Application program interface calling method, device, and system

Abstract

The present application provides an API calling method and its device and system, wherein the method may include an application program interface (API) providing network element receiving an API call request for a target application from an application server, the API call request being used to request information for operating a terminal device, the API call request including a first identifier of the terminal device and an identifier of the target application on the application server side; obtaining an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side; the authorization result being used to indicate whether the application server is allowed to operate the terminal device information; and determining whether the application server is allowed to execute the operation of the terminal device information based on the authorization result. The present application can reduce the risk of terminal device information being leaked, thereby improving information security.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an application program interface calling method, device, and system thereof. Background Art

[0002] The 3rd Generation Partnership Project (3GPP) defines many features involving application programming interface (API) calls. For example, Section 5.20 of 3GPP TS 23.501 states that an API-calling network element can call an API exposed by an API-providing network element to connect 3GPP services with external application functions. For example, a third-party application function (AF) network element can request an API-providing network element to call the API to obtain the corresponding service.

[0003] In some scenarios, the API-providing NE can provide the AF NE with APIs for operating on terminal device information, such as location services (requesting to read the terminal device's location information). The AF NE can call these APIs exposed by the API-providing NE to read, modify, add, or delete terminal device information, which may involve privacy concerns, such as location information or the terminal device's identifier (ID).

[0004] When the AF network element calls an API, the API provider and the AF network element perform mutual authentication. If authentication succeeds, the AF network element can manipulate the terminal device's information by calling the API. This process fails to consider whether the user has authorized the AF network element to perform the corresponding operation, potentially leaking terminal device information and posing a security risk. Summary of the Invention

[0005] The present application provides an application software programming interface calling method and its device and system, which can reduce the risk of information leakage of terminal devices and improve information security.

[0006] In a first aspect, the present application provides an API calling method that can be applied to scenarios where an application calls an API through a mobile network. The method can be executed by an API providing network element, or by a device (such as a processor or chip) in the API providing network element. The method uses the API providing network element as an example and includes the following content.

[0007] The API providing network element receives an API call request for a target application from an application server, where the API call request is used to request information for operating a terminal device, and the API call request includes a first identifier of the terminal device and an identifier of the target application on the application server side; obtains an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side; the authorization result is used to indicate whether the application server is allowed to operate information on the terminal device; and determines whether the application server is allowed to execute information for operating the terminal device based on the authorization result.

[0008] In the first aspect of the present application, the application server carries the first identifier of the terminal device in the API call request for the target application, so that the API providing network element determines whether the information requested by the application server to operate the terminal device is authorized by the terminal device based on the first identifier of the terminal device, thereby reducing the risk of information leakage of the terminal device and improving the security of the information.

[0009] In one possible implementation, the API provisioning network element sends an authorization request to the permission storage network element. The authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and operation instruction information; the operation instruction information is used to indicate the operation to be performed on the information of the terminal device; and the authorization response is received from the permission storage network element. The authorization response includes an authorization result. This is equivalent to the API provisioning network element directly obtaining the authorization result from the permission storage network element. The authorization result directly indicates whether the application server is allowed to operate the information of the terminal device. This simplifies the implementation and can reduce the processing load of the API provisioning network element.

[0010] In one possible implementation, the API providing network element sends an authorization request to the permission storage network element, the authorization request includes the second identifier of the terminal device; receives an authorization response from the permission storage network element, the authorization response includes the permissions of all applications corresponding to the terminal device on the mobile network side; determines the authorization result based on the identifier of the target application on the application server side, the permissions of all applications corresponding to the terminal device on the mobile network side, and the operation instruction information; wherein the operation instruction information is used to indicate the operation of the information of the terminal device. In this way, the API providing network element uses the second identifier of the terminal device to obtain the permissions of all applications corresponding to the terminal device on the mobile network side from the permission storage network element, and combines the identifier of the target application on the application server side, the permissions of all applications corresponding to the terminal device on the mobile network side, and the operation instruction information to independently determine whether the application server is allowed to operate the information of the terminal device to obtain the authorization result. This can improve the autonomous judgment ability of the API providing network element.

[0011] In one possible implementation, the API providing network element sends an authorization request to the permission storage network element, the authorization request includes the identifier of the target application on the mobile network side; receives an authorization response from the permission storage network element, the authorization response includes the permissions of all terminal devices corresponding to the target application on the mobile network side; determines the authorization result based on the first identifier of the terminal device, the permissions of all terminal devices corresponding to the target application on the mobile network side, and the operation instruction information; wherein the operation instruction information is used to indicate the operation on the information of the terminal device. In this way, the API providing network element uses the identifier of the target application on the mobile network side to obtain the permissions of all terminal devices corresponding to the target application on the mobile network side from the permission storage network element, and combines the first identifier of the terminal device, the permissions of all terminal devices corresponding to the target application on the mobile network side, and the operation instruction information to autonomously determine whether to allow the application server to operate the information of the terminal device, and obtain the authorization result. The autonomous judgment ability of the API providing network element can be improved.

[0012] In one possible implementation, the API providing network element sends an authorization request to the permission storage network element, the authorization request includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; receives an authorization response from the permission storage network element, the authorization response includes the permissions of the target application of the terminal device on the mobile network side; determines the authorization result based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate the operation of the information of the terminal device. In this way, the API providing network element uses the second identifier of the terminal device and the identifier of the target application on the mobile network side to obtain the permissions of the target application of the terminal device on the mobile network side from the permission storage network element, and combines the permissions and operation instruction information of the target application of the terminal device on the mobile network side to autonomously determine whether to allow the application server to operate the information of the terminal device, and obtains the authorization result. The autonomous judgment ability of the API providing network element can be improved.

[0013] In the above methods, if the first identifier of the terminal device is different from the second identifier of the terminal device, the API provides a network element that can convert the first identifier of the terminal device into the second identifier of the terminal device; if the identifier of the target application on the terminal device side is different from the identifier of the target application on the mobile network side, the API provides a network element that can convert the identifier of the target application on the terminal device side into the identifier of the target application on the mobile network side.

[0014] In one possible implementation, when the application server is allowed to execute information of the operating terminal device, the API providing network element sends an API call response to the application server, and the API call response is used to indicate the successful execution of the API call request so that the application server knows that the requested information of the operating terminal device is authorized.

[0015] In one possible implementation, when the application server is prohibited from executing information on the operating terminal device, the API providing network element sends an API call response to the application server. The API call response is used to indicate the rejection of the API call request to inform the application server that the API call cannot be executed.

[0016] In a possible implementation, the API call response includes a rejection reason, where the rejection reason is used to indicate that the operation requested by the application server is not authorized, so that the application server knows that the requested operation is not authorized.

[0017] In one possible implementation, the API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; a permission response message is received from the access and mobility management network element, and the permission response message includes the permissions of the target application of the terminal device on the mobile network side; based on the permissions and operation indication information of the target application of the terminal device on the mobile network side, it is determined whether the application server is allowed to perform operations on the information of the terminal device; wherein the operation indication information is used to indicate operations on the information of the terminal device. In this way, the API providing network element triggers the access and mobility management network element to obtain the permissions of the target application on the mobile network side to determine whether the application server is allowed to perform operations on the information of the terminal device, thereby reducing the risk of information leakage of the terminal device and improving the security of the information.

[0018] In a possible implementation, the operation instruction information in the above-mentioned several methods is determined according to the API call request. For example, the API call request has an API function.

[0019] In a possible implementation, the API call request includes a processing operation instruction, and the API providing network element determines the operation instruction information according to the processing operation instruction.

[0020] The second aspect of the present application provides an API calling method that can be applied to scenarios where an application calls an API through a mobile network. The method can be executed by a permission storage network element, or by a device (such as a processor or chip) in the permission storage network element. Taking the permission storage network element as an example, the method includes the following content.

[0021] The permission storage network element receives an authorization request from the API providing network element, where the authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and operation indication information, where the operation indication information is used to indicate the operation on the information of the terminal device; the authorization request is used to request an authorization result; the authorization result is used to indicate whether the application server is allowed to perform operations on the information of the terminal device; the authorization result is obtained based on the authorization request and the stored permission information, where the stored permission information includes the permissions of the target application of the terminal device on the mobile network side; and an authorization response is sent to the API providing network element, where the authorization response includes the authorization result.

[0022] In the second aspect of the present application, the permission storage network element directly provides the API providing network element with an authorization result indicating whether the application server is allowed to perform operations on the terminal device. The API providing network element can directly determine whether the application server is allowed to perform operations on the terminal device based on the authorization result. The implementation is simple and can reduce the risk of information leakage of the terminal device to improve the security of the information.

[0023] In one possible implementation, the permission storage network element receives a contract update message, which includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side; the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side are stored in the storage permission information, so that when the permission storage network element receives the authorization request, it can obtain the authorization result based on the authorization request and the storage permission information.

[0024] The subscription update message may come from an access and mobility management network element or an authorization server.

[0025] In one possible implementation, the authorization request includes a second identifier of the terminal device; the permission storage network element obtains the permissions of all applications corresponding to the terminal device on the mobile network side based on the second identifier of the terminal device, and sends an authorization response to the API providing network element, where the authorization response includes the permissions of all applications corresponding to the terminal device on the mobile network side. The API providing network element autonomously determines whether to allow the application server to operate the terminal device based on the identifier of the target application on the application server side and the permissions of all applications corresponding to the terminal device on the mobile network side.

[0026] In one possible implementation, the authorization request includes an identifier of the target application on the mobile network side; the permission storage network element obtains the permissions of all terminal devices corresponding to the target application on the mobile network side based on the identifier of the target application on the mobile network side, and sends an authorization response to the API providing network element, where the authorization response includes the permissions of all terminal devices corresponding to the target application on the mobile network side. The API providing network element autonomously determines whether to allow the application server to operate the terminal device based on the permissions of all terminal devices corresponding to the target application on the mobile network side and the first identifier of the terminal device.

[0027] In one possible implementation, the authorization request includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; the permission storage network element obtains the permissions of the target application of the terminal device on the mobile network side based on the second identifier of the terminal device and the identifier of the target application on the mobile network side, and sends an authorization response to the API providing network element, where the authorization response includes the permissions of the target application of the terminal device on the mobile network side. The API providing network element independently determines whether to allow the application server to operate the terminal device based on the permissions of the target application of the terminal device on the mobile network side.

[0028] In a third aspect, the present application provides an API calling method that can be applied to scenarios where an application calls an API via a mobile network. The method can be executed by a terminal device or by a device in the terminal device (such as a processor or chip). Taking the terminal device as an example, the method includes the following content.

[0029] The terminal device determines the permissions of the target application on the terminal side; converts the identifier of the target application on the terminal side into the identifier of the target application on the mobile network side, and converts the permissions of the target application on the terminal side into the permissions of the target application on the mobile network side; sends an uplink non-access layer NAS message to the access and mobility management network element; the uplink NAS message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0030] In a third aspect of the present application, a terminal device sends the permissions of a target application on the mobile network side and an identifier of the target application on the mobile network side to an access and mobility management network element, so that the access and mobility management network element updates the permissions of the target application on the mobile network side of the terminal device. This in turn facilitates the permission storage network element to update the permissions of the target application on the mobile network side of the terminal device.

[0031] In a possible implementation, the terminal device converts the first identifier of the terminal device into the second identifier of the terminal device so that the mobile network side can recognize it.

[0032] In a possible implementation, the terminal device determines the authority of the target application on the terminal device side when receiving a downlink NAS message from the access and mobility management network element, where the downlink NAS message includes an identifier of the target application on the mobile network side.

[0033] In a fourth aspect, the present application provides an API calling method that can be applied to scenarios where an application calls an API via a mobile network. The method can be executed by an application server or by a device in the application server (such as a processor or chip). Taking the application server as an example, the method includes the following content.

[0034] The application server sends an API call request for the target application to the API providing network element. The API call request is used to request information for operating the terminal device. The API call request includes a first identifier of the terminal device and an identifier of the target application on the application server side; and receives an API call response from the API providing network element. The API call response is used to indicate successful execution or rejection of the API call request.

[0035] In the fourth aspect of the present application, the application server carries the first identifier of the terminal device in the API call request for the target application, so that the API providing network element determines whether the information requested by the application server to operate the terminal device is authorized by the terminal device based on the first identifier of the terminal device, thereby reducing the risk of information leakage of the terminal device and improving the security of the information.

[0036] In a possible implementation, the API call response is used to indicate rejection of the API call request, and the API call response includes a rejection reason, which is used to indicate that the operation requested by the application server is not authorized.

[0037] In a fifth aspect, the present application provides a communication device, which may be an API providing network element or a device in an API providing network element. In one design, the device may include a module corresponding to the method / operation / step / action described in the first aspect and various possible implementations. The module may be a hardware circuit, software, or a combination of hardware circuit and software. In one design, the device may include a processing module and a transceiver module. For example,

[0038] The transceiver module is used to receive an API call request from the application server for the target application. The API call request is used to request information for operating the terminal device. The API call request includes the first identifier of the terminal device and the identifier of the target application on the application server side.

[0039] The processing module is used to obtain an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side; the authorization result is used to indicate whether the application server is allowed to operate the terminal device; based on the authorization result, it is determined whether the application server is allowed to execute the information of the terminal device.

[0040] In a sixth aspect of the present application, there is provided a communication device, which includes a processor for implementing the method described in the first aspect above. The device may also include a memory for storing instructions and data. The memory is coupled to the processor, and when the processor executes the instructions stored in the memory, the device can implement the method provided in the first aspect and each possible implementation of the first aspect. The device may also include a communication interface, which is used for the device to communicate with other devices. Exemplarily, the communication interface may be a circuit hardware module such as a transceiver or a bus, and the other device may be an application server, etc. In one possible design, the device includes:

[0041] a memory for storing program instructions;

[0042] The processor is configured to receive, using a communication interface, an API call request for a target application from an application server, the API call request being used to request information for operating a terminal device, the API call request including a first identifier of the terminal device and an identifier of the target application on the application server side; obtain an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side; the authorization result being used to indicate whether the application server is allowed to operate information on the terminal device; and determine, based on the authorization result, whether the application server is allowed to execute information for operating the terminal device.

[0043] In a seventh aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the first aspect and various possible implementations of the first aspect.

[0044] In an eighth aspect, the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method provided in the first aspect and each possible implementation of the first aspect. The chip system may be composed of a chip or may include a chip and other discrete devices.

[0045] In a ninth aspect of the present application, a communication device is provided. The communication device may be a permission storage network element or a device in a permission storage network element. In one design, the device may include a module corresponding to the method / operation / step / action described in the second aspect and various possible implementations. The module may be a hardware circuit, software, or a combination of hardware circuit and software. In one design, the device may include a processing module and a transceiver module. Exemplarily,

[0046] a transceiver module, configured to receive an authorization request from an API providing network element, the authorization request including a second identifier of the terminal device, an identifier of the target application on the mobile network side, and operation instruction information, the operation instruction information being used to indicate an operation on the information of the terminal device; the authorization request being used to request an authorization result; the authorization result being used to indicate whether the application server is allowed to execute the operation on the information of the terminal device;

[0047] A processing module, configured to obtain an authorization result based on the authorization request and storage permission information, wherein the storage permission information includes permissions of the target application of the terminal device on the mobile network side;

[0048] The transceiver module is further configured to send an authorization response to the API providing network element, where the authorization response includes an authorization result.

[0049] In a tenth aspect, the present application provides a communication device, which includes a processor for implementing the method described in the second aspect above. The device may also include a memory for storing instructions and data. The memory is coupled to the processor, and when the processor executes the instructions stored in the memory, the device can implement the method described in the second aspect and each possible implementation of the second aspect. The device may also include a communication interface, which is used for the device to communicate with other devices. Exemplarily, the communication interface can be a circuit hardware module such as a transceiver and a bus, and other devices can provide network elements for the API, etc. In one possible design, the device includes:

[0050] a memory for storing program instructions;

[0051] A processor is used to use a communication interface to receive an authorization request from an API providing network element, the authorization request including a second identifier of the terminal device, an identifier of the target application on the mobile network side, and operation indication information, the operation indication information being used to indicate an operation on the information of the terminal device; the authorization request is used to request an authorization result; the authorization result is used to indicate whether the application server is allowed to perform operations on the information of the terminal device; obtain an authorization result based on the authorization request and storage permission information, the storage permission information including the permissions of the target application of the terminal device on the mobile network side; and send an authorization response to the API providing network element, the authorization response including the authorization result.

[0052] In an eleventh aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the second aspect and various possible implementations of the second aspect.

[0053] In a twelfth aspect, the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method provided in the second aspect and each possible implementation of the second aspect. The chip system may be composed of a chip or may include a chip and other discrete devices.

[0054] In a thirteenth aspect of the present application, a communication device is provided. The communication device may be a terminal device or a device in a terminal device. In one design, the device may include a module corresponding to executing the method / operation / step / action described in the third aspect and various possible implementations. The module may be a hardware circuit, software, or a combination of hardware circuit and software. In one design, the device may include a processing module and a transceiver module. Exemplarily,

[0055] A processing module, configured to determine the permissions of the target application on the terminal side; convert the identifier of the target application on the terminal side into the identifier of the target application on the mobile network side, and convert the permissions of the target application on the terminal side into the permissions of the target application on the mobile network side;

[0056] The transceiver module is used to send an uplink non-access layer NAS message to the access and mobility management network element; the uplink NAS message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the authority of the target application on the mobile network side.

[0057] In a fourteenth aspect, the present application provides a communication device, which includes a processor for implementing the method described in the third aspect above. The device may also include a memory for storing instructions and data. The memory is coupled to the processor, and when the processor executes the instructions stored in the memory, the device can implement the method described in the third aspect and each possible implementation of the third aspect. The device may also include a communication interface, which is used for the device to communicate with other devices. Exemplarily, the communication interface can be a circuit hardware module such as a transceiver and a bus, and the other device can be an access and mobility management network element, etc. In one possible design, the device includes:

[0058] a memory for storing program instructions;

[0059] The processor is configured to determine the permissions of the target application on the terminal side; convert the identifier of the target application on the terminal side into the identifier of the target application on the mobile network side, and convert the permissions of the target application on the terminal side into the permissions of the target application on the mobile network side; and send an uplink non-access layer (NAS) message to the access and mobility management network element; the uplink NAS message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0060] In a fifteenth aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the third aspect and various possible implementations of the third aspect.

[0061] In a sixteenth aspect, the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method provided in the third aspect and each possible implementation of the third aspect. The chip system may be composed of a chip or may include a chip and other discrete devices.

[0062] A seventeenth aspect of the present application provides a communication system, the communication system comprising the API providing network element involved in the first aspect and the permission storage network element involved in the second aspect. Optionally, the communication system further comprises the application server involved in the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1a This is a schematic diagram of the network architecture of the 5G system;

[0064] Figure 1b This is a diagram of the 5G MEC network architecture;

[0065] Figure 2 A schematic diagram showing the correspondence between the identifier and permissions of the target application provided in an embodiment of the present application;

[0066] Figure 3 A schematic diagram of a network architecture for applying an embodiment of the present application;

[0067] Figure 4 A flowchart of the API calling method provided in Example 1 of this application;

[0068] Figure 5 A flowchart of the API calling method provided in Example 2 of this application;

[0069] Figure 6 A flowchart of the API calling method provided in Example 3 of this application;

[0070] Figure 7 A flowchart of the API calling method provided in Example 4 of this application;

[0071] Figure 8 A flowchart of the API calling method provided in Example 5 of this application;

[0072] Figure 9 A flowchart of an API calling method under a 5G MEC network architecture provided in an embodiment of the present application;

[0073] Figure 10A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0074] Figure 11 A schematic diagram of the structure of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In order to better understand the technical solutions provided by the embodiments of the present application, the technical terms involved in the embodiments of the present application are first introduced.

[0076] 1. Fifth Generation Communications (5 th -generation, 5G) system network architecture

[0077] See Figure 1a , is a schematic diagram of the network architecture of the 5G system, which includes user equipment (UE), access network (AN) equipment, core network elements and data network (DN).

[0078] Among them, the access network device may also be a radio access network (RAN) device. The access network device may include a base station (BS), which may be a device deployed in a radio access network that can communicate wirelessly with a terminal device. Among them, the base station may have various forms, such as a macro base station, a micro base station, a relay station, and an access point. Exemplarily, the access network device involved in the embodiment of the present application may be a base station in 5G or a base station in long-term evolution (LTE), wherein the base station in 5G may also be referred to as a transmission reception point (TRP) or a next generation base station node (gNB).

[0079] Among them, the core network elements may include these network elements: user plane function (UPF), access and mobility management function (AMF), session management function (SMF), policy control function (PCF), application function (AF), authentication server function (AUSF), network slice selection function (NSSF) and unified data management (UDM) and application function (AF).

[0080] The AMF network element, the termination point for non-access stratum (NAS) signaling, is primarily responsible for user access and mobility management. The UE and AMF can communicate via N1 NAS messages or via RAN N2 messages. The RAN and AMF communicate via N2 messages.

[0081] The SMF network element is responsible for managing the creation and deletion of user (protocol data unit, PDU) sessions, maintaining PDU session context and user plane forwarding channel information.

[0082] The NSSF network element is used to support flexible slice selection based on user-requested and contracted network slice selection assistance information (NSSAI), user location area, slice capacity, slice current load and other information.

[0083] The PCF network element is used to generate and manage user, session, and quality of service (QoS) flow processing policies.

[0084] UDM network element is used to manage user contract information and complete user authentication and authorization.

[0085] AF network element, provides application services, can be located in the operator network, can also be located outside the operator network. Application In the embodiment of the present application, AF network element can be called application server, for example, can be a positioning server, a server corresponding to a shopping application, etc.

[0086] In addition to the aforementioned core network elements, the 5G system may also include the following core network elements:

[0087] The Network Exposure Function (NEF) network element is used to provide an API for the operator network to be open to the outside world and to facilitate interaction between external servers and the internal operator network.

[0088] The unified data repository (UDR) is a network element used to store contract data for UDM network elements, policy data for PCF network elements, and structured data for NEF network elements. UDM, PCF, and NEF network elements can obtain relevant data from UDR network elements.

[0089] The core network elements involved in the embodiments of the present application include AMF network elements, UDM network elements, UDR network elements, AF, common API framework (CAPIFCAPIF) and NEF network elements. Among them, CAPIF can provide support service API operations, enabling API callers to discover and call service APIs provided by API providing network elements.

[0090] Figure 1a The network architecture diagram shown also includes interfaces between various network elements, for example, N2 represents the interface between the AMF network element and the RAN device.

[0091] 2. 5G Mobile Edge Computing (MEC) Network Architecture

[0092] See Figure 1b , is a schematic diagram of the 5G MEC network architecture, which includes UE, the Third Generation Partnership Project (3 rd -generation partnership project, 3GPP) core network and edge data network (edge ​​datanetwork).

[0093] The UE may include an application client (AC) and an edge enable client (EEC). The interface between the AC and the EEC may be an edge-5 interface.

[0094] AC is a module of UE and can be understood as the client of an application (App), such as the client of a shopping App or an instant messaging App installed on the UE.

[0095] EEC, a module of UE, provides the functions required by AC, including obtaining configuration information for data transmission with edge application server(s) (EAS), discovering EAS in the edge network, etc.

[0096] Among them, the 3GPP core network refers to the core network defined by the 3GPP protocol, which can be a 5G core network or a core network in a future communication system.

[0097] The edge data network may include an EAS and an edge enable server (EES). The interface between the EAS and the EES may be an edge-3 interface.

[0098] The EAS, located at the application server end of the edge data network, provides application services. When communicating with the UE, the EAS can transmit application data directly with the UE's AC or through the 3GPP core network. The interface between the EAS and the 3GPP core network can be the edge-7 interface.

[0099] The EES, located at the edge data network, provides support for the EAS and edge configuration server (ECS), including providing information for the EEC to connect to the EAS for data exchange, providing API call and API openness functions, and the ability to interact with mobile networks. The interface between the EES and the EEC can be the edge-1 interface, and the interface between the EES and the 3GPP core network can be the edge-2 interface, that is, the interface with the mobile network.

[0100] ECS, located at the edge data network, provides the function of supporting EEC to connect to EES, including providing information about EEC connecting to the network where EES is located and information about EES itself.

[0101] Application In the embodiments of the present application, EAS, EES and ECS may be referred to as application servers.

[0102] 3. The target application's identifier on the terminal device side, the target application's identifier on the mobile network side, and the target application's identifier on the application server side; the target application's permissions on the UE side, the target application's permissions on the mobile network side, and the target application's permissions on the application server side

[0103] The target application's identifier on the UE side, the target application's identifier on the mobile network side, the target application's identifier on the application server side, the target application's permissions on the UE side, the target application's permissions on the mobile network side, and the target application's permissions on the application server side can be found in Figure 2The application can be software that provides the functions required for the service, for example, an application running on a terminal device. The target application can be any application.

[0104] The identifier of the target application on the terminal device side can be understood as the identifier used by the terminal device side to identify the target application. For example, the identifier of the target application on the UE side can be the application package name or the operating system (OS) application (App) identifier (ID).

[0105] The identifier of the target application on the mobile network side can be understood as the identifier used by the mobile network side to identify the target application. The mobile network can be a mobile operator, such as a 5G core network. For example, the identifier of the target application on the mobile network side can be an application identifier (application identifier), AF ID, application server (AS) ID, AF transaction ID, or operating system identifier (OSID) + OSAppID, etc.

[0106] The target application identifier on the application server side can be understood as the identifier used by the application server to identify the target application. For example, the target application identifier on the application server side can be an application identifier, an external application identifier, an IP address, an IP triplet or quintuple, an AF ID, an AS ID, or an AF transaction ID.

[0107] The identifier of the target application on the terminal device side, the identifier of the target application on the mobile network side, and the identifier of the target application on the application server side may be the same or different.

[0108] The permissions of the target application on the terminal device side refer to the permissions of the target application on the terminal device, that is, whether the user grants the target application the ability to perform a certain operation. One possible format of the permissions of the target application on the terminal device side is {allow / conditionally allow / prohibit / conditionally prohibit, operation}. Among them, the operation can be the target application reading / adding / modifying / deleting certain information. For example, the user allows the target application to read the device ID of the terminal device, prohibits the target application from accessing the location information of the terminal device, allows the target application to access the location information of the terminal device during the use of the target application, allows the target application to adjust the configuration during the use of the target application, etc. Another possible format of the permissions of the target application on the terminal device side is {allow / conditionally allow / prohibit / conditionally prohibit, a certain system's API}. A certain system's API refers to the API of the terminal device's operating system, such as the Android system's API or the Apple Operating System (IOS) system's API, etc. For example, if the user allows the target application to access the user's device number during use, then the possible format of the permissions of the target application on the terminal device side is {allow during use, access to the user's device number's API}.

[0109] The target application's mobile network permissions refer to the target application's permissions within the mobile network. Possible formats are {Allow / Conditionally Allow / Prohibit / Conditionally Prohibit, a mobile network-exposed API}. Mobile network-exposed APIs are those provided by mobile operators, such as those exposed by the 5G core network. For example, if a user allows a target application to access their location information during a specified time period, the target application's mobile network permissions might be {Allowed during a specified time period, API access to user location information}.

[0110] The permissions of the target application on the application server side refer to the permissions of the target application on the application server.

[0111] The permissions of the target application on the UE side, the permissions of the target application on the mobile network side, and the permissions of the target application on the application server side may be the same or different.

[0112] 4. Information about the terminal device, the first identifier of the terminal device, and the second identifier of the terminal device

[0113] The terminal device (also referred to as a terminal) involved in the embodiments of the present application can be a device with wireless transceiver functions, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (for example, on airplanes, balloons, and artificial satellites, etc.). The terminal device can be a UE, which includes a handheld device, a vehicle-mounted device, a wearable device, or a computing device with wireless communication functions. Exemplarily, the UE can be a mobile phone, a tablet computer, or a computer with wireless transceiver functions. The terminal device can also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a smart vehicle terminal device, a wireless terminal in industrial control, a wireless terminal in unmanned driving, a drone, a drone controller, a wireless terminal in telemedicine, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home, and the like.

[0114] Terminal device information can be information collected or stored on the terminal device, and this information can be multimedia information, private information, or configuration information. Multimedia information includes video, audio, images, and text. Private information includes location information, contacts, call logs, chat logs, or device identification. Configuration information includes operating system configuration information or application configuration information. In this application, terminal device information can refer to the terminal's contextual information stored within the mobile network.

[0115] In this application, the first identifier of the terminal device is used to identify the terminal device on the application server side. The second identifier of the terminal device is used to identify the terminal device within the mobile network, that is, to identify the terminal device within the mobile operator, for example, to identify the terminal device within the 5G core network. The first identifier of the terminal device and the second identifier of the terminal device may be the same or different.

[0116] Exemplarily, the first identifier may be one or more of the following:

[0117] Internet protocol (IP) address, IP triplet, IP quintuple, or generic public subscription identifier (GPSI), etc.

[0118] Exemplarily, the second identifier may be a subscription permanent identifier (SUPI), a globally unique temporary identity (GUTI), or the like.

[0119] 5. APIs in mobile networks

[0120] In mobile networks, API-providing network elements can provide application servers with APIs for operating terminal device information. These APIs can include parameter configuration services, location services, identity conversion services, etc. Application servers can call these APIs to read / modify / add / delete terminal device information.

[0121] For example, the parameter configuration service can configure the application information of the terminal device, such as the expected behavior of the terminal device, network configuration parameters, location-privacy indication, etc. The application server calls the API corresponding to the parameter configuration service to configure the application information of the terminal device.

[0122] For another example, location services can request the location information of a terminal device. The positioning server calls the API corresponding to the location service to read the location information of the terminal device.

[0123] For another example, the identity conversion service can use the terminal device's Internet Protocol (IP) address to request the terminal device's generic public subscription identifier (GPSI). The application server invokes the identity conversion service and uses the terminal device's IP address as input to the identity conversion service's corresponding API. The API output is the terminal device's GPSI. In other words, the application server can obtain the terminal device's GPSI by invoking the identity conversion service's corresponding API.

[0124] When installing or configuring an app on a terminal device, the user can authorize the app to perform the corresponding operations. For example, when installing a navigation app on a terminal device, the user can authorize the app to read the terminal device's location information. The terminal device can send the permissions set for the application on the terminal device to the API provider network element, so that the API provider network element can provide an API based on service granularity.

[0125] Because the application server does not consider whether the user has authorized the application server to perform the corresponding operation during the process of calling the API, all applications can obtain the corresponding services by calling the API if the API network element is authenticated, which may cause the terminal device information to be leaked, posing a security risk.

[0126] In view of this, the embodiments of the present application provide an API calling method and its device and system, which can reduce the risk of information leakage of terminal devices and improve the security of information.

[0127] In the drawings of the embodiments of this application, the steps shown in each embodiment and the order of the steps are for illustrative purposes only and do not constitute a limitation on the embodiments of this application. It should be understood that performing some of the steps shown in the drawings or adjusting the order of the steps for specific implementations falls within the scope of protection of this application.

[0128] The technology described in the embodiments of the present application can be used in various communication systems, such as fourth generation (4G) communication systems, 4.5G communication systems, 5G communication systems, systems that integrate multiple communication systems, or future evolved communication systems.

[0129] See Figure 3 , is a schematic diagram of the network architecture applying the embodiment of the present application. Figure 3 It includes an application server 301 and an API providing network element 302.

[0130] Among them, the application server 301 can be Figure 1a AF in, or Figure 1b EAS, EES, or ECS in.

[0131] The API providing network element 302 is used to provide the API for operating the information of the terminal device to the application server 301. It can be the NEF network element in the 5G core network, or it can be CAPIF, or it can be Figure 1b EES or ECS in the CAPIF can provide support service API operations, enabling API callers to discover and call service APIs provided by API providing network elements.

[0132] Optional, Figure 4 The network architecture shown also includes a permission storage network element 303 for storing the identity of the application on the mobile network side and the permissions of the application on the mobile network side. The permission storage network element 303 can be a UDM network element, a UDR network element, or a PCF network element in the 5G core network.

[0133] It should be noted that the names of the application server 301, the API providing network element 302 and the permission storage network element 303 are used for examples and do not constitute a limitation on the embodiments of the present application.

[0134] In this application, application server 301 sends an API call request for a target application to API provisioning network element 302. This API call request is used to request information for operating a terminal device. The API call request includes a first identifier of the terminal device and an identifier of the target application on the application server side. Based on the first identifier of the terminal device and the identifier of the target application on the application server side, application server 301 obtains an authorization result, which indicates that the application server is allowed to operate the terminal device. Based on the authorization result, API provisioning network element 302 determines whether the application server is allowed to execute the information for operating the terminal device.

[0135] In one implementation, the API providing network element 302 sends an authorization request to the permission storage network element 303. The authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and operation instruction information, and the operation instruction information is used to indicate the operation of the information of the terminal device; the authorization request is used to request an authorization result; the authorization result is used to indicate whether the application server 301 is allowed to perform operations on the information of the terminal device; based on the authorization request and the stored permission information, an authorization result is obtained, and the stored permission information includes the permissions of the target application of the terminal device on the mobile network side; an authorization response is sent to the API providing network element 301, and the authorization response includes the authorization result. The API providing network element directly determines whether the application server is allowed to perform operations on the information of the terminal device based on the authorization result.

[0136] In one implementation, the API providing network element 302 sends an authorization request to the permission storage network element 303, and the authorization request includes the second identifier of the terminal device. The permission storage network element 303 obtains the permissions of all applications corresponding to the terminal device on the mobile network side based on the second identifier of the terminal device, and sends an authorization response to the API providing network element 302, and the authorization response includes the permissions of all applications corresponding to the terminal device on the mobile network side. The API providing network element 302 independently determines whether to allow the application server to operate the information of the terminal device based on the identifier of the target application on the application server side and the permissions of all applications corresponding to the terminal device on the mobile network side, as well as operation instruction information, which is used to indicate the operation of the information of the terminal device.

[0137] In one implementation, the API providing network element 302 sends an authorization request to the permission storage network element 303, where the authorization request includes the identifier of the target application on the mobile network side. The permission storage network element 303 obtains the permissions of all terminal devices corresponding to the target application on the mobile network side based on the identifier of the target application on the mobile network side, and sends an authorization response to the API providing network element 302, where the authorization response includes the permissions of all terminal devices corresponding to the target application on the mobile network side. The API providing network element 302 autonomously determines whether to allow the application server to operate the information of the terminal device based on the permissions of all terminal devices corresponding to the target application on the mobile network side and the first identifier of the terminal device, as well as operation instruction information, where the operation instruction information is used to indicate the operation on the information of the terminal device.

[0138] In one implementation, the API providing network element 302 sends an authorization request to the permission storage network element 303, and the authorization request includes the second identifier of the terminal device and the identifier of the target application on the mobile network side. The permission storage network element 303 obtains the permission of the target application of the terminal device on the mobile network side based on the second identifier of the terminal device and the identifier of the target application on the mobile network side, and sends an authorization response to the API providing network element 302, and the authorization response includes the permission of the target application of the terminal device on the mobile network side. The API providing network element independently determines whether to allow the application server to operate the information of the terminal device based on the permission of the target application of the terminal device on the mobile network side and the operation indication information, which is used to indicate the operation of the information of the terminal device.

[0139] The operation instruction information in the above-mentioned several methods may be determined according to an API call request, or may be determined according to a processing operation instruction, where the API call request includes a processing operation instruction.

[0140] The following is a detailed description of the API calling method provided in the embodiments of the present application, using a UE as an example of a terminal device. It should be noted that the message names between network elements or the names of parameters in the messages in the following embodiments of the present application are only examples, and other names may also be used in specific implementations, and the embodiments of the present application do not specifically limit this.

[0141] See Figure 4 , is a flowchart of the API calling method provided in Example 1 of the present application, which may include but is not limited to the following steps:

[0142] Step 401: The application server sends an API call request for a target application to the API providing network element. Correspondingly, the API providing network element receives the API call request for the target application from the application server.

[0143] An API call request is used to request an API call to manipulate UE information. It should be understood that manipulating UE information requires user authorization, specifically the UE's authorization. An API call request can be understood as an application server requesting an API provider element to invoke an API at a specific UE granularity. UE granularity refers to the permissions assigned to an application on a UE; the same application can have different permissions on different UEs.

[0144] Furthermore, the API call request can be understood as a request for the application server to provide the network element to the API to read / modify / add / delete UE information.

[0145] The API call request includes the first identifier of the UE, which is used to identify the UE requesting the operation, that is, the object of the operation requested. The first identifier of the UE can refer to the description of the first identifier of the terminal device in the terminology introduction part.

[0146] The API call request also includes the identifier of the target application on the application server side. The target application can be located on the application server that initiated the API call request or on another application server.

[0147] Optionally, the API call request also includes a processing operation instruction, which indicates the requested operation. The requested operation may include reading, modifying, adding, or deleting UE information. If the application server sends an API call request with a specific API function to the API providing network element, or the application server calls an API with a specific API function, the API call request may not include the processing operation instruction. If the API call request includes the processing operation instruction, the API providing network element may execute step 402 according to the processing operation instruction.

[0148] Exemplarily, an API call request is used to request the UE's GPSI using the UE's IP address. The API call request includes the UE's first identifier (i.e., the UE's IP address) and the identifier of the target application on the application server. The application server calls the API to provide a UE ID API exposed by the network element. The API's input parameters include the UE's IP address and the identifier of the target application on the application server. The UE ID API can be matched with operation instruction information, which indicates a request to read the UE's GPSI.

[0149] Exemplarily, an API call request is used to read the location information of the UE, and the API call request includes the first identifier of the UE (i.e., the GPSI of the UE) and the identifier of the target application on the application server side. The identifier of the target application on the application server side can be the identifier of the target application on the application server that needs to read the location information of the UE. The application server calls the API to provide a location service API exposed by the network element. The input parameters of the API include the GPSI of the UE and the identifier of the target application on the application server side. The location service API matches the operation indication information, and the operation indication information is used to indicate a request to read the location information of the UE.

[0150] Step 402: The API provides information for the network element to determine whether to allow the application server to perform operations on the UE.

[0151] It can be understood that the API provides information for the network element to determine whether to allow the target application to perform operations on the UE.

[0152] The API provides the network element to interact with the permission storage network element to determine whether the application server is allowed to perform the requested operation. The API provides the network element to determine whether the application server is allowed to perform the UE operation information in the following two ways:

[0153] Method 1: The API provides the network element to obtain the authorization result from the permission storage network element. The authorization result is used to indicate whether the application server is allowed to perform the operation on the UE. The authorization result can be expressed as a binary value, for example, 1 represents authorization allowed, and 0 represents authorization not allowed.

[0154] The API providing network element sends an authorization request to the permission storage network element, and the authorization request is used to request the authorization result.

[0155] In one implementation, a permission storage network element stores permission information, the stored permission information including the UE's second identifier, the target application's identifier on the mobile network side, and the target application's permissions on the mobile network side. The permission storage network element obtains an authorization result based on the UE's second identifier, the target application's identifier on the mobile network side, the operation instruction information, and the stored permission information. For example, the permission storage network element stores the target application's identifier on the mobile network side and the target application's permissions on the mobile network side in context information corresponding to the UE's second identifier. An authorization request may include the target application's identifier on the mobile network side, the UE's second identifier, and the operation instruction information. Upon receiving the authorization request, the permission storage network element obtains the UE's context information based on the UE's second identifier; obtains the target application's permissions on the mobile network side corresponding to the UE's context information based on the target application's identifier on the mobile network side; and determines, based on the operation instruction information and the target application's permissions on the mobile network side, whether the application server is authorized to perform the operation indicated by the operation instruction information. Based on the determination result, the permission storage network element generates an authorization result indicating whether the application server is authorized to perform the operation on the UE's information. For the UE's second identifier, see the description of the second identifier of the terminal device in the terminology introduction section.

[0156] Optionally, the operation instruction information is obtained based on the API call request. For example, the operation instruction information is obtained based on the specific API function of the API call request, or based on the processing operation instruction carried in the API call request. For example, the operation instruction information may be in the form of an API name. The API providing network element may convert the processing operation instruction into the operation instruction information.

[0157] Optionally, if the target application's identifier on the application server is different from the target application's identifier on the mobile network, the permission storage network element or API provisioning network element may convert the target application's identifier on the application server into the target application's identifier on the mobile network. For example, if App1's identifier on the application server is AF ID1 and its identifier on the mobile network is OSID1+OSAppID1, the permission storage network element or API provisioning network element may convert App1's AF ID1 into App1's OSID1+OSAppID1.

[0158] Optionally, if the UE's first identifier is different from the UE's second identifier, the authority storage network element or the API provisioning network element may replace the UE's first identifier with the UE's second identifier. For example, if UE A's second identifier is a SUPI and UE A's first identifier is a GPSI, the authority storage network element or the API provisioning network element may convert UE A's GPSI into UE A's SUPI.

[0159] Optionally, the API providing network element further sends a permission verification instruction to the permission storage network element, the permission verification instruction is used to instruct the permission storage network element to perform permission verification. After receiving the permission verification instruction, the permission storage network element triggers the above-mentioned verification process of the target application on the mobile network side.

[0160] Exemplarily, the UE context information indicated by the SUPI on the permission storage network element stores the OSAppID of shopping app 1 and its permissions on the mobile network side, i.e., shopping app 1 is prohibited from reading the UE's location information between 9:00 AM and 9:00 PM. The application server corresponding to shopping app 1 calls an API to provide a location service API exposed by a network element (e.g., NEF / CAPIF). The API input parameters include the identifier of the target application on the application server side (i.e., the identifier of shopping app 1 on the application server side) and the first identifier of the UE (i.e., GPSI). It is understood that the application server corresponding to shopping app 1 sends an API call request to the NEF / CAPIF, which includes the identifier of the target application on the application server side (i.e., the identifier of shopping app 1 on the application server side) and the first identifier of the UE (i.e., GPSI). Upon receiving the API call request or the API input parameters, the NEF / CAPIF converts the UE's GPSI into the UE's SUPI, converts the identifier of the target application on the application server side into the OSAppID, and converts the API action of calling the location service into operation instruction information for reading location information. After the conversion, the NEF / CAPIF sends an authorization request to the permission storage network element. The authorization request includes the UE's SUPI, OSAppID, and an instruction to read the location information. Upon receiving the authorization request, the permission storage network element obtains the UE's context information based on the UE's SUPI, searches the UE's context information for the shopping app 1 indicated by the OSAppID, and finds the permission on the mobile network side that prohibits reading the UE's location information from 9:00 AM to 9:00 PM. Based on the current time of 12:00 PM and the instruction to read the location information, the permission storage network element generates and sends an authorization result to the NEF / CAPIF. The authorization result indicates that the UE has not authorized the application server to read the UE's location information.

[0161] In method 2, the API-providing network element obtains stored information from the permission storage network element and obtains an authorization result based on the stored information. The authorization result indicates whether the application server is allowed to perform operations on the UE. Method 2 is divided into method A, method B, and method C based on the different stored information.

[0162] Mode A: The stored information is the permissions of all target applications corresponding to the UE on the mobile network side.

[0163] One implementation method is that the permission storage network element has storage permission information, and the stored permission information includes the second identifier of the UE, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side. The permission storage network element obtains the permissions of all target applications corresponding to the UE on the mobile network side based on the second identifier of the UE and the stored permission information. For example, the permission storage network element stores the identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side in the context information corresponding to the second identifier of the UE. The API providing network element sends the second identifier of the UE to the permission storage network element. The permission storage network element searches for the context information of the UE based on the second identifier of the UE, obtains the permissions of all target applications corresponding to the UE on the mobile network side from the context information of the UE, and sends it to the API providing network element. The API providing network element determines whether to allow the application server to perform operations on the UE based on the permissions of all target applications corresponding to the UE on the mobile network side and the API call request. Specifically, the API provides a network element to search for the permissions of all target applications on the mobile network side corresponding to the UE according to the identifier of the target application on the mobile network side carried in the API call request, obtain the permissions of the target application on the mobile network side, and determine whether the application server is allowed to perform the operation on the UE based on the permissions of the target application on the mobile network side and the operation indication information, and obtain the authorization result.

[0164] Optionally, if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, the permission storage network element or the API providing network element may convert the identifier of the target application on the application server side into the identifier of the target application on the mobile network side.

[0165] Optionally, if the first identifier of the UE is different from the second identifier of the UE, the authority storage network element or the API providing network element may convert the first identifier of the UE into the second identifier of the UE.

[0166] Exemplarily, the context information of the UE indicated by the SUPI on the permission storage network element stores the OSAppID of each current App on the UE, and also stores the permissions of each App on the mobile network side. The API providing network element sends the SUPI of the UE to the permission storage network element. The permission storage network element searches for the context information of the UE based on the SUPI of the UE, obtains the permissions of all target applications corresponding to the UE (including shopping App1) on the mobile network from the context information of the UE, and sends it to the API providing network element. The API providing network element obtains the permissions of the shopping App1 on the mobile network side based on the permissions of all target applications corresponding to the UE on the mobile network side and the identifier of the shopping App1 on the application server side, and determines whether the application server corresponding to the shopping App1 is allowed to perform operations on the UE information based on the permissions of the shopping App1 on the mobile network side, and obtains the authorization result.

[0167] Mode B: The stored information is the permissions of all UEs corresponding to the target application on the mobile network side.

[0168] One implementation method is that the permission storage network element has storage permission information, and the stored permission information includes the second identifier of the UE, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side. The permission storage network element obtains the permissions of all target applications on the mobile network side corresponding to the UE based on the second identifier of the UE and the stored permission information. For example, the permission storage network element stores the identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side in the context information corresponding to the second identifier of the UE. The API providing network element sends the identifier of the target application on the mobile network side to the permission storage network element. The permission storage network element searches for the permissions of all UEs on the mobile network side corresponding to the target application based on the identifier of the target application on the mobile network side, and sends the permissions of all UEs on the mobile network side corresponding to the target application to the API providing network element. The API providing network element determines whether the application server is allowed to perform operations on the UE information based on the permissions of all UEs on the mobile network side corresponding to the target application and the API call request, and obtains the authorization result. Specifically, the API provides a network element to search for the permissions of all UEs corresponding to the target application on the mobile network side based on the first identifier of the UE carried in the API call request, obtain the permissions of the UE on the mobile network side, and determine whether the application server is allowed to perform the requested operation based on the permissions of the UE on the mobile network side and the operation indication information.

[0169] Optionally, if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, the permission storage network element or the API providing network element may convert the identifier of the target application on the application server side into the identifier of the target application on the mobile network side.

[0170] Optionally, if the first identifier of the UE is different from the second identifier of the UE, the authority storage network element or the API providing network element may replace the first identifier of the UE with the second identifier of the UE.

[0171] Exemplarily, the context information of the UE indicated by the SUPI on the permission storage network element stores the OSAppID of each current App on the UE, and also stores the permissions of each App on the mobile network side. The API provides the network element to send the identifier of the shopping App1 on the mobile network side to the permission storage network element. The permission storage network element searches for the permissions of all UEs on the mobile network side that are authorized to the shopping App1 based on the identifier of the shopping App1 on the mobile network side, and sends the permissions of all UEs on the mobile network side corresponding to the shopping App1 to the API providing network element. The API provides the network element to determine whether to allow the application server to perform operations on the UE information based on the permissions of all UEs on the mobile network side that are authorized to the shopping App1 and the first identifier of the UE, and obtains the authorization result.

[0172] Mode C: The stored information is the permissions of the target application of the UE on the mobile network side.

[0173] In one implementation, a permission storage network element stores permission information, the stored permission information including a second identifier of the UE, an identifier of a target application on the mobile network side, and the permissions of the target application on the mobile network side. The permission storage network element obtains the UE's permissions for the target application on the mobile network side based on the second identifier of the UE, the identifier of the target application on the mobile network side, and the stored permission information. For example, the permission storage network element stores the identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side in context information corresponding to the second identifier of the UE. The API provisioning network element sends the second identifier of the UE and the identifier of the target application on the mobile network side to the permission storage network element. The permission storage network element searches the UE's context information based on the second identifier of the UE, obtains the permissions of the target application on the mobile network side corresponding to the UE's context information based on the identifier of the target application on the mobile network side, and sends the permissions of the target application on the mobile network side of the UE to the API provisioning network element. Specifically, the API provisioning network element determines whether to allow the application server to perform the operation on the UE based on the permissions of the target application on the mobile network side of the UE and the operation indication information, thereby obtaining an authorization result.

[0174] Optionally, if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, the permission storage network element or the API providing network element may convert the identifier of the target application on the application server side into the identifier of the target application on the mobile network side.

[0175] Optionally, if the first identifier of the UE is different from the second identifier of the UE, the authority storage network element or the API providing network element may convert the first identifier of the UE into the second identifier of the UE.

[0176] Exemplarily, the context information of the UE indicated by the SUPI on the permission storage network element stores the OSAppID of the shopping app 1 and the permissions of the shopping app 1 on the mobile network side. The API providing network element sends the SUPI of the UE and the identifier of the shopping app 1 on the mobile network side to the permission storage network element. The permission storage network element obtains the context information of the UE based on the SUPI of the UE, searches the context information of the UE for the permissions of the shopping app 1 indicated by the OSAppID on the mobile network side, and sends the permissions of the shopping app 1 on the mobile network side to the API providing network element. The API providing network element determines whether to allow the application server to perform operations on the UE information based on the permissions of the shopping app 1 on the mobile network side.

[0177] Optionally, in mode 2, the API providing network element also sends a permission acquisition instruction to the permission storage network element, where the permission acquisition instruction is used to instruct the permission storage network element to provide permissions on the mobile network side. After receiving the permission acquisition instruction, the permission storage network element triggers the above-mentioned process of providing permissions to the target application on the mobile network side.

[0178] Under method 2, the API providing network element obtains storage information from the permission storage network element; the API providing network element can also store storage information so that when receiving an API call request, if it can be judged based on the storage information, it can directly judge whether to allow the application server to perform the requested operation based on the storage information.

[0179] For the above-mentioned method A, the API providing network element stores the permissions of all target applications corresponding to the UE on the mobile network side. Then, when the API providing network element receives an API call request requesting to operate the same UE information again, it can directly search for the permissions of all target applications corresponding to the UE on the mobile network side based on the identifier of the target application on the application server side carried by the API call request, obtain the permissions of the target application on the mobile network side, and determine whether the application server is allowed to operate the UE information based on the permissions of the target application on the mobile network side, as well as the specific API function or the operation indication information carried by the API call request.

[0180] For the above-mentioned method B, the API providing network element stores the permissions of all UEs corresponding to the target application on the mobile network side. Then, when the API providing network element receives an API call request initiated by the same target application again, it can directly search for the permissions of all UEs corresponding to the target application on the mobile network side based on the first identifier of the UE carried in the API call request, obtain the permissions of the UE on the mobile network side, and determine whether to allow the application server to perform the requested operation based on the permissions of the UE on the mobile network side, as well as the specific API function or the operation indication information carried by the API call request.

[0181] For the above-mentioned method C, the API providing network element stores the permissions of the UE's target application on the mobile network side. Then, when the API providing network element receives an API call request initiated by the same target application again to request an operation on the same UE information, it can directly obtain the permissions of the UE's target application on the mobile network side based on the first identifier of the UE carried in the API call request and the identifier of the target application on the mobile network side, and determine whether the application server is allowed to operate the UE information based on the permissions of the UE's target application on the mobile network side, as well as the specific API function or the operation indication information carried by the API call request.

[0182] In the above methods 1 and 2, the storage process of the permission storage network element can be found in Figure 5 or Figure 6 A detailed description thereof is given in the illustrated embodiment.

[0183] Furthermore, the API provides the network element with information on whether to allow or prohibit the application server from performing operations on the UE according to the judgment result of step 402 .

[0184] If the result of step 402 is yes, the API-providing network element allows the application server to perform operations on the UE and performs the operations requested by the application server. For example, if the API-providing network element allows the application server to read the UE's location information, the API-providing network element obtains the UE's location information from the mobile network and feeds it back to the application server. For another example, if the API-providing network element allows the application server to obtain the UE's GPSI using the UE's IP address, the API-providing network element uses the UE's IP address to obtain the UE's GPSI from the mobile network and feeds it back to the application server.

[0185] When the judgment result in step 402 is no, the API provides the information that the network element prohibits the application server from performing the operation on the UE, and rejects the operation requested by the application server.

[0186] In step 403, the API providing network element sends an API call response to the application server. Correspondingly, the application server receives the API call response from the API providing network element.

[0187] If the API-providing network element authorizes the application server to perform the UE operation, the API-providing network element performs the operation requested by the application server and indicates the successful execution of the API call request through a call response. Optionally, if the API-providing network element also provides feedback to the application server, the API call response may include the feedback information, such as the UE's location information or the UE's GPSI. Optionally, the API call response may indicate that the requested operation is authorized by the UE.

[0188] In the case where the API provides information that the network element prohibits the application server from performing an operation on the UE, the API call response may carry a rejection reason value, which is used to indicate that the operation requested by the application server is not authorized.

[0189] exist Figure 4 In the embodiment shown, when the API providing network element receives an API call request from the application server, it determines whether to allow the application server to perform operations on the UE information based on the identifier of the target application on the application server side and the first identifier of the UE carried in the API call request, so that the target application must obtain authorization from the UE before operating the UE information through the mobile network. This can prevent the UE information from being abused, reduce the risk of the UE information being leaked, and thus improve the security of the information.

[0190] See Figure 5, is a flowchart of the API calling method provided in Example 1 of this application, Figure 5 and Figure 4 For the same or similar parts, see Figure 4 The corresponding description. Figure 5 The process shown may include but is not limited to the following steps:

[0191] Step 501: The UE determines the permissions of the target application on the UE side.

[0192] The UE determines the permissions of the target application on the UE side. For example, the UE determines whether the shopping App 1 on the UE is allowed to read the location information of the UE.

[0193] In one implementation, the target application layer of the UE obtains the first input result of the user and transmits the first input result to the system layer of the UE, and the system layer of the UE transmits the second input result to the NAS layer of the UE.

[0194] The target application layer of the UE can be understood as the target application level of the UE, such as the permission selection input by the user on the display interface of the target application.

[0195] The system layer of the UE can be understood as the system level of the UE, such as the Android system level. The user can modify, add, or set permissions of the target application at the system level.

[0196] The NAS layer of the UE can be understood as the layer for transmitting NAS messages. For example, when the UE communicates directly with the AMF network element, NAS messages can be transmitted through the NAS layer.

[0197] The target application layer of the UE obtains the first input result of the user, such as the selection result entered by the user in a permission selection dialog box displayed by the UE when the user installs and opens the target application on the UE. For example, when the user installs and opens Shopping App 1, the UE displays a permission selection dialog box, and the user enters a selection result in the permission selection dialog box. The selection result is the first input result.

[0198] The first input result and the second input result may be the same or different. Optionally, the first input result may be expressed as the correspondence between the identifier of the target application on the UE side and the permissions of the target application on the UE side, and the second input result may be expressed as the correspondence between the identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side. Optionally, the system layer or the NAS layer may convert the identifier of the target application on the UE side into the identifier of the target application on the mobile network side, and convert the permissions of the target application on the UE side into the permissions of the target application on the mobile network side.

[0199] In another implementation, the system layer of the UE obtains the user's input result and transmits the input result to the NAS layer.

[0200] The UE's system layer obtains the user's input results. For example, the user opens the settings interface on the UE and enters a permission selection instruction for a target application in the settings interface. The UE's system layer can thereby obtain the user's input results. The input results can be expressed as the correspondence between the target application's identifier on the UE side and the target application's permissions on the UE side. For another example, the user edits a short message for a target application, and the short message content contains the input results. The input results can be expressed as the correspondence between the target application's identifier on the UE side and the target application's permissions on the UE side. The user sends the short message to the system layer.

[0201] Optionally, the system layer or NAS layer may convert the identifier of the target application on the UE side into the identifier of the target application on the mobile network side, and convert the permissions of the target application on the UE side into the permissions of the target application on the mobile network side.

[0202] Step 502: The UE sends an uplink NAS message to the AMF network element. Correspondingly, the AMF network element receives the uplink NAS message from the UE.

[0203] The uplink NAS message may be an uplink NAS transmission message, including an identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side. The number of identifiers of the target application on the mobile network side included in the uplink NAS message may be one or more, and the number of permissions of the target application on the mobile network side may be one or more. The identifier of the target application on the mobile network side and the permissions of the target application on the mobile network side are reported in pairs, that is, N identifiers of the target application on the mobile network side are reported, and at the same time, the permissions of the target application on the mobile network side corresponding to these N identifiers of the target application on the mobile network side are reported. N is a positive integer greater than 1.

[0204] Optionally, the uplink NAS message further includes a second identifier of the UE.

[0205] Optionally, the uplink NAS message also includes first authority indication information, used to instruct the AMF network element to update the UE's authority on the mobile network side.

[0206] Step 503: The AMF network element sends a contract update message to the rights storage network element. Correspondingly, the rights storage network element receives the contract update message from the AMF network element.

[0207] Optionally, upon receiving the first authority indication information, the AMF network element sends a contract update message to the authority storage network element.

[0208] Optionally, the subscription update message is used to instruct the permission storage network element to update the permissions of the UE on the mobile network side, specifically to update the permissions of the UE's target application on the mobile network side, where the target application may be a target application identified by an identifier of the target application on the mobile network side. The subscription update message includes the second identifier of the UE, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0209] Optionally, when receiving an uplink NAS message, the AMF network element may also obtain the second identifier of the UE from the context information of the UE according to the link identifier (such as AMF UE NGAPID or RAN UE NGAPID) in the N2 message of the load NAS message.

[0210] Optionally, the AMF network element obtains the second identifier of the UE from the uplink NAS message.

[0211] Optionally, the subscription update message further includes second authority indication information, which is used to instruct the authority storage network element to update the authority of the UE on the mobile network side.

[0212] Step 504: The permission storage network element stores the permission of the target application of the UE on the mobile network side.

[0213] Optionally, the permission storage network element stores the permission of the target application of the UE on the mobile network side according to the second permission indication information. The target application is the target application identified by the identifier of the target application on the mobile network side.

[0214] Optionally, the permission storage network element stores the identifier of the target application on the mobile network side and the permission of the target application on the mobile network side in the context information corresponding to the second identifier of the UE.

[0215] Step 505: The application server sends an API call request to the API providing network element. Correspondingly, the API providing network element receives the API call request from the application server.

[0216] Step 506: The API provides information for the network element to determine whether to allow the application server to perform operations on the UE.

[0217] In step 507, the API providing network element sends an API call response to the application server. Correspondingly, the application server receives the API call response from the API providing network element.

[0218] For the specific implementation process of steps 505 to 507, please refer to Figure 4 The detailed description of steps 401 to 403 in the illustrated embodiment will not be repeated here.

[0219] exist Figure 5In the embodiment shown, the UE triggers the permission storage network element through the AMF network element to store the permissions of the UE's target application on the mobile network side, so that when the API providing network element receives an API call request from the application server, it can obtain the authorization result or storage information from the permission storage network element, and then determine whether to authorize the application server to perform operations on the UE's information, which can prevent the UE's information from being abused, help reduce the risk of UE's information being leaked, and improve the security of the information.

[0220] See Figure 6 , is a flowchart of the API calling method provided in Example 3 of this application, Figure 6 and Figure 4 or Figure 5 For the same or similar parts, see Figure 4 and Figure 5 The corresponding description. Figure 6 The process shown may include but is not limited to the following steps:

[0221] Step 601: The UE determines the permissions of the target application on the UE side.

[0222] The UE determines the permissions of the target application on the UE side. For example, the UE determines whether the shopping App 1 on the UE is allowed to read the location information of the UE.

[0223] In one implementation, the first target application layer of the UE obtains the first input result of the user and transmits the first input result to the system layer of the UE, and the system layer of the UE transmits the second input result to the second target application layer of the UE. The first target application layer of the UE obtains the first input result. For example, when the user installs and opens the shopping app 1, the UE outputs a permission selection dialog box, and the user enters the selection result in the permission selection dialog box. The selection result is the first input result. The system layer of the UE can refer to the description of the system layer of the UE in step 501, which will not be repeated here. The second target application layer of the UE can be understood as a layer that supports the UE to communicate with the authorization server.

[0224] The first input result and the second input result may be the same or different. Optionally, the first input result may be expressed as the identifier of the target application on the UE side and the permissions of the target application on the UE side, and the second input result may be expressed as the identifier of the target application on the application server side and the permissions of the target application on the application server side. Optionally, the system layer or the second target application layer may convert the identifier of the target application on the UE side into the identifier of the target application on the application server side, and convert the permissions of the target application on the UE side into the permissions of the target application on the application server side.

[0225] In another implementation, the UE's system layer obtains the user's input result and transmits the input result to the target application layer. In this implementation, the target application layer refers to the layer that supports communication between the UE and the authorization server. The UE's system layer obtains the user's input result as described in step 501 and is not further described here.

[0226] Optionally, the system layer or the target application layer may convert the identifier of the target application on the UE side into the identifier of the target application on the application server side, and convert the permissions of the target application on the UE side into the permissions of the target application on the application server side.

[0227] Step 602: The UE sends user plane data to the authorization server. Correspondingly, the authorization server receives the user plane data from the UE.

[0228] The authorization server can be understood as an AF within the mobile operator, and the application server can be understood as an AF outside the mobile operator.

[0229] The user plane data includes the target application's identifier on the application server side and the target application's permissions on the application server side. The user plane data can be carried in App traffic or short messages.

[0230] Optionally, the user plane data further includes a first identifier of the UE, for example, the IP address of the UE or the GPSI of the UE.

[0231] Optionally, the user plane data further includes third authority indication information, where the third authority indication information is used to instruct the authorization server to update the authority of the UE on the mobile network side.

[0232] Step 603: The authorization server sends a contract update message to the rights storage network element. Correspondingly, the rights storage network element receives the contract update message from the authorization server.

[0233] Optionally, upon receiving the third authority indication information, the authorization server sends a contract update message to the authority storage network element.

[0234] Among them, the subscription update message is used to instruct the permission storage network element to update the UE's permissions on the mobile network side, specifically to update the permission information of the UE's target application, which can be the target application identified by the target application's identifier on the application server side.

[0235] Optionally, the subscription update message includes the first identifier of the UE, the identifier of the target application on the application server side, and the permissions of the target application on the application server side.

[0236] Optionally, if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, the authorization server converts the identifier of the target application on the application server side into the identifier of the target application on the mobile network side. If the permissions of the target application on the application server side are different from the permissions of the target application on the mobile network side, the authorization server converts the permissions of the target application on the application server side into the permissions of the target application on the mobile network side. If the first identifier of the UE is different from the second identifier of the UE, the authorization server converts the first identifier of the UE into the second identifier of the UE. Furthermore, the contract update message may include the second identifier of the UE, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0237] Optionally, the subscription update message further includes fourth authority indication information, used to instruct the authority storage network element to update the UE's authority on the mobile network side.

[0238] Step 603 is one implementation method. In another implementation method, the authorization server calls the API to provide the API for the contract update enabled by the network element. The input parameters of the API include the first identifier of the UE, the identifier of the target application on the application server side, and the permissions of the target application on the application server side. The API provides the network element to send a contract update message to the permission storage network element. The contract update message includes the first identifier of the UE, the identifier of the target application on the application server side, and the permissions of the target application on the application server side. Optionally, the API provides the network element to convert the identifier of the target application on the application server side into the identifier of the target application on the mobile network side, convert the permissions of the target application on the application server side into the permissions of the target application on the mobile network side, and convert the first identifier of the UE into the second identifier of the UE. Then, the contract update message includes the second identifier of the UE, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0239] Step 604: The permission storage network element stores the permission of the target application of the UE on the mobile network side.

[0240] The specific implementation process of step 604 can be found in Figure 5 The detailed description of step 504 in the illustrated embodiment will not be repeated here.

[0241] Step 605: The application server sends an API call request to the API providing network element. Correspondingly, the API providing network element receives the API call request from the application server.

[0242] Step 606: The API provides information for the network element to determine whether to allow the application server to perform operations on the UE.

[0243] Step 607: The API providing network element sends an API call response to the application server. Correspondingly, the application server receives the API call response from the API providing network element.

[0244] For the specific implementation process of steps 605-607, please refer to Figure 4 The detailed description of steps 401 to 403 in the illustrated embodiment will not be repeated here.

[0245] exist Figure 6 In the embodiment shown, the UE triggers the permission storage network element to store the permissions of the UE's target application on the mobile network side through the authorization server, so that when the API providing network element receives an API call request from the application server, it can obtain the authorization result or storage information from the permission storage network element, and then determine whether to authorize the application server to perform operations on the UE's information, which can prevent the UE's information from being abused, help reduce the risk of UE's information being leaked, and improve the security of the information.

[0246] See Figure 7 , is a flowchart of the API calling method provided in Example 4 of this application, Figure 7 and Figure 4 or Figure 5 or Figure 6 For the same or similar parts, see Figure 4-Figure 6 The corresponding description. Figure 7 The process shown may include but is not limited to the following steps:

[0247] Step 701: The application server sends an API call request to the API providing network element. Correspondingly, the API providing network element receives the API call request from the application server.

[0248] The specific implementation process of step 701 can be found in Figure 4 The detailed description of step 401 in the illustrated embodiment will not be repeated here.

[0249] Step 702: The permission of the target application of the UE on the mobile network side cannot be found.

[0250] For Method 1 and Method C in step 402, the API providing network element obtains the authorization result or the permissions of the UE's target application on the mobile network side from the permission storage network element to determine whether the application server is allowed to perform operations on the UE. If the permission storage network element cannot find the permissions of the UE's target application on the mobile network side based on the authorization request sent by the API providing network element and cannot determine whether the application server is authorized to perform operations on the UE, the permission storage network element triggers a request to the UE for the permissions of the UE's target application on the mobile network side.

[0251] Step 703: The authority storage network element sends an authority request message to the AMF network element. Correspondingly, the AMF network element receives the authority request message from the authority storage network element.

[0252] The permission request message is used to trigger the AMF network element to request the UE's target application's permission on the mobile network side. The permission request message includes the UE's second identifier, the target application's identifier on the mobile network side, and the requested permission on the mobile network side. The requested permission on the mobile network side is the requested permission for the target application on the mobile network side, and the target application is the target application identified by the target application's identifier on the mobile network side.

[0253] The permission storage NE can perform one or more of the following operations:

[0254] (1) If the first identifier of the UE is different from the second identifier of the UE, convert the first identifier of the UE into the second identifier of the UE;

[0255] (2) if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, convert the identifier of the target application on the application server side into the identifier of the target application on the mobile network side;

[0256] (3) If the requested permission on the application server side is different from the requested permission on the mobile network side, the requested permission on the application server side is converted into the requested permission on the mobile network side.

[0257] Optionally, the permission request message also includes fifth authorization indication information, which is used to trigger the AMF network element to request the UE for permission for the UE's target application on the mobile network side.

[0258] In step 704, the AMF network element sends a downlink NAS message to the UE. Correspondingly, the UE receives the downlink NAS message from the AMF network element.

[0259] The downlink NAS message may be a downlink NAS transmission message, including an identifier of the target application on the mobile network side and the requested permission on the mobile network side. Optionally, the downlink NAS message also includes sixth authorization indication information, used to instruct the UE to feedback the permission of the UE's target application on the mobile network side.

[0260] Step 705: The UE determines the permissions of the target application on the UE side.

[0261] In step 706, the UE sends an uplink NAS message to the AMF network element. Correspondingly, the AMF network element receives the uplink NAS message from the UE.

[0262] The uplink NAS message includes the target application's permissions on the mobile network side, i.e., the UE's permissions on the target application on the mobile network side. Optionally, the uplink NAS message in step 706 may not include the target application's identifier on the mobile network side and the UE's first identifier. Because the AMF network element has already obtained the target application's identifier on the mobile network side and the UE's second identifier, the uplink NAS message does not need to carry the target application's identifier on the mobile network side and the UE's first identifier, saving transmission overhead.

[0263] Step 707: The AMF network element sends a contract update message to the rights storage network element. Correspondingly, the rights storage network element receives the contract update message from the AMF network element.

[0264] Step 708: The permission storage network element stores the permission of the target application of the UE on the mobile network side.

[0265] The specific implementation process of steps 705 to 708 can be found in Figure 5 The detailed description of steps 501 to 504 in the illustrated embodiment will not be repeated here.

[0266] Step 709: The authority storage network element sends an authorization response to the API providing network element. Correspondingly, the API providing network element receives the authorization response from the authority storage network element.

[0267] The authorization response target application responds to the authorization request sent by the API providing network element to the permission storage network element, including the permission of the target application on the mobile network side. Optionally, it also includes the second identifier of the UE, the identifier of the target application on the mobile network side.

[0268] Step 710: The API provides information for the network element to determine whether to allow the application server to perform operations on the UE based on the permissions of the target application on the mobile network side.

[0269] The API providing network element determines whether the application server is allowed to perform the UE operation based on the permissions of the target application on the mobile network side in step 709. Specifically, the API providing network element determines whether the application server is allowed to perform the UE operation based on the permissions of the target application on the mobile network side and the specific API function or operation indication information carried in the API call request.

[0270] Step 711: The API providing network element sends an API call response to the application server. Correspondingly, the application server receives the API call response from the API providing network element.

[0271] If the API-providing network element authorizes the application server to perform the UE operation, the API call response may indicate that the requested operation is authorized by the UE. Optionally, if the API-providing network element also provides feedback to the application server, the API call response may carry the feedback information, such as the UE's location information or the UE's GPSI.

[0272] In the case where the API provides information that the network element prohibits the application server from performing an operation on the UE, the API call response may carry a rejection reason value, which is used to indicate that the operation requested by the application server is not authorized.

[0273] exist Figure 7 In the embodiment shown, when the permission storage network element cannot find the permission of the UE's target application on the mobile network side, the permission storage network element triggers the acquisition of the permission of the UE's target application on the mobile network side, so that the API providing network element can determine whether to authorize the application server to perform operations on the UE information, which is conducive to reducing the risk of UE information being leaked and improving information security.

[0274] Figure 7 and Figure 5 、 Figure 6 The difference is that Figure 5 and Figure 6 In the process, the permission storage network element first stores the UE's permission for the target application on the mobile network side. When the API providing network element receives the API call request, it obtains the authorization result or stored information from the permission storage network element, and then determines whether to authorize the application server to perform the operation on the UE information. Figure 7 In the process, when the API providing network element receives the API call request, it cannot find the permission of the UE's target application on the mobile network side. The permission storage network element triggers the acquisition of the permission of the UE's target application on the mobile network side. When the API providing network element obtains the permission of the target application on the mobile network side, it determines whether to allow the application server to perform operations on the UE based on the permission of the target application on the mobile network side.

[0275] See Figure 8 , is a flowchart of the API calling method provided in Example 5 of this application, Figure 8 and Figure 4-Figure 7 For any identical or similar parts, see Figure 4-Figure 7 The corresponding description. Figure 8 The process shown may include but is not limited to the following steps:

[0276] Step 801: The application server sends an API call request to the API providing network element. Correspondingly, the API providing network element receives the API call request from the application server.

[0277] The specific implementation process of step 801 can be found in Figure 4 The detailed description of step 401 in the illustrated embodiment will not be repeated here.

[0278] Step 802: The permission of the target application of the UE on the mobile network side cannot be found.

[0279] For method A and method B in step 402, the API providing network element cannot obtain the permission of the UE's target application on the mobile network side based on the storage information obtained from the permission storage network element, then the API providing network element triggers a request to the AMF network element for the permission of the UE's target application on the mobile network side.

[0280] Step 803: The API providing network element sends a permission request message to the AMF network element. Correspondingly, the AMF network element receives the permission request message from the API providing network element.

[0281] The permission request message is used to trigger the AMF network element to request the UE's target application's permission on the mobile network side. The permission request message includes the UE's second identifier, the target application's identifier on the mobile network side, and the requested permission on the mobile network side.

[0282] The API allows network elements to perform one or more of the following operations:

[0283] (1) If the first identifier of the UE is different from the second identifier of the UE, convert the first identifier of the UE into the second identifier of the UE;

[0284] (2) if the identifier of the target application on the application server side is different from the identifier of the target application on the mobile network side, converting the identifier of the target application on the application server side into the identifier of the target application on the mobile network side;

[0285] (3) If the requested permission on the application service side is different from the requested permission on the mobile network side, the requested permission on the application service side is converted into the requested permission on the mobile network side.

[0286] Optionally, the permission request message also includes fifth authorization indication information, which is used to trigger the AMF network element to request the UE for permission for the UE's target application on the mobile network side.

[0287] In step 804, the AMF network element sends a downlink NAS message to the UE. Correspondingly, the UE receives the downlink NAS message from the AMF network element.

[0288] The specific implementation process of step 804 can be found in Figure 7 The detailed description of step 704 in the illustrated embodiment will not be repeated here.

[0289] Step 805: The UE determines the authority of the target application on the UE side.

[0290] In step 806, the UE sends an uplink NAS message to the AMF network element. Correspondingly, the AMF network element receives the uplink NAS message from the UE.

[0291] The specific implementation process of step 805-step 806 can be found in Figure 5 The detailed description of steps 501 and 502 in the illustrated embodiment will not be repeated here.

[0292] In step 807, the AMF network element sends a permission response message to the API providing network element. Correspondingly, the API providing network element receives the permission response message from the AMF network element.

[0293] The permission response message includes the permission of the target application on the mobile network side and, optionally, further includes the second identifier of the UE and the identifier of the target application on the mobile network side.

[0294] Optionally, the AMF network element may also execute step 707 so that the permission storage unit stores the permissions of the UE's target application on the mobile network side.

[0295] Step 808: The API provides information for the network element to determine whether to allow the application server to perform operations on the UE based on the permissions of the target application on the mobile network side.

[0296] Step 809: The API providing network element sends an API call response to the application server. Correspondingly, the application server receives the API call response from the API providing network element.

[0297] The specific implementation process of step 808-step 809 can be found in Figure 7 The detailed description of steps 710 and 711 in the illustrated embodiment will not be repeated here.

[0298] exist Figure 8 In the embodiment shown, when the permissions of the UE's target application on the mobile network side cannot be found, the API provides a network element to trigger the acquisition of the permissions of the UE's target application on the mobile network side, so that the API provides the network element to determine whether to authorize the application server to perform operations on the UE information, which is conducive to reducing the risk of UE information being leaked and improving information security.

[0299] Figure 8 and Figure 7 The difference is that Figure 7 In the example, the permission storage network element triggers the acquisition of the permission of the UE's target application on the mobile network side, and Figure 8 In the example, the API provides a network element to trigger the acquisition of the UE's target application's permissions on the mobile network side.

[0300] Figure 5-Figure 8It is to call the API in the 5G core network to provide the open API of the network element, so that the application server can request the operation of UE information. The API calling method under the 5G MEC network architecture can be found in Figure 9 shown. Figure 9 The process shown may include but is not limited to the following steps:

[0301] Step 901: EAS sends an API call request to EES. Correspondingly, EES receives the API call request from EAS.

[0302] EAS sends an API call request to EES, and Figure 4 The application server sends an API call request to the API provider network element. Figure 4 The detailed description of the application server sending an API call request to the API providing network element is omitted here.

[0303] Step 902: EES cannot find the permission of the target application of the UE on the EES side.

[0304] If the EES cannot find the permission of the UE's target application on the EES side based on one or more of the UE's identifier, the target application's identifier, or the processing operation instruction, step 903 is triggered.

[0305] The UE identifier may be the UE's IP address or GPSI, and the target application identifier may be an EAS ID or an AF ID, etc.

[0306] Step 903: EES sends a permission request message to EEC. Correspondingly, EEC receives the permission request message from EES.

[0307] The permission request message is used to request the UE's target application's permissions on the EES side. The permission request message includes the target application's identifier and the requested permissions on the EES side. The EES converts the requested operation (e.g., via an API or by processing an operation indication) into a requested permission on the EES side.

[0308] Optionally, the permission request message further includes authorization indication information, which is used to request permission for the target application of the UE on the EES side.

[0309] Step 904: The UE determines the permissions of the target application on the UE side.

[0310] In one implementation, the target application layer (e.g., EEC) transmits the identifier of the target application and the requested permissions to the system layer. The system layer outputs a dialog box to wait for user input. The dialog box displays a request for the user to input a permission selection for a certain operation of the target application. After the user enters the permission selection, the system layer transmits the user input result to the target application layer.

[0311] In another implementation, the target application layer (eg, EEC) triggers the UE to output a dialog box, and waits for the user to input permission selection for a certain operation for the target application in the dialog box, and the target application layer obtains the user input result.

[0312] Step 905: EEC sends a permission response message to EES. Correspondingly, EES receives the permission response message from EEC.

[0313] The permission response message includes the permission of the target application on the UE side.

[0314] Optionally, in step 906, the EES stores the permissions of the UE's target application on the EES side. The EES stores the permissions of the UE's target application on the EES side so that the next time the EES receives the same API call request, it can directly make a judgment based on the permissions of the target application on the EES side without having to obtain the permissions of the target application from the EEC again.

[0315] Optionally, if the permissions of the target application on the UE side are different from the permissions of the target application on the EES side, then the EES may convert the terminal device of the target application into the permissions of the target application on the EES side. Optionally, the EES stores the permissions of the target application on the UE on the EES.

[0316] EES stores the permissions of the UE's target application on the EES side. Figure 5 In the embodiment shown, the permission storage network element stores the permissions of the UE's target application on the mobile network side, which is similar to that of the mobile network side. Figure 5 The corresponding description in will not be repeated here.

[0317] Step 907: The EES determines whether the EAS is allowed to execute the UE information operation based on the permissions of the target application on the EES side.

[0318] In step 908, the EES sends an API call response to the EAS. Correspondingly, the EAS receives the API call response from the EES.

[0319] Steps 907-908 and Figure 7 Step 710 and step 711 in the illustrated embodiment are similar, and reference may be made to the detailed description of step 710 and step 711 , which will not be repeated here.

[0320] exist Figure 9 In the embodiment shown, when EES receives an API call request and cannot find the permissions of the UE's target application on the EES side, it obtains the permissions of the UE's target application on the EES side from EEC, and then EES can determine whether to authorize EAS to perform operations on UE information, which is beneficial to reducing the risk of UE information being leaked and improving information security.

[0321] Corresponding to the method provided in the above method embodiment, the present application embodiment also provides a corresponding device, including a module for executing the corresponding module of the above embodiment. The module can be software, hardware, or a combination of software and hardware.

[0322] See Figure 10 , is a structural diagram of a communication device provided in this application.

[0323] See Figure 10 , is a structural diagram of a communication device provided in this application. Figure 10 The communication device 1000 shown includes a transceiver module 1001 and a processing module 1002 .

[0324] In one design, apparatus 1000 provides network elements for an API:

[0325] Exemplarily, the transceiver module 1001 is used to receive an API call request for a target application from an application server, the API call request being used to request information for operating a terminal device, the API call request including a first identifier of the terminal device and an identifier of the target application on the application server side.

[0326] Processing module 1002 is used to obtain an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side; the authorization result is used to indicate whether the application server is allowed to operate the terminal device; based on the authorization result, determine whether the application server is allowed to execute the information of operating the terminal device.

[0327] This example is used to implement Figure 4-Figure 8 In the illustrated embodiment, the API provides the functionality of the network element.

[0328] In one design, apparatus 1000 is a rights storage network element:

[0329] Exemplarily, the transceiver module 1001 is configured to receive an authorization request from an API providing network element, the authorization request including a second identifier of the terminal device, an identifier of the target application on the mobile network side, and operation instruction information, the operation instruction information being used to indicate an operation on the information of the terminal device; the authorization request is used to request an authorization result; the authorization result is used to indicate whether the application server is allowed to perform the operation on the information of the terminal device;

[0330] Processing module 1002, configured to obtain an authorization result based on the authorization request and storage permission information, where the storage permission information includes permissions of the target application of the terminal device on the mobile network side;

[0331] The transceiver module 1001 is further configured to send an authorization response to the API providing network element, where the authorization response includes an authorization result.

[0332] This example is used to implement Figure 4-Figure 8 The functions of the rights storage network element in the illustrated embodiment.

[0333] In one design, apparatus 1000 is a terminal device:

[0334] Exemplarily, the processing module 1002 is configured to determine the permissions of the target application on the terminal side; convert the identifier of the target application on the terminal side into the identifier of the target application on the mobile network side, and convert the permissions of the target application on the terminal side into permissions of the target application on the mobile network side;

[0335] The transceiver module 1001 is used to send an uplink non-access layer NAS message to the access and mobility management network element; the uplink NAS message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side.

[0336] This example is used to implement Figure 5-Figure 8 Functionality of UE 1 in the illustrated embodiment.

[0337] See Figure 11 , is a structural diagram of another communication device provided in this application. Figure 11 The communication device 1100 shown includes at least one processor 1101 , a memory 1102 , and optionally, a communication interface 1103 .

[0338] The memory 1102 may be a volatile memory, such as a random access memory (RAM); a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 1102 may be a combination of the aforementioned memories.

[0339] The specific connection medium between the processor 1101 and the memory 1102 is not limited in the embodiment of the present application. In the figure, the memory 1102 and the processor 1101 are connected via a bus 1104. The bus 1104 is represented by a thick line in the figure. The connection between other components is only for schematic illustration and is not limited. The bus 1104 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 11 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0340] The processor 1101 may have a data transceiver function and may communicate with other devices. Figure 11 An independent data transceiver module, such as a communication interface 1103 , may also be provided in the device for transmitting and receiving data. When the processor 1101 communicates with other devices, data may be transmitted through the communication interface 1103 .

[0341] In one example, when the API provides network elements using Figure 11 When the form shown is Figure 11 The processor in the memory 1102 can call the computer execution instructions stored in the memory 1102 to enable the API providing network element to execute the method for the API providing network element to execute in any of the above method embodiments.

[0342] In one example, when the authority storage network element uses Figure 11 When the form shown is Figure 11 The processor in the memory 1102 can call the computer execution instructions stored in the memory 1102 to enable the authority storage network element to execute the method executed by the authority storage network element in any of the above method embodiments.

[0343] Specifically, Figure 10 The functions / implementation processes of the processing module and the transceiver module can be achieved through Figure 11 The processor 1101 in the embodiment calls the computer execution instructions stored in the memory 1102 to implement the above. Or, Figure 10 The function / implementation process of the processing module can be achieved through Figure 11 The processor 1101 in the embodiment calls the computer execution instruction stored in the memory 1102 to implement the above. Figure 10 The function / implementation process of the transceiver module can be achieved through Figure 11 It is implemented by the communication interface 1103 in.

[0344] The embodiment of the present application also provides an API calling system, which may include Figure 4-Figure 8 The API provides network elements and permission storage network elements.

[0345] The embodiment of the present application also provides an API calling system, which may include Figure 9 EES and EAS in.

[0346] It is understandable that some optional features in the embodiments of the present application may, in certain scenarios, be implemented independently of other features, such as the solution on which they are currently based, to solve corresponding technical problems and achieve corresponding effects. They may also be combined with other features in certain scenarios as needed. Accordingly, the devices provided in the embodiments of the present application may also implement these features or functions accordingly, which will not be described in detail here.

[0347] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for corresponding applications, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present application.

[0348] The solutions described in this application can be implemented in various ways. For example, these technologies can be implemented in hardware, software, or a combination of hardware. For hardware implementation, the processing unit used to execute these technologies at a communication device (e.g., a base station, a terminal, a network entity, a core network element, or a chip) can be implemented in one or more general-purpose processors, digital signal processors (DSPs), digital signal processing devices, application-specific integrated circuits (ASICs), programmable logic devices, field programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller, or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0349] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0350] The present application also provides a computer-readable medium having a computer program stored thereon, which implements the functions of any of the above method embodiments when executed by a computer.

[0351] The present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0352] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0353] It will be understood that the “embodiment” mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It will be understood that in the various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0354] It can be understood that in this application, "when", "if" and "if" all mean that the device will perform corresponding processing under certain objective circumstances, and do not limit the time. It does not require that the device must perform a judgment action when it is implemented, nor does it mean that there are other limitations.

[0355] In this application, elements expressed in the singular are intended to mean "one or more" rather than "one and only one" unless otherwise specified. In this application, unless otherwise specified, "at least one" is intended to mean "one or more" and "a plurality" is intended to mean "two or more."

[0356] Additionally, the terms "system" and "network" are often used interchangeably. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. A can be singular or plural, and B can be singular or plural.

[0357] The predefined in this application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0358] Those skilled in the art will appreciate that, for the sake of convenience and brevity of description, the specific working processes of the above-described systems, devices, and units may refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0359] The same or similar parts between the various embodiments in this application can refer to each other. In the various embodiments in this application, and the various implementation methods / implementation methods / implementation methods in each embodiment, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment are consistent and can be referenced to each other. The technical features in different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment can be combined to form new embodiments, implementation methods, implementation methods, or implementation methods according to their inherent logical relationships. The above-described implementation methods of this application do not constitute a limitation on the scope of protection of this application.

[0360] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. An API calling method, characterized in that: include: The application program interface (API) providing network element receives an API call request for a target application from an application server, the API call request being used to request information for operating a terminal device, the API call request including a first identifier of the terminal device and an identifier of the target application on the application server side; the target application being any application running on the terminal device, and the first identifier being used to identify the terminal device on the application server side; The API providing network element obtains the authorization result according to the first identifier of the terminal device and the identifier of the target application on the application server side; The authorization result is used to indicate whether the application server is allowed to operate the terminal device; The API provides information for the network element to determine whether to allow the application server to perform operations on the terminal device based on the authorization result.

2. The method according to claim 1, characterized in that The API providing network element obtains the authorization result according to the first identifier of the terminal device and the identifier of the target application on the application server side, including: The API providing network element sends an authorization request to the permission storage network element, wherein the authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and operation instruction information; wherein the operation instruction information is used to indicate an operation on the information of the terminal device; The API providing network element receives an authorization response from the authority storage network element, where the authorization response includes the authorization result.

3. The method according to claim 1, characterized in that The API providing network element obtains the authorization result according to the first identifier of the terminal device and the identifier of the target application on the application server side, including: The API providing network element sends an authorization request to the authority storing network element, where the authorization request includes the second identifier of the terminal device; The API providing network element receives an authorization response from the permission storage network element, where the authorization response includes permissions of all applications corresponding to the terminal device on the mobile network side; The API provides a network element to determine the authorization result based on the identification of the target application on the application server side, the permissions of all applications corresponding to the terminal device on the mobile network side, and the operation instruction information; wherein, the operation instruction information is used to indicate the operation of the information of the terminal device.

4. The method according to claim 1, wherein The API providing network element obtains the authorization result according to the first identifier of the terminal device and the identifier of the target application on the application server side, including: The API providing network element sends an authorization request to the permission storage network element, where the authorization request includes an identifier of the target application on the mobile network side; The API providing network element receives an authorization response from the permission storage network element, where the authorization response includes permissions of all terminal devices corresponding to the target application on the mobile network side; The API provides a network element to determine the authorization result based on the first identifier of the terminal device, the permissions of all terminal devices corresponding to the target application on the mobile network side, and the operation indication information; wherein the operation indication information is used to indicate the operation of the information of the terminal device.

5. The method according to claim 1, wherein The API providing network element obtains the authorization result according to the first identifier of the terminal device and the identifier of the target application on the application server side, including: The API providing network element sends an authorization request to the authority storage network element, where the authorization request includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives an authorization response from the permission storage network element, where the authorization response includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine the authorization result based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate the operation on the information of the terminal device.

6. The method according to any one of claims 1 to 5, characterized in that In the case of information allowing the application server to execute operations on the terminal device, the API providing network element sends an API call response to the application server, where the API call response is used to indicate successful execution of the API call request.

7. The method according to any one of claims 1 to 5, characterized in that In the case of information prohibiting the application server from executing operations on the terminal device, the API providing network element sends an API call response to the application server, where the API call response is used to indicate rejection of the API call request.

8. The method according to claim 7, characterized in that The API call response includes a rejection reason, where the rejection reason is used to indicate that the operation requested by the application server is not authorized.

9. The method according to any one of claims 1 to 5, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate operations on the information of the terminal device.

10. The method according to claim 9, characterized in that The operation instruction information is determined according to the API call request.

11. The method according to claim 10, characterized in that The API call request includes a processing operation instruction; the method further includes: The API providing network element determines the operation instruction information according to the processing operation instruction.

12. The method according to claim 6, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate operations on the information of the terminal device.

13. The method according to claim 6, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein, the operation instruction information is used to indicate the operation on the information of the terminal device, and the operation instruction information is determined based on the API call request.

14. The method according to claim 13, characterized in that The API call request includes a processing operation instruction; the method further includes: The API providing network element determines the operation instruction information according to the processing operation instruction.

15. The method according to claim 7, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate operations on the information of the terminal device.

16. The method according to claim 7, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein, the operation instruction information is used to indicate the operation on the information of the terminal device, and the operation instruction information is determined based on the API call request.

17. The method according to claim 16, characterized in that The API call request includes a processing operation instruction; the method further includes: The API providing network element determines the operation instruction information according to the processing operation instruction.

18. The method according to claim 8, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein the operation instruction information is used to indicate operations on the information of the terminal device.

19. The method according to claim 8, characterized in that The method further comprises: The API providing network element sends a permission request message to the access and mobility management network element; the permission request message includes the second identifier of the terminal device and the identifier of the target application on the mobile network side; The API providing network element receives a permission response message from the access and mobility management network element, where the permission response message includes the permission of the target application of the terminal device on the mobile network side; The API provides a network element to determine whether to allow the application server to perform operations on the information of the terminal device based on the permissions and operation instruction information of the target application of the terminal device on the mobile network side; wherein, the operation instruction information is used to indicate the operation on the information of the terminal device, and the operation instruction information is determined based on the API call request.

20. The method according to claim 19, characterized in that The API call request includes a processing operation instruction; the method further includes: The API providing network element determines the operation instruction information according to the processing operation instruction.

21. The method according to claim 2, 3, 4 or 5, characterized in that The operation instruction information is determined according to the API call request.

22. The method according to claim 21, characterized in that The API call request includes a processing operation instruction; the method further includes: The API providing network element determines the operation instruction information according to the processing operation instruction.

23. An API calling method, characterized in that: include: The permission storage network element receives an authorization request from the API providing network element, wherein the authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the operation instruction information; The operation instruction information is used to indicate the operation on the information of the terminal device; The target application is any application running on the terminal device, and the second identifier is used to identify the terminal device on the mobile network side; The permission storage network element obtains an authorization result based on the second identifier of the terminal device, the identifier of the target application on the mobile network side, the operation instruction information, and the storage permission information; wherein the authorization result is used to indicate whether the operation of the terminal device is allowed; the storage permission information includes the permission of the target application of the terminal device on the mobile network side; The authority storage network element sends an authorization response to the API providing network element, where the authorization response includes the authorization result.

24. The method according to claim 23, wherein The method further comprises: The permission storage network element receives a subscription update message, where the subscription update message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permissions of the target application on the mobile network side; The permission storage network element stores the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permission of the target application on the mobile network side in the stored permission information.

25. The method according to claim 24, characterized in that The contract update message also includes permission indication information; The permission indication information is used to indicate updating the network permission of the terminal device; The permission storage network element stores the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permission of the application on the mobile network side in the stored permission information, including: The permission storage network element stores the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permission of the target application on the mobile network side in the stored permission information according to the permission indication information.

26. An API calling method, characterized in that: include: The application server sends an API call request for the target application to the API providing network element, wherein the API call request is used to request information for operating the terminal device, and the API call request includes a first identifier of the terminal device and an identifier of the target application on the application server side; The target application is any application running on the terminal device, and the first identifier is used to identify the terminal device on the application server side; The application server receives an API call response from the API providing network element, where the API call response is used to indicate successful execution or rejection of the API call request.

27. The method according to claim 26, characterized in that When the API call response is used to indicate rejection of the API call request, the API call response includes a rejection reason, and the rejection reason includes a reason for indicating that the operation requested by the application server is not authorized.

28. An API calling method, characterized in that: include: The terminal device determines the permissions of the target application on the terminal side; The target application is any application running on the terminal device; The terminal device converts the identifier of the target application on the terminal side into the identifier of the target application on the mobile network side, and converts the permissions of the target application on the terminal side into the permissions of the target application on the mobile network side; The terminal device sends an uplink non-access layer NAS message to the access and mobility management AMF network element; the uplink NAS message includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permission of the target application on the mobile network side; The second identifier is used to identify the terminal device on the mobile network side.

29. The method according to claim 28, characterized in that The terminal device determines the permissions of the target application on the terminal side, including: When the terminal device receives a downlink NAS message from the AMF network element, it determines the authority of the target application on the terminal side, and the downlink NAS message includes the identifier of the target application on the mobile network side.

30. An API calling system, characterized in that: Includes API providing network elements, permission storage network elements and application servers; The application server is configured to send an API call request for a target application to an API providing network element, the API call request being used to request information for operating a terminal device, the API call request including a first identifier of the terminal device and an identifier of the target application on the application server side; the target application being any application program running on the terminal device, and the first identifier being used to identify the terminal device on the application server side; The API providing network element is configured to send an authorization request to the permission storage network element based on the first identifier of the terminal device and the identifier of the target application on the application server side, wherein the authorization request includes the second identifier of the terminal device, the identifier of the target application on the mobile network side, and operation instruction information; The operation instruction information is used to indicate an operation on the information of the terminal device; the second identifier is used to identify the terminal device on the mobile network side; The permission storage network element is configured to obtain an authorization result based on the second identifier of the terminal device, the identifier of the target application on the mobile network side, the operation instruction information, and the storage permission information, and send an authorization response to the API providing network element, wherein the authorization response includes the authorization result; the authorization result is used to indicate whether the operation of the terminal device is allowed; The storage permission information includes the permissions of the target application of the terminal device on the mobile network side; The API provides a network element and is further used to determine whether the application server is allowed to perform operations on the terminal device based on the authorization result.

31. The system according to claim 30, wherein: The permission storage network element is also used to receive a subscription update message, which includes the second identifier of the terminal device, the identifier of the target application on the mobile network side and the permissions of the application on the mobile network side, and stores the second identifier of the terminal device, the identifier of the target application on the mobile network side and the permissions of the application on the mobile network side in the stored permission information.

32. The system according to claim 31, wherein: The contract update message also includes permission indication information; The permission indication information is used to indicate updating the network permission of the UE, and the permission storage network element stores the second identifier of the terminal device, the identifier of the target application on the mobile network side, and the permission of the application on the mobile network side in the stored permission information; The permission storage network element is specifically used to store the second identifier of the terminal device, the identifier of the target application on the mobile network side and the permission of the application on the mobile network side in the stored permission information according to the permission indication information.

33. A communication device, characterized in that: The device includes a processing module and a transceiver module, and the processing module and the transceiver module are used for the device to perform the method according to any one of claims 1 to 29.

34. A communication device, characterized in that: The device includes: a processor coupled to a memory, wherein the memory is used to store a program. When the program is executed by the processor, the device performs the method according to any one of claims 1 to 29.

35. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, it causes the computer to perform the method according to any one of claims 1 to 29.

Images