Authorization method and device, equipment and storage medium

Abstract

The invention provides an authorization method and device, equipment and a storage medium, and the method comprises the steps: receiving a terminal information configuration request, the terminal information configuration request comprises first information of terminal equipment, and the first information of the terminal equipment is configured by an application function AF; determining indication information, wherein the indication information indicates an allowed configuration condition of first information of the terminal equipment; and authorizing a configuration process of the AF for the first information based on the indication information. The method disclosed by the invention can improve the communication stability.

Description

Authorization method, device, equipment and storage medium Technical Field

[0001] The present disclosure relates to the field of communication technologies, and in particular to authorization methods, devices, equipment, and storage media. Background Art

[0002] In a non-terrestrial network (NTN) communication system, an application function (AF) typically provides unreachability period information of a terminal device to an access and mobility management function (AMF) network element and / or a mobility management entity (MME).

[0003] Summary of the Invention

[0004] The present disclosure provides an authorization method, apparatus, device, and storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides an authorization method, including:

[0006] receiving a terminal information configuration request, the terminal information configuration request including first information of a terminal device, the first information of the terminal device being configured by an application function AF;

[0007] Determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device;

[0008] A configuration process of the first information is authorized to the AF based on the indication information.

[0009] The authorization method proposed in the present disclosure can be used to authorize the process of AF configuring the first information based on the authorization method, so that whether to transmit the first information can be determined based on the authorization result, thereby improving the rigor of information transmission and ensuring the stability of communication.

[0010] In a second aspect, an embodiment of the present disclosure provides an authorization method, including:

[0011] receiving first information of a terminal device, where the first information of the terminal device is configured by the AF;

[0012] Sending first information of the terminal device.

[0013] In a third aspect, an embodiment of the present disclosure provides an authorization method, including:

[0014] Sending a terminal information configuration request to the first NF, where the terminal information configuration request includes first information of the terminal device configured by the AF;

[0015] Receive a success response message or a rejection response message sent by the first NF.

[0016] In a fourth aspect, an embodiment of the present disclosure provides an authorization method, including:

[0017] Send indication information to the second NF, where the indication information indicates: an allowable configuration condition of the first information of the terminal device.

[0018] In a fifth aspect, an embodiment of the present disclosure provides an authorization method, including:

[0019] a transceiver module, configured to receive a terminal information configuration request, wherein the terminal information configuration request includes first information of a terminal device, and the first information of the terminal device is configured by an application function AF;

[0020] A processing module, configured to determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device;

[0021] The processing module is further configured to authorize the AF to configure the first information based on the indication information.

[0022] In a sixth aspect, an embodiment of the present disclosure provides an authorization device, including:

[0023] a transceiver module, configured to receive first information from a terminal device, where the first information from the terminal device is configured by the AF;

[0024] The transceiver module is further used to send the first information of the terminal device.

[0025] In a seventh aspect, an embodiment of the present disclosure provides an authorization device, including:

[0026] a transceiver module, configured to send a terminal information configuration request to the first NF, wherein the terminal information configuration request includes first information of the terminal device configured by the AF;

[0027] The transceiver module is further configured to receive a success response message or a rejection response message sent by the first NF.

[0028] In an eighth aspect, an embodiment of the present disclosure provides an authorization device, including:

[0029] The transceiver module is used to send the indication information to the second NF, where the indication information indicates: the allowed configuration conditions of the first information of the terminal device.

[0030] In a ninth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor. When the processor calls a computer program in a memory, the method described in the first to fourth aspects above is executed.

[0031] In the tenth aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and a memory, in which a computer program is stored; the processor executes the computer program stored in the memory so that the communication device executes the methods described in the first to fourth aspects above.

[0032] In the eleventh aspect, an embodiment of the present disclosure provides a communication device, which includes a processor and an interface circuit, wherein the interface circuit is used to receive code instructions and transmit them to the processor, and the processor is used to run the code instructions to enable the device to execute the methods described in the first to fourth aspects above.

[0033] In aspect 12, an embodiment of the present disclosure provides a communication system, which includes the communication device described in any one of aspects 5 to 8, or the system includes the communication device described in aspect 9, or the system includes the communication device described in aspect 10, or the system includes the communication device described in aspect 11.

[0034] In the thirteenth aspect, an embodiment of the present invention provides a computer-readable storage medium for storing instructions used by the above-mentioned network device, and when the instructions are executed, the terminal device executes the methods described in the first to fourth aspects above.

[0035] In a fourteenth aspect, the present disclosure further provides a computer program product comprising a computer program, which, when executed on a computer, enables the computer to execute the methods described in the first to fourth aspects above.

[0036] In a fifteenth aspect, the present disclosure provides a chip system comprising at least one processor and an interface for supporting a network device in implementing the functions described in aspects one to four, such as determining or processing at least one of the data and information involved in the above methods. In one possible design, the chip system further comprises a memory for storing computer programs and data necessary for the source slave node. The chip system may be composed of a chip or may include a chip and other discrete components.

[0037] In a sixteenth aspect, the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the methods described in the first to fourth aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above and / or additional aspects and advantages of the present disclosure will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0039] FIG1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present disclosure;

[0040] FIG2a is a schematic flow chart of an authorization method provided in another embodiment of the present disclosure;

[0041] FIG2 b is a flow chart of an authorization method provided in another embodiment of the present disclosure;

[0042] FIG2c is a schematic flow chart of an authorization method provided in another embodiment of the present disclosure;

[0043] FIG3a is a flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0044] FIG3 b is a flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0045] FIG4 is a flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0046] FIG5 is a flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0047] FIG6 a is a schematic flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0048] FIG6 b is a schematic flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0049] FIG6c is a schematic diagram of a flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0050] FIG6 d is a schematic flow chart of an authorization method provided in yet another embodiment of the present disclosure;

[0051] FIG7 is a flowchart of an interaction between a first NF and a second NF for subscription indication information provided by an embodiment of the present disclosure;

[0052] FIG8 is an interactive flow chart of an authorization method provided by an embodiment of the present disclosure;

[0053] FIG9 is a schematic structural diagram of an authorization device provided in yet another embodiment of the present disclosure;

[0054] FIG10 is a schematic structural diagram of an authorization device provided in yet another embodiment of the present disclosure;

[0055] FIG11 is a schematic structural diagram of an authorization device provided in yet another embodiment of the present disclosure;

[0056] FIG12 is a schematic structural diagram of an authorization device provided in yet another embodiment of the present disclosure;

[0057] FIG13 is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0058] FIG14 is a schematic structural diagram of a chip provided in accordance with an embodiment of the present disclosure. DETAILED DESCRIPTION

[0059] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible implementations consistent with the present disclosure. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

[0060] The terms used in the embodiments of the present disclosure are for the purpose of describing specific embodiments only and are not intended to limit the embodiments of the present disclosure. The singular forms "a," "an," and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0061] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, such information should not be limited to these terms. These terms are only used to distinguish signals of the same type from each other. For example, without departing from the scope of the embodiments of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0062] The embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be understood as limiting the present disclosure.

[0063] To facilitate understanding, the terms involved in this application are first introduced.

[0064] 1. Access and Mobility Management Function (AMF) network element

[0065] Supports terminal devices with different mobility management requirements. It performs the following key tasks: non-access stratum (NAS) signaling termination; NAS signaling security; access stratum security control; core network inter-node signaling for mobility between 3rd Generation Partnership Project (3GPP) access networks; idle mode terminal device reachability (including control and execution of paging retransmissions); registration area management; support for intra-system and inter-system mobility; access authentication; access authorization, including roaming rights checks; mobility management control (subscription and policy); support for network slicing; and session management function (SMF) selection.

[0066] The AMF network element, NAS signaling, 3GPP, and SMF mentioned above are example descriptions of the present disclosure. The present disclosure does not specifically limit these names. Other network elements that can implement similar functions are also within the scope of protection of the present disclosure.

[0067] 2. Unified Data Management (UDM)

[0068] Carries functions related to data management, such as the Authentication Credential Repository and Processing Function (ARPF), which can select the authentication method based on the user identity and configured policies, and calculate authentication data and keys for the Authentication Server Function (AUSF) when needed.

[0069] The UDM, ARPF, and AUSF mentioned above are examples of descriptions in the present disclosure. The present disclosure does not specifically limit these names. Other network elements that can implement similar functions are also within the scope of protection of the present disclosure.

[0070] 3. Application Function (AF)

[0071] AF can be used to provide the fifth generation (5G) network capabilities to edge applications. Edge applications access these capabilities through the interface between AF and the central Network Exposure Function (NEF) network element.

[0072] The AF and NEF mentioned above are examples of descriptions in the present disclosure. The present disclosure does not specifically limit these names. Other network elements that can implement similar functions are also within the protection scope of the present disclosure.

[0073] 4. Network Function (NF)

[0074] The 5G system architecture is service-based (SBA). Elements within the system architecture are defined as network functions (NFs), which are composed of services. Each NF provides external services through a service-oriented interface and allows other NFs to access or invoke its services. All NFs are automatically managed through the NF repository (NRF).

[0075] The NF, SBA, and NRF mentioned above are examples of descriptions in this disclosure. This disclosure does not specifically limit these names. Other network elements that can implement similar functions are also within the scope of protection of this disclosure.

[0076] In a communication system, different AFs are authorized to provide unreachability period information of different terminal devices. However, it is possible that an AF provides the core network with unreachability information of a terminal device that is not under the authority of the AF through the NEF network element and / or MME. That is, the unreachability information of the terminal device provided by the AF is not what it is allowed to provide. At this time, the unreachability information provided by the AF may be wrong, which may mislead the core network to launch a denial of service (DoS) attack on the terminal device. For example, the core network may be misled to abnormally interrupt the communication of the terminal device, resulting in service interruption, or the core network may be misled to provide inappropriate mobility management parameters and / or power saving parameters to the terminal device, affecting the service processing of the terminal device.

[0077] Based on this, the present disclosure proposes an authorization method.

[0078] In order to better understand an authorization method disclosed in an embodiment of the present disclosure, the communication system to which the embodiment of the present disclosure is applicable is first described below.

[0079] Please refer to Figure 1, which is a schematic diagram of the architecture of a communication system provided in an embodiment of the present disclosure. The communication system may include, but is not limited to, a first NF, an AF, a second NF, and an AMF network element. Optionally, the number and form of devices shown in Figure 1 are used for example and do not constitute a limitation on the embodiment of the present disclosure. In actual applications, one or more NFs, or one or more AFs, or one or more second NFs, or one or more AMF network elements may be included. Optionally, the communication system shown in Figure 1 includes a first NF, an AF, a second NF, and an AMF network element as an example.

[0080] It should be noted that the technical solutions of the embodiments of the present disclosure can be applied to various communication systems, such as long-term evolution (LTE) systems, fifth-generation (5G) mobile communication systems, 5G new radio (NR) systems, or other future new mobile communication systems.

[0081] It can be understood that the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.

[0082] The authorization method, apparatus, device, and storage medium provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0083] It should be noted that in the present disclosure, the authorization method provided in any embodiment can be executed alone, and any implementation method in the embodiment can also be executed alone, or combined with other embodiments, or possible implementation methods in other embodiments, and can also be executed together with any technical solution in the relevant technology.

[0084] In the present disclosure, the "sending" mentioned may include: direct sending, indirect sending, transparent sending, etc. For example, "AF sends a terminal information configuration request to the first NF" may include: AF directly sends the terminal information configuration request to the first NF, or, AF first sends the terminal information configuration request to an intermediate device, and the intermediate device forwards or transparently transmits the terminal information configuration request to the first NF. Similarly, the "receiving" mentioned in the present disclosure may also include: direct receiving, indirect receiving, transparent receiving, etc. For example, "the first NF receives the terminal information configuration request sent by the AF" may include: the first NF directly receives the terminal information configuration request sent by the AF, or, the first NF receives the terminal information configuration request forwarded or transparently transmitted by the intermediate device.

[0085] FIG2a is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by a first NF. As shown in FIG2a , the authorization method may include the following steps:

[0086] Step 201a: Receive a terminal information configuration request.

[0087] Optionally, in one embodiment of the present disclosure, the terminal information configuration request may be sent by the AF. Optionally, when the AF wants to provide the information of the terminal device to the AMF network element or MME, it will send a terminal information configuration request to the first NF to instruct the AF to request the provision of the terminal device information to the AMF network element or MME through the first NF. Optionally, the terminal information configuration request may include first information, and the first information may be information of the terminal device that the AF configures and plans to provide to the AMF network element or MME. Optionally, the first information may be unreachability period information of the terminal device, or, in other embodiments, the first information may also be other information related to the terminal device, such as positioning information of the terminal device, which is not limited in the present disclosure.

[0088] Optionally, in an embodiment of the present disclosure, the terminal information configuration request may further include at least one of the following:

[0089] an identifier of the AF configured with the first information;

[0090] An identifier of the terminal device corresponding to the first information;

[0091] The first service identifier corresponding to the first information indicates that the AF processes the first information through the service corresponding to the first service identifier; optionally, the service corresponding to the first service identifier can be understood as: which services can be used to process the first information configured by the AF, for example, the first service identifier can be Nnef_ParameterProvision (Nnef_parameter setting).

[0092] The first service operation identifier corresponding to the first information indicates that the AF processes the first information through the service operation corresponding to the first service operation identifier. Optionally, the service operation corresponding to the first service operation identifier can be understood as, for example, which service operations can be used to process the first information configured by the AF. For example, the first expected service operation identifier may include at least one of the Nnef_ParameterProvision_Update service operation, Nnef_ParameterProvision_Create service operation, Nnef_ParameterProvision_Delete service operation, and Nnef_ParameterProvision_Get service operation.

[0093] After the first NF receives the terminal information configuration request, it can provide the first information of the terminal device configured by the AF to the AMF network element or MME through the second NF based on the terminal information configuration request.

[0094] Optionally, in one embodiment of the present disclosure, when the first information of the terminal device is unreachable information of the terminal device, the information content corresponding to the first information of the terminal device may include at least one of the following:

[0095] The maximum waiting time corresponding to the transmission of the terminal device;

[0096] The maximum response time of the terminal device to the information;

[0097] The time the terminal device is covered by the communication signal;

[0098] The time when the terminal device is not covered by the communication signal.

[0099] Optionally, the above-mentioned communication signal coverage may include: communication signal coverage of a terrestrial network, and / or communication signal coverage of a non-terrestrial network.

[0100] Optionally, the first NF may include at least one of the following:

[0101] NEF network element;

[0102] Common Application Programming Interface Framework (CAPIF) core functions;

[0103] Authorization function;

[0104] Application Programming Interface Exposing Function (AEF)

[0105] Optionally, the second NF may include at least one of the following:

[0106] UDM;

[0107] Unified data repository (UDR).

[0108] Step 202a: Determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device.

[0109] Optionally, since different AFs are authorized to configure different first information of terminal devices, in one embodiment of the present disclosure, after the first NF receives the first information of the terminal device provided by the AF, and before providing the first information of the terminal device to the AMF network element or MME through the second NF, the first NF can first determine whether the AF has the authority to configure the first information, so as to avoid the situation where "when the AF provides the first information of the terminal device that is not within its authority, but the first NF does not recognize it, it directly provides the first information to the AMF network element or MME through the second NF, thereby causing the core network to launch a DoS attack on the terminal device."

[0110] Optionally, in one embodiment of the present disclosure, the permitted configuration conditions of the first information of the terminal device can be determined by determining the indication information corresponding to the terminal device. Then, based on the permitted configuration conditions, it can be determined whether the AF has the authority to configure the first information of the terminal device.

[0111] Optionally, in an embodiment of the present disclosure, the indication information may include at least one of the following:

[0112] An identifier of at least one target AF; the target AF is: a network element that allows configuration of the first information of the terminal device;

[0113] Identification of the terminal device;

[0114] at least one second information, where the second information may indicate: information that the terminal device is allowed to configure;

[0115] an expected service identifier, where the expected service identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service corresponding to the expected service identifier;

[0116] an expected service operation identifier, where the expected service operation identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service operation corresponding to the expected service operation identifier;

[0117] Indicates the validity period of the information;

[0118] Indicates the expiration time of the information;

[0119] The authorization policy includes: the terminal device allows the target AF to process the second information through the expected service and / or the expected service operation.

[0120] Optionally, the above-mentioned target AF can be a network element that is allowed by the terminal device to configure the first information, or it can be a network element that is allowed by other devices to configure the first information. Optionally, the above-mentioned "identification of the target AF" can be: at least one of the AF_ID of the target AF, the network application function (NAF) ID, the Internet Protocol Address (IP address), the application layer ID, and the fully qualified domain name (FQDN).

[0121] Optionally, the above-mentioned “terminal device identification” can be: user permanent identifier (SUbscription Permanent Identifier, SUPI), user concealed identifier (SUbscription Concealed Identifier, SUCI), IMS private user identity (IMS Privacy User Identity, IMPI), application layer ID of the terminal device, generic public subscriber identity (Generic Public Subscription Identifier, GPSI).

[0122] Optionally, the second information may include unreachable information.

[0123] Optionally, the expected service may be understood as, for example: which services may be used to process the second information. Optionally, the expected service identifier may be Nnef_ParameterProvision (Nnef_parameter provision) or the like.

[0124] Optionally, the expected service operation can be understood as, for example, which service operations can be used to process the second information. Optionally, the expected service operation identifier can include at least one of Nnef_ParameterProvision_Update service operation (Nnef_parameter setting_update service operation), Nnef_ParameterProvision_Create service operation (Nnef_parameter setting_create service operation), Nnef_ParameterProvision_Delete service operation (Nnef_parameter setting_delete service operation) and Nnef_ParameterProvision_Get service operation (Nnef_parameter setting_get service operation).

[0125] Optionally, the authorization policy is different from the aforementioned items (such as the identifier of the target AF, the identifier of the terminal device corresponding to the indication information, etc.) in that the aforementioned items are all saved or transmitted in the form of entries, while the authorization policy is a sentence, such as the authorization policy can be: Terminal device #1 allows AF #1 to process the unreachable information of terminal device #1 through the Nnef_ParameterProvision service

[0126] Optionally, in another embodiment of the present disclosure, the above-mentioned indication information may not include the identifier of the target AF, but include second information, that is, limiting which information can be configured without limiting which AFs have the authority to configure the information. The indication information may include at least one of the following:

[0127] Identification of the terminal device;

[0128] at least one second information, where the second information may indicate: information that the terminal device is allowed to configure;

[0129] Intended service identification;

[0130] Identification of the intended service operation;

[0131] Indicates the validity period of the information;

[0132] Indicates the expiration time of the information;

[0133] The authorization policy includes: the terminal device is allowed to process the second information through the expected service and / or the expected service operation.

[0134] Optionally, in an embodiment of the present disclosure, the method for determining the indication information corresponding to the terminal device may include at least one of the following:

[0135] Method 1: Determine the indication information corresponding to the terminal device from pre-configured indication information based on the identification of the terminal device.

[0136] Method 2: Determine the indication information corresponding to the terminal device from pre-stored indication information based on the identification of the terminal device, where the pre-stored indication information is obtained by the first NF through subscription or request to the second NF.

[0137] Optionally, the method by which the first NF obtains the pre-stored indication information by subscribing to the second NF may include: the first NF subscribing to the second NF for an indication information update event. Optionally, if the indication information of a terminal device is updated (e.g., the identifier of the target AF is updated), the terminal device may send the updated indication information to the AMF network element (e.g., via an N1NAS message), and the AMF network element may send the updated indication information to the second NF. For example, the AMF may invoke a Nudm_ParameterProvision_Update service operation on the second NF, the Nudm_ParameterProvision_Update service operation carrying the updated indication information, thereby sending the updated indication information to the second NF. The second NF may then update the stored indication information based on the updated indication information, for example, by correspondingly invoking a Nudr_DM_Update (SUPI, Subscription Data) service operation to update the stored indication information, and may send the updated indication information to the first NF that has subscribed to the indication information update event, thereby achieving the aforementioned "the first NF obtains the pre-stored indication information by subscribing to the second NF." Optionally, the first NF may also unsubscribe from the indication information update event from the second NF.

[0138] Optionally, after the second NF updates the stored indication information based on the updated indication information, it can also return a response to the AMF so that the AMF can send the response (such as through an N1NAS message) to the terminal device to inform the terminal device that the second NF has completed the update and storage of the indication information.

[0139] Optionally, the first NF obtaining the pre-stored indication information by requesting the second NF may include: the first NF sending a request message to the second NF to request the indication information.

[0140] Step 203a: Authorize the AF to perform a provisioning process for the first information based on the instruction information.

[0141] Optionally, in one embodiment of the present disclosure, the above-mentioned "process of authorizing AF to configure the first information based on indication information" can be understood as, for example: judging whether the AF has the authority to configure the first information. Optionally, when it is determined that the AF has the authority to configure the first information, the first information can be subsequently transmitted to other devices in the core network, which indicates that the AF has successfully configured the first information. When it is determined that the AF does not have the authority to configure the first information, the transmission of the first information is terminated, which indicates that the AF has failed to configure the first information.

[0142] Optionally, in an embodiment of the present disclosure, when the content included in the indication information is different, the method of “authorizing the AF to configure the first information based on the indication information” may also be different.

[0143] In one embodiment of the present disclosure, when the indication information defines both the identifier of the target AF and the second information, the method of “authorizing the AF to configure the first information based on the indication information” may include at least one of the following steps:

[0144] Step 1: Determine whether the AF configured with the first information is the target AF, and determine whether the first information is the second information;

[0145] Step 2: In response to the first information not being the second information and / or the AF configuring the first information not being the target AF, determining that the authorization is rejected;

[0146] Step 3: In response to the AF configuring the first information being the target AF, and the first information being the second information, determine whether the authorization is passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0147] Optionally, the above-mentioned “determining whether authorization is passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier” may include at least one of the following:

[0148] In response to the indication information not including the expected service identifier and the expected service operation identifier, determining that the authorization is passed;

[0149] In response to the indication information including the expected service identifier and the terminal information configuration request including the first service identifier, determining whether the first service identifier is the expected service identifier, if the first service identifier is the expected service identifier, determining that the authorization is passed; if the first service identifier is not the expected service identifier, determining that the authorization is rejected;

[0150] In response to the indication information including the expected service operation identifier and the terminal information configuration request including the first service operation identifier, determining whether the first service operation identifier is the expected service operation identifier, and if so, determining that the authorization is approved; if not, determining that the first service operation identifier is not the expected service operation identifier, and rejecting the authorization;

[0151] In response to the indication information including the expected service identifier and the expected service operation identifier, and the terminal information configuration request including the first service identifier and the first service operation identifier, determining whether the first service identifier belongs to the expected service identifier, and whether the first service operation identifier belongs to the expected service operation identifier, if the first service identifier belongs to the expected service identifier, and the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, or the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is rejected;

[0152] In response to the indication information including the expected service identifier and the terminal information configuration request not including the first service identifier, determining that the authorization is rejected;

[0153] In response to the indication information including the expected service operation identifier and the terminal information configuration request not including the first service operation identifier, it is determined that the authorization is rejected.

[0154] Optionally, the aforementioned “the first service identifier belongs to the expected service identifier” can be understood, for example, as follows: the first service identifier is consistent with the expected service identifier. For example, when the first service identifier and the expected service identifier are both Nnef_ParameterProvision, the first service identifier is considered to belong to the expected service identifier. The aforementioned “the first service operation identifier belongs to the expected service operation identifier” can be understood, for example, as follows: the first service operation identifier is consistent with the expected service operation identifier. For example, when the first service operation identifier and the expected service operation identifier are both Nnef_ParameterProvision_Update service operation, the first service operation identifier is considered to belong to the expected service operation identifier.

[0155] Optionally, in one embodiment of the present disclosure, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step 1 and step 2. In another embodiment of the present disclosure, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step 1 and step 3. Optionally, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step 1, step 2, and step 3.

[0156] In another embodiment of the present disclosure, when the indication information does not define the target AF but defines the second information, the method of “authorizing the AF to configure the first information based on the indication information” may include at least one of the following steps:

[0157] Step a: determining whether the first information is the second information;

[0158] Step b: In response to the first information being the second information, determining that the authorization is rejected;

[0159] Step c: In response to the first information not being the second information, determine whether the authorization is passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0160] For a detailed introduction to step c, please refer to the introduction to step 3 above.

[0161] Optionally, in one embodiment of the present disclosure, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step a and step b. In another embodiment of the present disclosure, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step a and step c. Optionally, the above-mentioned process of "authorizing the AF to configure the first information based on the indication information" may include step a, step b, and step c.

[0162] As can be seen from the foregoing, in one embodiment of the present disclosure, when authorizing the AF to configure the first information based on the indication information, the authorization is determined to be successful when it is determined that the AF has the authority to configure the first information and the configuration of the first information by the AF meets the permitted configuration conditions of the first information. When it is determined that the AF does not have the authority to configure the first information of the terminal device and / or the configuration of the first information of the terminal device by the AF does not meet the permitted configuration conditions of the first information, the authorization is determined to be unsuccessful. Therefore, based on the authorization result, the first information configured by the AF with configuration authority that meets the permitted configuration conditions can be authorized for transmission, while the first information configured by the AF without configuration authority and / or the first information configured by the AF with configuration authority that does not meet the permitted configuration conditions is not authorized for transmission, thereby improving the rigor of information transmission and avoiding the situation where "when the AF provides first information of a terminal device that is not under its authority, but the first NF does not recognize it, the first information is directly provided to the AMF network element or MME through the second NF, thereby causing the core network to launch a DoS attack on the terminal device", thereby ensuring communication stability.

[0163] Optionally, the optional examples of the embodiment of FIG. 2a and other embodiments (such as the embodiments of FIG. 2b, 2c, and at least one of the embodiments of FIG. 3 to FIG. 6d) of the present disclosure can be combined with each other.

[0164] To sum up, in the authorization method provided by the embodiment of the present disclosure, after the first NF receives the first information of the terminal device provided by the AF, before transmitting the first information, the first NF can first authorize the AF to configure the first information based on the indication information. Optionally, the indication information indicates the allowed configuration conditions of the first information of the terminal device. Then, "authorizing the AF to configure the first information based on the indication information" can be understood as: judging whether the AF has the authority to configure the first information, so that it can subsequently determine whether to transmit the first information based on the judgment result, thereby improving the rigor of information transmission, and avoiding the situation of "when the AF provides the first information of the terminal device that is not under its authority, but the first NF does not recognize it, it directly provides the first information to the AMF network element or MME through the second NF, thereby causing the core network to launch a DoS attack on the terminal device", thereby ensuring the stability of communication.

[0165] FIG2 b is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by a first NF. As shown in FIG2 b , the authorization method may include the following steps:

[0166] Step 201b: Determine whether to transmit the first information of the terminal device based on the authorization result.

[0167] Optionally, the method for determining whether to transmit the first information of the terminal device based on the authorization result may include at least one of the following:

[0168] In response to the authorization being passed, the first information of the terminal device is sent to the second NF; so that after the second NF receives the first information, it updates and stores the first information based on the content of the first information, and can send the received first information of the terminal device to the network element that has subscribed to the first information update event of the terminal device. Optionally, the network element that has subscribed to the first information update event of the terminal device may include an AMF network element and / or MME, thereby realizing "AF provides (or configures) terminal information to the AMF network element and / or MME".

[0169] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated, and a rejection response message is sent to the AF.

[0170] Optionally, in one embodiment of the present disclosure, the process of the above-mentioned "method for determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being passed, sending the first information of the terminal device to the second NF. In another embodiment of the present disclosure, the process of the above-mentioned "method for determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being rejected, terminating the transmission of the first information of the terminal device. In yet another embodiment of the present disclosure, the process of the above-mentioned "method for determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being passed, sending the first information of the terminal device to the second NF; in response to the authorization being rejected, terminating the transmission of the first information of the terminal device.

[0171] Optionally, in one embodiment of the present disclosure, after the first NF sends the first information of the terminal device to the second NF, the first NF will also obtain a success response message sent by the second NF, and will also send a success response message to the AF.

[0172] Optionally, the optional examples of the embodiment of FIG. 2b and other embodiments (such as at least one of the embodiments of FIG. 2a, 2c, and the embodiments of FIG. 3a to FIG. 6d) of the present disclosure can be combined with each other.

[0173] In summary, in the authorization method provided by the embodiment of the present disclosure, the first information is transmitted only when the authorization is passed, and the transmission of the first information is terminated when the authorization is not passed. Therefore, the information transmission of the disclosed method is more rigorous and the stability of communication is ensured.

[0174] FIG2c is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by the second NF. As shown in FIG2c , the authorization method may include the following steps:

[0175] Step 201c: Receive first information of the terminal device sent by the first NF.

[0176] For a detailed description of step 201b, please refer to the aforementioned embodiment of FIG. 2a.

[0177] Step 202c: Send the first information of the terminal device to the network element that has subscribed to the update event of the first information of the terminal device.

[0178] Optionally, the network element that subscribes to the update event of the first information of the terminal device may include: an AMF network element.

[0179] Optionally, the second NF may be used to store indication information of the terminal device, where the indication information may indicate: an allowable configuration condition of the first information of the terminal device; optionally, the second NF may send the indication information to the first NF based on a subscription or request of the first NF.

[0180] Optionally, after sending the first information of the terminal device to the network element that has subscribed to the update event of the first information, the second NF may also send a success response message to the first NF.

[0181] For a detailed description of step 202c, please refer to the embodiment described in FIG. 2a .

[0182] Optionally, the embodiment of FIG. 2c of the present disclosure and the optional examples of other embodiments (such as at least one of the embodiments of FIG. 2a, 2b, and the embodiments of FIG. 3a to FIG. 6d) can be combined with each other.

[0183] In summary, in the authorization method provided in the embodiments of the present disclosure, the second NF receives the first information about the terminal device sent by the first NF and sends the first information about the terminal device to the network element that has subscribed to the update event of the first information. Optionally, the first information about the terminal device received by the second NF is sent to the second NF after the first NF receives the first information about the terminal device provided by the AF and before transmitting the first information, when the first NF authorizes the AF to configure the first information based on the indication information. Therefore, after the first NF receives the first information about the terminal device provided by the AF and before transmitting the first information, the first NF can first authorize the AF to configure the first information based on the indication information to subsequently determine whether to transmit the first information. This improves the reliability of the transmission of the first information and avoids the situation where the AF provides first information about a terminal device that is not within its authority, but the first NF fails to recognize it and directly provides the first information to the AMF network element or MME through the second NF, thereby potentially causing a DoS attack on the terminal device by the core network. This ensures communication stability.

[0184] FIG3a is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by the second NF. As shown in FIG3a , the authorization method may include the following steps:

[0185] Step 301a: Acquire first information of the terminal device sent by the first NF.

[0186] Optionally, the first information of the terminal device sent by the first NF is determined by the first NF based on the terminal information configuration request sent by the AF, and the terminal information configuration request includes the first information of the terminal device configured by the AF.

[0187] Step 302a: Determine indication information, where the indication information indicates: an allowable configuration condition of the first information of the terminal device.

[0188] Optionally, the method for determining the indication information may include at least one of the following:

[0189] Determining indication information corresponding to the terminal device from pre-stored indication information based on the identification of the terminal device; the pre-stored indication information is determined by the second NF based on a transmission from the terminal device, or the pre-stored indication information is obtained by the second NF through a request to the terminal device;

[0190] Based on the identification of the terminal device, the indication information corresponding to the terminal device is determined from the pre-configured indication information.

[0191] Step 303a: Authorize the AF to configure the first information based on the instruction information.

[0192] The detailed description of the above steps 301a-303a can refer to the embodiment described in FIG2a.

[0193] Optionally, the embodiment of FIG. 3a and optional examples of other embodiments (such as at least one of the embodiments of FIG. 2a to FIG. 2c , the embodiment of FIG. 3b , and the embodiments of FIG. 4 to FIG. 6d ) of the present disclosure may be combined with each other.

[0194] To sum up, in the authorization method provided by the embodiment of the present disclosure, after the second NF receives the first information of the terminal device provided by the AF, before transmitting the first information, the second NF can first authorize the AF to configure the first information based on the indication information. Optionally, the indication information indicates the allowed configuration conditions of the first information of the terminal device. Then, "authorizing the AF to configure the first information based on the indication information" can be understood as: judging whether the AF has the authority to configure the first information, so that it can subsequently determine whether to transmit the first information based on the judgment result, thereby improving the transmission rigor of the first information, and avoiding the situation of "when the AF provides the first information of the terminal device that is not under its authority, but the second NF does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to launch a DoS attack on the terminal device", thereby ensuring the stability of communication.

[0195] FIG3 b is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by the second NF. As shown in FIG3 b , the authorization method may include the following steps:

[0196] Step 301b: Determine whether to transmit the first information of the terminal device based on the authorization result.

[0197] Optionally, the determining whether to transmit the first information of the terminal device based on the authorization result may include at least one of the following:

[0198] In response to the authorization being passed, sending the first information of the terminal device to the network element that has subscribed to the update event of the first information of the terminal device;

[0199] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated.

[0200] Optionally, the network element that subscribes to the update event of the first information of the terminal device may include: AMF network element and / or MME.

[0201] Optionally, in one embodiment of the present disclosure, the above-mentioned process of "determining whether to transmit the first information of the terminal device based on the authorization result and determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being passed, sending the first information of the terminal device to the network element that has subscribed to the update event of the first information of the terminal device; in another embodiment of the present disclosure, the above-mentioned process of "determining whether to transmit the first information of the terminal device based on the authorization result and determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being rejected, terminating the transmission of the first information of the terminal device. In yet another embodiment of the present disclosure, the above-mentioned process of "determining whether to transmit the first information of the terminal device based on the authorization result and determining whether to transmit the first information of the terminal device based on the authorization result" may include: in response to the authorization being passed, sending the first information of the terminal device to the network element that has subscribed to the update event of the first information of the terminal device; in response to the authorization being rejected, terminating the transmission of the first information of the terminal device.

[0202] Optionally, after determining whether to transmit the first information of the terminal device based on the authorization result, at least one of the following may be further included:

[0203] In response to the authorization being passed, the second NF also sends a success response message to the first NF;

[0204] In response to the authorization failure, the second NF also sends a rejection response message to the first NF.

[0205] Optionally, in one embodiment of the present disclosure, after determining whether to transmit the first information of the terminal device based on the authorization result, the second NF may execute: in response to the authorization being passed, sending a success response message to the first NF; or, in another embodiment of the present disclosure, after determining whether to transmit the first information of the terminal device based on the authorization result, the second NF may execute: in response to the authorization being rejected, sending a rejection response message to the first NF. Alternatively, in another embodiment of the present disclosure, after determining whether to transmit the first information of the terminal device based on the authorization result, the second NF may execute: in response to the authorization being passed, the second NF also sends a success response message to the first NF; in response to the authorization being rejected, sending a rejection response message to the first NF.

[0206] Optionally, the embodiment of FIG. 3 b and optional examples of other embodiments (such as at least one of the embodiments of FIG. 2 a - 2 c , the embodiment of FIG. 3 a , and the embodiments of FIG. 4 to FIG. 6 d ) of the present disclosure may be combined with each other.

[0207] In summary, in the authorization method provided by the embodiment of the present disclosure, the first information is transmitted only when the authorization is passed, and the transmission of the first information is terminated when the authorization is not passed. Therefore, the information transmission of the disclosed method is more rigorous and the stability of communication is ensured.

[0208] FIG4 is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by a first NF. As shown in FIG4 , the authorization method may include the following steps:

[0209] Step 401: Receive a success response message or a rejection response message sent by the second NF.

[0210] Optionally, the success response message or rejection response message may be sent by the second NF to the first NF based on its authorization result for the AF. For a detailed description of this part, please refer to the embodiment shown in FIG3 .

[0211] Step 402: Send a success response message or a rejection response message to the AF.

[0212] Optionally, the embodiment of FIG. 4 of the present disclosure and optional examples of other embodiments (such as at least one of the embodiments of FIG. 2a - 2c , the embodiments of FIG. 3a and FIG. 3c , the embodiment of FIG. 5 , and the embodiments of FIG. 6a - 6d ) may be combined with each other.

[0213] In summary, in the authorization method provided by the embodiment of the present disclosure, the success response message or rejection response message received by the first NF is: After the second NF receives the first information of the terminal device provided by the AF, and before transmitting the first information, it is sent to the first NF based on the authorization result of the AF's configuration process for the first information. It can be seen that after the second NF receives the first information of the terminal device provided by the AF, before transmitting the first information, the second NF can first authorize the AF's configuration process for the first information based on the indication information, so as to subsequently determine whether to transmit the first information, thereby improving the transmission rigor of the first information, and avoiding the situation of "when the AF provides the first information of the terminal device that is not under its authority, but the second NF does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to carry out a DoS attack on the terminal device", thereby ensuring the stability of communication.

[0214] FIG5 is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by a first NF. As shown in FIG5 , the authorization method may include the following steps:

[0215] Step 501: Acquire the first information of the terminal device sent by AF.

[0216] Step 502: Send the first information to the second NF.

[0217] Step 503: Receive a success response message or a rejection response message sent by the second NF.

[0218] Step 504: Send a success response message or a rejection response message to the AF.

[0219] For a detailed description of steps 501 - 504 , please refer to the contents of the aforementioned embodiments of FIG. 2 a to FIG. 4 .

[0220] Optionally, the optional examples of the embodiment of FIG. 5 and other embodiments (such as at least one of the embodiments of FIG. 2 a to FIG. 4 , and the embodiments of FIG. 6 a to FIG. 6 d ) of the present disclosure may be combined with each other.

[0221] In summary, in the authorization method provided by the embodiment of the present disclosure, the success response message or rejection response message received by the first NF is: after the second NF receives the first information of the terminal device provided by the AF, and before transmitting the first information, it is sent to the first NF based on the authorization result of the AF's configuration process for the first information. It can be seen that after the second NF receives the first information of the terminal device provided by the AF, before transmitting the first information, the second NF can first authorize the AF's configuration process for the first information based on the indication information, so that it can subsequently determine whether to transmit the first information, thereby improving the transmission rigor of the first information, and avoiding the situation of "when the AF provides the first information of the terminal device that is not under its authority, but the second NF does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to carry out a DoS attack on the terminal device", thereby ensuring the stability of communication.

[0222] FIG6a is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by an AF. As shown in FIG6a , the authorization method may include the following steps:

[0223] Step 601a: Send a terminal information configuration request to the first NF, where the terminal information configuration request includes first information of the terminal device configured by the AF.

[0224] For a detailed introduction to the terminal information configuration request and the first information of the terminal device, reference may be made to the contents of the aforementioned embodiments of FIG. 2a to FIG. 2c.

[0225] Step 602a: Receive a success response message or a rejection response message sent by the first NF.

[0226] Optionally, the optional examples of the embodiment of FIG. 6 a and other embodiments (such as at least one of the embodiments of FIG. 2 a to FIG. 5 and the embodiments of FIG. 6 b to FIG. 6 d ) of the present disclosure may be combined with each other.

[0227] In summary, in the authorization method provided by the embodiment of the present disclosure, the success response message or rejection response message received by the AF may be: after the second NF receives the first information of the terminal device provided by the AF and before transmitting the first information, the second NF sends it to the first NF based on the authorization result of the AF's configuration process for the first information; or, after the first NF receives the first information of the terminal device provided by the AF and before transmitting the first information, the second NF sends it to the first NF based on the authorization result of the AF's configuration process for the first information. Therefore, it can be seen that when the first NF or the second NF receives the first information of the terminal device provided by the AF, before transmitting the first information, it can first authorize the AF's configuration process for the first information based on the indication information so that it can subsequently determine whether to transmit the first information. This improves the transmission rigor of the first information and avoids the situation where "when the AF provides first information of a terminal device that is not within its authority, but does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to launch a DoS attack on the terminal device", thereby ensuring the stability of communication.

[0228] FIG6 b is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is executed by a terminal device. As shown in FIG6 b , the authorization method may include the following steps:

[0229] Step 601b: Send indication information to the second NF, where the indication information indicates: a permitted configuration condition of the first information of the terminal device.

[0230] Optionally, the above-mentioned "sending indication information to the second NF" may include: sending indication information to the second NF through the AMF network element.

[0231] For a detailed description of step 6b, please refer to the aforementioned description of the embodiment in FIG. 2a .

[0232] Optionally, the embodiment of FIG. 6 b and optional examples of other embodiments (such as at least one of the embodiments of FIG. 2 a to FIG. 5 , and the embodiments of FIG. 6 a , 6 c , and 6 d ) of the present disclosure may be combined with each other.

[0233] In summary, in the authorization method provided by the embodiment of the present disclosure, the terminal device can send indication information to the second NF so that the second NF can authorize the AF to configure the first information based on the indication information to determine whether to transmit the first information, or so that the second NF sends the indication information to the first NF so that the first NF can authorize the AF to configure the first information based on the indication information to determine whether to transmit the first information. This improves the rigor of the transmission of the first information, avoids the situation where "when the AF provides the first information of a terminal device that is not within its authority, but does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to launch a DoS attack on the terminal device", and ensures the stability of communication.

[0234] FIG6c is a flow chart of an authorization method provided in an embodiment of the present disclosure. The method is executed by a first device. As shown in FIG6c , the authorization method may include the following steps:

[0235] Step 601c: Receive a terminal information configuration request, where the terminal information configuration request includes first information of the terminal device, and the first information of the terminal device is configured by the AF.

[0236] Step 602c: Determine instruction information, where the instruction information indicates: a condition for allowing configuration of the first information of the terminal device;

[0237] Step 603c: Authorize the AF to configure the first information based on the instruction information.

[0238] Optionally, the indication information may include at least one of the following:

[0239] An identifier of at least one target AF; the target AF is: an AF that is allowed to configure the first information of the terminal device;

[0240] Identification of the terminal device;

[0241] at least one second information, where the second information indicates: information that the terminal device is allowed to configure;

[0242] An expected service identifier, where the expected service identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service corresponding to the expected service identifier;

[0243] an expected service operation identifier, where the expected service operation identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service operation corresponding to the expected service operation identifier;

[0244] Indicates the validity period of the information;

[0245] Indicates the expiration time of the information;

[0246] The authorization policy includes: the terminal device allows the target AF to process the second information through the expected service and / or the expected service operation.

[0247] For the relevant introduction of the indication information, please refer to the description of the aforementioned embodiment.

[0248] Optionally, the terminal information configuration request may further include at least one of the following:

[0249] An identifier of the AF configured with the first information;

[0250] Identification of the terminal device;

[0251] a first service identifier corresponding to the first information, the first service identifier indicating that the AF processes the first information through the service corresponding to the first service identifier;

[0252] The first service operation identifier corresponds to the first information, and the first service operation identifier indicates that the AF processes the first information through the service operation corresponding to the first service operation identifier.

[0253] For a detailed description of the terminal information configuration request, please refer to the description of the aforementioned embodiment.

[0254] Optionally, in response to the indication information including an identifier of at least one target AF, the process of authorizing the AF to configure the first information of the terminal device based on the indication information includes at least one of the following:

[0255] determining whether the AF configured with the first information is the target AF, and determining whether the first information is the second information;

[0256] In response to the first information not being the second information and / or the AF configuring the first information not being the target AF, determining that the authorization is rejected;

[0257] In response to the AF configuring the first information being the target AF, and the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0258] For a detailed description of “the process of authorizing the AF to configure the first information of the terminal device based on the indication information”, reference may be made to the aforementioned embodiment.

[0259] Optionally, in response to the indication information not including an identifier of at least one target AF, the process of authorizing the AF to configure the first information of the terminal device based on the indication information includes at least one of the following:

[0260] determining whether the first information is the second information;

[0261] In response to the first information not being the second information, determining that the authorization is rejected;

[0262] In response to the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0263] Among them, the detailed introduction of the above-mentioned "configuration process of authorizing AF to configure the first information of the terminal device based on the indication information" can refer to the description of the aforementioned embodiment.

[0264] Optionally, based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier, c includes at least one of the following:

[0265] In response to the indication information not including the expected service identifier and the expected service operation identifier, determining that the authorization is passed;

[0266] In response to the indication information including the expected service identifier and the terminal information configuration request including the first service identifier, determining whether the first service identifier is the expected service identifier, if the first service identifier is the expected service identifier, determining that the authorization is passed; if the first service identifier is not the expected service identifier, determining that the authorization is rejected;

[0267] In response to the indication information including the expected service operation identifier and the terminal information configuration request including the first service operation identifier, determining whether the first service operation identifier is the expected service operation identifier, and if so, determining that the authorization is approved; if not, determining that the first service operation identifier is not the expected service operation identifier, and rejecting the authorization;

[0268] In response to the indication information including the expected service identifier and the expected service operation identifier, and the terminal information configuration request including the first service identifier and the first service operation identifier, determining whether the first service identifier belongs to the expected service identifier, and whether the first service operation identifier belongs to the expected service operation identifier, if the first service identifier belongs to the expected service identifier, and the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, or the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is rejected;

[0269] In response to the indication information including the expected service identifier and the terminal information configuration request not including the first service identifier, determining that the authorization is rejected;

[0270] In response to the indication information including the expected service operation identifier and the terminal information configuration request not including the first service operation identifier, it is determined that the authorization is rejected.

[0271] For a detailed description of “determining whether authorization is passed or not”, please refer to the description of the aforementioned embodiment.

[0272] Optionally, the second information is: unreachable information of the terminal device.

[0273] Optionally, in response to the first information being unreachable information of the terminal device;

[0274] The information content corresponding to the first information includes at least one of the following:

[0275] The maximum waiting time corresponding to the transmission of the terminal device;

[0276] The maximum response time of the terminal device to the information;

[0277] The time the terminal device is covered by the communication signal;

[0278] The time when the terminal device is not covered by the communication signal.

[0279] For a detailed introduction to the first information and the second information, please refer to the description of the aforementioned embodiment.

[0280] Optionally, the method may further include:

[0281] Determine whether to transmit the first information of the terminal device based on the authorization result.

[0282] For the relevant introduction on “determining whether to transmit the first information of the terminal device based on the authorization result”, reference can be made to the description of the aforementioned embodiment.

[0283] Optionally, the first device is a first network function NF; or, the first device is a second NF.

[0284] Optionally, in response to the first device being the first NF, determining indication information corresponding to the terminal device includes at least one of the following:

[0285] Determining indication information corresponding to the terminal device from pre-configured indication information based on the identification of the terminal device;

[0286] Based on the identifier of the terminal device, the indication information corresponding to the terminal device is determined from the pre-stored indication information, where the pre-stored indication information is obtained by the first NF through subscription or request to the second NF.

[0287] Optionally, in response to the first device being the first NF, determining whether to transmit the first information of the terminal device based on the authorization result includes at least one of the following:

[0288] In response to the authorization being passed, sending the first information of the terminal device to the second NF;

[0289] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated, and a rejection response message is sent to the AF.

[0290] Optionally, in response to the first device being a first NF, the method further includes:

[0291] Receive a success response message sent by the second NF;

[0292] Send a success response message to AF.

[0293] Optionally, the first NF includes at least one of the following:

[0294] Network Open Function (NEF);

[0295] Common application interface framework CAPIF core functions;

[0296] Authorization function;

[0297] Application Programming Interface Open Function AEF;

[0298] The second NF includes at least one of the following:

[0299] UDM;

[0300] UDR.

[0301] Optionally, in response to the first device being the second NF, determining indication information corresponding to the terminal device includes at least one of the following:

[0302] Determining indication information corresponding to the terminal device from pre-stored indication information based on the identification of the terminal device; the pre-stored indication information is determined by the second NF based on a transmission from the terminal device, or the pre-stored indication information is obtained by the second NF through a request to the terminal device;

[0303] Based on the identification of the terminal device, the indication information corresponding to the terminal device is determined from the pre-configured indication information.

[0304] Optionally, in response to the first device being the second NF, determining whether to transmit the first information of the terminal device based on the authorization result includes at least one of the following:

[0305] In response to the authorization being passed, sending the first information of the terminal device to the network element that has subscribed to the update event of the first information of the terminal device;

[0306] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated.

[0307] Optionally, the network element that subscribes to the update event of the first information of the terminal device includes: access and mobility management function AMF network element.

[0308] Optionally, in response to the first device being the second NF, the method further includes at least one of the following:

[0309] In response to the authorization being passed, a success response message is sent to the first NF;

[0310] In response to the authorization being rejected, a rejection response message is sent to the first NF.

[0311] Optionally, in response to the first device being a second NF, the method further includes:

[0312] Receiving instruction information sent by the terminal device;

[0313] Receive instruction information sent by the terminal device, including:

[0314] Receive indication information sent by the terminal device through the AMF network element

[0315] For the relevant introduction of the above optional examples, please refer to the description of the aforementioned embodiments.

[0316] Optionally, the embodiment of FIG. 6 c of the present disclosure and optional examples of other embodiments (such as at least one of the embodiments of FIG. 2 a to FIG. 5 , and the embodiments of FIG. 6 a , 6 b , and 6 d ) may be combined with each other.

[0317] To sum up, the authorization method provided in the embodiment of the present disclosure can be used to: authorize the process of AF configuring the first information based on the authorization method, so that it can subsequently determine whether to transmit the first information based on the authorization result, thereby improving the rigor of information transmission and ensuring the stability of communication.

[0318] FIG6 d is a flow chart of an authorization method provided by an embodiment of the present disclosure. The method is performed by the second device. As shown in FIG6 d , the authorization method may include the following steps:

[0319] Step 601d: Receive first information of the terminal device, where the first information of the terminal device is configured by the AF;

[0320] Step 602d: Send the first information of the terminal device.

[0321] Optionally, the second device is a second NF; or, the second device is a first NF.

[0322] Optionally, in response to the second device being the second NF, receiving the first information of the terminal device includes:

[0323] receiving first information of a terminal device sent by a first NF;

[0324] The first information of the terminal device is sent, including:

[0325] The first information of the terminal device is sent to the network element that has subscribed to the update event of the first information of the terminal device.

[0326] Optionally, in response to the second device being a second NF, the method further includes:

[0327] Based on the subscription or request of the first NF, indication information is sent to the first NF, where the indication information indicates: an allowed configuration condition of the first information of the terminal device.

[0328] Optionally, the network element that subscribes to the update event of the first information of the terminal device includes: AMF network element.

[0329] Optionally, in response to the second device being a second NF, the method further includes:

[0330] A success response message is sent to the first NF.

[0331] Optionally, in response to the second device being the first NF, receiving the first information of the terminal device includes:

[0332] receiving a terminal information configuration request sent by the AF, where the terminal information configuration request includes first information of the terminal device, and the first information of the terminal device is configured by the AF;

[0333] The first information of the terminal device is sent, including:

[0334] Send the terminal information configuration request to the second NF.

[0335] Optionally, in response to the second device being the first NF, the method further includes:

[0336] receiving a success response message or a rejection response message sent by the second NF;

[0337] Send a success response message or a rejection response message to AF.

[0338] For a detailed description of each of the above optional examples, please refer to the description of the aforementioned embodiments.

[0339] Optionally, the embodiment of FIG. 6d of the present disclosure and the optional examples of other embodiments (such as at least one of the embodiments of FIG. 2a to FIG. 5 , and the embodiments of FIG. 6a , 6b , and 6c ) can be combined with each other.

[0340] In summary, in the authorization method provided by the embodiment of the present disclosure, the second device will receive the first information of the terminal device, and the first information of the terminal device is configured by the AF; thereafter, the second device will send the first information of the terminal device. Optionally, the first information received by the second device may be: sent to the second device when the first device authorizes the AF to configure the first information based on the indication information, or, the second device sends the first information to the first device so that the first device can authorize the AF to configure the first information based on the indication information, so as to subsequently determine whether to transmit the first information. It can be seen that the authorization method of the present disclosure is highly rigorous and ensures the stability of communication.

[0341] FIG7 is a flowchart of an interaction in which a first NF subscribes to indication information from a second NF according to an embodiment of the present disclosure. The following describes an example of a process in which the first NF subscribes to indication information from the second NF with reference to FIG7 .

[0342] 0.NF (i.e., the aforementioned first NF, for example, the CAPIF core function, the authorization function in CAPIF, the API exposure function in CAPIF, NEF, and NWDAF) can subscribe to UDM / UDR notifications of UE profile (i.e., the aforementioned indication information) updates.

[0343] 1. If the UE (i.e. the aforementioned terminal device) has generated or updated the UE profile, the UE sends the latest updated part of the UE profile to the AMF via the UE profile setting in the N1NAS message.

[0344] 2. The AMF calls the Nudm_ParameterProvision_Update service operation to the UDM / UDR (i.e., the aforementioned second NF), which carries the updated part of the UE profile. The UDM / UDR stores or updates the UE profile in the UDR by calling the Nudr_DM_Update (SUPI, Subscription Data) service operation accordingly.

[0345] 3. The AMF responds to the UE with a UE Profile Setup Response in an N1 NAS message.

[0346] 4. The UDM / UDR notifies the subscribed network function of the updated UE profile via the Nudm_SDM_Notification message.

[0347] 5. NF (e.g., CAPIF core function, authorization function in CAPIF, API exposure function, NEF, NWDAF) may unsubscribe from UDM / UDR notifications of a UE profile.

[0348] The UE profile is stored in the UDM / UDR. For each UE, the UE profile determines whether a specific AF can provide specific information related to the specific UE. The UE profile includes AF identification (e.g., AF_ID, application layer ID, FQDN), expected service (e.g., Nnef_ParameterProvision), target UE identification (e.g., SUPI, SUCI, IMPI, UE application layer ID, GPSI), UE unreachability information, expiration time (expiration), and authorization policy (e.g., a specific AF can provide UE unreachability information).

[0349] FIG8 is an interactive flow chart of an authorization method provided by an embodiment of the present disclosure. The method of the present disclosure is introduced below with reference to FIG8 .

[0350] 1. The AF sends a UE unreachable information provision request to the NEF. The request includes the AF identifier (e.g., AF_ID, application layer ID, FQDN), the target UE identifier (e.g., IMPI, UE application layer ID, GPSI), and UE unreachable information. The UE unreachable information may include information such as maximum waiting time and maximum response. The information may also include information related to when the UE is expected to be covered and when the UE is expected to be out of coverage.

[0351] 2. If UDM / UDR is used to authorize the UE unreachable information provision process, step 2 can be skipped. Upon receiving the request, the NEF identifies the UE profile based on the target UE identity. If the NEF does not contain the UE profile, the NEF obtains the profile according to section 2.1 of this document. The NEF uses the UE profile to check whether the UE authorizes the AF to provide UE unreachable information to the 5GS. The NEF can also use local policies to check whether the AF is authorized to provide UE unreachable information to the 5GS. If the AF is authorized to provide UE unreachable information to the 5GS, the process proceeds to step 3. Otherwise, the NEF terminates the process.

[0352] 3.NEF sends a UE unreachable information provision request to UDM / UDR.

[0353] 4. If the NEF is used to authorize the UE unreachable information provision process, step 4 can be skipped. Upon receiving the request, the UDM / UDR identifies the UE profile based on the target UE identity. The UDM / UDR uses the UE profile to check whether the UE authorizes the AF to provide UE unreachable information to the 5GS. The UDM / UDR can also use local policy to check whether the AF has access to 5GC assistance information. If the AF is authorized to provide UE unreachable information to the 5GS, the process proceeds to step 5. Otherwise, the UDM / UDR terminates the process.

[0354] 5. If the AF is authorized to provide information, the UDM / UDR stores the UE unreachable information and sends a UE unreachable information provision response to the NEF.

[0355] 6. The NEF sends a UE unreachable information provision response to the AF.

[0356] Optionally, in one embodiment of the present disclosure, the UDM / UDR should be able to store the UE profile. The UDM / UDR uses the UE profile to check whether the UE authorizes the AF to provide UE unreachable period information to the 5GS. The UDM / UDR can also use local policies to check whether the AF has the right to access 5GC assistance information.

[0357] Optionally, in one embodiment of the present disclosure, upon receiving a request, the NEF identifies the UE profile based on the target UE identity. If the NEF does not contain the UE profile, the NEF obtains the profile in accordance with Section 2.1 of this document. The NEF uses the UE profile to check whether the UE authorizes the AF to provide UE unreachable period information to the 5GS. The NEF may also use local policy to check whether the AF is authorized to provide UE unreachable period information to the 5GS.

[0358] Optionally, any step in the aforementioned embodiments (e.g., at least one of the embodiments in FIG. 2a through FIG. 8 ) may be considered a separate embodiment. Different steps in the same embodiment or different steps in different embodiments may be combined and / or their order swapped, unless inconsistent. The resulting solution is also within the scope of protection of this disclosure.

[0359] Optionally, in an embodiment of the present disclosure, the authorization method may include the following steps:

[0360] Step A: receiving a terminal information configuration request, where the terminal information configuration request includes first information of a terminal device, where the first information of the terminal device is configured by an application function AF;

[0361] Step B: determining indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device;

[0362] Step C: authorizing whether to transmit the first information based on the indication information.

[0363] Optionally, in one embodiment of the present disclosure, the above-mentioned “authorizing whether to transmit the first information based on the indication information” can be understood as, for example: authorizing whether to transmit the first information by judging whether the AF that configures the first information has the authority to configure the first information.

[0364] For a detailed description of the above steps A and B, please refer to the contents of the aforementioned embodiments of FIG. 2 a to FIG. 6 d .

[0365] Optionally, any of the above steps A, B, and C can be used as separate embodiments. Unless there is any contradiction, steps A, B, and C can be arbitrarily combined with the different steps of the above-mentioned embodiments of Figures 2a to 6d, and / or their order can be interchanged. The resulting scheme is also within the scope of protection of this disclosure.

[0366] FIG9 is a schematic diagram of the structure of an authorization device provided by an embodiment of the present disclosure. As shown in FIG9 , the device may include:

[0367] a transceiver module, configured to receive a terminal information configuration request, wherein the terminal information configuration request includes first information of a terminal device, and the first information of the terminal device is configured by an application function AF;

[0368] A processing module, configured to determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device;

[0369] The processing module is further configured to authorize the AF to configure the first information based on the indication information.

[0370] In summary, the authorization device provided in the embodiment of the present disclosure can be used to authorize the process of AF configuring the first information, so that it can subsequently determine whether to transmit the first information based on the authorization result, thereby improving the rigor of information transmission and ensuring the stability of communication.

[0371] Optionally, in an embodiment of the present disclosure, the indication information includes at least one of the following:

[0372] an identifier of at least one target AF; the target AF being: an AF that is allowed to configure the first information of the terminal device;

[0373] The identifier of the terminal device;

[0374] at least one second information, where the second information indicates: information that the terminal device is allowed to configure;

[0375] an expected service identifier, where the expected service identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service corresponding to the expected service identifier;

[0376] an expected service operation identifier, where the expected service operation identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service operation corresponding to the expected service operation identifier;

[0377] The validity period of the instruction information;

[0378] The expiration time of the indication information;

[0379] An authorization policy, wherein the authorization policy includes: the terminal device allows the target AF to process the second information through the expected service and / or the expected service operation.

[0380] Optionally, in an embodiment of the present disclosure, the terminal information configuration request further includes at least one of the following:

[0381] an identifier of the AF configured with the first information;

[0382] The identifier of the terminal device;

[0383] a first service identifier corresponding to the first information, wherein the first service identifier indicates that the AF processes the first information through the service corresponding to the first service identifier;

[0384] The first information corresponds to a first service operation identifier, where the first service operation identifier indicates that the AF processes the first information through a service operation corresponding to the first service operation identifier.

[0385] Optionally, in an embodiment of the present disclosure, in response to the indication information including an identifier of at least one target AF, the processing module is further configured to do at least one of the following:

[0386] determining whether the AF that configures the first information is the target AF, and determining whether the first information is the second information;

[0387] In response to the first information not being the second information and / or the AF configuring the first information not being the target AF, determining that the authorization is rejected;

[0388] In response to the AF configuring the first information being the target AF, and the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0389] Optionally, in an embodiment of the present disclosure, in response to the indication information not including an identifier of at least one target AF, the processing module is further configured to do at least one of the following:

[0390] determining whether the first information is second information;

[0391] In response to the first information not being the second information, determining that the authorization is rejected;

[0392] In response to the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

[0393] Optionally, in one embodiment of the present disclosure, the processing module is further configured to perform at least one of the following:

[0394] In response to the indication information not including the expected service identifier and the expected service operation identifier, determining that the authorization is passed;

[0395] In response to the indication information including the expected service identifier and the terminal information configuration request including the first service identifier, determining whether the first service identifier belongs to the expected service identifier, if the first service identifier belongs to the expected service identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, determining that the authorization is rejected;

[0396] In response to the indication information including the expected service operation identifier and the terminal information configuration request including the first service operation identifier, determining whether the first service operation identifier belongs to the expected service operation identifier, and if the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is rejected;

[0397] In response to the indication information including the expected service identifier and the expected service operation identifier, and the terminal information configuration request including the first service identifier and the first service operation identifier, determining whether the first service identifier belongs to the expected service identifier, and whether the first service operation identifier belongs to the expected service operation identifier; if the first service identifier belongs to the expected service identifier, and the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, or the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is failed;

[0398] In response to the indication information including the expected service identifier and the terminal information configuration request not including the first service identifier, determining that the authorization is rejected;

[0399] In response to the indication information including the expected service operation identifier and the terminal information configuration request not including the first service operation identifier, it is determined that the authorization is rejected.

[0400] Optionally, in one embodiment of the present disclosure, the second information is: unreachable information of the terminal device.

[0401] Optionally, in one embodiment of the present disclosure, in response to the first information being unreachable information of the terminal device;

[0402] The information content corresponding to the first information includes at least one of the following:

[0403] The maximum waiting time corresponding to the transmission of the terminal device;

[0404] The maximum response time of the terminal device to the information;

[0405] The time during which the terminal device is covered by the communication signal;

[0406] The time during which the terminal device is not covered by the communication signal.

[0407] Optionally, in one embodiment of the present disclosure, the apparatus is further configured to:

[0408] Determine whether to transmit the first information of the terminal device based on the authorization result.

[0409] Optionally, in one embodiment of the present disclosure, the first device is a first network function NF; or, the first device is a second NF.

[0410] Optionally, in an embodiment of the present disclosure, in response to the first device being a first NF, the processing module is further configured to perform at least one of the following:

[0411] Determining the indication information corresponding to the terminal device from the pre-configured indication information based on the identifier of the terminal device;

[0412] The indication information corresponding to the terminal device is determined from the pre-stored indication information based on the identifier of the terminal device, where the pre-stored indication information is obtained by the first NF through subscription or request to the second NF.

[0413] Optionally, in one embodiment of the present disclosure, in response to the first device being a first NF, the apparatus is further configured to perform at least one of the following:

[0414] In response to the authorization being passed, sending the first information of the terminal device to the second NF;

[0415] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated, and a rejection response message is sent to the AF.

[0416] Optionally, in one embodiment of the present disclosure, in response to the first device being a first NF, the apparatus is further configured to:

[0417] Receive a success response message sent by the second NF;

[0418] Send the success response message to the AF.

[0419] Optionally, in an embodiment of the present disclosure, the first NF includes at least one of the following:

[0420] Network Open Function (NEF);

[0421] Common application interface framework CAPIF core functions;

[0422] Authorization function;

[0423] Application Programming Interface Open Function AEF;

[0424] The second NF includes at least one of the following:

[0425] Unified data management function UDM;

[0426] Unified Data Repository UDR.

[0427] Optionally, in one embodiment of the present disclosure, in response to the first device being a second NF, the processing module is further configured to perform at least one of the following:

[0428] Determining, based on the identifier of the terminal device, the indication information corresponding to the terminal device from the pre-stored indication information; the pre-stored indication information is determined by the second NF based on a transmission from the terminal device, or the pre-stored indication information is obtained by the second NF through a request to the terminal device;

[0429] The indication information corresponding to the terminal device is determined from the pre-configured indication information based on the identification of the terminal device.

[0430] Optionally, in one embodiment of the present disclosure, in response to the first device being a second NF, the apparatus is further configured to perform at least one of the following:

[0431] In response to the authorization being passed, sending the first information of the terminal device to a network element that has subscribed to an update event of the first information of the terminal device;

[0432] In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated.

[0433] Optionally, in one embodiment of the present disclosure, the network element that subscribes to the update event of the first information of the terminal device includes: an access and mobility management function AMF network element.

[0434] Optionally, in one embodiment of the present disclosure, in response to the first device being a second NF, the apparatus is further configured to perform at least one of the following:

[0435] In response to the authorization being passed, sending a success response message to the first NF;

[0436] In response to the authorization being rejected, a rejection response message is sent to the first NF.

[0437] Optionally, in one embodiment of the present disclosure, in response to the first device being a second NF, the apparatus is further configured to:

[0438] Receiving the indication information sent by the terminal device;

[0439] The receiving the indication information sent by the terminal device includes:

[0440] Receive the indication information sent by the terminal device through the AMF network element.

[0441] FIG10 is a schematic diagram of the structure of an authorization device provided by an embodiment of the present disclosure. As shown in FIG10 , the device may include:

[0442] a transceiver module, configured to receive first information from a terminal device, where the first information from the terminal device is configured by the AF;

[0443] The transceiver module is further used to send the first information of the terminal device.

[0444] In summary, in the authorization device provided in the embodiment of the present disclosure, the second device will receive the first information of the terminal device, and the first information of the terminal device is configured by the AF; thereafter, the second device will send the first information of the terminal device. Optionally, the first information received by the second device may be: sent to the second device when the first device authorizes the AF to configure the first information based on the indication information, or, the second device sends the first information to the first device so that the first device can authorize the AF to configure the first information based on the indication information, so as to subsequently determine whether to transmit the first information. It can be seen that the authorization method of the present disclosure is highly rigorous and ensures the stability of communication.

[0445] Optionally, in an embodiment of the present disclosure, the second device is a second NF; or, the second device is a first NF.

[0446] Optionally, in one embodiment of the present disclosure, in response to the second device being a second NF, the transceiver module is further configured to:

[0447] receiving first information of a terminal device sent by a first NF;

[0448] The sending of the first information of the terminal device includes:

[0449] The first information of the terminal device is sent to a network element that has subscribed to an update event of the first information of the terminal device.

[0450] Optionally, in one embodiment of the present disclosure, in response to the second device being a second NF, the apparatus is further configured to:

[0451] The indication information is sent to the first NF based on the subscription or request of the first NF, where the indication information indicates: an allowed configuration condition of the first information of the terminal device.

[0452] Optionally, in one embodiment of the present disclosure, the network element that subscribes to the update event of the first information of the terminal device includes: an AMF network element.

[0453] Optionally, in one embodiment of the present disclosure, in response to the second device being a second NF, the apparatus is further configured to:

[0454] Send a success response message to the first NF.

[0455] Optionally, in one embodiment of the present disclosure, in response to the second device being the first NF, the transceiver module is further configured to:

[0456] receiving a terminal information configuration request sent by the AF, where the terminal information configuration request includes first information of the terminal device, and the first information of the terminal device is configured by the AF;

[0457] The sending of the first information of the terminal device includes:

[0458] The terminal information configuration request is sent to the second NF.

[0459] Optionally, in one embodiment of the present disclosure, in response to the second device being the first NF, the apparatus is further configured to:

[0460] receiving a success response message or a rejection response message sent by the second NF;

[0461] The success response message or the rejection response message is sent to the AF.

[0462] FIG11 is a schematic diagram of the structure of an authorization device provided by an embodiment of the present disclosure. As shown in FIG11 , the device may include:

[0463] a transceiver module, configured to send a terminal information configuration request to a first NF, wherein the terminal information configuration request includes first information of the terminal device configured by the AF;

[0464] The transceiver module is further configured to receive a success response message or a rejection response message sent by the first NF.

[0465] In summary, in the authorization device provided in the embodiments of the present disclosure, the success response message or rejection response message received by the AF may be: sent by the second NF to the first NF after receiving the first information of the terminal device provided by the AF and before transmitting the first information, based on the authorization result of the AF's configuration process for the first information; or, sent by the first NF to the first NF after receiving the first information provided by the AF and before transmitting the first information, based on the authorization result of the AF's configuration process for the first information of the terminal device. Therefore, when the first NF or the second NF receives the first information of the terminal device provided by the AF and before transmitting the first information, it can first authorize the AF's configuration process for the first information based on the indication information so that it can subsequently determine whether to transmit the first information. This improves the transmission rigor of the first information and avoids the situation where "when the AF provides first information of a terminal device that is not within its authority but does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to launch a DoS attack on the terminal device," thereby ensuring communication stability.

[0466] FIG12 is a schematic diagram of the structure of an authorization device provided by an embodiment of the present disclosure. As shown in FIG12 , the device may include:

[0467] The transceiver module is used to send the indication information to the second NF, where the indication information indicates: the allowed configuration conditions of the first information of the terminal device.

[0468] In summary, in the authorization device provided in the embodiment of the present disclosure, the terminal device can send indication information to the second NF so that the second NF can authorize the AF to configure the first information based on the indication information to determine whether to transmit the first information, or so that the second NF sends the indication information to the first NF so that the first NF can authorize the AF to configure the first information based on the indication information to determine whether to transmit the first information. This improves the rigor of the transmission of the first information, avoids the situation where "when the AF provides the first information of a terminal device that is not within its authority, but does not recognize it, it directly provides the first information to the AMF network element or MME, thereby causing the core network to launch a DoS attack on the terminal device," and ensures the stability of communication.

[0469] Please refer to Figure 13, which is a schematic diagram of the structure of a communication device 1300 provided in an embodiment of the present application. Communication device 1300 can be a network device or a terminal device, or a chip, chip system, or processor that supports the network device to implement the above method. It can also be a chip, chip system, or processor that supports the terminal device to implement the above method. This device can be used to implement the method described in the above method embodiment. For details, please refer to the description of the above method embodiment.

[0470] The communication device 1300 may include one or more processors 1301. The processor 1301 may be a general-purpose processor or a dedicated processor. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the communication device (e.g., a base station, a baseband chip, a terminal device, a terminal device chip, a DU or CU, etc.), execute computer programs, and process computer program data.

[0471] Optionally, the communication device 1300 may further include one or more memories 1302, on which a computer program 1304 may be stored. The processor 1301 executes the computer program 1304 to cause the communication device 1300 to perform the method described in the above method embodiment. Optionally, the memory 1302 may also store data. The communication device 1300 and the memory 1302 may be provided separately or integrated together.

[0472] Optionally, the communication device 1300 may further include a transceiver 1305 and an antenna 1306. The transceiver 1305 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, and is configured to implement transceiver functions. The transceiver 1305 may include a receiver and a transmitter. The receiver may be referred to as a receiver or a receiving circuit, and is configured to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, and is configured to implement a transmitting function.

[0473] Optionally, the communication device 1300 may further include one or more interface circuits 1306. The interface circuit 1306 is configured to receive code instructions and transmit the code instructions to the processor 1301. The processor 1301 executes the code instructions to enable the communication device 1300 to perform the method described in the above method embodiment.

[0474] In one implementation, processor 1301 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and transmitting functions may be separate or integrated. The transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or may be used for transmitting or delivering signals.

[0475] In one implementation, processor 1301 may store a computer program 1303. Computer program 1303, when executed on processor 1301, enables communication device 1300 to perform the method described in the above method embodiment. Computer program 1303 may be embedded in processor 1301, in which case processor 1301 may be implemented by hardware.

[0476] In one implementation, the communication device 1300 may include a circuit that can implement the functions of sending, receiving, or communicating in the aforementioned method embodiments. The processor and transceiver described in this application can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0477] The communication device described in the above embodiments may be a network device or a terminal device, but the scope of the communication device described in this application is not limited thereto, and the structure of the communication device may not be limited to FIG13. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be:

[0478] (1) An independent integrated circuit (IC), or chip, or chip system or subsystem;

[0479] (2) a collection of one or more ICs, optionally including a storage component for storing data and computer programs;

[0480] (3) ASIC, such as modem;

[0481] (4) Modules that can be embedded in other devices;

[0482] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0483] (6)Others, etc.

[0484] If the communication device can be a chip or a chip system, please refer to the schematic diagram of the chip structure shown in Figure 14. The chip shown in Figure 14 includes a processor 1401 and an interface 1402. Optionally, the number of processors 1401 can be one or more, and the number of interfaces 1402 can be multiple.

[0485] Optionally, the chip further includes a memory 1403, which is used to store necessary computer programs and data.

[0486] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present application can be implemented by electronic hardware, computer software, or a combination of both. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present application.

[0487] The present application also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.

[0488] The present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0489] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0490] Those skilled in the art will understand that the various numerical numbers such as first and second involved in this application are only for the convenience of description and are not used to limit the scope of the embodiments of this application, and also indicate the order of precedence.

[0491] In this application, at least one can also be described as one or more, and multiple can be two, three, four or more, which is not limited in this application. In the embodiments of this application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0492] The correspondences shown in the tables in this application can be configured or predefined. The values ​​of the signals in each table are merely examples and can be configured to other values, which are not limited by this application. When configuring the correspondences between the configuration information and the parameters, it is not necessarily required to configure all the correspondences shown in the tables. For example, in the tables in this application, the correspondences shown in certain rows may not be configured. For another example, appropriate modifications and adjustments can be made based on the above tables, such as splitting, merging, etc. The names of the parameters shown in the titles of the above tables may also use other names that can be understood by the communication device, and the values ​​or representations of the parameters may also use other values ​​or representations that can be understood by the communication device. When implementing the above tables, other data structures may also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables, etc.

[0493] The predefined in this application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0494] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0495] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0496] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An authorization method, characterized in that: The method is executed by a first device and includes: receiving a terminal information configuration request, the terminal information configuration request including first information of a terminal device, the first information of the terminal device being configured by an application function AF; Determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device; A configuration process of the first information is authorized to the AF based on the indication information.

2. The method according to claim 1, wherein The indication information includes at least one of the following: an identifier of at least one target AF; the target AF being: an AF that is allowed to configure the first information of the terminal device; The identifier of the terminal device; at least one second information, where the second information indicates: information that the terminal device is allowed to configure; an expected service identifier, where the expected service identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service corresponding to the expected service identifier; an expected service operation identifier, where the expected service operation identifier is used to indicate that the terminal device allows the target AF to process the second information through the expected service operation corresponding to the expected service operation identifier; The validity period of the instruction information; The expiration time of the indication information; An authorization policy, wherein the authorization policy includes: the terminal device allows the target AF to process the second information through the expected service and / or the expected service operation.

3. The method according to claim 1, wherein The terminal information configuration request also includes at least one of the following: an identifier of the AF configured with the first information; The identifier of the terminal device; a first service identifier corresponding to the first information, wherein the first service identifier indicates that the AF processes the first information through the service corresponding to the first service identifier; The first information corresponds to a first service operation identifier, where the first service operation identifier indicates that the AF processes the first information through a service operation corresponding to the first service operation identifier.

4. The method according to claim 2 or 3, wherein: In response to the indication information including an identifier of at least one target AF, the process of authorizing the AF to configure the first information based on the indication information includes at least one of the following: determining whether the AF that configures the first information is the target AF, and determining whether the first information is the second information; In response to the first information not being the second information and / or the AF configuring the first information not being the target AF, determining that the authorization is rejected; In response to the AF configuring the first information being the target AF, and the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

5. The method according to claim 2 or 3, wherein: In response to the indication information not including an identifier of at least one target AF, the process of authorizing the AF to configure the first information based on the indication information includes at least one of the following: determining whether the first information is second information; In response to the first information not being the second information, determining that the authorization is rejected; In response to the first information being the second information, the authorization is determined to be passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier.

6. The method according to claim 4 or 5, characterized in that The determining whether the authorization is passed or not based on whether the indication information includes at least one of the expected service identifier and the expected service operation identifier, and / or whether the terminal information configuration request includes at least one of the first service identifier and the first service operation identifier, includes at least one of the following: In response to the indication information not including the expected service identifier and the expected service operation identifier, determining that the authorization is passed; In response to the indication information including the expected service identifier and the terminal information configuration request including the first service identifier, determining whether the first service identifier belongs to the expected service identifier, if the first service identifier belongs to the expected service identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, determining that the authorization is rejected; In response to the indication information including the expected service operation identifier and the terminal information configuration request including the first service operation identifier, determining whether the first service operation identifier belongs to the expected service operation identifier, and if the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is rejected; In response to the indication information including the expected service identifier and the expected service operation identifier, and the terminal information configuration request including the first service identifier and the first service operation identifier, determining whether the first service identifier belongs to the expected service identifier, and whether the first service operation identifier belongs to the expected service operation identifier; if the first service identifier belongs to the expected service identifier, and the first service operation identifier belongs to the expected service operation identifier, determining that the authorization is passed; if the first service identifier does not belong to the expected service identifier, or the first service operation identifier does not belong to the expected service operation identifier, determining that the authorization is failed; In response to the indication information including the expected service identifier and the terminal information configuration request not including the first service identifier, determining that the authorization is rejected; In response to the indication information including the expected service operation identifier and the terminal information configuration request not including the first service operation identifier, it is determined that the authorization is rejected.

7. The method according to any one of claims 2 to 6, wherein: The second information is: unreachable information of the terminal device.

8. The method according to any one of claims 1 to 7, wherein: In response to the first information being unreachable information of the terminal device; The information content corresponding to the first information includes at least one of the following: The maximum waiting time corresponding to the transmission of the terminal device; The maximum response time of the terminal device to the information; The time during which the terminal device is covered by the communication signal; The time during which the terminal device is not covered by the communication signal.

9. The method according to any one of claims 1 to 8, wherein: The method further comprises: Determine whether to transmit the first information of the terminal device based on the authorization result.

10. The method according to any one of claims 1 to 9, characterized in that: The first device is a first network function NF; or, the first device is a second NF.

11. The method according to any one of claims 1 to 10, wherein: In response to the first device being the first NF, the determining of the indication information corresponding to the terminal device includes at least one of the following: Determining the indication information corresponding to the terminal device from the pre-configured indication information based on the identifier of the terminal device; The indication information corresponding to the terminal device is determined from the pre-stored indication information based on the identifier of the terminal device, where the pre-stored indication information is obtained by the first NF through subscription or request to the second NF.

12. The method according to any one of claims 9 to 11, wherein: In response to the first device being the first NF, the determining, based on the authorization result, whether to transmit the first information of the terminal device includes at least one of the following: In response to the authorization being passed, sending the first information of the terminal device to the second NF; In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated, and a rejection response message is sent to the AF.

13. The method according to any one of claims 1 to 12, wherein: In response to the first device being a first NF, the method further includes: Receive a success response message sent by the second NF; Send the success response message to the AF.

14. The method according to any one of claims 1 to 10, wherein: In response to the first device being a second NF, the determining of the indication information corresponding to the terminal device includes at least one of the following: Determining, based on the identifier of the terminal device, the indication information corresponding to the terminal device from the pre-stored indication information; the pre-stored indication information is determined by the second NF based on a transmission from the terminal device, or the pre-stored indication information is obtained by the second NF through a request to the terminal device; The indication information corresponding to the terminal device is determined from the pre-configured indication information based on the identification of the terminal device.

15. The method according to any one of claims 9, 10 and 14, wherein: In response to the first device being the second NF, the determining, based on the authorization result, whether to transmit the first information of the terminal device includes at least one of the following: In response to the authorization being passed, sending the first information of the terminal device to a network element that has subscribed to an update event of the first information of the terminal device; In response to the authorization being rejected, the transmission of the first information of the terminal device is terminated.

16. The method according to claim 15, wherein The network element that subscribes to the update event of the first information of the terminal device includes: an access and mobility management function AMF network element.

17. The method according to any one of claims 1-10 and 14-16, wherein: In response to the first device being a second NF, the method further includes at least one of the following: In response to the authorization being passed, sending a success response message to the first NF; In response to the authorization being rejected, a rejection response message is sent to the first NF.

18. The method according to any one of claims 1-10 and 14-17, wherein: In response to the first device being a second NF, the method further includes: Receiving the indication information sent by the terminal device; The receiving the indication information sent by the terminal device includes: Receive the indication information sent by the terminal device through the AMF network element.

19. The method according to any one of claims 10 to 18, wherein: The first NF includes at least one of the following: Network Open Function (NEF); Common application interface framework CAPIF core functions; Authorization function; Application Programming Interface Open Function AEF; The second NF includes at least one of the following: Unified data management function UDM; Unified Data Repository UDR.

20. An authorization method, characterized in that: The method is performed by a second device, including: receiving first information of a terminal device, where the first information of the terminal device is configured by the AF; Sending first information of the terminal device.

21. The method according to claim 20, wherein The second device is a second NF; or, the second device is a first NF.

22. The method according to claim 20 or 21, wherein: In response to the second device being a second NF, the receiving the first information of the terminal device includes: receiving first information of a terminal device sent by a first NF; The sending of the first information of the terminal device includes: The first information of the terminal device is sent to a network element that has subscribed to an update event of the first information of the terminal device.

23. The method according to any one of claims 20 to 22, wherein: In response to the second device being a second NF, the method further includes: The indication information is sent to the first NF based on the subscription or request of the first NF, where the indication information indicates: an allowed configuration condition of the first information of the terminal device.

24. The method of claim 22, wherein: The network element that subscribes to the update event of the first information of the terminal device includes: AMF network element.

25. The method according to any one of claims 20 to 24, wherein: In response to the second device being a second NF, the method further includes: Send a success response message to the first NF.

26. The method according to claim 20 or 21, wherein In response to the second device being the first NF, the receiving the first information of the terminal device includes: receiving a terminal information configuration request sent by the AF, where the terminal information configuration request includes first information of the terminal device, and the first information of the terminal device is configured by the AF; The sending of the first information of the terminal device includes: The terminal information configuration request is sent to the second NF.

27. The method according to any one of claims 20, 21 and 26, wherein: In response to the second device being the first NF, the method further includes: receiving a success response message or a rejection response message sent by the second NF; The success response message or the rejection response message is sent to the AF.

28. An authorization method, characterized in that: The method is executed by the AF, comprising: Sending a terminal information configuration request to the first NF, where the terminal information configuration request includes the first information of the terminal device configured by the AF; Receive a success response message or a rejection response message sent by the first NF.

29. An authorization method, characterized in that: The method is executed by a terminal device, comprising: Send indication information to the second NF, where the indication information indicates: an allowable configuration condition of the first information of the terminal device.

30. The method of claim 29, wherein: The sending the instruction information to the second NF includes: The indication information is sent to the second NF through the AMF network element.

31. An authorization device, characterized in that: include: a transceiver module, configured to receive a terminal information configuration request, wherein the terminal information configuration request includes first information of a terminal device, and the first information of the terminal device is configured by an application function AF; A processing module, configured to determine indication information, where the indication information indicates: a permitted configuration condition of the first information of the terminal device; The processing module is further configured to authorize the AF to configure the first information based on the indication information.

32. An authorization device, characterized in that: include: a transceiver module, configured to receive first information of a terminal device, where the first information of the terminal device is configured by the AF; The transceiver module is further used to send the first information of the terminal device.

33. An authorization device, characterized in that: include: a transceiver module, configured to send a terminal information configuration request to a first NF, wherein the terminal information configuration request includes first information of the terminal device configured by the AF; The transceiver module is further configured to receive a success response message or a rejection response message sent by the first NF.

34. An authorization device, characterized in that: include: The transceiver module is used to send the indication information to the second NF, where the indication information indicates: the allowed configuration conditions of the first information of the terminal device.

35. A communication device, characterized in that: The device includes a processor and a memory, wherein a computer program is stored in the memory, and the processor executes the computer program stored in the memory so that the device performs the method according to any one of claims 1 to 19, or the processor executes the computer program stored in the memory so that the device performs the method according to any one of claims 20 to 27, or the processor executes the computer program stored in the memory so that the device performs the method according to any one of claim 28, or the processor executes the computer program stored in the memory so that the device performs the method according to claim 29.

36. A communication device, characterized in that include: processor and interface circuitry, wherein The interface circuit is used to receive code instructions and transmit them to the processor; The processor is used to run the code instructions to execute the method according to any one of claims 1 to 19, or to run the code instructions to execute the method according to any one of claims 20 to 27, or to run the code instructions to execute the method according to any one of claim 28, or to run the code instructions to execute the method according to claim 29.

37. A computer-readable storage medium for storing instructions, which, when executed, causes the method according to any one of claims 1 to 19 to be implemented, or, when executed, causes the method according to any one of claims 20 to 27 to be implemented, or, when executed, causes the method according to claim 28 to be implemented, or, when executed, causes the method according to claim 29 to be implemented.

Images