Communication method, system, multi-access edge computing platform and application function

Abstract

The disclosure provides a communication method, system, multi-access edge computing platform and application function, and relates to the technical field of communication. The method is executed by a MEP, and comprises the following steps: receiving a key acquisition request sent by a first application function, wherein the key acquisition request carries an application identifier of the first application function and a key identifier of a first key corresponding to a first user equipment (UE) to which the first application function is subscribed; and sending a key acquisition response carrying a second key to the first application function, wherein the second key is obtained based on the key identifier and the application identifier in the key acquisition request.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a communication method, system, multi-access edge computing platform and application functions. Background Technology

[0002] To ensure communication security, User Equipment (UE) and Application Function (AF) use application keys (i.e., K keys) based on Authentication and Key Management for Applications (AKMA). AF ) to communicate.

[0003] In related technologies, when a UE requests access to a certain application function, the application function interacts with the AKMA Anchor Function (AAnF) network element in the core network through signaling to obtain the AKMA application key on which the communication with the UE is based from the AAnF network element. Summary of the Invention

[0004] The inventors noted that, since many application functions are deployed outside the trusted domain of the core network, the frequent signaling interactions between these application functions and AAnF network elements within the core network reduce the security of the core network.

[0005] To address the aforementioned problems, the present disclosure proposes the following solutions.

[0006] According to one aspect of the present disclosure, a communication method is provided, executed by a multi-access edge computing platform (MEP), the method comprising: receiving a key acquisition request sent by a first application function, the key acquisition request carrying an application identifier of the first application function and a key identifier of a first key corresponding to a first user equipment (UE) to which the first application function is subscribed; and sending a key acquisition response carrying a second key to the first application function, the second key being obtained based on the key identifier and the application identifier in the key acquisition request.

[0007] In some embodiments, the first application function has a first application instance deployed on the MEC device where the MEP is located, the key acquisition request is sent by the first application instance, and the key acquisition response is sent to the first application instance.

[0008] In some embodiments, the method further includes: obtaining key information, the key information including a first key corresponding to each UE in at least one UE, and a key identifier of the first key corresponding to each UE, wherein the at least one UE includes the first UE; searching for the first key corresponding to the first UE from the key information based on the key identifier in the key acquisition request; and determining the second key based on the application identifier and the found first key.

[0009] In some embodiments, the key information is obtained before receiving the key acquisition request.

[0010] In some embodiments, obtaining key information includes: obtaining the key information from a first network element in the core network, wherein the MEP is located within the trusted domain of the core network.

[0011] In some embodiments, the first network element is an authentication service function network element, and the method is performed by the Authentication and Key Management Anchor Function (AAnF) network element in the MEP.

[0012] In some embodiments, the first network element is an AAnF network element.

[0013] In some embodiments, the at least one UE further includes at least one second UE.

[0014] In some embodiments, the at least one UE includes each UE contracted with one or more application functions, each application function having an application instance deployed on the MEC device where the MEP resides.

[0015] In some embodiments, obtaining key information includes: obtaining the key information at a preset period; and / or obtaining the key information when a preset event occurs.

[0016] In some embodiments, the preset event includes at least one of a first event and a second event, wherein the first event is a change in the one or more application functions, and the second event is a change in the UE subscribed to the one or more application functions.

[0017] According to another aspect of the embodiments of this disclosure, a communication method is provided, executed by an application function, the method comprising: sending a key acquisition request to a multi-access edge computing platform (MEP), the key acquisition request carrying an application identifier of the application function and a key identifier of a first key corresponding to a first user equipment (UE) to which the application function is subscribed; and receiving a key acquisition response carrying a second key sent by the MEP, the second key being obtained based on the key identifier and the application identifier in the key acquisition request.

[0018] In some embodiments, the application function has an application instance deployed on the MEC device where the MEP resides, and the method is executed by the application instance.

[0019] In some embodiments, the method further includes: receiving an application session establishment request sent by the first UE before sending the key acquisition request, the application session establishment request carrying the key identifier; sending an application session establishment response to the first UE after receiving the key acquisition response; and communicating with the first UE based on the second key.

[0020] In some embodiments, the first key is an AKMA anchor key for application authentication and key management, and the second key is an AKMA application key.

[0021] In some embodiments, the key acquisition response also carries the expiration time of the second key and the identifier of the first UE.

[0022] According to another aspect of the present disclosure, a multi-access edge computing platform is provided, comprising: a receiving module configured to receive a key acquisition request sent by a first application function, the key acquisition request carrying an application identifier of the first application function and a key identifier of a first key corresponding to a first user equipment (UE) to which the first application function is subscribed; and a sending module configured to send a key acquisition response carrying a second key to the first application function, the second key being obtained based on the key identifier and the application identifier in the key acquisition request.

[0023] According to another aspect of the present disclosure, a multi-access edge computing platform is provided, including: a memory; and a processor coupled to the memory, configured to execute the communication method described in any of the above embodiments based on instructions stored in the memory.

[0024] According to another aspect of the embodiments of this disclosure, an application function is provided, including: a sending module configured to send a key acquisition request to a multi-access edge computing platform (MEP), the key acquisition request carrying an application identifier of the application function and a key identifier of a first key corresponding to a first user equipment (UE) to which the application function is subscribed; and a receiving module configured to receive a key acquisition response carrying a second key sent by the MEP, the second key being obtained based on the key identifier and the application identifier in the key acquisition request.

[0025] According to another aspect of the present disclosure, an application function is provided, including: a memory; and a processor coupled to the memory, configured to execute the communication method described in any of the above embodiments based on instructions stored in the memory.

[0026] According to another aspect of the present disclosure, a communication system is provided, including: the multi-access edge computing platform (MEP) as described in any of the above embodiments; and the first application function, which is the application function described in any of the above embodiments.

[0027] In some embodiments, the system further includes: a first network element in the core network; wherein the MEP is located within the trusted domain of the core network and is further configured to obtain key information from the first network element, the key information including a first key corresponding to each UE in at least one UE, and a key identifier of the first key corresponding to each UE, wherein the at least one UE includes the first UE.

[0028] In some embodiments, the system further includes: the first UE, configured to send an application session establishment request carrying a key identifier corresponding to a first key to the first application function; receive an application session establishment response sent by the first application function; and communicate with the first application function based on the second key.

[0029] According to another aspect of the present disclosure, a computer-readable storage medium is provided, including computer program instructions, wherein the computer program instructions, when executed by a processor, implement the communication method described in any of the above embodiments.

[0030] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein the computer program, when executed by a processor, implements the communication method described in any of the above embodiments.

[0031] In this embodiment, the MEP receives a key acquisition request sent by the application function and sends a key acquisition response carrying the second key to the application function. In this way, the application function can obtain the second key simply by interacting with the MEP, without needing to perform signaling interactions with network elements in the core network. This eliminates the signaling interactions between the application function and network elements in the core network during the process of obtaining the second key, thereby improving the security of the core network.

[0032] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating a communication method according to some embodiments of the present disclosure;

[0035] Figure 2 This is a flowchart illustrating a communication method according to other embodiments of this disclosure;

[0036] Figure 3 This is a flowchart illustrating a communication method according to some embodiments of the present disclosure;

[0037] Figure 4 This is a flowchart illustrating a communication method according to some embodiments of the present disclosure;

[0038] Figure 5 This is a schematic diagram of the structure of a MEP according to some embodiments of the present disclosure;

[0039] Figure 6 This is a structural schematic diagram of the application functions according to some embodiments of this disclosure;

[0040] Figure 7 This is a schematic diagram of the structure of an electronic device according to some embodiments of the present disclosure;

[0041] Figure 8 This is a schematic diagram of the structure of a communication system according to some embodiments of the present disclosure. Detailed Implementation

[0042] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0043] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of this disclosure.

[0044] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0045] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0046] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0047] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0048] Figure 1 This is a flowchart illustrating a communication method according to some embodiments of the present disclosure.

[0049] Figure 1 The communication method shown is performed by a Multi-Access Edge Computing platform (MEP). A Multi-Access Edge Computing platform can also be called a Mobile Edge Computing platform. The MEP can be deployed on an MEC device. For example, the MEC device can be an MEC host device. Figure 1 As shown, the communication method includes steps 102 to 104.

[0050] In step 102, a key acquisition request sent by the first application function is received.

[0051] Here, the key acquisition request carries the application identifier of the first application function and the key identifier of the first key corresponding to the first UE that the first application function is subscribed to.

[0052] It should be understood that the first application function can be any application function, and the first UE can be any UE that has signed a contract with the first application function.

[0053] In some embodiments, the first key may be an AKMA anchor key (i.e., K AKMA The key identifier of the first key can be an AKMA key identifier (A-KID).

[0054] In step 104, a key acquisition response carrying the second key is sent to the first application function.

[0055] Here, the second key in the sent key acquisition response is obtained based on the key identifier and application identifier in the key acquisition request.

[0056] In some embodiments, the second key may be an AKMA application key. After receiving a key acquisition response, the first application function may communicate with the first UE based on the AKMA application key.

[0057] In some embodiments, the key acquisition response also carries the expiration time of the second key and the identifier of the first UE. For example, the identifier of the first UE may be a Subscription Permanent Identifier (SUPI) or a Generic Public Subscription Identifier (GPSI).

[0058] In the above embodiments, the MEP receives a key acquisition request sent by the application function and sends a key acquisition response carrying the second key to the application function. In this way, the application function can obtain the second key simply by interacting with the MEP, without needing to perform signaling interactions with network elements in the core network. This eliminates the signaling interactions between the application function and network elements in the core network during the process of obtaining the second key, thereby improving the security of the core network.

[0059] In some embodiments, the first application function does not have an application instance deployed on the MEC device where the MEP is located; that is, the first application function is deployed entirely outside the MEC device.

[0060] In other embodiments, the first application function has a first application instance deployed on the MEC device where the MEP resides. In these embodiments, the key acquisition request in step 102 is sent by the first application instance, and the key acquisition response in step 104 is sent to the first application instance.

[0061] Since the first application instance and the MEP are deployed on the same MEC device, the key acquisition request received and the key acquisition response sent by the MEP do not need to be transmitted over the network. This reduces network load and communication latency between the MEP and the first application function, enabling the first application function to obtain the second key as quickly as possible, thereby reducing the latency required for the first UE to access the first application function.

[0062] In some implementations, the second key is obtained by the AAnF network element in the core network based on the key identifier and application identifier in the key acquisition request.

[0063] For example, upon receiving a key acquisition request from a first application function, the MEP can send the request to the AAnF network element in the core network. The AAnF network element in the core network can obtain a second key based on the key identifier and application identifier in the key acquisition request, and send a key acquisition response carrying the second key to the MEP. Subsequently, the MEP can send the key acquisition response from the AAnF network element in the core network to the first application function.

[0064] In this way, the security of the core network can be improved while reducing the processing pressure on the MEP.

[0065] In some implementations, the second key is obtained by the MEP based on the key identifier and application identifier in the key acquisition request. The following section combines... Figure 2 Please provide an explanation.

[0066] Figure 2 This is a flowchart illustrating a communication method according to other embodiments of the present disclosure.

[0067] like Figure 2 As shown, the communication method executed by the MEP also includes steps 202 to 206.

[0068] In step 202, obtain the key information.

[0069] Here, the acquired key information includes a first key corresponding to each UE in at least one UE, and a key identifier for the first key corresponding to each UE. At least one UE includes the first UE in step 102.

[0070] It should be understood that steps 202 and 102 can be executed simultaneously or sequentially.

[0071] In some embodiments, the acquired key information may also include the identifier of each UE in at least one UE. The identifier of each UE may be SUPI or GPSI.

[0072] It should be understood that different UEs have different first keys, and the key identifiers of different first keys are also different.

[0073] For ease of explanation, the key information will be simply described below as including a first key and a key identifier for each of at least one UE.

[0074] In step 204, based on the key identifier in the key acquisition request, the first key corresponding to the first UE is found from the key information.

[0075] In step 206, the second key is determined based on the application identifier and the found first key.

[0076] In some embodiments, the application identifier and the found first key can be substituted into a preset algorithm to derive a second key.

[0077] In the above embodiments, the MEP acquires key information including the first key and key identifier corresponding to the first UE, and determines the second key based on the acquired key information, the application identifier of the first application function, and the key identifier of the first key corresponding to the first UE, without requiring the network elements in the core network to determine the second key. This improves the security of the core network while reducing the processing load on the network elements in the core network.

[0078] The following description, in conjunction with some embodiments, further illustrates the point. Figure 2 The communication method shown.

[0079] In some embodiments, step 202 is performed before step 102, that is, key information is obtained before receiving a key acquisition request from the first application function.

[0080] In this approach, after receiving a key acquisition request, the MEP can find the first key corresponding to the first UE from the pre-acquired key information and determine the second key based on it. This allows the first application function to obtain the second key as quickly as possible, thereby reducing the latency required for the first UE to access the first application function.

[0081] In some embodiments, in addition to the first UE, at least one UE in step 202 also includes at least one second UE. That is, the first key and key identifier corresponding to each of the multiple UEs can be obtained at once. In this way, if the MEP subsequently receives another key acquisition response carrying the key identifier of the first key corresponding to the second UE, it can determine the second key corresponding to the second UE without having to obtain the key information again. In this way, the number of times the MEP obtains key information can be reduced, thereby reducing the network load.

[0082] In some embodiments, in step 202, key information can be obtained from a first network element in the core network. For example, key information can be obtained directly from the first network element. Alternatively, key information can be obtained from the first network element via a Network Exposure Function (NEF) network element in the core network. The first network element can be an Authentication Server Function (AUSF) network element or an AAnF network element.

[0083] In some implementations, the MEP resides outside the trusted domain of the core network. In this approach, during the process of various application functions outside the trusted domain acquiring the second key, the first network element in the core network only needs to interact with one MEP outside the trusted domain, without needing to interact with the various application functions outside the trusted domain. This reduces security risks to the core network and ensures improved core network security.

[0084] In some implementations, the MEP resides within the trusted domain of the core network. In this approach, during the process of various application functions outside the trusted domain acquiring the second key, the first network element in the core network only needs to interact with one MEP within the trusted domain, without needing to interact with various application functions outside the trusted domain. This further reduces the security risks of the core network and enhances its security.

[0085] In some embodiments, key information can be obtained from AAnF network elements in the core network. For example, the MEP can act as a proxy for one or more AAnF network elements in the core network. The AAnF network elements that the MEP proxies can first obtain key information from the AAnF network elements in the core network, and then the MEP obtains the key information from these proxies so that it can send a key acquisition response to the application function after receiving a key acquisition request from the application function. In this way, the workload of the AAnF network elements in the core network can be reduced.

[0086] In other implementations, key information can be obtained from AUSF network elements in the core network. In these implementations, the MEP can include elements configured to perform... Figure 1 , Figure 2 The AAnF network element of the communication method described in the relevant embodiments refers to the existence of an AAnF network element deployed on the MEP. For example, a new module can be added to the MEP, and this module is configured to perform... Figure 1 , Figure 2 The communication method described in the relevant embodiments and the operations performed by the AAnF network element.

[0087] In this approach, the AAnF network elements in the MEP obtain key information from the AUSF network elements in the core network, while the network elements in the core network no longer need to obtain key information from the AUSF network elements. This reduces the workload of the network elements in the core network and decreases the transmission of key information between different network elements in the core network, thereby reducing network load.

[0088] In some embodiments, at least one UE in step 202 includes each UE subscribed to one or more application functions. Here, each application function has an application instance deployed on the MEC device where the MEP resides.

[0089] For ease of explanation, the application functions that have application instances deployed on MEC devices will be referred to as the first group of application functions, and each UE subscribed to by the first group of application functions will be referred to as the first group of UEs.

[0090] In the above embodiment, the MEP obtains the key information of each UE in the first group of UEs. In this way, when any UE in the first group of UEs requests access to any application function in the first group of application functions, the application instance in that application function can obtain the second key by interacting with the MEP. This further reduces network load and also reduces the latency required for any UE in the first group of UEs to access any application function in the first group of application functions.

[0091] As one implementation method, key information can be obtained at a preset period. For example, if the preset period is 30 minutes, key information, including the first key and key identifier corresponding to each UE in the first group of UEs, can be obtained from the first network element in the core network every 30 minutes. In this way, the obtained key information can be updated periodically.

[0092] In other implementations, key information can be obtained upon the occurrence of a preset event. The preset event may include at least one of a first event and a second event. The first event is a change in one or more application functions (i.e., a first group of application functions), and the second event is a change in the UEs subscribed to by one or more application functions (i.e., the first group of UEs). In this way, the obtained key information can be updated in a timely manner.

[0093] In some embodiments, when the first event occurs, the acquired key information includes only the first key and key identifier corresponding to each UE that has signed up for the newly added application function in the first group of application functions. In other embodiments, when the second event occurs, the acquired key information includes only the first key and key identifier corresponding to the newly added UE in the first group of UEs.

[0094] For example, the first set of application functions initially included only AF1 and AF2, and later changed to include only AF1 and AF3. In this case, the acquired key information may only include the first key and key identifier corresponding to each UE that has signed up for the newly added AF3.

[0095] For example, the first group of application functions includes AF1 and AF2. Initially, the UEs subscribed to by AF1 only include UE1 and UE2, and the UEs subscribed to by AF2 only include UE2, so the first group of UEs includes UE1 and UE2. Later, the UEs subscribed to by AF1 change to only include UE1 and UE3, while the UEs subscribed to by AF2 still only include UE2, that is, the first group of UEs changes to include UE1, UE2, and UE3. In this case, the obtained key information can only include the first key and key identifier corresponding to the newly added UE3.

[0096] For example, the first group of application functions includes AF1 and AF2. Initially, AF1 only subscribes to UE1 and UE2, and AF2 only subscribes to UE3. Therefore, the first group of UEs includes UE1, UE2, and UE3. Later, the subscribed UEs of AF1 change to include only UE1 and UE3, and the subscribed UEs of AF2 change to include only UE2 and UE3. That is, the first group of UEs still includes UE1, UE2, and UE3. In other words, although the subscribed UEs of some application functions in the first group of application functions change, the overall first group of UEs subscribed to by the first group of application functions remains unchanged. In this case, key information is not required.

[0097] In this way, the network load can be further reduced while the acquired key information is updated in a timely manner.

[0098] Figure 3 This is a flowchart illustrating a communication method according to some embodiments of the present disclosure.

[0099] Figure 3 The communication method shown is executed by the application function and includes steps 302 to 304.

[0100] In step 302, a key acquisition request is sent to the MEP.

[0101] Here, the key acquisition request carries the application identifier of the application function and the key identifier of the first key corresponding to the first UE to which the application function is subscribed.

[0102] In step 304, a key acquisition response carrying the second key is received from the MEP.

[0103] Here, the second key is obtained based on the key identifier and application identifier in the key acquisition request.

[0104] In the above embodiments, the application function sends a key acquisition request to the MEP and receives a key acquisition response carrying the second key from the MEP. In this way, the application function can obtain the second key simply by interacting with the MEP, without needing to perform signaling interactions with network elements in the core network. This eliminates the signaling interactions between the application function and network elements in the core network during the process of obtaining the second key, thereby improving the security of the core network.

[0105] In some embodiments, the application functionality has an application instance deployed on the MEC device where the MEP resides. Figure 3 The communication methods described in the relevant embodiments are executed by application instances in the application functions.

[0106] In this approach, the application instance of the application function and the MEP are deployed on the same MEC device, and neither the key acquisition request sent by the application function nor the key acquisition response received needs to be transmitted over the network. This reduces network load and communication latency between the application function and the MEP, enabling the application function to obtain the second key as quickly as possible, thereby reducing the latency required for the first UE to access the application function.

[0107] Figure 3 Other embodiments of the communication method shown can be found in [reference needed]. Figure 1 , Figure 2 The relevant embodiments are not described in detail here.

[0108] Figure 4This is a flowchart illustrating a communication method according to some embodiments of the present disclosure.

[0109] In some embodiments, the communication method includes steps 402 to 408 and steps 412 to 424. In other embodiments, the communication method includes steps 402 to 404 and steps 410 to 424.

[0110] In step 402, the first UE and the AUSF network elements in the core network perform the initial authentication process for the first UE.

[0111] In some embodiments, during the initial authentication process of the first UE, the AUSF network element can interact with the Unified Data Management (UDM) network element in the core network to obtain the authentication information of the first UE in order to complete the initial authentication of the first UE. The authentication information of the first UE may include user credentials and authentication methods. User credentials may be, for example, an Authentication and Key Agreement (AKA) authentication vector.

[0112] In step 404, the AUSF network element in the core network generates the first key and key identifier corresponding to the first UE.

[0113] Taking the AKMA anchor key as an example, AUSF network elements can use the stored AUSF key (i.e., K...) as the anchor key. AUSF Generate the AKMA anchor key and A-KID for the first UE.

[0114] In some embodiments, after performing the initial authentication process of the first UE, the first UE also generates a first key and a key identifier corresponding to the first UE. It should be understood that the first key and key identifier generated by the first UE are the same as those generated by the AUSF network element. For example, the first UE and the AUSF network element can generate the first key and key identifier corresponding to the first UE based on the same algorithm.

[0115] In step 406, the AUSF network element in the core network sends the first key and key identifier corresponding to the first UE to the AAnF network element in the core network.

[0116] In some embodiments, the AUSF network element also sends the identifier of the first UE to the AAnF network element.

[0117] For example, an AUSF network element can send an AKMA anchor key registration request to an AAnF network element. The AKMA anchor key registration request can carry the identifier of the first UE, the first key corresponding to the first UE, and the key identifier.

[0118] In some embodiments, the core network includes multiple AAnF network elements, and different AAnF network elements can correspond to different UEs. After generating the first key and key identifier corresponding to the first UE, the AAnF network element can select one AAnF network element corresponding to the first UE from the multiple AAnF network elements in the core network, and send an AKMA anchor key registration request to that AAnF network element.

[0119] In step 408, the MEP obtains key information from the AAnF network element in the core network.

[0120] In step 410, the MEP obtains key information from the AUSF network element in the core network.

[0121] For example, the AAnF network element corresponding to the first UE is the AAnF network element in the MEP. After generating the first key and key identifier corresponding to the first UE, the AUSF network element in the core network can send an AKMA anchor key registration request carrying key information to the AAnF network element in the MEP. The key information may include the first key and key identifier corresponding to the first UE.

[0122] In step 412, the application instance (i.e., the first application instance) deployed on the MEC device where the MEP is located in the first application function receives the application session establishment request sent by the first UE.

[0123] Here, the application session establishment request carries the key identifier of the first key corresponding to the first UE.

[0124] It should be understood that step 412 is performed before step 414.

[0125] In step 414, the application instance sends a key acquisition request to the MEP, and the MEP receives the key acquisition request sent by the application instance.

[0126] For example, an application instance can extract a key identifier from an application session establishment request to generate a key retrieval request carrying the application identifier and the key identifier, and send the generated key retrieval request to the MEP.

[0127] In step 416, the MEP searches for the first key corresponding to the first UE from the acquired key information.

[0128] In step 418, the MEP determines the second key based on the first key corresponding to the first UE and the application identifier of the first application function.

[0129] In step 420, the MEP sends a key retrieval response carrying the second key to the application instance, and the application instance receives the key retrieval response sent by the MEP.

[0130] In step 422, the application instance sends an application session establishment response to the first UE.

[0131] In step 424, the application instance communicates with the first UE based on the second key.

[0132] In the above embodiments, the application instance of the first application function can obtain the second key upon interaction with the MEP, which is the basis for communication with the first UE. This improves the security of the core network and reduces the latency required for the first UE to access the first application function.

[0133] In some embodiments, the communication method may include one or more of steps 402 to 410. In other embodiments, the communication method may be one or more of steps 412 to 424.

[0134] Figure 5 This is a schematic diagram of the structure of a MEP according to some embodiments of the present disclosure.

[0135] like Figure 5 As shown, the MEP 500 may include a receiving module 501 and a transmitting module 502.

[0136] The receiving module 501 can be configured to receive a key acquisition request sent by the first application function. The key acquisition request carries the application identifier of the first application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the first application function is subscribed.

[0137] The sending module 502 can be configured to send a key acquisition response carrying a second key to the first application function, the second key being obtained based on the key identifier and application identifier in the key acquisition request.

[0138] It should be understood that the MEP 500 may also include various other modules to perform... Figure 1 and Figure 2 The communication methods described in the relevant embodiments.

[0139] Figure 6 This is a structural diagram illustrating the application functions according to some embodiments of the present disclosure.

[0140] like Figure 6 As shown, application function 600 may include a sending module 601 and a receiving module 602.

[0141] The sending module 601 can be configured to send a key acquisition request to the MEP, the key acquisition request carrying the application identifier of the application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the application function is subscribed.

[0142] The receiving module 602 can be configured to receive a key acquisition response carrying a second key sent by the MEP, the second key being obtained based on the key identifier and application identifier in the key acquisition request.

[0143] It should be understood that application function 600 may also include various other modules to perform... Figure 3 The communication method described in the relevant embodiments, and the operation performed by the first application function in any of the above embodiments.

[0144] Figure 7 This is a schematic diagram of the structure of an electronic device according to some embodiments of the present disclosure.

[0145] like Figure 7 As shown, the electronic device 700 includes a memory 701 and a processor 702 coupled to the memory 701. The processor 702 is configured to execute the communication method of any of the above embodiments based on instructions stored in the memory 701.

[0146] The memory 701 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory may store, for example, an operating system, application programs, a boot loader, and other programs.

[0147] The electronic device 700 may also include an input / output interface 703, a network interface 704, and a storage interface 705. These interfaces 703, 704, and 705, as well as the memory 701 and processor 702, can be connected, for example, via a bus 706. The input / output interface 703 provides a connection interface for input / output devices such as displays, mice, keyboards, and touchscreens. The network interface 704 provides a connection interface for various networked devices. The storage interface 705 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0148] It should be understood that the electronic device 700 can be a MEP or application function (e.g., a first application function) in any of the above embodiments. In some embodiments, the electronic device 700 can be an AAnF network element in the MEP. In other embodiments, the electronic device 700 can be a first application instance deployed on the MEC device where the MEP resides within the first application function.

[0149] Figure 8 This is a schematic diagram of the structure of a communication system according to some embodiments of the present disclosure.

[0150] like Figure 8As shown, the communication system may include MEP 801 and a first application function 802. MEP 801 may be any MEP of the above embodiments (e.g., MEP 500). The first application function 802 may be any application function of the above embodiments (e.g., application function 600).

[0151] In some embodiments, see Figure 8 The communication system also includes a first UE 803. The first UE 803 can be configured to send an application session establishment request carrying a key identifier corresponding to a first application function 802; receive an application session establishment response sent by the first application function 802; and communicate with the first application function 802 based on a second key.

[0152] In some embodiments, see Figure 8 The communication system also includes the first network element 804 in the core network.

[0153] In this embodiment, MEP 801 can be configured to obtain key information from the first network element 804. The key information may include a first key corresponding to each of the at least one UE, and a key identifier for the first key corresponding to each UE. The at least one UE may include a first UE 803.

[0154] The communication system described in this disclosure can improve the security of the core network while increasing user stickiness and acceptance of the MEP. This can enhance the willingness of application function providers to deploy application instances on the MEC equipment where the MEP is located, thus facilitating the promotion of the MEP.

[0155] This disclosure also provides a computer-readable storage medium including computer program instructions that, when executed by a processor, implement the method of any of the above embodiments.

[0156] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the method of any of the above embodiments.

[0157] The embodiments of this disclosure have now been described in detail. To avoid obscuring the concept of this disclosure, some details known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0158] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the others. Similar or identical parts between embodiments can be referred to interchangeably. For the MEP, application function, and communication system embodiments, since they largely correspond to the communication method embodiments, the descriptions are relatively simple; relevant parts can be referred to the descriptions of the communication method embodiments.

[0159] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that the functions specified in one or more flowchart illustrations and / or one or more blocks in a block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate functions for implementing the functions in the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0161] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0162] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0163] While specific embodiments of this disclosure have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments or equivalent substitutions can be made to some technical features without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A communication method executed by a multi-access edge computing platform (MEP), the method comprising: Receive a key acquisition request sent by a first application function, wherein the key acquisition request carries the application identifier of the first application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the first application function is subscribed; and Sending a key acquisition response carrying a second key to the first application function, wherein the second key is obtained based on the key identifier and the application identifier in the key acquisition request, the method further includes: Before receiving the key acquisition request, key information is acquired, including a first key corresponding to each UE in at least one UE, and a key identifier for the first key corresponding to each UE, wherein the at least one UE includes the first UE; Based on the key identifier in the key acquisition request, the first key corresponding to the first UE is retrieved from the key information; and The second key is determined based on the application identifier and the found first key.

2. The method according to claim 1, wherein, The first application function has a first application instance deployed on the MEC device where the MEP is located. The key acquisition request is sent by the first application instance, and the key acquisition response is sent to the first application instance.

3. The method according to claim 1, wherein, Obtaining key information includes: The key information is obtained from the first network element in the core network, wherein the MEP is located within the trusted domain of the core network.

4. The method according to claim 3, wherein, The first network element is an authentication service function network element, and the method is executed by the AAnF network element, which is responsible for the authentication and key management anchoring function of the application in the MEP.

5. The method according to claim 3, wherein, The first network element is the AAnF network element.

6. The method according to claim 1, wherein, The at least one UE also includes at least one second UE.

7. The method according to claim 1, wherein, The at least one UE includes each UE that has been contracted with one or more application functions, and each application function has an application instance deployed on the MEC device where the MEP is located.

8. The method according to claim 7, wherein, Obtaining key information includes: The key information is acquired at a preset period; and / or The key information is obtained when a preset event occurs.

9. The method according to claim 8, wherein, The preset event includes at least one of a first event and a second event, wherein the first event is a change in the one or more application functions, and the second event is a change in the UE subscribed to the one or more application functions.

10. A communication method executed by an application function, the method comprising: Send a key acquisition request to the Multi-Access Edge Computing Platform (MEP). The key acquisition request carries the application identifier of the application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the application function is subscribed. and Receive a key acquisition response carrying a second key from the MEP, the second key being obtained based on the key identifier and the application identifier in the key acquisition request. Before receiving the key acquisition request, the MEP acquires key information, which includes a first key corresponding to each UE in at least one UE and a key identifier for the first key corresponding to each UE. The at least one UE includes the first UE. Based on the key identifier in the key acquisition request, the MEP searches for the first key corresponding to the first UE in the key information and determines the second key based on the application identifier and the found first key.

11. The method according to claim 10, wherein, The application function has an application instance deployed on the MEC device where the MEP is located, and the method is executed by the application instance.

12. The method of claim 10, further comprising: Before sending the key acquisition request, an application session establishment request sent by the first UE is received, the application session establishment request carrying the key identifier; After receiving the key acquisition response, an application session establishment response is sent to the first UE; and The second key is used to communicate with the first UE.

13. The method according to any one of claims 1-12, wherein, The first key is the AKMA anchor key for application authentication and key management, and the second key is the AKMA application key.

14. The method according to any one of claims 1-12, wherein, The key acquisition response also carries the expiration time of the second key and the identifier of the first UE.

15. A multi-access edge computing platform, comprising: The receiving module is configured to receive a key acquisition request sent by a first application function, wherein the key acquisition request carries the application identifier of the first application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the first application function is subscribed. and The sending module is configured to send a key acquisition response carrying a second key to the first application function, the second key being obtained based on the key identifier and the application identifier in the key acquisition request. The multi-access edge computing platform is configured as follows: Before receiving the key acquisition request, key information is acquired, including a first key corresponding to each UE in at least one UE, and a key identifier for the first key corresponding to each UE, wherein the at least one UE includes the first UE; Based on the key identifier in the key acquisition request, the first key corresponding to the first UE is retrieved from the key information; and The second key is determined based on the application identifier and the found first key.

16. A multi-access edge computing platform, comprising: Memory; as well as A processor coupled to the memory is configured to execute the method of any one of claims 1-9 based on instructions stored in the memory.

17. An application function, comprising: The sending module is configured to send a key acquisition request to the multi-access edge computing platform (MEP), the key acquisition request carrying the application identifier of the application function and the key identifier of the first key corresponding to the first user equipment (UE) to which the application function is subscribed; and The receiving module is configured to receive a key acquisition response carrying a second key sent by the MEP, the second key being obtained based on the key identifier and the application identifier in the key acquisition request. Before receiving the key acquisition request, the MEP acquires key information, which includes a first key corresponding to each UE in at least one UE and a key identifier for the first key corresponding to each UE. The at least one UE includes the first UE. Based on the key identifier in the key acquisition request, the MEP searches for the first key corresponding to the first UE in the key information and determines the second key based on the application identifier and the found first key.

18. An application function, comprising: Memory; as well as A processor coupled to the memory is configured to perform the method of any one of claims 10-12 based on instructions stored in the memory.

19. A communication system, comprising: The Multi-Access Edge Computing Platform (MEP) as described in claim 15 or 16; and The first application function is the application function described in claim 17 or 18.

20. The system of claim 19, further comprising: The first network element in the core network; The MEP is located within the trusted domain of the core network and is configured to obtain key information from the first network element. The key information includes a first key corresponding to each UE in at least one UE and a key identifier of the first key corresponding to each UE. The at least one UE includes the first UE.

21. The system of claim 19, further comprising: The first UE is configured to send an application session establishment request carrying a key identifier corresponding to the first application function to the first application function; Receive the application session establishment response sent by the first application function; The second key is used to communicate with the first application function.

22. A computer-readable storage medium comprising computer program instructions, wherein, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1-14.

23. A computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it implements the method described in any one of claims 1-14.

Images