API caller authentication methods, devices, communication equipment, and storage media

Abstract

This disclosure provides an API caller authentication method, apparatus, communication device, and storage medium. The API caller authentication method is executed by the API caller and includes: sending a first request message to a CAPIF function, wherein the first request message includes authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller.

Description

Technical Field

[0001] This disclosure relates to, but is not limited to, the field of communication technology, and in particular to an API caller authentication method, apparatus, communication device, and storage medium. Background Technology

[0002] In related technologies, one of the goals of research on user-aware northbound API access (SNA) application (APP) security is to address the security issues of application program interface (API) calls initiated by user equipment (UE). In the SNA scenario, the UE can act as an API invoker; API invoker boarding is a crucial process. During API invoker boarding, the Common Application Interface Framework (CAPIF) function needs to authenticate the API invoker before authorizing services to the API invoker. However, currently, there is no solution within CAPIF to enable CAPIF to authenticate the API invoker. Summary of the Invention

[0003] This disclosure provides an API caller authentication method, apparatus, communication device, and storage medium.

[0004] According to a first aspect of the present disclosure, an API caller authentication method is provided, executed by an API caller, including:

[0005] Send a first request message to the CAPIF function, wherein the first request message includes the authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller.

[0006] In some embodiments, the method includes: obtaining registration information from pre-configured information of an API provider domain or an API caller, wherein the registration information includes at least one of the following:

[0007] The address of the CAPIF function;

[0008] Fully Qualified Domain Name (FQDN) for CAPIF functionality;

[0009] The root CA certificate for CAPIF functionality.

[0010] In some embodiments, the method includes: establishing a Transport Layer Security (TLS) connection with the CAPIF function based on registration information;

[0011] Sending a first request message to the CAPIF function, including: sending a first request message to the CAPIF function over a TLS connection.

[0012] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to an AKMA Anchor Key for Authentication and Key Management for Applications (AKMA); wherein the AKMA key identifier is used to determine the AKMA Anchor Key, and the AKMA Anchor Key is used to authenticate the identity of the API caller for the CAPIF function.

[0013] In some embodiments, the method includes: based on the Authentication Server Function (K) key. AUSF ), determine the AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key;

[0014] Based on the AKMA anchor key, determine the first application function key (K). AF ).

[0015] In some embodiments, K is determined based on the AKMA anchor key. AF Including one of the following:

[0016] Based on the AKMA anchor key and the identification information of the CAPIF function, the first K is determined. AF The identification information for the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0017] In some embodiments, the method includes: based on a first K AF The second K with CAPIF function AF This determines whether the API caller's authentication was successful.

[0018] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0019] In some embodiments, the method includes: receiving first response information sent by the CAPIF function, wherein the first response information includes:

[0020] API caller configuration information; which includes: Open Functions (AEF) authentication and authorization information;

[0021] The API caller's certificate includes: the API caller's identification information and the API caller's public key.

[0022] Online signing keys for API callers.

[0023] In some embodiments, the API caller's identification information includes one of the following:

[0024] Identification information of the API caller assigned to the CAPIF function;

[0025] User Permanent Identifier (SUPI);

[0026] Generic Public Subscription Identifier (GPSI);

[0027] IMS Private Identity (IMPI);

[0028] Subscription Concealed Identifier (SUCI);

[0029] UE's application layer ID.

[0030] In some embodiments, the first request information further includes: the API caller's token; the first response information is sent by CAPIF based on successful token verification.

[0031] In some embodiments, the API caller includes: UE.

[0032] In some embodiments, the CAPIF function includes one of the following:

[0033] CAPIF core function (CCF);

[0034] API exposing function (AEF);

[0035] Authorization Function (AF).

[0036] According to a second aspect of the present disclosure, an API caller authentication method is provided, executed by an AKMA Anchor Function (AAnF), comprising:

[0037] Receive a second request message sent by the CAPIF function, wherein the second request message is determined by the CAPIF function based on the first request message, and the second request message includes: the AKMA key identifier of the API caller included in the first request message;

[0038] Based on the AKMA key identifier, the corresponding AKMA anchor key is determined. The AKMA anchor key is used to identify the caller of the CAPIF function authentication API.

[0039] In some embodiments, the method includes:

[0040] Determine the second K based on the AKMA anchor key. AF ;

[0041] Send a second response message to CAPIF, wherein the second response message includes a second K. AF .

[0042] In some embodiments, the second response information further includes: with the second K AF The corresponding validity period, and / or the identifier information of the API caller.

[0043] In some embodiments, the API caller's identification information includes one of the following: SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0044] In some embodiments, the second request information includes: identification information of the CAPIF function;

[0045] Based on the AKMA anchor key, determine the second application function key K. AF ,include:

[0046] Based on the AKMA anchor key and the identification information of the CAPIF function, the second application function key K is determined. AF .

[0047] In some embodiments, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0048] Based on the AKMA anchor key and the identification information of the CAPIF function, the second application function key K is determined. AF Including one of the following:

[0049] AKMA anchor key and FQDN, determine the second application function key K AF ;

[0050] AKMA anchor key, FQDN and security protocol identifier, determine the second K AF .

[0051] In some embodiments, the method includes: determining whether AAnF can provide services for the CAPIF function based on the identification information of the CAPIF function;

[0052] Based on the AKMA key identifier, determine the AKMA anchor key corresponding to the AKMA key identifier, including:

[0053] If it is determined that AAnF can provide services for the CAPIF function, the AKMA anchor key corresponding to the AKMA key identifier is determined based on the AKMA key identifier.

[0054] In some embodiments, the method includes: if it is determined that AAnF cannot provide services for the CAPIF function, refusing to provide the second K to CAPIF. AF .

[0055] In some embodiments, the method includes: sending a second response message carrying error indication information to the CAPIF function based on the fact that there is no AKMA anchor key in AAnF corresponding to the AKMA key.

[0056] In some embodiments, the API caller includes: UE.

[0057] In some embodiments, the CAPIF function includes one of the following:

[0058] CAPIF Core Functionality (CCF);

[0059] API Open Functionality (AEF);

[0060] Authorization Function (AF).

[0061] According to a third aspect of the embodiments of this disclosure, an API caller authentication method is provided, performed by a CAPIF function, including:

[0062] Receive the first request information sent by the API caller, wherein the first request information includes the API caller's authentication information; the authentication information is used to authenticate the identity of the API caller.

[0063] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to authenticate the identity of the API caller.

[0064] In some embodiments, the method includes: sending a second request message to the AKMA anchor function AAnF, wherein the second request message includes an AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second K of the CAPIF function. AF .

[0065] In some embodiments, the method includes: based on a second K AF and the first K of the API caller AF Authenticate the identity of the API caller.

[0066] In some embodiments, the method includes: determining an AAnF corresponding to the CAPIF function based on the AKMA key identifier.

[0067] In some embodiments, the method includes: receiving second response information sent by AAnF, wherein the second response information includes at least one of the following:

[0068] Second K AF ;

[0069] API caller identification information and second KB AF ;

[0070] Second K AF and the second K AF The corresponding valid time;

[0071] API caller identification information, second K AF and the second K AF The corresponding valid time.

[0072] In some embodiments, the API caller's identification information includes one of the following: SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0073] In some embodiments, the second request information includes: identification information of the CAPIF function; wherein, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function; the AKMA anchor key and the identification information of the CAPIF function are used by ANF to determine the second K AF .

[0074] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0075] In some embodiments, the method includes: determining whether API caller authentication is successful based on a first certificate and a root certificate corresponding to the first certificate stored in the CAPIF core functionality storage.

[0076] In some embodiments, the method includes at least one of the following:

[0077] Based on successful API caller authentication, determine the API caller's online signing key;

[0078] Based on successful API caller authentication, determine the API caller's API caller configuration information; the API caller configuration information includes: Open Functionality (AEF) authentication and authorization information;

[0079] Based on successful API caller authentication, a certificate for the API caller is generated; the API caller certificate includes: the API caller's public key and the API caller's identification information.

[0080] In some embodiments, the first request information may further include: the API caller's token;

[0081] Determine the API caller's configuration information, including: determining the API caller's configuration information based on successful API caller authentication and the token.

[0082] In some embodiments, the method includes sending a first response message to an API caller, wherein the first response message includes at least one of the following: the API caller's online contract information, API caller configuration information, and API caller's certificate.

[0083] In some embodiments, the API caller includes: UE.

[0084] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0085] According to a fourth aspect of the present disclosure, an API caller authentication device is provided, comprising:

[0086] The sending module is configured to send a first request message to the CAPIF function, wherein the first request message includes the authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller.

[0087] In some embodiments, the apparatus includes: a receiving module configured to obtain registration information from pre-configured information of an API provider domain or an API caller, wherein the registration information includes at least one of the following:

[0088] The address of the CAPIF function;

[0089] FQDN for CAPIF functionality;

[0090] The root CA certificate for CAPIF functionality.

[0091] In some embodiments, the apparatus includes: a processing module configured to establish a TLS connection with the CAPIF function based on registration information;

[0092] The sending module is configured to send the first request information to the CAPIF function via a TLS connection.

[0093] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to identify the caller of the CAPIF function authentication API.

[0094] In some embodiments, the apparatus includes: a processing module configured to be based on K AUSF Determine the AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key;

[0095] The processing module is also configured to determine the first K based on the AKMA anchor key. AF .

[0096] In some embodiments, the processing module is configured to determine the first K based on the AKMA anchor key and the identification information of the CAPIF function. AF The identification information for the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0097] In some embodiments, the apparatus includes: a processing module configured to be based on a first K AF The second K with CAPIF function AF This determines whether the API caller's authentication was successful.

[0098] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0099] In some embodiments, the apparatus includes: a receiving module configured to receive first response information sent by the CAPIF function, wherein the first response information includes:

[0100] API caller configuration information; which includes: Open Functionality (AEF) authentication and authorization information;

[0101] The API caller's certificate includes: the API caller's identification information and the API caller's public key.

[0102] Online signing keys for API callers.

[0103] In some embodiments, the API caller identification information includes one of the following: API caller identification information assigned by the CAPIF function, SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0104] In some embodiments, the first request information further includes: the API caller's token; the first response information is sent by CAPIF based on successful token verification.

[0105] In some embodiments, the API caller includes: UE.

[0106] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0107] According to a fifth aspect of the present disclosure, an API caller authentication device is provided, executed by AAnF, comprising:

[0108] The receiving module is configured to receive a second request message sent by the CAPIF function, wherein the second request message is determined by the CAPIF function based on the first request message, and the second request message includes: the AKMA key identifier of the API caller included in the first request message;

[0109] The processing module is configured to determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier. The AKMA anchor key is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0110] In some embodiments, the apparatus includes: a processing module configured to determine a second K based on an AKMA anchor key. AF ;

[0111] The sending module is configured to send a second response message to CAPIF, wherein the second response message includes a second K. AF .

[0112] In some embodiments, the second response information further includes: with the second K AF The corresponding validity period, and / or the identifier information of the API caller.

[0113] In some embodiments, the API caller's identification information includes one of the following: SUPI; GPSI, IMPI, SUCI, and the UE's application layer ID.

[0114] In some embodiments, the second request information includes: identification information of the CAPIF function;

[0115] The processing module is configured to determine the second K based on the AKMA anchor key and the identification information of the CAPIF function. AF .

[0116] In some embodiments, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0117] The processing module is configured with the AKMA anchor key and FQDN to determine the second application function key K. AF ;

[0118] Alternatively, the processing module is configured to use the AKMA anchor key, FQDN, and security protocol identifier to determine the second application function key K. AF .

[0119] In some embodiments, the apparatus includes: a processing module configured to determine whether AAnF can provide services for the CAPIF function based on the identification information of the CAPIF function;

[0120] The processing module is also configured to determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier if it is determined that AAnF can provide services for the CAPIF function.

[0121] In some embodiments, the apparatus includes: a processing module configured to refuse to provide a second K to CAPIF if it is determined that ANF cannot provide services for the CAPIF function. AF .

[0122] In some embodiments, the apparatus includes: a sending module configured to send a second response message carrying error indication information to the CAPIF function based on the absence of an AKMA anchor key corresponding to the AKMA key in AKMA in AKMA.

[0123] In some embodiments, the API caller includes: UE.

[0124] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0125] According to a sixth aspect of the present disclosure, an API caller authentication apparatus is provided, executed by a CAPIF function, comprising:

[0126] The receiving module is configured to receive first request information sent by the API caller, wherein the first request information includes the API caller's authentication information; the authentication information is used to authenticate the identity of the API caller.

[0127] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to authenticate the identity of the API caller.

[0128] In some embodiments, the apparatus includes: a sending module configured to send second request information to the AKMA anchor function AAnF, wherein the second request information includes an AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second K of the CAPIF function. AF .

[0129] In some embodiments, the apparatus includes: a processing module configured to be based on a second K AF and the first K of the API caller AF Authenticate the identity of the API caller.

[0130] In some embodiments, the apparatus includes a processing module configured to determine an AAnF corresponding to the CAPIF function based on an AKMA key identifier.

[0131] In some embodiments, the apparatus includes: a receiving module configured to receive second response information sent by AAnF, wherein the second response information includes at least one of the following:

[0132] Second K AF ;

[0133] API caller identification information and second KB AF ;

[0134] Second K AF and the second K AF The corresponding valid time;

[0135] API caller identification information, second K AF and the second K AF The corresponding valid time.

[0136] In some embodiments, the API caller's identification information includes one of the following: SUPI; GPSI, IMPI, SUCI, and the UE's application layer ID.

[0137] In some embodiments, the second request information includes: identification information of the CAPIF function; wherein, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function; the AKMA anchor key and the identification information of the CAPIF function are used by ANF to determine the second K AF .

[0138] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0139] In some embodiments, the apparatus includes a processing module configured to determine whether API caller authentication is successful based on a first certificate and a root certificate corresponding to the first certificate stored in the CAPIF core functionality.

[0140] In some embodiments, the processing module is configured to be at least one of the following:

[0141] Based on successful API caller authentication, determine the API caller's online signing key;

[0142] Based on successful API caller authentication, determine the API caller's API caller configuration information; the API caller configuration information includes: Open Functionality (AEF) authentication and authorization information;

[0143] Based on successful API caller authentication, a certificate for the API caller is generated; the API caller certificate includes: the API caller's public key and the API caller's identification information.

[0144] In some embodiments, the first request information may further include: the API caller's token;

[0145] The processing module is configured to determine the API caller configuration information of the API caller, including: determining the API caller configuration information based on the token after successful API caller authentication.

[0146] In some embodiments, the apparatus includes: a sending module configured to send first response information to an API caller, wherein the first response information includes at least one of the following: online subscription information of the API caller, API caller configuration information, and API caller certificate.

[0147] In some embodiments, the API caller includes: UE.

[0148] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0149] According to a seventh aspect of this disclosure, a communication device is provided, comprising:

[0150] processor;

[0151] Memory used to store processor-executable instructions;

[0152] The processor is configured to implement the API caller authentication method of any embodiment of this disclosure when running executable instructions.

[0153] According to an eighth aspect of this disclosure, a computer storage medium is provided that stores a computer executable program, which, when executed by a processor, implements the API caller authentication method of any embodiment of this disclosure.

[0154] The technical solutions provided in this disclosure may have the following beneficial effects:

[0155] In this embodiment of the disclosure, the API caller sends a first request message to the CAPIF function, wherein the first request message includes the API caller's authentication information; the authentication information is used by the CAPIF function to authenticate the API caller's identity. This allows CAPIF to effectively authenticate the API caller's identity based on the authentication information.

[0156] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0157] Figure 1 This is a schematic diagram illustrating the structure of a wireless communication system according to an exemplary embodiment.

[0158] Figure 2 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0159] Figure 3 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0160] Figure 4 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0161] Figure 5 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0162] Figure 6 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0163] Figure 7This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0164] Figure 8 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0165] Figure 9 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0166] Figure 10 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0167] Figure 11 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0168] Figure 12 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0169] Figure 13 This is a schematic diagram illustrating an API caller authentication method according to an exemplary embodiment.

[0170] Figure 14 This is a block diagram illustrating an API caller authentication device according to an exemplary embodiment.

[0171] Figure 15 This is a block diagram illustrating an API caller authentication device according to an exemplary embodiment.

[0172] Figure 16 This is a block diagram illustrating an API caller authentication device according to an exemplary embodiment.

[0173] Figure 17 This is a block diagram illustrating a UE according to an exemplary embodiment.

[0174] Figure 18 This is a block diagram illustrating a base station according to an exemplary embodiment. Detailed Implementation

[0175] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this disclosure as detailed in the appended claims.

[0176] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. The singular forms “a” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0177] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of embodiments of this disclosure, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0178] Please refer to Figure 1 This illustration shows a schematic diagram of the structure of a wireless communication system provided in an embodiment of this disclosure. Figure 1 As shown, the wireless communication system is a communication system based on cellular mobile communication technology. The wireless communication system may include: several user equipment 110 and several base stations 120.

[0179] User equipment 110 can be a device that provides voice and / or data connectivity to a user. User equipment 110 can communicate with one or more core networks via a Radio Access Network (RAN). User equipment 110 can be an Internet of Things (IoT) user equipment, such as sensor devices, mobile phones (or "cellular" phones), and computers with IoT user equipment capabilities. For example, it can be a fixed, portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted device. Examples include a station (STA), subscriber unit, subscriber station, mobile station, mobile station, remote station, access point, remote terminal, access terminal, user terminal, user agent, user device, or user equipment. Alternatively, user equipment 110 can also be a device from an unmanned aerial vehicle (UAV). Alternatively, user equipment 110 can also be a vehicle-mounted device, such as a vehicle computer with wireless communication capabilities, or a wireless user equipment connected to an external vehicle computer. Alternatively, user equipment 110 can also be a roadside device, such as a street light, traffic light, or other roadside device with wireless communication capabilities.

[0180] Base station 120 can be a network-side device in a wireless communication system. This wireless communication system can be a 4G system (also known as Long Term Evolution, LTE); or it can be a 5G system (also known as a New Radio, 5G NR, or 5G NR system). Alternatively, it can be the next generation after 5G. In this case, the access network in the 5G system can be called a New Generation-Radio Access Network (NG-RAN).

[0181] The base station 120 can be an evolved NB (eNB) used in a 4G system. Alternatively, the base station 120 can also be a gNB (gNB) using a centralized-distributed architecture in a 5G system. When the base station 120 adopts a centralized-distributed architecture, it typically includes a central unit (CU) and at least two distributed units (DUs). The central unit is equipped with a protocol stack of the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control (RLC) layer, and the Medium Access Control (MAC) layer; the distributed units are equipped with a physical (PHY) layer protocol stack. This disclosure does not limit the specific implementation of the base station 120.

[0182] Base station 120 and user equipment 110 can establish a wireless connection via a wireless air interface. In different implementations, the wireless air interface is a wireless air interface based on the fourth-generation mobile communication network technology (4G) standard; or, the wireless air interface is a wireless air interface based on the fifth-generation mobile communication network technology (5G) standard, such as a new air interface; or, the wireless air interface can also be a wireless air interface based on a next-generation mobile communication network technology standard based on 5G.

[0183] In some embodiments, user equipment 110 can also establish E2E (End to End) connections. Examples include vehicle-to-vehicle (V2V) communication, vehicle-to-infrastructure (V2I) communication, and vehicle-to-pedestrian (V2P) communication in vehicle-to-everything (V2X) communication.

[0184] Here, the user equipment mentioned above can be considered as the terminal equipment in the following embodiments.

[0185] In some embodiments, the wireless communication system described above may further include a network management device 130.

[0186] Several base stations 120 are connected to network management device 130. Network management device 130 can be a core network device in a wireless communication system, such as a Mobility Management Entity (MME) in an Evolved Packet Core (EPC). Alternatively, it can be other core network devices, such as a Serving Gateway (SGW), a Public Data Network Gateway (PGW), a Policy and Charging Rules Function (PCRF), or a Home Subscriber Server (HSS). The implementation of network management device 130 is not limited in this embodiment.

[0187] To facilitate understanding by those skilled in the art, this disclosure provides multiple embodiments to clearly illustrate the technical solutions of the embodiments of this disclosure. Of course, those skilled in the art will understand that the multiple embodiments provided in this disclosure can be executed individually, or in combination with the methods of other embodiments in this disclosure, or individually or in combination with some methods in other related technologies; this disclosure does not limit these aspects.

[0188] To better understand the technical solutions described in any embodiment of this disclosure, some aspects of the related art will be explained first:

[0189] In some application scenarios, one of the purposes of research on the security of user-perceived northbound AIP access application (SNAAPP) is to solve the security problem of UE API calls; in the SNA scenario, the UE can act as an API caller. Specifically, in TS 22.261 Clause 6.10.2, it stipulates that "by authenticating and authorizing the UE, secure access to the API is provided to the UE (e.g., triggered by an application not visible to the 5G system)". It can be understood that the APP running on the UE is not visible to the 3GPP system, and the UE needs to be authenticated and authorized. In addition, SA6 SID[2] points out that "it should be noted that the UE that triggers the API caller (hereinafter referred to as the triggering UE) may be different from the UE whose service experience is affected by the API call response (hereinafter referred to as the resource owner)". Therefore, it is also important to authenticate and authorize the caller UE to protect the service experience of the target UE.

[0190] For API callers, the CAPIF function needs to authenticate the API caller before authorizing services to the API caller. However, there is no existing solution within CAPIF that enables the CAPIF function to authenticate API callers.

[0191] like Figure 2 As shown, this disclosure provides an API caller authentication method, executed by the API caller, including:

[0192] Step S21: Send a first request message to the CAPIF function, wherein the first request message includes the authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller.

[0193] In one embodiment, the API caller can be, but is not limited to, a User-Defined Device (UE). This can be various mobile or fixed terminals. For example, the UE can be, but is not limited to, a mobile phone, computer, server, wearable device, vehicle terminal, game control platform, or multimedia device.

[0194] In one embodiment, CAPIF functionality may be, but is not limited to, the CAPIF Core Function (CCF), API Open Function (AEF), and Authorization Function (AF). Here, CCF, AEF, and AF can all be logical nodes or functions flexibly deployed within CAPIF. The AF can also be a logical node or function in the core network or in the network accessing the core.

[0195] Here, CAPIF functionality can refer to other logical nodes or functions flexibly deployed within CAPIF. CAPIF functionality can also be a network function deployed by the operator.

[0196] For example, the API caller sends a first request message to the CCF; or, the API caller sends a first request message to the AEF; or, the API caller sends a first request message to the AF.

[0197] For example, the UE sends a first request message to the CCF; or, the API caller sends a first request message to the AEF; or, the API caller sends a first request message to the AF.

[0198] In the embodiments of this disclosure, the AAnF mentioned below can be a logical node or function that is flexibly deployed in a communication network. For example, the AAnF can be a logical node or function on the core network side; or, the AAnF can be a logical node or function in a data network connected to the core network.

[0199] In one embodiment, the first request information may be: an Onboard API invoker request message.

[0200] In one embodiment, the authentication information may be, but is not limited to, the AKMA key identifier corresponding to the AKMA anchor key and / or certificate information. Here, either the AKMA anchor key or the certificate information can be used to authenticate the identity of the API caller using the CAPIF function.

[0201] In one embodiment, the first request information may include, but is not limited to, at least one of the following: an API caller's token, an API caller's key pair, and an API caller's public key. Here, the API caller's key pair includes the API caller's private key and public key. Here, the API caller's token may be, but is not limited to, an OAuth 2.0 token; of course, the API caller's token may also be other access tokens (OAuth), etc. Here, the API caller's public key may be any type of public key, such as a pre-set string. Here, the API caller's token and / or API caller's public key can facilitate CAPIF's further authentication of the API caller's identity.

[0202] In this embodiment, the API caller sends a first request message to the CAPIF function, wherein the first request message includes the API caller's authentication information; the authentication information is used by the CAPIF function to authenticate the API caller's identity. This allows CAPIF to effectively authenticate the API caller's identity based on the authentication information.

[0203] Thus, the embodiments of this disclosure can improve the security protection of the target UE's services when an API caller invokes them.

[0204] In one embodiment, sending the first request information to the CAPIF function in step S21 may include sending the first request information before or during the SNA. Thus, this embodiment of the present disclosure can authenticate the identity of the API caller when the API caller performs SNA applications, thereby enhancing the service security protection of the called UE.

[0205] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0206] like Figure 3 As shown, this disclosure provides an API caller authentication method, executed by the API caller, including:

[0207] Step S31: Obtain registration information from the API provider domain, wherein the registration information includes at least one of the following: the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate of the CAPIF function.

[0208] This disclosure provides an API caller authentication method, executed by the API caller, including: obtaining registration information from the API caller's pre-configuration information, wherein the registration information includes at least one of the following: the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate of the CAPIF function.

[0209] In some embodiments of this disclosure, the CAPIF function may be the CAPIF function in step S21.

[0210] In one embodiment, the API provider domain can be a function or a logical node; for example, the API provider domain is a function integrated into CAPIF that manages information about API callers and / or CAPIF functions. For instance, the API provider domain could manage API caller tokens, etc.

[0211] In one embodiment, the API caller stores pre-configuration information for at least one API caller. Alternatively, the API caller may also obtain the pre-configuration information for the API caller from other network elements.

[0212] In one embodiment, the address of the CAPIF function can be, but is not limited to, the physical address of the CAPIF function.

[0213] In one embodiment, the FQDN of the CAPIF function can be, but is not limited to, a combination of the hostname and domain name of the CAPIF function, or a name containing the hostname and domain name of the CAPIF function. For example, if the hostname of the CAPIF function is "bigserver" and the domain name of the CAPIF function is "mycompany.com", then the FQDN could be "bigserver.mycompany.com".

[0214] In one embodiment, the root CA certificate for the CAPIF function can be any type of root CA certificate.

[0215] In one embodiment, the registration information may be online registration information.

[0216] Thus, in this embodiment of the disclosure, the API caller can obtain registration information from the API provider domain or the API caller's pre-configured information. This registration information may include at least one of the following: the address of the CAPIF function, the FQDN, and the root certificate. This is beneficial for the API caller to perform subsequent operations based on the registration information; for example, it may be establishing a connection with CAPIF.

[0217] In some embodiments, the method includes: establishing a TLS connection with the CAPIF function based on registration information;

[0218] Step S21, which involves sending the first request information to the CAPIF function, includes sending the first request information to the CAPIF function via a TLS connection.

[0219] This disclosure provides an API caller authentication method, executed by the API caller, including:

[0220] Based on registration information, establish a TLS connection with the CAPIF function;

[0221] Send the first request message to the CAPIF function via a TLS connection.

[0222] Here, the TLS connection is mutually authenticated between the API caller and the API caller through the CAPIF function of the CAPIF interface.

[0223] Here, the API caller can establish a TLS session with CAPIF via a TLS connection; the API caller can send the first request information to CAPIF through the TLS session.

[0224] For example, an API caller can establish a TLS connection with a CAPIF function based on the CAPIF function's address and / or CAPIF function's FQDN.

[0225] Thus, in this embodiment of the disclosure, the API caller can establish a TLS connection with CAPIF based on the registration information, so that the API caller can send the first request information to CAPIF through the TLS connection; this realizes the sending of the first request information.

[0226] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0227] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to identify the caller of the CAPIF function authentication API.

[0228] like Figure 4 As shown, this disclosure provides an API caller authentication method, executed by the API caller, including:

[0229] Step S41: Send a first request message to the CAPIF function, wherein the first request message includes the authentication information of the API caller; wherein the authentication information includes the AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used by the CAPIF function to authenticate the identity of the API caller.

[0230] In some embodiments of this disclosure, the first request information and the authentication information may be the first request information and the authentication information in step S21, respectively.

[0231] Here, the AKMA anchor key is used to determine K. AF K AF Used to authenticate the identity of API callers for the CAPIF function. This K AF It can be the first K involved in the following AF Or the second K AF .

[0232] In one embodiment, the AKMA key identifier can be: A-KID.

[0233] Here, the AKMA key identifier carried in the first request information is used by AAnF to determine the AKMA anchor key; this AKMA anchor key is used by AAnF to generate K AF For example, AAnF determines the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier; and determines the second K based on the AKMA anchor key. AF ;AAnF will be the second K AF Send it to the CAPIF function so that the CAPIF function can authenticate the identity of the API caller.

[0234] In this embodiment, the API caller can send a first request message to the CAPIF function. This first request message includes authentication information, specifically an AKMA key identifier corresponding to the AKMA anchor key. Based on this AKMA key identifier, the AKMA anchor key can be determined, and subsequently, based on the AKMA anchor key, the K key used for CAPIF function authentication of the API caller's identity can be determined. AF This allows the CAPIF function to authenticate the identity of the API caller.

[0235] This disclosure provides an API caller authentication method, executed by the API caller, including:

[0236] Based on the authentication service function key (K) AUSF ), determine the AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key;

[0237] Based on the AKMA anchor key, determine the first application function key (K). AF ).

[0238] In some embodiments, K is determined based on the AKMA anchor key. AF Including one of the following:

[0239] Based on the AKMA anchor key and the identification information of the CAPIF function, the first K is determined. AF The identification information for the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0240] In one embodiment, the identification information for the CAPIF function can be: AF_ID.

[0241] This disclosure provides an API caller authentication method, executed by the API caller, including: obtaining an authentication service function key (K). AUSF For example, an API caller can obtain K from the API provider's domain. AUSF Alternatively, the API caller can determine K. AUSF .

[0242] In one embodiment, the security protocol identifier can be a Ua* protocol security protocol identifier.

[0243] This disclosure provides an API caller authentication method, executed by the API caller, including:

[0244] Based on the AKMA anchor key and the identification information of the CAPIF function, the first K is determined. AF The identification information for the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0245] Of course, in other embodiments, the identification information of the CAPIF function can be any kind of identification information that can uniquely represent the CAPIF function; for example, the identification information of the CAPIF function can be the number information of the CAPIF function; or the physical address of the identification information of the CAPIF function can be determined.

[0246] For example, the API caller generates the first K based on the AKMA anchor key and FQDN. AF .

[0247] For example, the API caller generates the first K based on the AKMA anchor key, FQDN, and security protocol identifier. AF .

[0248] In this embodiment of the disclosure, the API caller can be based on K AUSF The AKMA anchor key and the corresponding AKMA key identifier are determined; wherein, the AKMA anchor key can be used by the API caller to generate the first K for API caller authentication. AF The AKMA key identifier can be sent to the CAPIF function so that the CAPIF function can obtain a second K based on the AKMA key identifier for API caller authentication. AF .

[0249] This disclosure provides an API caller authentication method, executed by the API caller, including: based on a first K AF The second K with CAPIF function AF This determines whether the API caller's authentication was successful.

[0250] Here, we can base it on the first K. AF With the second K AF Whether there is a match determines whether the API caller's authentication was successful. If the first K... AF With the second K AF If there is a mismatch, it indicates that the API caller's authentication failed; or, if the first K... AF With the second K AF The system matches and confirms that the API caller's identity has been successfully authenticated.

[0251] For example, the API caller utilizes the first K AF The first message is encrypted to obtain the second encrypted message; the API caller sends the second message to the CAPIF function; the CAPIF function can then base its message on the second K... AF Decrypt the second information to obtain the first information. Thus, the first K... AF With the second K AF match.

[0252] In this embodiment of the disclosure, the first K AF With the second K AF It is generated based on the same AKMA anchor key, if the first K AF With the second K AF If the match is successful, it can be determined that the API caller's identity has been successfully authenticated and that the API caller is not a forged identity.

[0253] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0254] like Figure 5 As shown, this disclosure provides an API caller authentication method, executed by the API caller, including:

[0255] Step S51: Send a first request message to the CAPIF function, wherein the first request message includes the authentication information of the API caller; wherein the authentication information includes a first certificate; wherein the first certificate is used by the CAPIF function to authenticate the identity of the API caller.

[0256] Here, the first certificate can be a certificate generated by an authoritative organization for the API caller or a certificate generated by the CAPIF Core Function for the API caller.

[0257] Here, the first certificate is used by CAPIF functions to authenticate the identity of API callers based on the first certificate and the root certificate stored in CAPIF. This root certificate is either stored in CAPIF or obtained from other functions as the root certificate corresponding to the first certificate.

[0258] Thus, in this embodiment of the disclosure, the API caller can send its own first certificate so that CAPIF can perform identity authentication for CAPIF functions based on the certificate.

[0259] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0260] like Figure 6 As shown, this disclosure provides an API caller authentication method, executed by the API caller, including:

[0261] Step S61: Receive the first response information sent by the CAPIF function, wherein the first response information includes at least one of the following: API caller configuration information, API caller certificate, and API caller online signing key.

[0262] Here, the API caller configuration information includes AEF authentication information and authorization information.

[0263] Here, the API caller's certificate includes at least one of the following: the API caller's identification information and the API caller's public key.

[0264] Here, the API caller's identification information includes, but is not limited to, one of the following: API caller identification information assigned by CAPIF, SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0265] In some embodiments of this disclosure, the API caller can be the API caller in step S21; the CAPIF function can be the CAPIF function in step S21.

[0266] Here, the API caller certificate includes, but is limited to, at least one of the following: API caller identification information, API caller public key, and API caller identification information.

[0267] Here, the first response message is sent by CAPIF after successfully authenticating the API caller.

[0268] In one embodiment, the first response information may be an Onboard API Invoker response message.

[0269] In this embodiment, after the API caller's identity is successfully authenticated by the CAPIF function, the CAPIF function can reassign the API caller's certificate, AEF authentication and authorization information, and online signing key. This facilitates secure interactions between the API caller and functions such as CAPIF in subsequent processes.

[0270] In some embodiments, the first request information further includes: the API caller's token; the first response information is sent by CAPIF based on successful token verification.

[0271] In this embodiment of the disclosure, after the API caller's identity is successfully authenticated, the CAPIF function can further verify the API caller's token, and only after the token is successfully verified will the API caller configuration information be generated; this can further authenticate the API identity to improve the security of subsequent online interactions, etc.

[0272] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0273] The following API caller authentication method is executed by AAnF and is similar to the API caller authentication method executed by the API caller described above. For technical details not disclosed in the embodiment of the API caller authentication method executed by AAnF, please refer to the description of the example of the API caller authentication method executed by the API caller, which will not be described in detail here.

[0274] like Figure 7 As shown, this disclosure provides an API caller authentication method, executed by AAnF, including:

[0275] Step S71: Receive the second request information sent by the CAPIF function, wherein the second request information is determined by the CAPIF function based on the first request information, and the second request information includes: the AKMA key identifier of the API caller included in the first request information;

[0276] Step S72: Based on the AKMA key identifier, determine the AKMA anchor key corresponding to the AKMA key identifier, wherein the AKMA anchor key is used to identify the caller of the CAPIF function authentication API.

[0277] Here, the second request information can be: application key request information (Naanf_AKMA_ApplicationKey).

[0278] In some embodiments of this disclosure, the API caller can be the API caller in the above embodiments; the CAPIF function can be the CAPIF function in the above embodiments; and AAnF can be AAnF in the above embodiments.

[0279] For example, the API caller can be, but is not limited to, a user interface (UE).

[0280] For example, CAPIF functionality may include, but is not limited to: CAPIF Core Functionality (CCF), API Open Functionality (AEF), and Authorization Functionality (AF).

[0281] Here, the second request information is sent by the CAPIF function after receiving the first request information. The first request information here can be the first request information in the above embodiment.

[0282] Here, the second request information is at least used to request K. AF .

[0283] Thus, in this embodiment of the disclosure, AAnF can receive a second request message, wherein the second request message includes an AKMA key identifier; and determine the AKMA anchor key based on the AKMA key identifier. This is beneficial for AAnF to determine the second K based on the AKMA anchor key.AF This is to enable the CAPIF function to authenticate API callers.

[0284] This disclosure provides an API caller authentication method, executed by ANF, including: sending an AKMA anchor key to a CAPIF function. For example, the API caller sends a second response message to the CAPIF function, wherein the second response message includes the AKMA anchor key. Thus, this AKMA anchor key can also be used by CAPIF to generate a second AKMA anchor key. AF .

[0285] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0286] like Figure 8 As shown, this disclosure provides an API caller authentication method, executed by AAnF, including:

[0287] Step S81: Determine the second K based on the AKMA anchor key. AF ;

[0288] Step S82: Send a second response message to CAPIF, wherein the second response message includes a second K. AF .

[0289] In some embodiments, the second response information further includes: with the second K AF The corresponding validity period, and / or the identifier information of the API caller.

[0290] In some embodiments of this disclosure, the identification information of the API caller can be the same as the identification information of the API caller described in the above embodiments. For example, the identification information of the API caller includes one of the following: SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0291] In one embodiment, the second response information includes at least one of the following:

[0292] Second K AF ;

[0293] Second K AF and the second K AF The effective time;

[0294] Second K AF and the identifier information of the API caller;

[0295] Second K AF The second K AFThe validity period and the identifier information of the API caller.

[0296] For example, AAnF sends a second response message to CAPIF, wherein the second response message includes a second K. AF In this way, CAPIF can obtain the second K. AF So that CAPIF can be based on the second K AF Implement authentication of API callers.

[0297] For example, AAnF sends a second response message to CAPIF, wherein the second response message includes a second K. AF Second K AF The effective time. In this way, CAPIF can obtain the second K. AF and the second K AF The effective time, so that CAPIF can be based on the second K AF Authenticate the identity of the API caller within the valid time.

[0298] For example, AAnF sends a second response message to CAPIF, wherein the second response message includes a second K. AF This includes the identifier information of the API caller. This allows CAPIF to know which API caller is being authenticated.

[0299] Thus, in this embodiment of the disclosure, AAnF can provide a second K for CAPIF. AF The second K AF And at least one of the API caller's identification information, to facilitate CAPIF's authentication of the API caller.

[0300] In some embodiments, the second request information includes: identification information of the CAPIF function;

[0301] Step S81 includes: determining the second K based on the AKMA anchor key and the identification information of the CAPIF function. AF .

[0302] This disclosure provides an API caller authentication method, executed by ANF, including: determining a second K based on the AKMA anchor key and the identification information of the CAPIF function. AF .

[0303] In some embodiments, the identification information for the CAPIF function includes: FQDN and / or security protocol identifier;

[0304] Based on the AKMA anchor key and the identification information of the CAPIF function, the second K is determined. AF Including one of the following:

[0305] Based on the AKMA anchor key and FQDN, determine the second K AF ;

[0306] Based on the AKMA anchor key, FQDN, and security protocol identifier, determine the second K AF .

[0307] In some embodiments of this disclosure, the FQDN and security protocol identifier can be the FQDN and security protocol identifier described in the above embodiments.

[0308] For example, an FQDN can be, but is not limited to, a combination of a hostname and a domain name with CAPIF functionality, or a hostname and a domain name with CAPIF functionality.

[0309] For example, the security protocol identifier is determined through negotiation between the API caller and the CAPIF function. The security protocol identifier can be a Ua* protocol security protocol identifier.

[0310] In this embodiment of the disclosure, AAnF can generate the second K in the same way as the API caller. AF This ensures the generation of K. AF Consistency.

[0311] In some embodiments, the method includes: determining whether AAnF can provide services for the CAPIF function based on the identification information of the CAPIF function;

[0312] Step S72, which determines the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier, includes: if it is determined that AAnF can provide services for the CAPIF function, determining the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier.

[0313] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0314] like Figure 9 As shown, this disclosure provides an API caller authentication method, executed by AAnF, including:

[0315] Step S91: Based on the identification information of the CAPIF function, determine whether AAnF can provide services for the CAPIF function;

[0316] Step S92: If it is determined that AAnF can provide services for the CAPIF function, determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier.

[0317] Here, AAnF can provide services for the CAPIF function in the following ways: AAnF can provide K for the CAPIF function. AF Services, etc.

[0318] Here, the identification information of the CAPIF function in step S91 can be the FQDN of the CAPIF function. Of course, in other embodiments, the identification information of the CAPIF function in step S91 can be any other unique identification information that identifies the CAPIF function.

[0319] Thus, in this embodiment of the disclosure, it can be determined whether AAnF can provide services for the CAPIF function based on the identification information of the CAPIF function. If so, the AKMA anchor key is determined based on the AKMA key identifier. In this way, the power consumption consumed in determining the AKMA anchor key based on the AKMA key identifier provided by the CAPIF function can be reduced when AAnF cannot provide services for a certain CAPIF function.

[0320] This disclosure provides an API caller authentication method, executed by AAnF, including: if it is determined that AAnF cannot provide services for the CAPIF function, refusing to provide the second K to CAPIF. AF Here, we can directly refuse to execute the decision to determine the second K. AF Operations such as sending a second response message to CAPIF and / or other operations.

[0321] This disclosure provides an API caller authentication method, executed by AAnF, comprising: if AAnF has an AKMA anchor key corresponding to an AKMA key identifier, determining the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier.

[0322] Here, AAnF stores mapping information, which includes at least one AKMA key identifier and its corresponding AKMA anchor key. Thus, AAnF can retrieve the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier and this mapping information.

[0323] This disclosure provides an API caller authentication method executed by AAnF, comprising: sending a second response message carrying error indication information to the CAPIF function based on the fact that no AKMA anchor key corresponding to the AKMA key exists in AAnF.

[0324] Here, the error message indicates that there is no AKMA anchor key in AAnF corresponding to the AKMA key.

[0325] In this embodiment of the disclosure, when there is no AKMA anchor key corresponding to the AKMA key in ANF, an error indication message can be sent to inform the CAPIF function that it cannot provide a second K for the CAPIF function. AF .

[0326] For details on the above implementation methods, please refer to the description on the API caller side; they will not be repeated here.

[0327] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0328] The following API caller authentication method is executed by the CAPIF function and is similar to the API caller authentication method executed by the API caller and / or AAnF described above. For technical details not disclosed in the embodiment of the API caller authentication method executed by the CAPIF function, please refer to the description of the example of the API caller authentication method executed by the API caller and / or AAnF, which will not be described in detail here.

[0329] like Figure 10 As shown, this disclosure provides an API caller authentication method, executed by the CAPIF function, including:

[0330] Step S101: Receive the first request information sent by the API caller, wherein the first request information includes the authentication information of the API caller; the authentication information is used to authenticate the identity of the API caller.

[0331] In some embodiments of this disclosure, the API caller can be the API caller in the above embodiments; the CAPIF function can be the CAPIF function in the above embodiments; and AAnF can be AAnF in the above embodiments.

[0332] For example, the API caller can be, but is not limited to, a user interface (UE).

[0333] For example, CAPIF functionality may include, but is not limited to: CAPIF Core Functionality (CCF), API Open Functionality (AEF), and Authorization Functionality (AF).

[0334] In some embodiments of this disclosure, the first request information and the registration information can be the first request information and the registration information in the above embodiments, respectively.

[0335] For example, the first request information may include, but is not limited to, at least one of the following: the API caller's token, the API caller's key pair, and the API caller's public key. Here, the API caller's key pair includes the API caller's private key and public key.

[0336] For example, registration information could be online registration information.

[0337] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0338] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to authenticate the identity of the API caller.

[0339] This disclosure provides an API caller authentication method, executed by the CAPIF function, including:

[0340] Receive first request information sent by the API caller, wherein the first request information includes the API caller's authentication information; the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to authenticate the identity of the API caller.

[0341] Here, the AKMA key identifier is used by AAnF to determine the AKMA anchor key. The AKMA anchor key is used by AAnF to determine the second K. AF Alternatively, the AKMA anchor key is used by the API caller to determine the first K. AF .

[0342] In one embodiment, the AKMA anchor key can also be used by the CAPIF function to determine the second K. AF .

[0343] For example, CAPIF receives the AKMA anchor key sent by ANF, and determines the second K based on the AKMA anchor key and the identification information of the CAPIF function. AF .

[0344] like Figure 11 As shown, this disclosure provides an API caller authentication method, executed by the CAPIF function, including:

[0345] Step S1101: Send a second request message to AAnF, wherein the second request message includes an AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second K of the CAPIF function. AF .

[0346] Here, the second request information can be: application key request information (Naanf_AKMA_ApplicationKey).

[0347] This disclosure provides an API caller authentication method, executed by the CAPIF function, comprising: receiving second response information sent by CAPIF, wherein the second response information includes at least one of the following:

[0348] Second K AF ;

[0349] API caller identification information and second KB AF ;

[0350] Second K AF and the second K AF The corresponding valid time;

[0351] API caller identification information, second K AF and the second K AF The corresponding valid time.

[0352] In some embodiments of this disclosure, the identification information of the API caller can be the same as the identification information of the API caller described in the above embodiments. For example, the identification information of the API caller includes one of the following: SUPI; GPSI; and IMPI.

[0353] This disclosure provides an API caller authentication method, executed by the CAPIF function, including: based on a second K... AF and the first K of the API caller AF Authenticate the identity of the API caller.

[0354] For example, the CAPIF function receives a second message sent by the API caller, which is based on the first K. AF The information is encrypted using the first piece of information; the CAPIF function utilizes the second K... AF If the first information can be decrypted after the second information is decrypted, then the API caller's identity authentication is confirmed to be successful.

[0355] For example, the CAPIF function receives the first K sent by the API caller. AF If the first K is determined AFThe second K provides the CAPIF function AF With the first K AF If a match is found, the API caller's identity authentication is confirmed to be successful.

[0356] Thus, in this embodiment of the disclosure, CAPIF can authenticate the identity of the API caller based on the application function key.

[0357] This disclosure provides an API caller authentication method executed by the CAPIF function, including: determining the AAnF corresponding to the CAPIF function based on the AKMA key identifier.

[0358] Here, the key identifier of the AKMA can be used by the CAPIF function to select the corresponding AAnF.

[0359] In some embodiments, the second request information includes: identification information of the CAPIF function; wherein, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function; the AKMA anchor key and the identification information of the CAPIF function are used by ANF to determine the second K AF .

[0360] Here, the AKMA anchor key and the identification information of the CAPIF function can also be used by the API caller to determine the first K. AF .

[0361] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0362] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0363] This disclosure provides an API caller authentication method executed by a CAPIF function, comprising: receiving first request information sent by an API caller, wherein the first request information includes authentication information of the API caller; the authentication information includes: a first certificate, which is used by the CAPIF function to authenticate the identity of the API caller.

[0364] This disclosure provides an API caller authentication method executed by the CAPIF function, including: determining whether API caller authentication is successful based on a first certificate and the root certificate corresponding to the first certificate stored in the CAPIF core function.

[0365] Here, if the first certificate matches the root certificate stored in the CAPIF function, the API caller's identity authentication is confirmed to be successful.

[0366] Here, the CAPIF function stores the root certificate corresponding to at least one API caller.

[0367] Thus, in this embodiment of the disclosure, CAPIF can authenticate the identity of the API caller based on a certificate.

[0368] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0369] This disclosure provides an API caller authentication method, executed by the CAPIF function, including:

[0370] Based on successful API caller authentication, determine the API caller's online signing key;

[0371] Based on successful API caller authentication, determine the API caller's API caller configuration information; the API caller configuration information includes: Open Functionality (AEF) authentication and authorization information;

[0372] Based on successful API caller authentication, a certificate for the API caller is generated; the API caller certificate includes: the API caller's public key and the API caller's identification information.

[0373] In some embodiments, the first request information may further include: the API caller's token;

[0374] Determine the API caller's configuration information, including: determining the API caller's configuration information based on successful API caller authentication and the token.

[0375] This disclosure provides an API caller authentication method executed by the CAPIF function, including: determining API caller configuration information based on the API caller's token after successful API caller authentication.

[0376] This disclosure provides an API caller authentication method executed by the CAPIF function, comprising: sending first response information to the API caller, wherein the first response information includes at least one of the following: the API caller's online contract information, the API caller's configuration information, and the API caller's certificate.

[0377] For details on the above implementation methods, please refer to the descriptions provided by the API caller and / or the CAPIF side; they will not be repeated here.

[0378] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0379] The following API caller authentication method is executed by a communication device and is similar to the API caller authentication method executed by the API caller and / or AAnF and / or CAPIF functions described above. For technical details not disclosed in the embodiments of the API caller authentication method executed by the communication device, please refer to the description of the API caller authentication method example executed by the API caller and / or AAnF and / or CAPIF functions, which will not be described in detail here.

[0380] This disclosure provides an API caller authentication method, executed by a network device, the network device including: an API caller, ANFI and / or CAPIF functionality; the API caller method includes:

[0381] The API caller, based on KAUSF, determines the KAMA anchor key and the corresponding AKMA key identifier; based on the AKMA anchor key, it determines the first K... AF ; and send a first request message to the CAPIF function; wherein the first request message includes the AMKA key identifier corresponding to the AMKA anchor key;

[0382] After receiving the first request information, the CAPIF function sends a second request information to AAnF, wherein the second request information includes the AMKA key identifier corresponding to the AMKA anchor key;

[0383] AAnF determines the AKMA anchor key corresponding to the AKMA key identifier based on the AMKA key identifier; and determines the second K based on the AKMA anchor key. AF And send the second K to the CAPIF function. AF The second response information;

[0384] CAPIF functionality is based on the second K AF With the first K provided by the API caller AF Authenticate the identity of the API caller.

[0385] This disclosure provides an API caller authentication method, executed by a network device, the network device including: API caller and / or CAPIF functionality; the API caller method includes:

[0386] The API caller sends a first request message to the CAPIF function, wherein the first request message includes a first certificate;

[0387] The CAPIF function authenticates the identity of the API caller based on the first certificate and the root certificate corresponding to the first certificate stored in the CAPIF function.

[0388] For details on the above implementation methods, please refer to the descriptions provided by the API caller and / or the AAnF and / or CAPIF functional departments; they will not be repeated here.

[0389] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0390] To further explain any of the embodiments of this disclosure, several specific embodiments are provided below.

[0391] These specific embodiments can be adapted to the following application scenarios, in which it is assumed that the UE acts as an API caller and that both the UE and the CAPIF function (such as CCF or AEF) support the AKMA protocol.

[0392] API callers and CAPIF functions shall follow the procedures outlined in this sub-clause to protect and authenticate API caller logins to CAPIF functions; API callers and CAPIF functions shall establish secure sessions using TLS. The security profile for TLS implementation and use shall comply with the provisions of TS 33.310 of the protocol.

[0393] With the TLS secure session established, the API caller sends an Online API Caller Request message to the CAPIF function. The Online API Caller Request message carries online credentials (such as an OAuth 2.0 token), which are obtained from the API provider domain. When an OAuth 2.0 token-based mechanism is used as the online credential, the OAuth 2.0 token should be encoded as a JSON web token as specified in IETF RFC 7519, should include the JSON web signature specified in IETF RFC 7515, and should be verified according to OAuth 2.0, IETF RFC 7519, and IETF RFC 7515. Of course, other online credentials (such as message digests) can also be used.

[0394] Example 1

[0395] like Figure 12 As shown, this disclosure provides an API caller authentication method, executed by a network device, which includes: an API caller, an API provider domain, ANFO and / or CAPIF functionality; the API caller authentication method includes the following steps:

[0396] Here, the CAPIF function can be the CAPIF Core Function (CCF).

[0397] Step S1201: The API caller obtains registration information from the API provider domain; the registration information includes at least one of the following: the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate of the CAPIF function;

[0398] Here, the registration information can be online registration information. Online registration information is used by API callers to verify and establish TLS sessions with CAPIF functionality in the online process.

[0399] In one alternative embodiment, as a prerequisite for the online process, the API caller needs to obtain online registration information from the API provider domain. This online registration information includes the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate (OAuth 2.0 token) of the CAPIF function.

[0400] In one alternative embodiment, the API caller is based on K AUSF This generates an AKMA anchor key and an AKMA key identifier (A-KID) corresponding to the AKMA anchor key. In this embodiment, the operation can be performed before the API caller sends the first request information to CAPIF.

[0401] In an alternative embodiment, the API caller generates a first K based on the AKMA anchor key. AF In this embodiment, the operation can be performed before or after the API caller sends the first request to CAPIF.

[0402] Step S1202: The API caller establishes a TLS connection with the CAPIF function based on the registration information;

[0403] In one alternative embodiment, the API caller establishes a secure TLS session (TLS session) with the CAPIF function based on registration information; this TLS connection is established after authentication with the server certificate.

[0404] Step S1203: The API caller sends a first request message to the CAPIF function. The first request message carries at least the AKMA key identifier corresponding to the AKMA anchor key.

[0405] Here, the first request information can be an online API request message (Onboard API invoker request message).

[0406] In one optional embodiment, after successfully establishing a TLS session, the API caller sends an online API request message to the CAPIF function; wherein the online API request message includes at least an AKMA key identifier (A-KID); the online API request message may also include at least one of the following: an OAuth 2.0 token, an API caller key pair, and an API caller public key. The API caller key pair includes the API caller private key and the API caller public key.

[0407] Step S1204: The CAPIF function sends a second request message to AAnF, wherein the second request message includes: AKMA key identifier;

[0408] Here, the second request information can be the application key request information (Naanf_AKMA_ApplicationKey).

[0409] Here, the second request information may include identification information for the CAPIF function.

[0410] In an optional embodiment, when the CAPIF function determines that there is no AKMA key identifier above or below it, it selects AAnF according to the identifier information of the CAPIF function; and sends a key request information to AAnF, the key request information including the AKMA key identifier, and the key request information is used to request the AKMA anchor key.

[0411] Step S1205: AAnF determines the second K based on the AKAM key identifier. AF ;

[0412] In one optional embodiment, AAnF determines whether it can provide services for the CAPIF function based on the identification information of the CAPIF function; if yes, it performs the operation of obtaining the AKMA anchor key; if no, it refuses to provide the second K key for the CAPIF function. AF .

[0413] In an optional embodiment, AAnF identifies the existence of a UE-specific AKMA anchor key based on the AKAM key identifier and verifies whether the UE is authorized to use the AKMA anchor key.

[0414] In an optional embodiment, if AANF determines that an AKMA anchor key corresponding to the AKMA key identifier exists, it determines the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier; or if it determines that no AKMA anchor key corresponding to the AKMA key identifier exists, it sends an error indication message to CAPIF.

[0415] In an optional embodiment, if AAnF does not have a K corresponding to the AKMA anchor key...AF Based on the AKMA anchor key, generate the second K AF .

[0416] Step S1206: AAnF sends a second response message to the CAPIF function, wherein the second response message includes a second K. AF ;

[0417] In an optional embodiment, the second response information further includes at least one of the following: a second K AF The validity period and the identifier information of the API caller.

[0418] Step S1207: CAPIF function based on the second K AF With the first K provided by the API caller AF Authenticate the identity of the API caller;

[0419] In an optional embodiment, the CAPIF function is based on K as described in 3GPP TS 33.535. AF The authentication method for UEs is to authenticate the identity of the API caller.

[0420] Step S1208: The CAPIF function is determined to be authorized by the API caller;

[0421] In an optional embodiment, after the API caller's identity is successfully authenticated, the CAPIF function verifies based on credential information (OAuth 2.0 token). If the verification based on the OAuth 2.0 token is successful, the CAPIF function determines the API caller's API caller configuration information. Here, the CAPIF function can generate the API caller configuration information specified in protocol TS 23.222. The API caller configuration information includes AEF authentication and authorization information; the API caller's certificate includes at least one of the following: the API caller's identification information and the API caller's public key. The API caller's identification information includes at least one of the following: the API caller's identification information assigned by the CAPIF function, SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID. Thus, the API caller can use the API caller's certificate to perform subsequent authentication processes through the CAPIF core and establish a secure connection and authentication through AEF.

[0422] In an optional embodiment, if the signed API service uses method 3 (as specified in clause 6.5.2.3) for CAPIF-2e security, the CAPIF function may selectively generate an online signing key for the API caller. Here, the API caller's online signing key value may remain unchanged throughout the lifecycle of the onboarding process, and a mapping between the API caller's online signing key and the API caller's identification information should be established.

[0423] Step S1209: The CAPIF function sends a first response message to the API caller; the first response message includes at least one of the following: API caller configuration information, API caller certificate, and API caller online signing key.

[0424] Here, the first response information can be the online API invoker response message.

[0425] Example 2

[0426] like Figure 13 As shown, this disclosure provides an API caller authentication method, executed by a network device, which includes: an API caller, an API provider domain, and / or CAPIF functionality; the API caller authentication method includes the following steps:

[0427] Here, the CAPIF function can be the CAPIF Core Function (CCF).

[0428] Step S1301: The API caller obtains registration information from the API provider domain; the registration information includes at least one of the following: the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate of the CAPIF function;

[0429] Here, the registration information can be online registration information. Online registration information is used by API callers to verify and establish TLS sessions with CAPIF functionality in the online process.

[0430] In one alternative embodiment, as a prerequisite for the online process, the API caller needs to obtain online registration information from the API provider domain. This online registration information includes the address of the CAPIF function, the FQDN of the CAPIF function, and the root CA certificate (OAuth 2.0 token) of the CAPIF function.

[0431] Step S1302: The API caller establishes a TLS connection with the CAPIF function based on the registration information;

[0432] In one alternative embodiment, the API caller establishes a secure TLS session (TLS session) with the CAPIF function based on registration information; this TLS connection is established after authentication with the server certificate.

[0433] Step S1303: The API caller sends a first request message to the CAPIF function, the first request message carrying at least the API caller's first certificate;

[0434] Here, the first request information can be an online API request message (Onboard API invoker request message).

[0435] In one optional embodiment, after successfully establishing a TLS session, the API caller sends an online API request message to the CAPIF function; wherein the online API request message includes at least the API caller's first certificate; the online API request message may also include at least one of the following: an OAuth 2.0 token, an API caller key pair, and an API caller public key. The API caller key pair includes the API caller's private key and API caller's public key.

[0436] Step S1304: The CAPIF function authenticates the identity of the API caller based on the first certificate;

[0437] In an optional embodiment, the CAPIF function determines whether the API caller's authentication is successful based on the first certificate and the root certificate corresponding to the first certificate stored in the CAPIF function.

[0438] Step S1305: The CAPIF function is determined to be authorized by the API caller;

[0439] In an optional embodiment, after the API caller's identity is successfully authenticated, the CAPIF function verifies based on credential information (OAuth 2.0 token). If the verification based on the OAuth 2.0 token is successful, the CAPIF function determines the API caller's API caller configuration information. Here, the CAPIF function can generate the API caller configuration information specified in protocol TS 23.222. The API caller configuration information includes: AEF authentication and authorization information; the API caller's certificate includes at least one of the following: the API caller's public key and the API caller's identification information. The API caller's identification information includes at least one of the following: the API caller's identification information assigned by the CAPIF function, SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID. Thus, the API caller can use the API caller's certificate to perform subsequent authentication processes through the CAPIF core and establish a secure connection and authentication through AEF.

[0440] In an optional embodiment, if the signed API service uses method 3 (as specified in clause 6.5.2.3) for CAPIF-2e security, the CAPIF function may selectively generate an online signing key for the API caller. Here, the API caller's online signing key value may remain unchanged throughout the lifecycle of the onboarding process, and a mapping between the API caller's online signing key and the API caller's identification information should be established.

[0441] Step S1306: The CAPIF function sends a first response message to the API caller; the first response message includes: API caller configuration information, the API caller's certificate, and the API caller's online signing key.

[0442] Here, the first response information can be the online API invoker response message.

[0443] It should be noted that those skilled in the art will understand that the methods provided in the embodiments of this disclosure can be executed alone or together with some methods in the embodiments of this disclosure or some methods in related technologies.

[0444] like Figure 14 As shown, this disclosure provides an API caller authentication device, including:

[0445] Sending module 51 is configured to send a first request message to the CAPIF function, wherein the first request message includes authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller.

[0446] The API caller authentication device provided in this disclosure can be applied to API callers.

[0447] This disclosure provides an API caller authentication device, including: a receiving module configured to obtain registration information from an API provider domain or pre-configured information of an API caller, wherein the registration information includes at least one of the following:

[0448] The address of the CAPIF function;

[0449] FQDN for CAPIF functionality;

[0450] The root CA certificate for CAPIF functionality.

[0451] This disclosure provides an API caller authentication device, including: a processing module configured to establish a TLS connection with the CAPIF function based on registration information;

[0452] Sending module 51 is configured to send the first request information to the CAPIF function based on a TLS connection.

[0453] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to identify the caller of the CAPIF function authentication API.

[0454] This disclosure provides an API caller authentication device, including:

[0455] The processing module is configured to be based on K. AUSF Determine the AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key;

[0456] The processing module is also configured to determine the first K based on the AKMA anchor key. AF .

[0457] This disclosure provides an API caller authentication device, including: a processing module configured to determine a first K based on AKMA anchor key and CAPIF function identification information. AF The identification information for the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0458] This disclosure provides an API caller authentication device, including: a processing module configured to authenticate based on a first K. AF The second K with CAPIF function AF This determines whether the API caller's authentication was successful.

[0459] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0460] This disclosure provides an API caller authentication device, including: a receiving module configured to receive first response information sent by a CAPIF function; wherein the first response information includes:

[0461] API caller configuration information; which includes: Open Functionality (AEF) authentication and authorization information;

[0462] The API caller's certificate includes: the API caller's identification information and the API caller's public key.

[0463] Online signing keys for API callers.

[0464] In some embodiments, the API caller identification information includes one of the following: API caller identification information assigned by the CAPIF function, SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0465] In some embodiments, the first request information further includes: the API caller's token; the first response information is sent by CAPIF based on successful token verification.

[0466] In some embodiments, the API caller includes: UE.

[0467] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0468] like Figure 15 As shown, this disclosure provides an API caller authentication device, including:

[0469] The receiving module 61 is configured to receive a second request message sent by the CAPIF function, wherein the second request message is determined by the CAPIF function based on the first request message, and the second request message includes: the AKMA key identifier of the API caller included in the first request message;

[0470] Processing module 62 is configured to determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier, wherein the AKMA anchor key is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0471] The API caller authentication device provided in this disclosure can be applied to AAnF.

[0472] This disclosure provides an API caller authentication device, including:

[0473] Processing module 62 is configured to determine the second K based on the AKMA anchor key. AF ;

[0474] The sending module is configured to send a second response message to CAPIF, wherein the second response message includes a second K. AF .

[0475] In some embodiments, the second response information further includes: with the second K AFThe corresponding validity period, and / or the identifier information of the API caller.

[0476] In some embodiments, the API caller's identification information includes one of the following: SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0477] In some embodiments, the second request information includes: identification information of the CAPIF function, which includes: FQDN and / or security protocol identifier; the security protocol identifier is determined by the API caller and the CAPIF function through negotiation.

[0478] This disclosure provides an API caller authentication device, including: a processing module 62 configured to determine a second K based on AKMA anchor key and CAPIF function identification information. AF .

[0479] In some embodiments, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

[0480] The processing module is configured with the AKMA anchor key and FQDN to determine the second application function key K. AF ;

[0481] Alternatively, the processing module is configured to use the AKMA anchor key, FQDN, and security protocol identifier to determine the second application function key K. AF .

[0482] This disclosure provides an API caller authentication device, including: a processing module 62, configured to determine whether AAnF can provide services for the CAPIF function based on the identification information of the CAPIF function;

[0483] The processing module 62 is also configured to determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier if it is determined that AAnF can provide services for the CAPIF function.

[0484] This disclosure provides an API caller authentication device, including: a processing module 62 configured to refuse to provide a second K to CAPIF if it is determined that ANF cannot provide services for the CAPIF function. AF .

[0485] This disclosure provides an API caller authentication device, including: a sending module configured to send a second response message carrying error indication information to the CAPIF function based on the absence of an AKMA anchor key corresponding to the AKMA key in AKMA in AKMA.

[0486] In some embodiments, the API caller includes: UE.

[0487] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0488] like Figure 16 As shown, this disclosure provides an API caller authentication device, including:

[0489] The receiving module 71 is configured to receive first request information sent by an API caller, wherein the first request information includes the authentication information of the API caller; the authentication information is used to authenticate the identity of the API caller.

[0490] The API caller authentication device provided in this disclosure can be applied to the CAPIF function.

[0491] In some embodiments, the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key, and the AKMA anchor key is used to authenticate the identity of the API caller.

[0492] This disclosure provides an API caller authentication device, including: a sending module configured to send second request information to an AKMA anchor function (AAnF), wherein the second request information includes an AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second K of the CAPIF function. AF .

[0493] This disclosure provides an API caller authentication device, including: a processing module configured to authenticate based on a second K. AF and the first K of the API caller AF Authenticate the identity of the API caller.

[0494] This disclosure provides an API caller authentication device, including: a processing module configured to determine an AAnF corresponding to the CAPIF function based on an AKMA key identifier.

[0495] This disclosure provides an API caller authentication device, including: a receiving module 71 configured to receive second response information sent by ANF, wherein the second response information includes at least one of the following:

[0496] Second K AF ;

[0497] API caller identification information and second KB AF ;

[0498] Second K AF and the second K AF The corresponding valid time;

[0499] API caller identification information, second K AF and the second K AF The corresponding valid time.

[0500] In some embodiments, the API caller's identification information includes one of the following: SUPI, GPSI, IMPI, SUCI, and the UE's application layer ID.

[0501] In some embodiments, the second request information includes: identification information of the CAPIF function; wherein, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function; the AKMA anchor key and the identification information of the CAPIF function are used by ANF to determine the second K AF .

[0502] In some embodiments, the authentication information includes: a first certificate; wherein the first certificate is used to authenticate the identity of the caller of the CAPIF function authentication API.

[0503] This disclosure provides an API caller authentication device, including: a processing module configured to determine whether API caller authentication is successful based on a first certificate and a root certificate corresponding to the first certificate stored in the CAPIF core function.

[0504] This disclosure provides an API caller authentication device, including: a processing module configured to be at least one of the following:

[0505] Based on successful API caller authentication, determine the API caller's online signing key;

[0506] Based on successful API caller authentication, determine the API caller's API caller configuration information; the API caller configuration information includes: Open Functionality (AEF) authentication and authorization information;

[0507] Based on successful API caller authentication, a certificate for the API caller is generated; the API caller certificate includes: the API caller's public key and the API caller's identification information.

[0508] In some embodiments, the first request information may also include: the API caller's token.

[0509] This disclosure provides an API caller authentication device, including: a processing module configured to determine API caller configuration information of an API caller, including: determining API caller configuration information based on a token after successful API caller authentication.

[0510] This disclosure provides an API caller authentication device, including: a sending module configured to send first response information to an API caller, wherein the first response information includes at least one of the following: online signing information of the API caller, API caller configuration information, and API caller certificate.

[0511] In some embodiments, the API caller includes: UE.

[0512] In some embodiments, the CAPIF function includes one of the following: CCF; AEF; and AF.

[0513] It should be noted that those skilled in the art will understand that the apparatus provided in the embodiments of this disclosure can be executed alone or together with some apparatus in the embodiments of this disclosure or some apparatus in related technologies.

[0514] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0515] This disclosure provides a communication device, including:

[0516] processor;

[0517] Memory used to store processor-executable instructions;

[0518] The processor is configured to implement the beam reporting enhancement method of any embodiment of this disclosure when running executable instructions.

[0519] In one embodiment, the communication device may include, but is not limited to, at least one of the following: API caller, AAnF, and CAPIF functions. Here, the API caller can be the UE; the CAPIF function can be CCF, AEF, or AF.

[0520] The processor may include various types of storage media, which are non-transitory computer storage media that can continue to store information after the user equipment loses power.

[0521] The processor can connect to memory via a bus or similar means to read executable programs stored in memory, for example... Figures 2 to 13 At least one of the methods shown.

[0522] This disclosure also provides a computer storage medium storing a computer-executable program. When executed by a processor, the executable program implements the beam reporting enhancement method of any embodiment of this disclosure. For example, such as... Figures 2 to 13 At least one of the methods shown.

[0523] Regarding the apparatus or storage medium in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0524] Figure 17 This is a block diagram illustrating a user equipment 800 according to an exemplary embodiment. For example, user equipment 800 may be a mobile phone, computer, digital broadcast user equipment, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.

[0525] Reference Figure 17 User equipment 800 may include one or more of the following components: processing component 802, memory 804, power supply component 806, multimedia component 808, audio component 810, input / output (I / O) interface 812, sensor component 814, and communication component 816.

[0526] Processing component 802 typically controls the overall operation of user equipment 800, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 802 may include one or more modules to facilitate interaction between processing component 802 and other components. For example, processing component 802 may include a multimedia module to facilitate interaction between multimedia component 808 and processing component 802.

[0527] Memory 804 is configured to store various types of data to support the operation of user equipment 800. Examples of this data include instructions for any application or method operating on user equipment 800, contact data, phonebook data, messages, pictures, videos, etc. Memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0528] Power supply component 806 provides power to various components of user equipment 800. Power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to user equipment 800.

[0529] Multimedia component 808 includes a screen that provides an output interface between the user equipment 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 808 includes a front-facing camera and / or a rear-facing camera. When the user equipment 800 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0530] Audio component 810 is configured to output and / or input audio signals. For example, audio component 810 includes a microphone (MIC) configured to receive external audio signals when user equipment 800 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 804 or transmitted via communication component 816. In some embodiments, audio component 810 also includes a speaker for outputting audio signals.

[0531] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0532] Sensor assembly 814 includes one or more sensors for providing status assessments of various aspects of user equipment 800. For example, sensor assembly 814 may detect the on / off state of device 800, the relative positioning of components such as the display and keypad of user equipment 800, changes in position of user equipment 800 or a component of user equipment 800, the presence or absence of user contact with user equipment 800, orientation or acceleration / deceleration of user equipment 800, and temperature changes of user equipment 800. Sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 814 may also include an accelerometer, gyroscope, magnetometer, pressure sensor, or temperature sensor.

[0533] Communication component 816 is configured to facilitate wired or wireless communication between user equipment 800 and other devices. User equipment 800 can access wireless networks based on communication standards, such as WiFi, 4G, or 5G, or combinations thereof. In one exemplary embodiment, communication component 816 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 816 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0534] In an exemplary embodiment, the user equipment 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0535] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, which can be executed by a processor 820 of a user device 800 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0536] like Figure 18 As shown, one embodiment of this disclosure illustrates the structure of a base station. For example, base station 900 can be provided as a network-side device. (Refer to...) Figure 18 The base station 900 includes a processing component 922, which further includes one or more processors, and memory resources represented by a memory 932 for storing instructions, such as application programs, that can be executed by the processing component 922. The application programs stored in the memory 932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 922 is configured to execute instructions to perform any of the methods described above applied to the base station.

[0537] Base station 900 may also include a power supply component 926 configured to perform power management of base station 900, a wired or wireless network interface 950 configured to connect base station 900 to a network, and an input / output (I / O) interface 958. Base station 900 can operate on an operating system stored in memory 932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0538] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0539] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. An application programming interface (API) caller authentication method, wherein, Executed by the application programming interface (API) caller, including: Based on the authentication service function key K AUSF Determine the application-oriented authentication and key management AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key; Send a first request message to the CAPIF (Capable Application Programming Interface) function, wherein the first request message includes authentication information of the API caller; the authentication information includes: the AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key; Based on the AKMA anchor key, the first application function key K is determined. AF ;wherein, the first K AF Used for API caller authentication.

2. The method according to claim 1, wherein, The method includes: Registration information is obtained from the API provider domain or the pre-configured information of the API caller, wherein the registration information includes at least one of the following: The address of the CAPIF function; The fully qualified domain name (FQDN) for the CAPIF function; The root CA certificate for the CAPIF function.

3. The method according to claim 2, wherein, The method includes: Based on the registration information, a transport layer secure TLS connection is established with the CAPIF function; Sending the first request information to the CAPIF (Capable of General Application Programming Interface) function includes: Based on the TLS connection, the first request information is sent to the CAPIF function.

4. The method according to any one of claims 1 to 3, wherein, The first application function key K is determined based on the AKMA anchor key. AF Including one of the following: Based on the AKMA anchor key and the identification information of the CAPIF function, the first K is determined. AF The identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function.

5. The method according to any one of claims 1 to 3, wherein, The authentication information includes: a first certificate; wherein the first certificate is used by the CAPIF function to authenticate the identity of the API caller.

6. The method according to any one of claims 1 to 3, wherein, The method includes: Receive the first response information sent by the CAPIF function, wherein the first response information includes: API caller configuration information; wherein, the API caller configuration information includes: Open Functions (AEF) authentication and authorization information; The certificate of the API caller; wherein, the certificate of the API caller includes at least one of the following: the API caller's identification information and the API caller's public key; The online signing key of the API caller.

7. The method according to claim 6, wherein, The identification information of the API caller includes one of the following: Identification information of the API caller assigned to the CAPIF function; User permanent identifier SUPI; Public subscription identifier GPSI; IMS user private identifier IMPI; Subscriber hidden identifier SUCI; UE's application layer ID.

8. The method according to claim 6, wherein, The first request information also includes: the token of the API caller; the first response information is sent by CAPIF after successful verification of the token.

9. The method according to any one of claims 1 to 3, wherein, The API callers include: UE.

10. The method according to any one of claims 1 to 3, wherein, The CAPIF function includes one of the following: CAPIF's core function is CCF; API Open Functionality (AEF); Authorization function AF.

11. An API caller authentication method, wherein, Performed by the AKMA anchor function AAnF, including: The system receives a second request message sent by the CAPIF (Capable Application Programming Interface) function, wherein the second request message is determined by the CAPIF function based on the first request message, and the second request message includes: the AKMA key identifier of the API caller included in the first request message; Based on the AKMA key identifier, determine the AKMA anchor key corresponding to the AKMA key identifier; Based on the AKMA anchor key, the second application function key K is determined. AF ; Send a second response message to the CAPIF, wherein the second response message includes the second K AF ; where the second K AF The CAPIF function is used to authenticate the API caller.

12. The method according to claim 11, wherein, The second response information also includes: with the second K AF The corresponding valid time, and / or the identification information of the API caller.

13. The method according to claim 12, wherein, The identifier information of the API caller includes one of the following: User permanent identifier SUPI; Public subscription identifier GPSI; IMS user private identifier IMPI; Subscriber hidden identifier SUCI; UE's application layer ID.

14. The method according to any one of claims 11 to 13, wherein, The second request information includes: the identification information of the CAPIF function; The second application function key K is determined based on the AKMA anchor key. AF ,include: Based on the AKMA anchor key and the identification information of the CAPIF function, the second application function key K is determined. AF .

15. The method according to claim 14, wherein, The identification information of the CAPIF function includes: Fully Qualified Domain Name (FQDN) and / or Security Protocol Identifier; the Security Protocol Identifier is determined through negotiation between the API caller and the CAPIF function. The second application function key K is determined based on the AKMA anchor key and the identification information of the CAPIF function. AF Including one of the following: The AKMA anchor key and the FQDN are used to determine the second application function key K. AF ; The AKMA anchor key, the FQDN, and the security protocol identifier are used to determine the second application function key K. AF .

16. The method according to any one of claims 11 to 13, wherein, The method includes: Based on the identification information of the CAPIF function, it is determined whether AAnF can provide services for the CAPIF function; The step of determining the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier includes: If it is determined that the AAnF can provide services for the CAPIF function, the AKMA anchor key corresponding to the AKMA key identifier is determined based on the AKMA key identifier.

17. The method according to claim 16, wherein, The method includes: If it is determined that AAnF cannot provide services for the CAPIF function, the second K will be refused to be provided to the CAPIF. AF .

18. The method according to claim 16, wherein, The method includes: Based on the fact that there is no AKMA anchor key in the AAnF corresponding to the AKMA key, the second response information carrying error indication information is sent to the CAPIF function.

19. The method according to any one of claims 11 to 13, wherein, The API callers include: UE.

20. The method according to any one of claims 11 to 13, wherein, The CAPIF function includes one of the following: CAPIF's core function is CCF; API Open Functionality (AEF); Authorization function AF.

21. An API caller authentication method, wherein, Performed by the CAPIF (Common Application Programming Interface) framework, including: Receive first request information sent by an application programming interface (API) caller, wherein the first request information includes the API caller's authentication information; the authentication information includes: an AKMA key identifier corresponding to an application-oriented authentication and key management (AKMA) anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key; A second request message is sent to the AKMA anchor function AAnF, wherein the second request message includes the AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second K of the CAPIF function. AF ; Receive the second response information sent by AAnF, wherein the second response information includes: the second K AF ; Based on the second K AF Authenticate the identity of the API caller.

22. The method according to claim 21, wherein, The method includes: Based on the AKMA key identifier, the AAnF corresponding to the CAPIF function is determined.

23. The method according to claim 21 or 22, wherein, The second response information also includes at least one of the following: The identifier information of the API caller; With the second K AF The corresponding valid time; The API caller's identification information, and the second K AF The corresponding valid time.

24. The method according to claim 23, wherein, The identifier information of the API caller includes one of the following: User permanent identifier SUPI; Public subscription identifier GPSI; IMS user private identifier IMPI; Subscriber hidden identifier SUCI; UE's application layer ID.

25. The method according to claim 21 or 22, wherein, The second request information includes: the identification information of the CAPIF function; wherein, the identification information of the CAPIF function includes: FQDN and / or security protocol identifier; the security protocol identifier is determined through negotiation between the API caller and the CAPIF function; The AKMA anchor key and the identification information of the CAPIF function are used by ANF to determine the second K. AF .

26. The method according to claim 21 or 22, wherein, The authentication information includes: a first certificate; wherein the first certificate is used by the CAPIF function to authenticate the identity of the API caller.

27. The method according to claim 26, wherein, The method includes: Based on the first certificate and the root certificate corresponding to the first certificate stored in the CAPIF function, it is determined whether the API caller's identity authentication is successful.

28. The method according to claim 21, 22, or 27, wherein, The method includes at least one of the following: Based on the successful authentication of the API caller, the online signing key of the API caller is determined; Based on the successful authentication of the API caller, the API caller configuration information of the API caller is determined; wherein, the API caller configuration information includes: Open Functions (AEF) authentication and authorization information; Based on the successful authentication of the API caller, a certificate for the API caller is generated; wherein, the certificate for the API caller includes: the API caller's public key and the API caller's identification information.

29. The method according to claim 28, wherein, The first request information also includes: the API caller's token; The process of determining the API caller's API caller configuration information includes: Based on the successful authentication of the API caller, the API caller configuration information is determined according to the token.

30. The method according to claim 29, wherein, The method includes: Send a first response message to the API caller, wherein the first response message includes at least one of the following: the API caller's online contract information, the API caller's configuration information, and the API caller's certificate.

31. The method according to claim 21 or 22, wherein, The API callers include: UE.

32. The method according to claim 21 or 22, wherein, The CAPIF function includes one of the following: CAPIF's core function is CCF; API Open Functionality (AEF); Authorization function AF.

33. An API caller authentication device, wherein, include: The processing module is configured to use the authentication service function key K. AUSF Determine the application-oriented authentication and key management AKMA anchor key and the AKMA key identifier corresponding to the AKMA anchor key; The sending module is configured to send a first request message to the CAPIF (Capable Application Programming Interface) function, wherein the first request message includes authentication information of the API caller; the authentication information is used by the CAPIF function to authenticate the identity of the API caller; the authentication information includes: an AKMA key identifier corresponding to the AKMA anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key; The processing module is also configured to determine the first application function key K based on the AKMA anchor key. AF ;wherein, the first K AF Used for API caller authentication.

34. An API caller authentication device, wherein, include: The receiving module is configured to receive a second request message sent by the CAPIF (Capable Application Programming Interface) function, wherein the second request message is determined by the CAPIF function based on the first request message, and the second request message includes: the AKMA key identifier of the API caller included in the first request message; The processing module is configured to determine the AKMA anchor key corresponding to the AKMA key identifier based on the AKMA key identifier; The processing module is also configured to determine the second application function key K based on the AKMA anchor key. AF ; The sending module is configured to send a second response message to the CAPIF, wherein the second response message includes the second K. AF ; where the second K AF The CAPIF function is used to authenticate the API caller.

35. An API caller authentication device, wherein, include: The receiving module is configured to receive first request information sent by an application programming interface (API) caller, wherein the first request information includes authentication information of the API caller; the authentication information includes: an AKMA key identifier corresponding to an application-oriented authentication and key management (AKMA) anchor key; wherein the AKMA key identifier is used to determine the AKMA anchor key; The sending module is configured to send a second request message to the AKMA anchor function AAnF, wherein the second request message includes the AKMA key identifier; wherein the AKMA key identifier is used by AAnF to determine the AKMA anchor key, and the AKMA anchor key is used by AAnF to determine the second application function key K of the Universal Application Programming Interface Framework (CAPIF) function. AF ; The receiving module is further configured to receive second response information sent by the AAnF, wherein the second response information includes the second K AF ; The processing module is configured to be based on the second K AF Authenticate the identity of the API caller.

36. A communication device, wherein, The communication device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to implement the API caller authentication method according to any one of claims 1 to 10, or claims 11 to 20, or claims 21 to 32 when running the executable instructions.

37. A computer storage medium, wherein, The computer storage medium stores a computer-executable program, which, when executed by a processor, implements the API caller authentication method according to any one of claims 1 to 10, or claims 11 to 20, or claims 21 to 32.

Images