Access control methods, devices and storage media for network functions

Abstract

This application discloses a method, apparatus, and storage medium for access control of Network Functions (NFs). The method includes: obtaining a first request sent by a first NF in an NF set, the first request being used to request an access token for a target NF; querying whether a valid access token for the target NF exists in the NF set based on the first request and management information of the NF set; and if a valid access token for the target NF is found in the NF set, then sending the stored valid access token to the first NF. This allows a valid access token to be used by different NFs in the NF set within its validity period, effectively preventing a large number of NFs from requesting access tokens for the target NF from the NRF, thereby reducing resource consumption for NF access.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method, apparatus and storage medium for access control of a network function (NF). Background Technology

[0002] The 5G (5th-Generation) core network adopts a service-based architecture (SBA), which defines network functions (NFs) as multiple relatively independent service modules that can be flexibly invoked. This has a fundamental impact on how new services are created and how each NF communicates.

[0003] In related technologies, service producer NFs expose their capabilities as a service to the network through service-oriented interfaces, which can then be invoked by other NFs. Service consumer NFs discover and obtain service producer NF instances that offer the required services through these service-oriented interfaces. 5G introduces the OAuth (Open Authorization) 2.0 authorization mechanism, with the NRF (NFRepository Function) acting as an OAuth authorization server, providing authentication and authorization services to NFs. The NRF receives registration requests from NFs, maintains relevant information about NF instances and supported services, and receives discovery requests from NFs, returning the corresponding NF instance information. This more open and flexible architecture presents new challenges to 5G network security, necessitating the research of different methods to address new security threats.

[0004] In 3GPP (3rd Generation Partnership Project) TS (Technical Specification) Rel-16 (Release 16), it is defined that a service consumer NF requests an access token from an NRF (Network RF) to request services from a service producer NF. Since the concept of NF sets is introduced in the 5G SBA architecture, if the NRF grants an access token to a service consumer NF set, and other NFs in that set request services from the same service producer NF, they need to apply for new access tokens from the NRF. This results in the access token not being fully utilized by the NF set within its validity period. Furthermore, each time a different NF instance in the NF set requests existing resources, a new access token is required, exponentially increasing the demand for access token requests and leading to resource waste. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, and storage medium for access control of network functions, aiming to effectively reduce the resource consumption of network function access.

[0006] The technical solution of this application embodiment is implemented as follows:

[0007] In a first aspect, embodiments of this application provide an access control method for network functions, including:

[0008] Obtain the first request sent by the first NF in the Network Function (NF) set, the first request being used to request an access token for the target NF;

[0009] Based on the first request and the management information of the NF set, query whether the NF set contains a valid access token for the target NF;

[0010] If it is determined that a valid access token for the target NF exists in the NF set, then the stored valid access token is sent to the first NF.

[0011] The method in the above scheme further includes:

[0012] If it is determined that the NF set does not contain an access token for the target NF or that the access token for the target NF has expired, then an access token for the target NF is generated and sent to the first NF based on the first request.

[0013] In the above scheme, before sending the stored valid access token to the first NF, the method further includes:

[0014] Forward the first request to the second NF in the NF set that currently possesses the valid access token;

[0015] Based on the response message returned by the second NF, determine whether to send the stored valid access token to the first NF.

[0016] In the above scheme, determining whether to send the stored valid access token to the first NF based on the response message returned by the second NF includes:

[0017] If the response message returned by the second NF is a confirmation of forwarding of the first message, or if no response message is received from the second NF within the set time period, then the stored valid access token is sent to the first NF; or,

[0018] If the response message returned by the second NF is a second message refusing forwarding, then a third message refusing the first request is sent to the first NF.

[0019] The method in the above scheme further includes:

[0020] The management information of the NF set is updated based on the sending information of the valid access token or the sending information of the newly generated access token.

[0021] The method in the above scheme further includes:

[0022] Store the access token generated based on the first request.

[0023] The method in the above scheme further includes:

[0024] The first NF is authenticated based on the first request and the management information of the NF set;

[0025] If it is determined that the first NF belongs to the NF set, then based on the first request and the management information of the NF set, query whether the NF set has a valid access token for the target NF.

[0026] Secondly, embodiments of this application provide a method for access control of network functions, including:

[0027] Obtain a first request from the first NF in the set of Network Functions (NFs) forwarded by the Network Storage Function (NRF), the first request being used to request an access token for the target NF;

[0028] Based on the usage status of the valid access tokens corresponding to the target NF in the currently owned NF set, a response message is returned to the NRF. The response message is used to indicate whether the NRF should forward the stored valid access tokens.

[0029] In the above scheme, the step of returning a response message to the NRF based on the usage status of the valid access tokens corresponding to the target NF in the currently owned NF set includes:

[0030] If it is determined that no valid access token is being used, a first confirmation message for forwarding is sent to the NRF; or,

[0031] If it is determined that the valid access token is being used, a second message refusing forwarding is sent to the NRF.

[0032] In the above scheme, if it is determined that the valid access token is not being used, the method further includes:

[0033] Delete the valid access token stored locally.

[0034] Thirdly, embodiments of this application provide a network function access control device, including:

[0035] The first acquisition module is used to acquire a first request sent by a first NF in the set of network functions (NFs), the first request being used to request an access token for the target NF;

[0036] The query module is used to query whether the target NF exists in the NF set based on the first request and the management information of the NF set;

[0037] The first processing module is configured to send the stored valid access token to the first NF if it is determined that the NF set contains a valid access token for the target NF.

[0038] Fourthly, embodiments of this application provide a network function access control device, including:

[0039] The second acquisition module is used to acquire a first request from a first NF in the set of network functions (NFs) forwarded by the network storage function (NRF), the first request being used to request an access token for the target NF;

[0040] The second processing module is used to return a response message to the NRF based on the usage status of the valid access tokens corresponding to the target NF in the currently owned NF set. The response message is used to indicate whether the NRF should forward the stored valid access tokens.

[0041] Fifthly, embodiments of this application also provide a network function device, including: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, executes the steps of the method described in the first aspect of embodiments of this application.

[0042] In a sixth aspect, embodiments of this application also provide a network function device, including: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, executes the steps of the method described in the second aspect of embodiments of this application.

[0043] In a seventh aspect, embodiments of this application also provide a storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the methods described in embodiments of this application.

[0044] The technical solution provided in this application embodiment obtains a first request sent by a first NF in an NF set, the first request being used to request an access token for a target NF; based on the first request and the management information of the NF set, it queries whether a valid access token for the target NF exists in the NF set; if it is determined that a valid access token for the target NF exists in the NF set, the stored valid access token is sent to the first NF. In this way, the valid access token can be used by different NFs in the NF set within its validity period, which can effectively avoid a large number of NFs requesting access tokens for the target NF from the NRF, thereby reducing the resource consumption of NF access. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating an embodiment of the access control method for NF in this application;

[0046] Figure 2 This is a flowchart illustrating an access control method for NF according to another embodiment of this application;

[0047] Figure 3 This is a flowchart illustrating the access control method of NF in an application embodiment of this application;

[0048] Figure 4 This is a schematic diagram of the structure of an access control device for an NF according to an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the structure of an access control device for an NF according to another embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the structure of the first network function device according to an embodiment of this application;

[0051] Figure 7 This is a schematic diagram of the structure of the second network function device in the embodiment of this application. Detailed Implementation

[0052] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0054] Before providing a further detailed description of the embodiments of this application, the nouns and terms used in the embodiments of this application are explained, and the nouns and terms used in the embodiments of this application shall be interpreted as follows:

[0055] An NF set is a collection of NFs or NF services that are functionally equivalent and interchangeable.

[0056] The service consumer (NF), as a consumer of NF services, needs to obtain the access token of the service producer (NF) through NRF, and provide the obtained access token for token authentication by the service producer (NF) when calling the service.

[0057] The service producer (NF), as the provider of NF services, provides the NRF with an access token for authentication when the NF registers; and authenticates the service consumer (NF) when it calls the services it provides.

[0058] The 5G SBA architecture introduces the concept of NF sets. In 3GPP TS 23.501 / 29.500, access tokens are allowed to be used by all NF instances within the service consumer NF set. However, 3GPP TS Rel-16 currently does not specify the specific usage of access tokens within NF sets. Furthermore, since all NF instances within an NF set share resources and context, if multiple NF instances in the NF set simultaneously use access tokens to request the same resource or service, it may lead to resource deadlock.

[0059] Based on this, various embodiments of this application provide an access control method for NFs, which can enable the valid access token of the target NF (i.e., the service producer NF) to be used by different NFs in the NF set (i.e., the service consumer NF set) during its validity period, thereby reducing the resource consumption of NF access.

[0060] This application provides an access control method for Network Functions (NFs), which can be applied to network devices that manage NFs, such as an Network RF (Network Controller). It is understood that the NRF can be used for NF registration, management, and status detection to achieve automated NF management. Each NF needs to register with the NRF upon startup to provide services; the registration information includes NF type, address, and service list.

[0061] like Figure 1 As shown, the access control method includes:

[0062] Step 101: Obtain the first request sent by the first NF in the NF set. The first request is used to request the access token of the target NF.

[0063] Understandably, as the NF registration and discovery center within the 5G system, the first NF (i.e., the service consumer NF) can obtain the address of the target NF (i.e., the service producer NF) providing the service from the NRF based on an NF discovery request. The first NF can then generate and send a first request to the NRF based on the address of the target NF.

[0064] Step 102: Based on the first request and the management information of the NF set, query whether the NF set has a valid access token for the target NF.

[0065] Here, after the NRF obtains the first request sent by the first NF, it queries whether the NF set has a valid access token for the target NF based on the first request and the management information of the NF set.

[0066] Understandably, if other NFs in the NF set (such as the second NF) have previously requested an access token for the target NF, and that access token is still valid, the NRF-maintained management information for the NF set will contain a record of the target NF's valid access token. For example, this record may include: the target NF's address, the access token's validity period, and the NF address where the access token is currently located. Thus, the management information for the NF set can be queried based on the target NF's address carried in the first request to determine if an access token matching that target NF's address exists. If it does, the second NF in the NF set that currently possesses the valid access token can be determined based on the NF address where the access token is currently located.

[0067] Step 103: If it is determined that the NF set contains a valid access token for the target NF, then the stored valid access token is sent to the first NF.

[0068] Here, the NRF determines, based on the first request and the management information of the NF set, that a valid access token for the target NF exists in the NF set. The NRF then sends the stored valid access token to the first NF. It should be noted that the NRF can pre-store a backup of the valid access token and forward this backup to the first NF.

[0069] It is understood that in this embodiment of the application, if the NRF determines that there is a valid access token for the target NF in the NF set, it will forward the stored valid access token to the first NF. In this way, the valid access token can be used by different NFs in the NF set within its validity period, which can effectively avoid a large number of NFs requesting the access token of the target NF from the NRF, thereby reducing the resource consumption of NF access.

[0070] For example, the access control method further includes:

[0071] If it is determined that the NF set does not contain an access token for the target NF or that the access token for the target NF has expired, then an access token for the target NF is generated and sent to the first NF based on the first request.

[0072] Understandably, the NRF queries the management information of the NF set based on the address of the target NF carried in the first request. If it determines that there is no matching access token or the access token has expired, the NRF regenerates the access token for the target NF and sends the access token to the first NF.

[0073] Here, the NRF can generate an access token for the target NF according to the OAuth 2.0 authorization mechanism specified in 3GPP TS 33.501, and send the access token to the first NF. The relevant authorization mechanism will not be described in detail here.

[0074] To prevent multiple NF instances in an NF set from simultaneously requesting the same resource or service using access tokens, which could lead to resource deadlock, in some embodiments, the access control method includes the following steps before sending a stored valid access token to the first NF:

[0075] Forward the first request to the second NF in the NF set that currently has a valid access token;

[0076] Based on the response message returned by the second NF, determine whether to send the stored valid access token to the first NF.

[0077] Understandably, after the second NF receives the first request forwarded by the NRF from the first NF, the second NF determines whether it is currently using a valid access token. Based on whether it is using a valid access token, the second NF generates a response message to the NRF. The NRF then determines whether to forward the stored valid access token to the first NF based on this response message. In this way, before forwarding the valid access token, the response message returned by the second NF is used to confirm whether it will lead to a resource deadlock, thereby improving the reliability of NF access.

[0078] For example, determining whether to send a stored valid access token to the first NF based on the response message returned by the second NF includes:

[0079] If the response message returned by the second NF is a confirmation of forwarding of the first message, or if no response message is received from the second NF within the set time period, then the stored valid access token is sent to the first NF; or,

[0080] If the response message returned by the second NF is a second message refusing forwarding, then a third message refusing the first request is sent to the first NF.

[0081] Understandably, if the second NF determines that the valid access token is not being used, it generates and sends a first message confirming forwarding to the NRF; if it determines that the valid access token is being used, it generates and sends a first message refusing forwarding to the NRF.

[0082] Here, the NRF can send the stored valid access token to the first NF based on the received first message; or, the NRF can send a third message rejecting the first request to the first NF based on the received second message, and the first NF can resend the first request after receiving the third message to re-request the access token.

[0083] It should be noted that if the NRF does not receive a response message from the second NF within a set time period, it can confirm that the second NF has experienced network failure or other problems. In this case, the NRF can also forward a valid access token to the first NF to avoid access token forwarding failure caused by the failure of the second NF.

[0084] For example, the access control method further includes:

[0085] Update the management information of the NF set based on the sending information of a valid access token or the sending information of a newly generated access token.

[0086] Understandably, the NRF also needs to update the management information of the maintained NF set. Here, for the case of forwarding a valid access token, the NRF can update the address of the NF currently holding the access token in the NF set's management information based on the sending information of that valid access token (e.g., the NRF forwards the valid access token to the first NF, and the first NF returns an acknowledgment of receipt of the valid access token). For the case of the NRF generating an access token, the NRF can update the NF set's management information based on the sending information of that access token (e.g., the NRF sends the generated access token to the first NF, and the first NF returns an acknowledgment of receipt of the access token), for example, by recording the valid access token and the address of the corresponding NF.

[0087] For example, the access control method further includes:

[0088] Store the access token generated based on the first request.

[0089] Understandably, in addition to sending the newly generated access token to the NF, the NRF also stores a backup of the access token locally, so that it can be forwarded to other NFs in the NF set later.

[0090] For example, the access control method further includes:

[0091] The first NF is authenticated based on the first request and the management information of the NF set;

[0092] If the first NF is determined to belong to the NF set, then based on the first request and the management information of the NF set, query whether the NF set has a valid access token for the target NF.

[0093] Understandably, an NRF can first authenticate the first NF based on the first request and the management information of the NF set to determine whether the first NF belongs to the NF set. For example, the management information of the NF set maintained by the NRF may include the addresses of each NF to which the NF set belongs. The NRF can determine whether the first NF belongs to the NF set based on the address of the first NF carried in the first request. Subsequent steps are only executed if it is determined that the first NF belongs to the NF set. This prevents malicious NFs from impersonating NF members of the NF set and requesting access tokens for the NF set.

[0094] This application also provides an access control method for network functions, applied to an NF in an NF set that currently possesses a valid access token, such as the aforementioned second NF, as shown below. Figure 2 As shown, the access control method includes:

[0095] Step 201: Obtain the first request from the first NF in the NF set forwarded by the NRF. The first request is used to request the access token of the target NF.

[0096] Step 202: Based on the usage status of the valid access tokens for the target NF corresponding to the currently owned NF set, return a response message to the NRF. The response message is used to indicate whether the NRF should forward the stored valid access tokens.

[0097] Considering that all NF instances in an NF set share resources and context, if multiple NF instances in an NF set simultaneously use access tokens to request the same resource or service, a resource deadlock may occur. In this embodiment, the second NF returns a response message to the NRF based on the usage status of the valid access tokens of the target NF corresponding to its current NF set. This ensures that at any given time, only one NF instance in an NF set can obtain an access token, thereby effectively preventing the resource deadlock problem.

[0098] For example, based on the usage status of the valid access tokens for the target NF corresponding to the currently owned NF set, a response message is returned to the NRF, including:

[0099] If it is determined that no valid access token is being used, a first message confirming the forwarding is sent to the NRF; or,

[0100] If a valid access token is determined to be in use, a second message denying forwarding is sent to the NRF.

[0101] Here, after receiving the first request from the first NF forwarded by the NRF, if the second NF determines that it is not using the valid access token, it sends a first message confirming the forwarding to the NRF. The NRF can then forward the valid access token to the first NF based on this first message. If the second NF determines that it is using the valid access token, it sends a second message rejecting the forwarding to the NRF. The NRF then sends a third message rejecting the first request to the first NF, causing the first NF to resend the first request. In this way, the first NF can receive the valid access token forwarded by the NRF, effectively avoiding resource deadlock caused by multiple NFs in the NF set using the same access token simultaneously.

[0102] For example, if the second NF determines that no valid access token is being used, the access control method further includes:

[0103] Delete the valid access token for local storage.

[0104] Here, the second NF can delete the valid access token stored locally, so that only one NF in the NF set obtains and stores the valid access token, which helps to satisfy the requirement that the access token is uniquely invoked by the NF in the NF set.

[0105] It is understood that the NF access control method in this application embodiment enables all NF instances in an NF set to share a valid access token, thereby achieving resource and context sharing. Furthermore, based on the confirmation mechanism before forwarding the access token and the maintenance of management information for the NF set, it can ensure that only one NF instance in an NF set can use the access token at any given time. For example, a set consisting of multiple SMF (Session Management Function) instances establishes a PDU (Packet Data Unit) session with a UPF (User Plane Function) via an N4 connection. All SMF instances in the set can control this N4 connection, but only one SMF instance is allowed to control this connection at any given time.

[0106] The present application will be further described in detail below with reference to application examples.

[0107] In this application example, NFa and NFb belong to the same set of service consumer NFs, and NFp is the service producer NF, such as... Figure 3 As shown, the access control method for NF in this application embodiment includes:

[0108] Step 301: NFb sends a Token request to NRF.

[0109] NFb sends a Token request (equivalent to the first request mentioned above) to NRF, requesting an access token for the NFp service.

[0110] Step 302: NFb authentication and the authentication of the NF set to which it belongs, query the status of the request token.

[0111] Upon receiving a token request, NRF first authenticates the identity of NFb and verifies whether NFb is in its declared NF set. After confirming that NFb belongs to the NF set, it queries the access token issuance status of the corresponding NFp in that NF set. If there is no access token requested by the NF instance in the current NF set or the access token has expired, NRF directly issues an access token to NFb; otherwise, NRF forwards the token request to the NF (NFa) in that NF set that currently possesses the access token.

[0112] Step 303: Forward the Token request.

[0113] If the NRF determines that a valid access token exists in the current NF set and that the access token is owned by NFA, it will forward the token request to NFA.

[0114] Step 304: Delete the local access token.

[0115] NFa removes the local access token.

[0116] Understandably, if NFA is currently using the access token, it will reply with a second message to NRF refusing to forward the request.

[0117] This application example illustrates how NFa currently does not use the access token, and NFa deletes the local access token.

[0118] Step 305: Send a Token request for confirmation.

[0119] NFa sends a token request confirmation to NRF, that is, it sends the first confirmation message to NRF.

[0120] Step 306: Forward the access token.

[0121] Based on the first message received, NRF forwards the access token to NFb.

[0122] Step 307: Send forwarding results.

[0123] After receiving the access token, NFb will send the result of receiving the access token (e.g., a confirmation message of receiving the access token) to NRF.

[0124] Step 308: Record the Token status.

[0125] NRF records and updates the status of the access token based on the forwarding results sent by NFb.

[0126] Step 309: Send a service request.

[0127] NFb sends a service request to NFp based on the received access token.

[0128] Step 310: Return service response.

[0129] NFp authenticates service requests based on the access token they carry. If authentication is successful, it returns the service result corresponding to the service request; if authentication fails, it returns a response message indicating that the service request has been rejected.

[0130] In order to implement the NF access control method of the present application embodiments, the present application embodiments also provide an NF access control device, which corresponds to the above-mentioned NF access control method, and the steps in the above-mentioned NF access control method embodiments are also fully applicable to the NF access control device embodiments.

[0131] like Figure 4 As shown, the access control device for this NF can be applied to an NRF, and includes: a first acquisition module 401, a query module 402, and a first processing module 403. The first acquisition module 401 is used to acquire a first request sent by a first NF in the NF set, the first request being used to request an access token for the target NF; the query module 402 is used to query whether a valid access token for the target NF exists in the NF set based on the first request and the management information of the NF set; the first processing module 403 is used to send the stored valid access token to the first NF if it is determined that a valid access token for the target NF exists in the NF set.

[0132] For example, the first processing module 403 is further configured to:

[0133] If it is determined that the NF set does not contain an access token for the target NF or that the access token for the target NF has expired, then an access token for the target NF is generated and sent to the first NF based on the first request.

[0134] For example, before the first processing module 403 sends the stored valid access token to the first NF, it is also used to:

[0135] Forward the first request to the second NF in the NF set that currently has a valid access token;

[0136] Based on the response message returned by the second NF, determine whether to send the stored valid access token to the first NF.

[0137] For example, the first processing module 403 determines whether to send the stored valid access token to the first NF based on the response message returned by the second NF, including:

[0138] If the response message returned by the second NF is a confirmation of forwarding of the first message, or if no response message is received from the second NF within the set time period, then the stored valid access token is sent to the first NF; or,

[0139] If the response message returned by the second NF is a second message refusing forwarding, then a third message refusing the first request is sent to the first NF.

[0140] For example, the first processing module 403 is further configured to:

[0141] Update the management information of the NF set based on the sending information of a valid access token or the sending information of a newly generated access token.

[0142] For example, the first processing module 403 is further configured to:

[0143] Store the access token generated based on the first request.

[0144] For example, the first processing module 403 is further configured to: perform identity authentication on the first NF based on the first request and the management information of the NF set; if it is determined that the first NF belongs to the NF set, then the query module 402 queries whether the NF set has a valid access token for the target NF based on the first request and the management information of the NF set.

[0145] In practical applications, the first acquisition module 401, the query module 402, and the first processing module 403 can be implemented by the processor in the NF's access control device. Of course, the processor needs to run the computer program in memory to implement its functions.

[0146] In another embodiment, such as Figure 5 As shown, the access control device for the NF can be applied to NFs in the NF set that currently possess valid access tokens. It includes a second acquisition module 501 and a second processing module 502. The second acquisition module 501 is used to acquire a first request forwarded by the NRF from a first NF in the NF set. The first request is used to request an access token for the target NF. The second processing module 502 is used to return a response message to the NRF based on the usage status of the valid access token for the target NF in the currently possessed NF set. The response message is used to indicate whether the NRF should forward the stored valid access token.

[0147] For example, the second processing module 502 is specifically used for:

[0148] If it is determined that no valid access token is being used, a first message confirming the forwarding is sent to the NRF; or,

[0149] If a valid access token is determined to be in use, a second message denying forwarding is sent to the NRF.

[0150] For example, if the second processing module 502 determines that no valid access token is being used, it is also used to: delete the valid access token in local storage.

[0151] In practical applications, the second acquisition module 501 and the second processing module 502 can be implemented by the processor in the NF's access control device. Of course, the processor needs to run the computer program in memory to implement its functions.

[0152] It should be noted that the NF access control device provided in the above embodiments is only illustrated by the division of the above program modules when performing NF access control. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the NF access control device and the NF access control method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0153] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide a first network function device. Figure 6 The diagram shows only an exemplary structure of the first network function device, not the entire structure; implementation is possible as needed. Figure 6 The structure shown may be part or all of the structure.

[0154] like Figure 6 As shown, the first network function device 600 provided in this application embodiment includes: at least one processor 601, a memory 602, a user interface 603, and at least one network interface 604. The various components in the first network function device 600 are coupled together through a bus system 605. It can be understood that the bus system 605 is used to implement communication between these components. In addition to a data bus, the bus system 605 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 6 The general designated all buses as Bus System 605.

[0155] The user interface 603 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0156] The memory 602 in this embodiment is used to store various types of data to support the operation of the first network function device. Examples of such data include any computer program used to operate on the first network function device.

[0157] For example, the first network function device can be an NRF (Network Functions Provider). The access control method for the NF (Network Functions) on the NRF side disclosed in this application can be applied to the processor 601, or implemented by the processor 601. The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the NF access control method can be completed by the integrated logic circuit of the hardware in the processor 601 or by instructions in the form of software. The processor 601 mentioned above can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 601 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in memory 602. The processor 601 reads the information in memory 602 and, in conjunction with its hardware, completes the steps of the NF access control method provided in the embodiments of this application.

[0158] In an exemplary embodiment, the first network function device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0159] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide a second network function device. Figure 7 This is merely an exemplary structure of the second network function device, not the entire structure; implementation is possible as needed. Figure 7The structure shown may be part or all of the structure.

[0160] like Figure 7 As shown, the second network function device 700 provided in this application embodiment includes: at least one processor 701, a memory 702, a user interface 703, and at least one network interface 704. The various components in the second network function device 700 are coupled together through a bus system 705. It can be understood that the bus system 705 is used to implement communication between these components. In addition to a data bus, the bus system 705 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general labeled all buses as Bus System 705.

[0161] The user interface 703 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0162] The memory 702 in this embodiment is used to store various types of data to support the operation of the second network function device. Examples of such data include any computer program used to operate on the second network function device.

[0163] For example, the second network function device can be an NF in the NF set that currently possesses a valid access token. The access control method for NFs applied to the NF side disclosed in this application embodiment can be applied to the processor 701, or implemented by the processor 701. The processor 701 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the NF access control method can be completed by the integrated logic circuit of the hardware in the processor 701 or by instructions in the form of software. The aforementioned processor 701 can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 701 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in memory 702. The processor 701 reads the information in memory 702 and, in conjunction with its hardware, completes the steps of the NF access control method provided in the embodiments of this application.

[0164] In an exemplary embodiment, the second network function device 700 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0165] It is understood that memories 602 and 702 can be volatile or non-volatile memories, or both. Non-volatile memories can be read-only memories (ROM), programmable read-only memories (PROM), erasable programmable read-only memories (EPROM), electrically erasable programmable read-only memories (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical discs, or compact disc read-only memories (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memories can be random access memory (RAM), used as external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0166] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 602 including a computer program, which can be executed by the processor 601 of the first network function device 600 to complete the steps of the access control method applied to the NF on the NRF side according to the embodiments of this application; or, for example, a memory 702 including a computer program, which can be executed by the processor 701 of the second network function device 700 to complete the steps of the access control method applied to the NF side according to the embodiments of this application. The computer-readable storage medium can be a ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0167] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0168] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0169] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of access control of a network function, characterized by, The method is applied to a network storage function (NRF), and the method comprises the following steps: obtaining a first request sent by a first network function (NF) in a set of network functions (NFs), wherein the first request is used to request an access token of a target NF; querying, based on the first request and management information of the set of NFs, whether there is a valid access token of the target NF in the set of NFs; if it is determined that there is a valid access token of the target NF in the set of NFs, sending the stored valid access token to the first NF; if it is determined that there is no access token of the target NF in the set of NFs or the existing access token of the target NF has expired, generating and sending an access token of the target NF to the first NF based on the first request; and storing the generated access token based on the first request.

2. The method of claim 1, wherein, Before the step of sending the stored valid access token to the first NF, the method further comprises the following steps: forwarding the first request to a second NF in the set of NFs that currently holds the valid access token; determining, based on a response message returned by the second NF, whether to send the stored valid access token to the first NF.

3. The method of claim 2, wherein, The step of determining, based on the response message returned by the second NF, whether to send the stored valid access token to the first NF comprises the following steps: if the response message returned by the second NF is a first message for confirming the forwarding or the response message returned by the second NF is not received within a set time length, sending the stored valid access token to the first NF; or if the response message returned by the second NF is a second message for rejecting the forwarding, sending a third message for rejecting the first request to the first NF.

4. The method of claim 1, wherein, The method further comprises the following steps: updating the management information of the set of NFs based on the sending information of the valid access token or the sending information of the newly generated access token.

5. The method of claim 1, wherein, The method further comprises the following steps: performing identity authentication on the first NF based on the first request and the management information of the set of NFs; if it is determined that the first NF belongs to the set of NFs, querying, based on the first request and the management information of the set of NFs, whether there is a valid access token of the target NF in the set of NFs.

6. A method of access control of a network function, characterized by, The method is applied to a second network function (NF) in a set of network functions (NFs), and the method comprises the following steps: obtaining a first request forwarded by a network storage function (NRF) from a first NF in the set of NFs, wherein the first request is used to request an access token of a target NF; returning a response message to the NRF based on a use state of a valid access token of the target NF currently held by the set of NFs, wherein the response message is used to instruct the NRF whether to forward the stored valid access token; The method further comprises the following steps: if it is determined that the valid access token is not being used, deleting the locally stored valid access token.

7. The method of claim 6, wherein, The step of returning a response message to the NRF based on a use state of a valid access token of the target NF currently held by the set of NFs comprises the following steps: if it is determined that the valid access token is not being used, sending a first message for confirming the forwarding to the NRF; or if it is determined that the valid access token is being used, sending a second message for rejecting the forwarding to the NRF. determining that the valid access token is being used, sending a second message of a rejection of forwarding to the NRF.

8. An apparatus for access control of a network function, the apparatus comprising: The apparatus is applied to a network storage function (NRF), and the apparatus comprises: a first obtaining module, configured to obtain a first request sent by a first network function (NF) in a set of NFs, the first request being used to request an access token of a target NF; a querying module, configured to query, based on the first request and management information of the set of NFs, whether the set of NFs has a valid access token of the target NF; a first processing module, configured to, if it is determined that the set of NFs has the valid access token of the target NF, send the stored valid access token to the first NF; the first processing module is further configured to, if it is determined that the set of NFs does not have an access token of the target NF or the access token of the target NF that exists has expired, generate an access token of the target NF based on the first request and send the access token to the first NF; and store the generated access token based on the first request.

9. An apparatus for access control of a network function, the apparatus comprising: The apparatus is applied to a second NF in a set of network functions (NFs), and the apparatus comprises: a second obtaining module, configured to obtain a first request from a first NF in the set of NFs forwarded by a network storage function (NRF), the first request being used to request an access token of a target NF; a second processing module, configured to return a response message to the NRF based on a current use state of a valid access token of the target NF corresponding to the set of NFs that is currently possessed, the response message being used to instruct the NRF whether to forward the stored valid access token; the second processing module is further configured to, if it is determined that the valid access token is not being used, delete the locally stored valid access token.

10. A network function device, comprising: comprise: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the steps of the method of any one of claims 1 to 5 when running the computer program.

11. A network function device, comprising: comprise: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the steps of the method of any one of claims 6 to 7 when running the computer program.

12. A storage medium having stored thereon a computer program, characterized in that the computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images