFp, so that the situation that an attacker illegally steals the declaration and then illegally obtains the NF service can be avoided, and the security of the NF service use is effectively improved. Figure 9 In the embodiments of the present application, the check on the binding relationship can also be performed by other network elements. For example, the NRF can check the binding relationship before issuing the token to the first network element after receiving the token request from the first network element. For details, please refer to

[0247] Figure 10 S1001, the first network element sends a token request to the NRF, and the NRF receives the token request. The token request carries the declaration of the NFc.

[0248] In a possible implementation, the first network element is the SCP, and the SCP sends the token request to the NRF after receiving the service request or the token request from the NFc.

[0249] In another possible implementation, the first network element is the NFc, and the NFc directly sends the token request to the NRF.

[0250] S1002, the NRF obtains the first FQDN and the third NF instance ID associated with the certificate.

[0251] In a possible implementation, the token request carries the declaration of the NFc, and the declaration includes the application layer certificate and the transport layer certificate of the NFc. The NRF can extract the FQDN from the transport layer certificate of the NFc and the third NF instance ID from the application layer certificate of the NFc.

[0252] In a possible implementation, the token request carries the declaration of the NFc, and the declaration includes the application layer certificate and the transport layer certificate of the NFc. The NRF can extract the FQDN from the transport layer certificate of the NFc and the third NF instance ID from the application layer certificate of the NFc.

[0253] ​It should be understood that the transport layer certificate can be sent by the first network element to the NRF when the transport layer link between the first network element and the NRF is established.

[0254] In another possible implementation, the token request carries a declaration of the NFc, the declaration including a common certificate of the application layer and the transport layer of the NFc, from which the first FQDN and / or the third NF instance ID can be extracted by the NRF from the NF.

[0255] S1003, the NRF determines that the first FQDN and the third NF instance ID match.

[0256] In a possible implementation, after receiving the token request from the first network element, the NRF can determine whether the first FQDN and the third NF instance ID match according to a binding relationship between the FQDN and the NF instance ID locally saved by the NRF. Specifically, the NRF determines that the first FQDN and the third NF instance ID respectively correspond to the FQDN and the NF instance ID in the binding relationship one by one, and then determines that the first FQDN and the third NF instance ID match, generates a token, and performs S1004. If the NRF determines that the first FQDN and the third NF instance ID do not respectively correspond to the FQDN and the NF instance ID in the binding relationship one by one, it is determined that the first FQDN and the third NF instance ID do not match, and the NRF returns response information indicating that the token request fails or rejects the token request of the first network element to the first network element.

[0257] In another possible implementation, after receiving the token request from the first network element, the NRF can obtain the related parameters (FQDN and / or NF instance ID) of the binding relationship from the CA / RA, and determine whether the first FQDN and the third NF instance ID match according to the related parameters of the binding relationship. The specific implementation of the NRF obtaining the related parameters of the binding relationship from the CA / RA will be described in detail in the embodiment shown in Figure 12

[0258] S1004, the NRF returns a token to the first network element, and the first network element receives the token.

[0259] In a possible implementation, the first network element is an SCP, and the SCP forwards the token to the NFc after receiving the token.

[0260] In another possible implementation, the first network element is an NFc, and the NFc receives the token from the NRF. ​

[0261] In Figure 10 In the service authorization method shown, the NRF will first check the matching relationship between the FQDN associated with the certificate in the declaration of the NFc and the NF instance ID before returning the token to the first network element. Only after the check is passed, the token is returned. The NFc or SCP can only initiate a service request after receiving the token, so that the situation of illegal theft of declarations by attackers and then illegal acquisition of NF services can be avoided, effectively improving the security of NF service use.

[0262] Optionally, the binding relationship between the FQDN and the NF instance ID can be generated by the CA / RA when the NFc applies for a certificate.

[0263] The application method of the certificate is described below.

[0264] Please refer to Figure 11 , which is a schematic diagram of a certificate application method. The method includes the following steps:

[0265] S1101, the NFc sends a first certificate application request to the CA / RA, and the CA / RA receives the first certificate application request.

[0266] Specifically, the first certificate application request includes a certificate template, and the certificate template includes second information. The second information can include one or more of a third NF instance ID, a second PLMN ID, a second SNPN ID, a second S-NSSAI ID, a second NFtype, a second NF set, and a second URI. After receiving the first certificate application request, the CA / RA can generate a first certificate according to the second information.

[0267] S1102, the CA / RA generates a first certificate carrying the second information.

[0268] It should be understood that the first certificate can be an application layer certificate of the NFc.

[0269] S1103, the CA / RA returns the first certificate to the NFc, and the NFc receives the first certificate.

[0270] S1104, the NFc sends a second certificate application request to the CA / RA, and the CA / RA receives the second certificate application request.

[0271] Specifically, the second certificate application request includes a certificate template, and the certificate template includes a first FQDN. After receiving the first certificate application request, the CA / RA can generate a second certificate according to the first FQDN.

[0272] S1105, the CA / RA generates a second certificate carrying the first FQDN.

[0273] It should be understood that the first certificate can be an NFC transport layer certificate.

[0274] S1106, CA / RA returns the second certificate to NFc, and NFc receives the second certificate.

[0275] S1107, CA / RA binds the third NF instance ID in the second information to the first FQDN, generating a binding relationship between the third NF instance ID and the first FQDN.

[0276] Optionally, the first and second certificates mentioned above can be combined into a single certificate. Therefore, the NFc only needs to submit a certificate request to the CA / RA once. The NFc can include a certificate template containing the first FQDN and second information in the certificate request sent to the CA / RA. After receiving the certificate request, the CA / RA can generate a certificate containing the first FQDN and second information, as well as the binding relationship between the third NF instance ID and the first FQDN, based on the certificate template in the certificate request request.

[0277] The following describes how to obtain binding relationships using NRF.

[0278] See Figure 12 The diagram shows a flowchart of a method for obtaining binding relationships using NRF. The process includes:

[0279] S1201 and NRF detected the triggered event.

[0280] The triggering event could be the NRF receiving an NF service registration request from NFp, or the NRF receiving a service discovery request from NFc, or the NRF receiving a service request from NFc. The embodiments of this application do not impose specific limitations.

[0281] S1202, NRF sends a binding relationship request to CA / RA, and CA / RA receives the binding relationship request.

[0282] One possible implementation is that the NRF carries a certificate in the binding relationship request. This certificate can be an NFc transport layer certificate (containing the first FQDN), an NFc application layer certificate (containing the third NF instance ID), or an NFc certificate shared by both the transport and application layers (i.e., a certificate containing the first NF instance ID and the third FQDN).

[0283] In another possible implementation, the NRF carries a parameter of the certificate association in the binding relationship request, which can be the first FQDN in the transport layer certificate of the NFc, or the third NF instance ID in the application layer certificate of the NFc, or the first FQDN in the transport layer certificate of the NFc and the third NF instance ID in the application layer certificate of the NFc.

[0284] S1203, the CA / RA determines a response result corresponding to the binding relationship request.

[0285] In the implementation of the present application, if the CA / RA receives the transport layer certificate of the NFc in the binding relationship request, the CA / RA determines that the response result is the application layer certificate in the binding relationship; if the CA / RA receives the application layer certificate of the NFc in the binding relationship request, the CA / RA determines that the response result is the transport layer certificate in the binding relationship; and if the CA / RA receives the common certificate of the transport layer and the application layer of the NFc in the binding relationship request, the CA / RA determines that the response result is the matching result of the FQDN and the NF instance ID.

[0286] Correspondingly, if the CA / RA receives the first FQDN in the transport layer certificate of the NFc in the binding relationship request, the CA / RA determines that the response result is the NF instance ID in the binding relationship; if the CA / RA receives the third NF instance ID in the application layer certificate of the NFc in the binding relationship request, the CA / RA determines that the response result is the FQDN in the binding relationship; and if the CA / RA receives the first FQDN and the third NF instance ID in the common certificate of the transport layer and the application layer of the NFc in the binding relationship request, the CA / RA determines that the response result is the matching result of the first FQDN and the third NF instance ID.

[0287] S1204, the CA / RA returns the response result to the NRF, and the NRF receives the response result.

[0288] Specifically, after the CA / RA determines the corresponding response result according to the parameter carried in the binding relationship request, the CA / RA returns the response result to the NRF.

[0289] Optionally, after the NRF receives the response result, the NRF can determine whether the first FQDN and the third NF instance ID contained in the certificate association in the declaration of the NFc carried in the service request received from the SCP match according to the response result, and send the matching result to the SCP.

[0290] It should be understood that the above corresponding technical solutions are proposed for the three technical problems respectively, and in actual application, the above embodiments can also be combined with each other to realize different technical solutions and technical effects. The following will be described in detail through several specific examples.

[0291] Example one,

[0292] As Figure 13 indicated, in combination with the technical solutions shown in Figure 4 , Figure 7 , Figure 9 , the embodiment of the present application provides a service authorization method, which is applied to the application scenario shown in Figure 3A , and the method comprises the following steps:

[0293] S1301, the NFc sends a token request to the SCP, and the SCP receives the token request.

[0294] For example, the NFc can be an SMF, an AMF, etc. in the communication system shown in Figure 2 .

[0295] The token request carries a declaration of the NFc and first information, wherein the declaration includes a certificate of the NFc, and the certificate includes second information of the NFc; wherein the specific content of the first information and the second information please refer to the related description of S401 above, which will not be repeated here.

[0296] S1302, the SCP determines that the first FQDN and the third NF instance ID match.

[0297] The first FQDN can be the FQDN in the transport layer certificate of the NFc, and the third NF instance ID can be the NF instance ID in the application layer certificate of the NFc, or the first FQDN and the third NF instance ID can be the FQDN and the NF instance ID in the common certificate of the transport layer and the application layer of the NFc.

[0298] Specifically, the SCP can determine whether the first FQDN and the third NF instance ID match according to the binding relationship between the FQDN and the NF instance ID.

[0299] It can be understood that the specific implementation of the SCP in S1302 to determine that the first FQDN and the third NF instance ID match according to the above binding relationship is similar to the specific implementation of S902 described above, which will not be repeated here.

[0300] Optionally, after the SCP performs S1302, the SCP can save the binding relationship between the FQDN and the NF instance ID or the related parameters (e.g., the FQDN and the NF instance ID) in the binding relationship in the local.

[0301] S1303, the SCP sends the token request to the NRF, and the NRF receives the token request.

[0302] Specifically, the token request carries a declaration and first information, the second information is carried in the certificate in the declaration, and the first information includes the first NF instance ID. After the NRF receives the token request, before generating the token, the NRF performs S1304 to determine whether the first information matches the second information. When the NRF determines that the first information matches the second information, the NRF generates a token carrying the certificate and the first NF instance ID, and performs S1305 to return the token to the NFc through the SCP. If the NRF determines that the first information does not match the second information, the NRF returns prompt information of a token request failure or rejects the token request of the NFc to the NFc through the SCP.

[0303] S1304, the NRF determines that the first information matches the second information.

[0304] It can be understood that the specific implementation of whether the first information matches the second information in S1304 is similar to the specific implementation of S402, which will not be described here.

[0305] S1305, the NRF sends the token to the NFc through the SCP, and the NFc receives the token through the SCP.

[0306] S1306, the NFc sends a service request to the SCP, and the SCP receives the service request.

[0307] Specifically, the NFc carries the declaration of the NFc and the token in the service request. The SCP can further perform S1302 again to determine whether the first FQDN associated with the certificate in the declaration and the third NF instance ID match. Alternatively, according to the binding relationship or the related parameters in the binding relationship saved in S1302, the SCP can verify whether the first FQDN associated with the certificate included in the declaration and the third NF instance ID match.

[0308] S1307, the SCP sends a service request to the NFp, and the NFp receives the service request.

[0309] Specifically, the service request carries the declaration and the token of the NFc, the token includes the first NF instance ID, and the declaration includes the second NF instance ID. After receiving the service request, the NFp performs S1308.

[0310] S1308, the NFp determines whether the first NF instance ID is same as the second NF instance ID.

[0311] Specifically, the NFp checks whether the first NF instance ID in the token is same as the second NF instance ID in the declaration. If yes, the NFp performs S1309; if not, the NFp returns the information of service request failure to the NFc through the SCP.

[0312] It can be understood that the specific implementation of the NFp checking whether the first NF instance ID is same as the second NF instance ID in S1308 is similar to the specific implementation of S702, which will not be repeated here.

[0313] S1309, the NFp returns the service response to the NFp through the SCP, and the NFp receives the service response through the SCP.

[0314] It can be understood that the specific implementation of S1309 is similar to the specific implementation of S703A, which will not be repeated here.

[0315] In the above Figure 13 In the technical solution shown in the above

[0316] Example two,

[0317] Example two is different from example one in that: in example one, the token request is initiated by the NFc to the NRF through the SCP, and the NFc initiates the service request only after receiving the token returned by the NRF through the SCP; while in example two, the NFc sends a service request to the NRF directly through the SCP, to trigger the SCP to initiate a token request to the NRF on behalf of the NFc.

[0318] As shown in Figure 14 , in combination with the technical solutions shown in Figure 4 , Figure 7 , Figure 9 , another service authorization method provided by the embodiments of the present application is provided, which can be applied to the application scenario shown in Figure 3B , and the method comprises:

[0319] S1401, the NFc sends a first service request to the SCP, and the SCP receives the first service request.

[0320] S1402, the SCP determines that the first FQDN and the third NF instance ID match.

[0321] The first FQDN can be the FQDN in the transport layer certificate, and the third NF instance ID can be the NF instance ID in the application layer certificate of the NFc, or the first FQDN and the third NF instance ID can be the FQDN and the NF instance ID in the common certificate of the transport layer and the application layer of the NFc.

[0322] Specifically, the first service request carries the declaration of the NFc, the first information, the declaration includes the transport layer certificate, the application layer certificate, or the common certificate of the transport layer and the application layer of the NFc; the SCP can extract the first FQDN and / or the third NF instance ID from these certificates, and perform step S1402 to determine that the first FQDN and the third NF instance ID match. It can be understood that the specific implementation of S1402 is similar to that of S902, please refer to the description of S902 above, which will not be repeated here.

[0323] S1403, the SCP sends a token request to the NRF, and the NRF receives the token request.

[0324] Specifically, the token request carries the declaration of the NFc and the first information, the declaration includes the certificate of the NFc, and the certificate includes the second information; for the specific content of the first information and the second information, please refer to the related description of S401 above, which will not be repeated here.

[0325] Specifically, the first information includes the first NF instance ID, after the NRF receives the token request, before generating the token, the step S1404 is performed: verifying whether the first information matches the second information, when the NRF determines that the first information and the second information match, the NRF generates a token carrying the certificate and the first NF instance ID, and performs S1405: returning the token to the NFc through the SCP; if the NRF determines that the first information and the second information do not match, the NRF returns prompt information of token request failure to the NFc or rejects the token request of the NFc through the SCP.

[0326] S1404, the NRF determines that the first information matches the second information.

[0327] It can be understood that the specific implementation of the NRF verifying whether the first information matches the second information in S1404 is similar to the specific implementation of the foregoing S402, and will not be described here.

[0328] S1405, the NRF sends the token to the SCP, and the SCP receives the token.

[0329] S1406, the SCP sends the second service request to the NFp, and the NFp receives the second service request.

[0330] Specifically, the second service request carries the token of the NFc and the declaration, the token includes the first NF instance ID, and the declaration includes the second NF instance ID.

[0331] S1407, the NFp determines that the first NF instance ID is the same as the second NF instance ID.

[0332] Specifically, after the NFp receives the second service request, the NFp verifies whether the first NF instance ID is the same as the second NF instance ID, if yes, S1408 is performed: returning the service response to the NFc through the SCP, if not, returning the information of service request failure to the NFc through the SCP.

[0333] It can be understood that the specific implementation of the NFp verifying whether the first NF instance ID is the same as the second NF instance ID in S1407 is similar to the specific implementation of the foregoing S702, and will not be described here.

[0334] S1408, the NFp returns the service response to the NFc through the SCP, and the NFc receives the service response through the SCP.

[0335] It can be understood that the specific implementation of S1408 is similar to the specific implementation of the foregoing S703A, and will not be described here again.

[0336] In the above Figure 14 In the technical solutions shown, the SCP checks the matching relationship between the first FQDN and the third NF instance ID associated with the certificate in the declaration of the NFc carried in the first service request from the NFc, and the NRF checks the matching relationship between the first information and the second information carried in the token request from the SCP; the NFp checks the matching relationship between the first NF instance ID in the token and the second NF instance ID in the declaration carried in the second service request from the SCP, effectively avoiding the situation that an attacker illegally steals a token and forges a declaration to illegally obtain NF services, and at the same time, the legality of the NFc does not need to be checked by relying on the configuration file of the NFc, so the NRF can also check the legality of the parameters of the NFc that does not have a configuration file saved in the NRF. Therefore, the embodiments of the present application can effectively improve the security of the use of NF services, and the SCP does not need to repeatedly check the matching relationship between the first FQDN and the third NF instance ID associated with the certificate in the declaration of the NFc, effectively saving computing resources.

[0337] Example Three,

[0338] Different from example one and example two, in example three, the NFc initiates a token request to the NRF directly, and after receiving the token returned by the NRF, sends a service request to the SCP; after receiving the service request, the SCP checks the matching relationship between the first FQDN and the third NF instance ID associated with the certificate in the declaration carried in the service request.

[0339] As Figure 15 shown, in combination with Figure 4 , Figure 7 , Figure 9 the technical solutions shown, the embodiments of the present application provide another service authorization and request method, which can be applied to Figure 3C the application scenarios shown, and the method comprises:

[0340] S1501, the NFc sends a token request to the NRF, and the NRF receives the token request.

[0341] Specifically, the token request carries the first information of the NFc, and after receiving the token request, the NRF obtains the certificate of the NFc, the certificate comprising the second information, the NRF performs S1502 to check whether the first information and the second information match, if they match, the NRF performs 1503, and if they do not match, the NRF returns an indication information of token request failure or rejects the token request of the NFc to the NFc.

[0342] In the embodiments of the present application, the certificate of the NFc obtained by the NRF can be the certificate of the NFc obtained by the NRF from the transmission layer link established with the NFc, can be the certificate of the NFc preconfigured on the NRF, or can be the certificate of the NFc carried in the token request.

[0343] S1502, the NRF determines that the first information matches the second information.

[0344] It can be understood that the specific implementation of whether the first information matches the second information in S1502 is similar to that of S302, and please refer to the related description of S402 above, which will not be repeated here.

[0345] S1503, the NRF sends a token to the NFc, and the NFc receives the token.

[0346] Specifically, before the NRF sends the token to the NFc, the NRF generates a token carrying the certificate and the first NF instance ID.

[0347] S1504, the NFc sends a service request to the SCP, and the SCP receives the service request.

[0348] Specifically, the service request carries the token and the declaration of the NFc, and the declaration includes the certificate of the NFc. After receiving the service request, the SCP can determine the first FQDN and the third NF instance ID associated with the certificate, and perform S1505 to determine whether the first FQDN and the third NF instance ID match. If the SCP determines that the first FQDN and the third NF instance ID match, S1506 is performed. If the SCP determines that the first FQDN and the third NF instance ID do not match, the SCP returns indication information indicating that the service request fails to the NFc.

[0349] S1505, the SCP determines that the first FQDN and the third NF instance ID match.

[0350] It can be understood that the specific implementation of whether the first FQDN and the third NF instance ID match in S1505 is similar to that of S902, and will not be repeated here.

[0351] S1506, the SCP sends a service request to the NFp, and the NFp receives the service request.

[0352] Specifically, the service request carries a declaration of the NFc, a token, the token carries a first NF instance ID, and the declaration carries a second NF instance ID.

[0353] S1507, the NFp determines that the first NF instance ID is the same as the second NF instance ID.

[0354] Specifically, after receiving the service request, the NFp checks whether the first NF instance ID is the same as the second NF instance ID. If yes, the NFp performs S1508 and returns a service response to the NFc through the SCP. If not, the NFp returns a service request failure information to the NFc through the SCP.

[0355] It can be understood that the specific implementation of the NFp checking whether the first NF instance ID is the same as the second NF instance ID in S1507 is similar to the specific implementation of S702, which will not be repeated here.

[0356] S1508, the NFp returns a service response to the NFc through the SCP, and the NFc receives the service response through the SCP.

[0357] It can be understood that the specific implementation of S1508 is similar to the specific implementation of S703A, which will not be repeated here.

[0358] In the above Figure 15 In the technical solution shown in the above

[0359] Of course, in actual applications, in addition to the above three examples, there can be other more combined solutions, which will not be enumerated one by one here.

[0360] For more clearly understanding the above-mentioned scheme of the embodiments of the present application, hereinafter, several NF instance IDs involved in the above embodiments of the present application are clarified: the first NF instance ID is the NF instance ID carried in the token request of the NFc or the NF instance ID in the token, the second NF instance ID is the NF instance ID carried in the declaration of the NFc, and the third NF instance ID is the NF instance ID carried in the declaration of the NFc.

[0361] It should be noted that, in addition to the information listed in the embodiments of the present application, each token request, token, service request or service response message involved in the embodiments of the present application can also include other information, which is not limited in the present application.

[0362] In the application scenario of the NFc subscribing the NF service to the NFp, some attackers can carry an illegal URI in the subscription request, and then illegally obtain the notification information of the NF service, resulting in the network information of the NF service being leaked. In view of this, the embodiments of the present application also provide a service authorization method, please refer to Figure 16 , comprising:

[0363] S1601, the NFc sends a subscription request to the NFp, and the NFp receives the subscription request.

[0364] In one possible implementation, the subscription request carries the first URI of the NFc and the certificate of the NFc, and the certificate includes the second URI, so that the NFp can obtain the first URI and the second URI from the subscription request.

[0365] In another possible implementation, the subscription request carries the first URI of the NFc, and the NFp obtains the certificate of the NFc through other ways, such as obtaining the certificate of the NFc from the transport layer, and then obtains the second URI from the certificate of the NFc. Then the NFp can also obtain the first URI and the second URI.

[0366] S1602, the NFp verifies whether the first URI matches the second URI in the certificate.

[0367] Specifically, the process of NFp verifying whether the first URI and the second URI match can be either determining that the first URI and the second URI are identical, or determining that the first URI is a subset of the second URI. For example, if the first URI is "##8888" and the second URI is also "##8888", then NFp determines that the first URI and the second URI match. As another example, if the first URI is "123" and the second URI is {123, 456}, and the first NF URI is a subset of the second NF URI, then NFp determines that the first NF URI and the second NF URI match. If NFp determines that the first URI and the second URI match, it executes S1603A; if NFp determines that the first URI and the second URI do not match, it executes S1603B.

[0368] S1603A, NFp returns a first response message to NFc, NFc receives the first response message, which is used to indicate that NFc's subscription request was successful or that NFp accepted the subscription request.

[0369] Specifically, after NFp agrees to the subscription request sent by NFC, it can send notification messages related to the NF services supported by NFp to NFC at preset time intervals.

[0370] S1603B, NFp returns a second response message to NFc, NFc receives the second response message, which is used to indicate that NFc's subscription request failed or NFp rejected the subscription request.

[0371] exist Figure 16 In the illustrated embodiment, NFp can effectively prevent NFc from illegally obtaining network information by verifying whether the first URI in the first information of NFc carried in the subscription request is consistent with the second URI in the transport layer certificate of NFc. This effectively avoids the leakage of network information of NF service.

[0372] The above combination Figures 4-16 This application introduces the service authorization method provided in its embodiments. The following description, in conjunction with the appendix, illustrates this method. Figure 17 , Figure 18 , Figure 19 The apparatus provided in the embodiments of this application is described.

[0373] Based on the same technical concept, embodiments of this application also provide a communication device 1700, which has the function of implementing the NRF in the above method example. For example, the device 1700 includes the function of performing the above... Figure 10The modules or units or means corresponding to the steps performed by the NRF in the embodiments shown can be implemented by software or by hardware, or by a combination of hardware and software performing corresponding software.

[0374] For example, referring to Figure 17 The apparatus 1700 can include:

[0375] The transceiver unit 1701 is configured to receive a first token request from a first network element; the first token request comprises first information of a network function service consumer entity and a declaration of the network function service consumer entity, the declaration comprising a certificate of the network function service consumer entity, the certificate comprising second information of the network function service consumer entity.

[0376] The processing unit 1702 is configured to verify whether the first information matches the second information, and generate a token upon determining that the first information matches the second information.

[0377] The transceiver unit 1701 is further configured to send the token to the first network element.

[0378] It should be understood that all related contents of the steps involved in the above method embodiments can be cited to the function description of the corresponding functional modules, which will not be repeated here.

[0379] Based on the same technical concept, the embodiments of the present application also provide a communication apparatus 1800, which has the function of realizing the first network element in the above method examples, for example, the apparatus 1800 includes a processing unit 1801 for executing the above Figure 7 The modules or units or means corresponding to the steps performed by the first network element in the embodiments shown can be implemented by software or by hardware, or by a combination of hardware and software performing corresponding software.

[0380] For example, referring to Figure 18 The apparatus 1800 can include:

[0381] The processing unit 1801 is configured to generate a first token request; the first token request comprises first information of a network function service consumer entity and a declaration of the network function service consumer entity, the declaration comprising a certificate of the network function service consumer entity, the certificate comprising second information of the network function service consumer entity.

[0382] The transceiver unit 1802 is configured to send the first token request to a network storage function network element; and receive a token from the network storage function network element.

[0383] It should be understood that all related contents of the steps involved in the above method embodiments can be cited to the function description of the corresponding functional modules, which will not be repeated here.

[0384] Based on the same technical concept, the embodiments of the present application further provide a communication device 1900, which has the function of implementing the NFp in the above method examples, such as the device 1900 comprising a processor 1901, a memory 1902 and a communication interface 1903. Figure 7 The modules or units or means corresponding to the steps performed by the NFp in the embodiments shown above can be implemented by software, or by hardware, or by a combination of the corresponding software and hardware.

[0385] For example, referring to Figure 19 , the device 1900 can comprise:

[0386] The transceiver unit 1901 is configured to receive a first service request from a first network element; the first service request comprises a token and a claim; the token comprises a first network function instance identifier, and the claim comprises a second network function instance identifier;

[0387] The processing unit 1902 is configured to verify whether the first network function instance identifier and the second network function instance identifier match; and when it is determined that the first network function instance identifier and the second network function instance identifier match, provide a service for a network function service consumption entity.

[0388] It should be understood that all relevant contents of the steps involved in the above method embodiments can be cited to the function description of the corresponding functional modules, which will not be repeated here.

[0389] Based on the same technical concept, the embodiments of the present application further provide an electronic device 2000 for implementing the method in the embodiments shown above. Figures 4-16

[0390] As shown in Figure 20 , the electronic device 2000 can comprise a processor 2001 for executing the program or instruction stored in the memory 2002, and when the program or instruction stored in the memory 2002 is executed, the processor is configured to execute the method in the embodiments shown above. Figures 4-16

[0391] Optionally, the electronic device 2000 can further comprise a communication interface 2003. The Figure 20 communication interface 2003 is optional for the electronic device 2000, which is indicated by a dashed line.

[0392] Among them, the number of processors 2001, memories 2002 and communication interfaces 2003 does not constitute a limitation to the embodiments of the present application, and in the implementation, they can be configured arbitrarily according to business needs.

[0393] Optionally, the memory 2002 is located outside the electronic device 2000.

[0394] ​​Optionally, the electronic device 2000 includes the memory 2002, which is connected to the at least one processor 2001. The memory 2002 stores instructions that can be executed by the at least one processor 2001. (Appendix) Figure 20 The dashed line indicates that memory 2002 is optional for electronic device 2000.

[0395] The processor 2001 and the memory 2002 can be coupled through an interface circuit or integrated together; no restriction is imposed here.

[0396] This application embodiment does not limit the specific connection medium between the processor 2001, memory 2002, and communication interface 2003. This application embodiment... Figure 20 The processor 2001, memory 2002, and communication interface 2003 are connected via bus 2004. Figure 20 The connections between other components are shown in bold and are for illustrative purposes only, not as limiting information. The bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 20 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0397] It should be understood that the processor mentioned in the embodiments of this application can be implemented in hardware or software. When implemented in hardware, the processor can be a logic circuit, integrated circuit, etc. When implemented in software, the processor can be a general-purpose processor, implemented by reading software code stored in memory.

[0398] For example, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0399] It should be understood that the memory mentioned in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0400] It should be noted that when the processor is a general processor, a DSP, an ASIC, a FPGA or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, the memory (storage module) can be integrated in the processor.

[0401] It should be noted that the memory described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0402] Based on the same technical concept, the embodiments of the present application also provide a computer readable storage medium, comprising a program or instructions, when the program or instructions run on a computer, the method executed by the NRF in the above method examples, or the method executed by the first network element, or the method executed by the NFp is executed.

[0403] Based on the same technical concept, the embodiments of the present application also provide a chip, which is coupled with a memory, for reading and executing program instructions stored in the memory, so that the method executed by the NRF in the above method examples, or the method executed by the first network element, or the method executed by the NFp is executed.

[0404] Based on the same technical concept, the embodiment of the present application further provides a computer program instruction, which, when running on a computer, causes the method performed by the NRF in the above method example, or the method performed by the first network element, or the method performed by the NFp to be executed.

[0405] The above embodiments can be combined with each other to achieve different technical effects.

[0406] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0407] The present application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device implemented in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0408] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction apparatus, which implements the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0409] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a process for implementing the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 Figure 1 an apparatus that performs the functions specified in one or more flows and / or blocks.

[0410] It is apparent that a person skilled in the art can make various changes and modifications to the embodiments of the application without departing from the scope of the application. Therefore, if these modifications and changes of the embodiments of the application belong to the scope of the claims of the application and their equivalent technologies, the application also intends to include these modifications and changes.

Claims

1. A processing method, characterized in that, The method includes: The network storage function network element receives a token request from the network function service consumer entity, the token request carrying the first network function type of the network function service consumer entity; The network storage function network element obtains the certificate of the network function service consumer entity, and the certificate includes a second network function type; After verifying that the first network function type in the token request matches the second network function type in the certificate, the network storage function element sends a token to the network function service consumer entity.

2. The method according to claim 1, characterized in that, The method further includes: If the network storage function element fails to verify that the first network function type in the token request does not match the second network function type in the certificate, it sends a failure response to the network function service consumer entity.

3. The method according to claim 1 or 2, characterized in that, The method further includes: A network function service provider receives a service request from a network function service consumer, the service request including the token and the claim, the token including a first NF instance ID and the claim including a second NF instance ID; After verifying that the first NF instance ID and the second NF instance ID match, the network function service providing entity sends a service response to the network function service consuming entity.

4. The method according to claim 3, characterized in that, The method further includes: If the network function service provider entity verifies that the first NF instance ID and the second NF instance ID do not match, it sends a failure response to the network function service consumer entity.

5. The method according to any one of claims 1 to 4, characterized in that, After the network storage function element verifies that the first network function type in the token request matches the second network function type in the certificate, the method further includes: generating the token.

6. A communication device, characterized in that, include: The transceiver unit is configured to receive a token request from a network function service consumer entity, the token request carrying a first network function type of the network function service consumer entity. The processing unit is configured to obtain the certificate of the network function service consuming entity, the certificate including a second network function type; and to verify whether the first network function type in the token request matches the second network function type in the certificate. The transceiver unit is further configured to send a token to the network function service consumer entity after verifying that the first network function type in the token request matches the second network function type in the certificate.

7. The apparatus according to claim 6, characterized in that, The transceiver unit is further configured to: send a failure response to the network function service consumer entity if the processing unit verifies that the first network function type in the token request does not match the second network function type in the certificate.

8. The apparatus according to claim 6 or 7, characterized in that, After verifying that the first network function type in the token request matches the second network function type in the certificate, the processing unit is further configured to: generate the token.

9. A computer-readable storage medium, characterized in that, Includes a program or instructions that, when run on a computer, perform the method as described in any one of claims 1-5.

10. A chip, characterized in that, The chip is coupled to a memory for reading and executing program instructions stored in the memory to implement the method as described in any one of claims 1-5.

11. A service authorization system, characterized in that, include: The communication device as described in any one of claims 6 to 8.

12. A computer program product, characterized in that, When the computer program product is executed, it causes the method as described in any one of claims 1-5 to be implemented.

Images