Internet of Things service management and execution method, network equipment and system

Abstract

The invention provides an Internet of Things service management and execution method, network equipment and a system, and relates to the technical field of Internet of Things. The Internet of Things service management method disclosed by the invention comprises the following steps: a passive Internet of Things function AIoTF network element acquires an application function AF request for an Internet of Things terminal; the AIoTF network element obtains a verification policy of a service corresponding to the AF request through a policy control function (PCF) network element; when the verification strategy is that password verification needs to be carried out, the AIoTF network element obtains a first password of the service and sends an Internet of Things service request and the first password to the Internet of Things terminal through the wireless side read-write device, and the Internet of Things terminal executes the service under the condition that the verification of the first password is passed. The service execution result and the second password are fed back to the AIoTF network element through the wireless side read-write device; and the AIoTF network element feeds back a service execution result or service data corresponding to the service execution result to the source node of the AF request under the condition that the second password passes verification.

Description

Technical Field

[0001] The present disclosure relates to the technical field of Internet of Things, and in particular to an Internet of Things service management, execution method, network device and system. Background Art

[0002] Passive IoT is different from traditional IoT. It maintains the normal operation of equipment by collecting micro-energy in the environment, such as radio wave energy, heat energy, vibration energy, etc. It has the advantages of no need for built-in batteries, low cost, and flexible deployment space. The emergence of passive IoT is of great significance in logistics tracking, environmental monitoring, building automation, etc.

[0003] According to 3GPP's existing definition of AIoT (Ambient IoT, passive Internet of Things) terminals, AIoT terminals are IoT devices with extremely low energy storage, extremely low power consumption, and are not equipped with SIM cards. Depending on whether they are equipped with amplifiers, they are divided into weak terminals that only support backscatter communication and strong terminals that can support self-generated signals or use backscatter communication.

[0004] Although power constraints limit application functionality, passive IoT is able to perform many types of tasks, such as reading, writing, logging out, and permanently logging out. Summary of the invention

[0005] One purpose of the present disclosure is to improve the security of services within the scope that the passive Internet of Things can withstand.

[0006] According to one aspect of some embodiments of the present disclosure, a method for managing IoT services is proposed, which is executed by a network-side device, and includes: an AIoTF (Ambient IoT Function) network element obtains an AF (Application Function) request for an IoT terminal; the AIoTF network element obtains a verification policy for the service corresponding to the AF request through a PCF (Policy Control Function) network element according to the AF request; when the verification policy requires password verification, the AIoTF network element obtains a first password for the service, and sends the IoT service request and the first password to the IoT terminal through a wireless-side reader / writer, wherein the IoT terminal executes the service when the first password is verified successfully, and feeds back the service execution result and the second password to the AIoTF network element through the wireless-side reader / writer; when the second password is verified successfully, the AIoTF network element feeds back the service execution result or the service data corresponding to the service execution result to the source node of the AF request.

[0007] In some embodiments, the method also includes: obtaining an AF request from an AF network element; NEF (Network Exposure Function) network element and UDM (Unified Data Management) network element authenticate the authority and AF request of the AF network element; if the authentication is successful, the AF request is sent to the AIoTF network element so as to execute the operation of the AIoTF network element obtaining the AF request for the IoT terminal.

[0008] In some embodiments, the AIoTF network element obtains the verification policy of the service corresponding to the AF request through the PCF network element, including: the AIoTF network element sends a query request for the service corresponding to the AF request to the PCF network element; the PCF network element determines the verification policy of the service based on pre-stored security policy information, and feeds back to the AIoTF network element.

[0009] In some embodiments, the security policy information includes at least one of the following: the type of IoT operation that requires password verification, the IoT operation type including at least one of read, write, enable, disable, register, logout, activate, deactivate, and inventory; the identification of the enterprise that requires password verification; the identification of the application function that requires password verification; the type of IoT terminal that requires password verification; the identification of the application that requires password verification.

[0010] In some embodiments, the AIoTF network element obtains the first password of the service including: the AIoTF network element requests the first password of the service from the UDM network element; the UDM network element determines the first password based on pre-stored password information and feeds it back to the AIoTF network element.

[0011] In some embodiments, the AIoTF network element obtaining the first password of the service further includes: when the UDM network element fails to query the first password of the service according to the pre-stored password information, the AIoTF network element parses the first password from the AF request.

[0012] In some embodiments, the AIoTF network element obtains the first password for the service, further comprising: when the UDM network element fails to query the first password for the service according to the pre-stored password information, and the AIoTF network element fails to parse the first password from the AF request, the AIoTF network element rejects the AF request and provides a prompt message that the request is illegal.

[0013] In some embodiments, the method also includes: the NEF network element obtains the authentication information of the AF from the BOSS (Business Operation Support System), and the UDM network element obtains the Internet of Things password information from the BOSS, wherein, after the AF signs an Internet of Things network service with the BOSS and provides the Internet of Things password information to the BOSS, the BOSS sends the authentication information of the AF to the NEF network element, and sends the Internet of Things password information to the UDM network element; the NEF network element deploys the signing and authorization information of the AF according to the authentication information; the UDM network element deploys and generates pre-stored password information according to the Internet of Things password information; the NEF network element and the UDM network element feedback the deployment results to the BOSS.

[0014] In some embodiments, the method further includes: the NEF network element obtains authentication information and IoT password information from the AF network element; the NEF network element deploys the signing and authorization information of the AF according to the authentication information; and the UDM network element deploys and generates pre-stored password information according to the IoT password information.

[0015] In some embodiments, the pre-stored password information includes at least one of the following: an association between an identification of an Internet of Things terminal and a first password; an association between an identification of an enterprise and a first password; an association between an identification of an application and a first password; an association between an identification of an application function and a first password.

[0016] In some embodiments, the AIoTF network element verifies the second password if it determines that the second password is the same as the first password.

[0017] In some embodiments, the method meets at least one of the following conditions: the Internet of Things is a passive Internet of Things; the wireless side reading and writing device includes at least one of a terminal reading and writing device and a base station reading and writing device.

[0018] According to one aspect of some embodiments of the present disclosure, a method for executing an Internet of Things service is proposed, which is executed by an Internet of Things terminal device, including: obtaining an Internet of Things service request and a first password from a network side; when the first password is verified, executing the Internet of Things service request and obtaining a service execution result; and feeding back the service execution result and the stored second password to the network side, wherein the device on the network side executes any one of the above-mentioned Internet of Things service management methods.

[0019] According to one aspect of some embodiments of the present disclosure, a network device is proposed, including: a request acquisition unit, configured to acquire an AF request for an IoT terminal; a policy determination unit, configured to acquire a verification policy for a service corresponding to the AF request through a PCF network element; a service request unit, configured to acquire a first password for the service when the verification policy requires password verification, and to send an IoT service request and a first password to the IoT terminal through a wireless side reader / writer, wherein the IoT terminal executes the service when the first password is verified successfully, and feeds back the service execution result and the second password to the AIoTF network element through the wireless side reader / writer; a feedback unit, configured to feed back the service execution result or service data corresponding to the service execution result to the source node of the AF request when the second password is verified successfully.

[0020] According to one aspect of some embodiments of the present disclosure, a network device is provided, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the above-mentioned methods based on instructions stored in the memory.

[0021] According to one aspect of some embodiments of the present disclosure, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, any one of the methods mentioned above is implemented.

[0022] According to one aspect of some embodiments of the present disclosure, a computer program product is provided, including a computer program or instructions, and when the computer program or instructions are executed by a processor, any one of the methods mentioned above is implemented.

[0023] According to one aspect of some embodiments of the present disclosure, a network system is proposed, including: an AIoTF network element, configured to execute the operations performed by the AIoTF network element in the IoT service management method mentioned above; a NEF network element, configured to: obtain an AF request from an AF network element, and authenticate the authority and AF request of the UDM network element to the AF network element; if the authentication is successful, send the AF request to the AIoTF network element; a PCF network element, configured to: obtain a query request for the service corresponding to the AF request from the AIoTF network element; determine the verification strategy of the service according to the pre-stored security policy information, and feed it back to the AIoTF network element.

[0024] In some embodiments, the network system also includes: a UDM network element, which is configured to determine the first password based on a request from the AIoTF network element and pre-stored password information, and feed it back to the AIoTF network element.

[0025] In some embodiments, the AIoTF network element is also configured to parse the first password from the AF request when the UDM network element fails to query the first password of the service according to the pre-stored password information; when the parsing of the first password from the AF request fails, reject the AF request and provide a prompt message that the request is illegal.

[0026] In some embodiments, the NEF network element is further configured to: obtain authentication information of the AF network element, and deploy the signing and authorization information of the AF based on the authentication information; the UDM network element is further configured to: obtain the IoT password information of the AF network element, and deploy and generate pre-stored password information based on the IoT password information. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute improper limitations on the present disclosure.

[0028] Figure 1 The present invention is a flowchart of some embodiments of the Internet of Things business management method disclosed in the present invention.

[0029] Figure 2 The present invention provides a signaling flow chart of some embodiments of the IoT service management method disclosed herein.

[0030] Figure 3 The following is a signaling flow chart of other embodiments of the Internet of Things service management method disclosed in the present invention.

[0031] Figure 4 The present invention is a signaling flow chart of some other embodiments of the Internet of Things service management method disclosed in the present invention.

[0032] Figure 5 The present invention is a signaling flow chart of some further embodiments of the IoT service management method disclosed herein.

[0033] Figure 6 The present invention is a schematic diagram of some embodiments of storing security policy information in a PCF in the IoT service management method of the present invention.

[0034] Figure 7 The diagram is a schematic diagram of some embodiments of password information pre-stored in the UDM in the IoT service management method disclosed in the present invention.

[0035] Figure 8 The present invention is a flowchart of some embodiments of the method for executing Internet of Things services disclosed herein.

[0036] Fig. 9 Schematic diagram of some embodiments of the network device disclosed herein.

[0037] Fig.10Schematic diagrams of other embodiments of the network device disclosed herein.

[0038] Fig.11 Schematic diagrams of some further embodiments of the network device disclosed herein.

[0039] Fig.12 Schematic diagrams of some embodiments of the network system disclosed herein.

[0040] Fig.13 Schematic diagrams of other embodiments of the network system disclosed herein. DETAILED DESCRIPTION

[0041] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments.

[0042] The inventors found that due to the different service characteristics of the passive Internet of Things (such as read only, write, logout, permanent logout, etc.), different services may have different requirements on the security level. However, the security of the service will bring great pressure to the passive Internet of Things and the passive Internet of Things terminals.

[0043] In response to the above problems, the present disclosure proposes an IoT business management and execution method, network equipment and system to provide security for some services with higher requirements, while avoiding the waste of resources caused by providing security for all services, and avoiding excessive burden on the network and passive IoT terminals.

[0044] The flowcharts of some embodiments of the IoT service management method disclosed in the present invention are as follows: Figure 1 As shown, the method is executed by a network side device, and includes steps S11-S16. In some embodiments, the Internet of Things of the present disclosure is a passive Internet of Things, the Internet of Things terminal is a passive Internet of Things terminal, and the Internet of Things AF is a passive Internet of Things AF.

[0045] In step S11, the AIoTF network element obtains an AF request for the IoT terminal. In some embodiments, the AF request is sent by the IoT AF network element and reaches the AIoTF network element through the interface core network device.

[0046] In some embodiments, before step S11, the method further includes: obtaining an AF request from the AF network element; the NEF network element and the UDM network element authenticate the authority of the AF network element and the AF request; if the authentication is successful, the AF request is sent to the AIoTF network element, triggering the execution of step S11. Through such a method, the AF request can be authenticated first, and subsequent processing can be performed if the authentication is successful, thereby reducing the probability of subsequent invalid operations.

[0047] In step S12, the AIoTF network element obtains the verification policy of the service corresponding to the AF request through the PCF network element. The PCF network element stores security policy information for various IoT services.

[0048] In some embodiments, AIoTF can parse the AF request, obtain the content therein, and send a query request for the service corresponding to the AF request to the PCF network element based on the content therein, and carry the service identifier in the query request. In some embodiments, the query request can carry one or more of the operation type identifier, the business enterprise identifier, the IoT terminal identifier, and the application identifier. The PCF network element uses the information carried in the query request to query based on the pre-stored security policy information, determine the verification policy of the service, and feedback to the AIoTF network element.

[0049] In step S13, if the verification strategy fed back by the PCF requires password verification, step S14 is executed; otherwise, the method in the relevant technology is adopted to execute the corresponding IoT service through a process without password verification.

[0050] In step S14, the AIoTF network element obtains the first password of the service, and sends the IoT service request and the first password to the IoT terminal through the wireless side reader. In some embodiments, the IoT service request can be generated based on the AF request, or the AF request itself can be used as the IoT service request.

[0051] In some embodiments, the wireless side reading and writing device may include a base station reading and writing device located on the network side and a terminal reading and writing device located on the terminal. After receiving the IoT service request and the first password, the IoT terminal verifies the first password using its own stored password. If the first password is verified, the service corresponding to the IoT service request is executed, and the service execution result and the second password are fed back to the AIoTF network element through the wireless side reading and writing device. The second password is the password stored by the IoT terminal itself.

[0052] In some embodiments, the above-mentioned first password can be stored by the UDM network element, and the AIoTF network element requests the first password of the service from the UDM network element; the UDM network element determines the first password based on the pre-stored password information, and feeds back to the AIoTF network element to obtain the first password.

[0053] In some embodiments, the first password may be stored by the AF network element and sent to the AIoTF network element via an AF request.

[0054] In some embodiments, the AIoTF network element may first send a request to the UDM network element. If the UDM feeds back the first password, the operation of sending the IoT service request and the first password to the IoT terminal through the wireless side reader / writer is executed; if the UDM does not feed back the first password, the operation of sending the IoT service request and the first password to the IoT terminal through the wireless side reader / writer is executed using the first password carried in the AF request. This method can increase the probability of obtaining the first password.

[0055] In some embodiments, if the first password cannot be obtained in both the UDM and AF requests, the AF request is rejected, and the corresponding AF network element is informed that the AF request is an illegal request. This method can improve the security of IoT services, intercept illegal requests in a timely manner, and reduce the probability of subsequent invalid operations.

[0056] When the first password is verified, the IoT terminal executes the service and feeds back the service execution result and the second password to the AIoTF network element through the wireless side reading and writing device. In some embodiments, the wireless side reading and writing device actively reads the service execution result generated by the IoT terminal and the second password stored in the IoT terminal, thereby eliminating the need for the IoT terminal to have an active reporting function, thereby ensuring smooth service execution.

[0057] The IoT terminal disclosed in the present invention has a device identifier, which includes an identifier defined by 3GPP, and optionally, may also include an application-defined identifier / application identifier (defined by a third-party service). The identifiers defined by 3GPP include a home network identifier, an enterprise identifier, and an instance identifier, wherein the home network identifier includes MCC (Mobile Country Code) + MCN (Mobile Network Code), and also includes a PLMN (Public Land Mobile Network) identifier, the enterprise identifier is the service provider information or public platform information or manufacturer information, and the instance identifier is an AIoT device identifier displaced in the network (similar to the network unique identification number of a mobile phone number).

[0058] The IoT terminal stores a password, and determines whether the verification is successful by matching the first password with the password stored in the terminal. If the password stored in the IoT terminal matches the first password (for example, the two are consistent or the relationship between the two meets a predetermined rule), the verification is successful and the service can be executed; if the password stored in the IoT terminal does not match the first password, the verification fails and the service is refused to be executed. In some embodiments, the IoT terminal can remain silent and not respond to IoT service requests for services that are refused to be executed, thereby reducing energy consumption.

[0059] In step S15, the AIoTF network element receives the service execution result and the second password transmitted by the wireless side reader and writer, and verifies the second password. If the verification is successful, step S16 is executed. In some embodiments, if the verification fails, the result reporting process fails to pass the verification, preventing the result feedback.

[0060] In some embodiments, the AIoTF network element may compare the first password obtained previously (managed and provided by the UDM or AF) with the second password (managed and provided by the IoT terminal). If the two match (they are the same or the relationship between the two meets predetermined rules), the second password is verified; otherwise, the verification is considered to have failed.

[0061] In step S16, the service execution result or the service data corresponding to the service execution result is fed back to the source node of the AF request.

[0062] Based on the method in the embodiment shown above, it is possible to provide the IoT terminal with verification information before the service is executed, and to verify the information provided by the IoT terminal after the service is executed, thereby achieving two-way security verification for some services with higher requirements, while avoiding the waste of resources caused by security protection for all services, and avoiding excessive burden on the network and passive IoT terminals while improving security.

[0063] In some embodiments, the above Figure 1 The signaling flow chart of the IoT service management method shown in Figure 2 as shown in .

[0064] In 201, the AIoT AF network element initiates an AF request to the network for the contracted AIoT terminal, requesting the network to perform specific operations on the AIoT terminal.

[0065] In 202, the NEF and the UDM authenticate and authorize the AF's authority and the AF's request.

[0066] In 203, the NEF forwards the authorized AF request to the corresponding AIoTF.

[0067] In 204, AF requests identification. After receiving the AF request forwarded by NEF, AIoTF requests PCF to provide the policy configuration of the AIoT service, that is, to query whether the AIoT service requires AIoT password verification operation.

[0068] In 205, the PCF returns the result. The PCF sends the policy result of whether the password verification operation is required under the AIoT service.

[0069] In 206, AIoTF requests a password. When PCF indicates that the AIoT service request sent by AF needs password verification, AIoTF requests UDM to query the password of the AIoT and whether the AIoT Password (first password) corresponding to the AIoT ID is stored in UDM.

[0070] In 207 , UDM returns the query result to AIoTF.

[0071] Furthermore, the execution is determined based on whether the query result fed back by UDM includes AIoT Password. Figure 3 or Figure 4 The signaling process in .

[0072] If the password is managed by the network side, that is, UDM holds the AIoT Password, then UDM will provide the AIoT Password in the query result. Figure 3 The signaling process in .

[0073] In 301, AIoTF requests a service. AIoTF initiates an AIoT service request to Reader (RAN (Radio Access Network) Reader), requests Reader to execute the relevant AIoT service and provides the password corresponding to the AIoT to Reader for AIoT self-verification.

[0074] In 302, the AIoT service is executed. The Reader sends the AIoT request and the AIoT Password to the AIoT terminal at the same time. The AIoT terminal first verifies the password. If the AIoT password verification is successful, the AIoT executes the actual request sent by the Reader.

[0075] In 303, the Reader checks the result. After the AIoT terminal completes the business, the Reader will check or collect the business execution results of the AIoT again. After confirming that the AIoT terminal has successfully executed the relevant business, the Reader will read the password in the AIoT device. Through this method, it can be considered that it is difficult for the AIoT terminal to actively report the execution results. In order to implement operations such as data writing or terminal logout and ensure the smooth execution of the business, the Reader finally confirms whether the AIoT business is successfully executed.

[0076] In 304, the Reader reports the result. The Reader uploads the AIoT service execution result or service data and the read AIoT Password (second password) kept by the AIoT terminal to the AIoTF.

[0077] In 305, the network verifies the password. AIoTF verifies whether the AIoT Password read by the Reader is consistent with the AIoT Password provided by the UDM.

[0078] In 306, the result is returned. After AIoTF verifies that the AIoT Password is consistent, AIoTF reports the AIoT service execution result or service data to the AIoT service requester AF.

[0079] If the password is managed by AF, then in step 207, the query result returned by UDM shows that UDM does not save the AIoT Password, and execute Figure 4 In the signaling process, AIoTF checks whether the AIoT Password is included in the AF request.

[0080] If the AF request does not include AIoT Password, execute 401a; if the AF request includes AIoTPassword, execute 401b.

[0081] In 401a, AIoTF rejects AF's AIoT service request and prompts AF that the request is illegal. The process ends and no subsequent operations are performed.

[0082] In 401b, AIoTF forwards the request of AF to the corresponding Reader to request execution of the service, and executes step 402.

[0083] In 402, the Reader sends the AIoT request and password to the AIoT terminal at the same time. The AIoT terminal first verifies the password. If the AIoT password verification is successful, the AIoT executes the actual request sent by the Reader.

[0084] In 403, the Reader checks the result. After the AIoT completes the business, the Reader will check or collect the business execution results of the AIoT again. After confirming that the AIoT terminal has successfully executed the relevant business, the Reader will read the password in the AIoT terminal.

[0085] In 404, the Reader reports the result. The Reader uploads the service execution result or service data of the AIoT terminal and the read AIoT Password (second password) to the AIoTF.

[0086] In 405, the network verifies the password. AIoTF verifies whether the AIoT Password read by the Reader is consistent with the AIoT Password provided by the AF.

[0087] In 406, the result is returned. After AIoTF verifies that the AIoT Password is consistent, AIoTF reports the AIoT service execution result or service data to the AIoT service requester AF.

[0088] Based on the method in the embodiment shown above, two-way security verification can be achieved. The network first sends a password to AIoT for verification. AIoT will perform the operation only after success. When the business results or data are uploaded, the network collects the password of AIoT and performs a second verification on the network side. Only after the verification is successful can the relevant data of AIoT be transmitted back to the business party AF.

[0089] The IoT service management method disclosed in the present invention also includes preliminary contract configuration operations. In some embodiments, the contract signing process requires the cooperation of BOSS. The NEF network element obtains the authentication information of the AF from the BOSS, and the UDM network element obtains the IoT password information from the BOSS, wherein after the AF signs a contract for IoT network services with the BOSS and provides the IoT password information to the BOSS, the BOSS sends the authentication information of the AF to the NEF network element and sends the IoT password information to the UDM network element. The NEF network element deploys the contract signing and authorization information of the AF based on the authentication information; the UDM network element deploys and generates pre-stored password information based on the IoT password information; the NEF network element and the UDM network element feedback the deployment results to the BOSS. In some embodiments, during the contract signing process, the AF can choose the password management method, including network-side management or self-provided by the AF, so as to improve flexibility.

[0090] The signaling flow chart of some embodiments of the contract configuration process is as follows Figure 5 as shown in .

[0091] In 501, AF signs a contract. AF signs a contract with the operator for AIoT network services, that is, the operator needs to provide network access services to AF and related AIoT terminals. In some embodiments, the operator's BOSS participates in the signing process. BOSS consists of two parts: BSS (Business Support System) and OSS system (Operation Support System). In some embodiments, the present disclosure uses the operator as the business system carrier responsible for signing a contract with the third party AF for AIoT-related services, and is also the dominant party and initiator of the operator's deployment of AIoT-related services.

[0092] In 502, AF provides a password. After signing a contract with the operator (BOSS), AF provides BOSS with the password information corresponding to the contracted AIoT terminal.

[0093] In some embodiments, the AF may provide a corresponding password information table according to requirements, and provide different password information tables for different contract signing methods (password management method, service deployment).

[0094] In 503, AF authorization information is deployed. The operator BOSS deploys the contract and authorization information of the contracted AF to the network side NEF, that is, the server address information and authentication information related to the AF, as well as the corresponding AIoT information and contracted service content.

[0095] In 504, the AIoT password is deployed. The operator BOSS deploys the password information of the AIoT terminal provided by the contracted AF to the UDM side.

[0096] In 505, UDM is deployed. After receiving the password information table of the AIoT terminal provided by the AF, the UDM deploys and saves the table for subsequent AIoT access or service request by the AF.

[0097] In 506, the result is notified. After the deployment is completed, the UDM notifies the actual AIoT terminal of the actual deployment result of the subscription data location information table.

[0098] Through the method in the embodiment shown above, the network can flexibly set policies based on external request identification and configuration policies, thereby improving the network's ability to configure flexible and diverse policies for different external customers, business types, and terminal types, thereby improving the flexibility of the service.

[0099] In some embodiments, the AF network element can sign a contract directly with the NEF, and the AF sends the AF's identification and authentication information and the AIoT password information to the NEF for NEF to save and use. In some embodiments, the NEF network element obtains the authentication information and the IoT password information from the AF network element; the NEF network element deploys the AF's contract and authorization information based on the authentication information; the UDM network element deploys and generates pre-stored password information based on the IoT password information. This method simplifies the system process without the need for BOSS participation.

[0100] In some embodiments, the security policy information mentioned in the above step S12 includes the IoT operation type that requires password verification, and the security policies corresponding to different operation types are stored with the IoT operation type as the index. IoT operation type IoT operation type includes at least one of read, write, enable, disable, register, deregister, activate, deactivate, and inventory. Figure 6 The leftmost table shows:

[0101] •When the AIoT Operation requested by AF is in the table, PCF needs to instruct AIoTF and UDM to trigger the password verification process.

[0102] •The contents of AIoT Operation in this table are the actual business operations of AIoT, such as Read, write, enable, disable, register, deregister, activate, deactivate, inventory, etc.

[0103] •The AIoT business operation table is deployed on the PCF side by default, and as a policy design for AIoT business, it is valid for all AIoT requests.

[0104] In some embodiments, the security policy information includes the identity of the enterprise (organization) that needs to perform password verification. Figure 6 As shown in the second table from left to right, IoT services belonging to the same enterprise have the same security policy.

[0105] In some embodiments, the security policy information includes an identification of an application function that requires password authentication. Figure 6 As shown in the third table from left to right, IoT services belonging to the same AF have the same security policy.

[0106] In some embodiments, the security policy information includes the type of IoT terminal that requires password verification. Figure 6 As shown in the fourth table from left to right, IoT services belonging to the same IoT terminal type have the same security policy.

[0107] In some embodiments, the security policy information includes an identification of the application that requires password authentication. Figure 6 As shown in the rightmost column, IoT services belonging to the same application have the same security policy.

[0108] The above tables 2-5 from left to right involve the actual level of network and AF contract signing. In addition to being deployed in PCF, these tables can also be deployed directly on the UDM side. Therefore, in the above step S12, the AIoTF network element can obtain the verification strategy through interaction with UDM, thereby reducing the processing burden of PCF in the network.

[0109] Taking into account that in actual business deployment, different AFs, different AIoT terminal types, and different enterprises or business types may have different security requirements, the network can customize the AIoT security policy based on the actual AF contract situation, that is, arrange different security policies for different Enterprise IDs, different AF IDs, different APP IDs, and different AIoT terminal types, and decide which specific situations and scenarios need to trigger AIoT password verification based on actual business deployment needs.

[0110] Based on the method in the embodiment shown above, it is possible to consider the level of the actual network and AF contract, reduce the number of entries that need to be stored in the security policy information, improve query efficiency, and achieve management enhancement.

[0111] In some embodiments, the pre-stored password information mentioned in step S14 can be as follows: Figure 7 As shown in, including the information shown in at least one table therein.

[0112] The pre-stored password information includes the association between the identifier of the IoT terminal and the first password. Figure 7 Per-AIoT Device Management shown in the first table from left to right: If the network needs or the AF business needs to manage AIoT devices one by one, then the corresponding network needs to store AIoT IDs and corresponding password information one by one. This solution requires strong storage capacity, but also has the greatest business flexibility and management strength.

[0113] The pre-stored password information includes the association between the enterprise's identification and the first password. The pre-stored password information includes the association between the application's identification and the first password. Figure 7 As shown in the second and third tables from left to right, Per-AIoT Group management: If the network's management needs for AIoT or the actual deployment business needs of AF can be managed by grouping without managing each device, in this case, the network's management of AIoT Password can be solved by grouping. One is to manage through Enterprise ID (usually Enterprise has industry standards and is unified, and different Enterprise IDs represent different enterprises or AIoT businesses), and the other is to manage through APP ID (APP ID is usually designed by third-party enterprises, with relatively high freedom and customization capabilities, and enterprises can also do relevant security design based on APP ID).

[0114] The pre-stored password information includes the association between the identifier of the application function and the first password. Figure 7 As shown in the fourth table from left to right, Per-AF management: Different from the management at the AIoT Device level mentioned above, the management method in this table is AF-oriented, that is, when the AIoT service request is initiated by a specified AF, the network can directly choose to manage the AF at the AIoT Password level, that is, each AIoT password matches the corresponding AF (usually this situation depends on the actual deployment of the AF and can be decided according to the specific situation).

[0115] Based on the methods in the embodiments shown above, passwords can be stored in UDM in a variety of forms, thereby improving the flexibility of password storage, query and management.

[0116] The flowcharts of some embodiments of the IoT service execution method disclosed in the present invention are as follows: Figure 8 As shown, it is executed by the Internet of Things terminal. In some embodiments, the Internet of Things terminal of the present disclosure is a passive Internet of Things terminal. During the execution of the Internet of Things service execution method, the device on the network side executes any one of the Internet of Things service management methods described above.

[0117] In step S81, the IoT terminal obtains an IoT service request and a first password from the network side.

[0118] In step S82, if the first password is verified, the IoT service request is executed and the service execution result is obtained. In some embodiments, the IoT terminal compares the password stored in itself with the first password obtained. If the two match (consistent or meet the predetermined rules), the verification is passed. Otherwise, the verification fails and the service is refused. In some embodiments, if the service is refused, the rejection information can be fed back to the network side so that the network side can respond in time.

[0119] In step S83, the service execution result and the stored second password are fed back to the network side. In some embodiments, the second password is a password kept by the IoT terminal itself.

[0120] Based on the method in the above embodiment, the password provided by the network side can be verified before executing the service, and the password itself can be fed back to the network side after executing the service so that the network side can verify it, thereby realizing two-way security verification for some services with higher requirements, while avoiding the waste of resources caused by security protection for all services, and avoiding excessive burden on the network and passive Internet of Things terminals while improving security.

[0121] Schematic diagrams of some embodiments of the network device disclosed in the present invention are as follows Fig. 9 shown. Fig. 9 The network device shown is an AIoTF network element.

[0122] The request acquisition unit 901 can acquire an AF request for an IoT terminal. In some embodiments, the request acquisition unit 901 can execute any function executed by the AIoTF network element in step S11 above.

[0123] The policy determination unit 902 can obtain the verification policy of the service corresponding to the AF request through the PCF network element. In some embodiments, the policy determination unit 902 can send a query request for the service corresponding to the AF request to the PCF network element, and carry the service identifier in the query request. In some embodiments, the query request can carry one or more of the operation type identifier, the enterprise identifier to which the service belongs, the IoT terminal identifier, and the application identifier. The PCF network element uses the information carried in the query request to query based on the pre-stored security policy information, determine the verification policy of the service, and feed it back to the AIoTF.

[0124] The service request unit 903 can obtain the first password of the service when the authentication policy requires password authentication, and send the IoT service request and the first password to the IoT terminal through the wireless side reader / writer. When the IoT terminal passes the authentication of the first password, it executes the service and feeds back the service execution result and the second password to AIoTF through the wireless side reader / writer.

[0125] The feedback unit 904 can verify the second password, and when the second password is verified successfully, feed back the service execution result or the service data corresponding to the service execution result to the source node of the AF request.

[0126] Based on the network elements in the embodiments shown above, it is possible to query and schedule information on the network side, use AF requests and information stored on the network side to provide verification information for the IoT terminal before service execution, and verify the information provided by the IoT terminal after the service is executed, thereby achieving two-way security verification for some services with higher requirements, while avoiding the waste of resources caused by security protection for all services, and avoiding excessive burden on the network and passive IoT terminals while improving security.

[0127] A structural diagram of an embodiment of the network device disclosed in the present invention is shown in FIG. Fig.10 As shown. The network device of the present disclosure may be any one or more network-side devices mentioned above, or an Internet of Things terminal. The network device includes a memory 1001 and a processor 1002. Among them: the memory 1001 may be a disk, a flash memory, or any other non-volatile storage medium. The memory is used to store instructions in the corresponding embodiments of the Internet of Things business management method or the Internet of Things business execution method mentioned above. The processor 1002 is coupled to the memory 1001 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 1002 is used to execute instructions stored in the memory, and can improve the security of the business within the range that the passive Internet of Things can withstand.

[0128] In one embodiment, it is also possible to Fig.11As shown, the network device 1100 includes a memory 1101 and a processor 1102. The processor 1102 is coupled to the memory 1101 via a BUS 1103. The network device 1100 can also be connected to an external storage device 1105 via a storage interface 1104 to call external data, and can also be connected to a network or another computer system (not shown) via a network interface 1106. No further detailed description will be given here.

[0129] In this embodiment, by storing data instructions in a memory and processing the instructions through a processor, the security of the business can be improved within the range that the passive Internet of Things can bear.

[0130] In another embodiment, a computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the steps of the method in the corresponding embodiment of the networking service management method or the Internet of Things service execution method. It should be understood by those skilled in the art that the embodiments of the present disclosure can be provided as methods, devices, or computer program products. Therefore, the present disclosure can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure can take the form of a computer program product implemented on one or more computer-usable non-transitory storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] Schematic diagrams of some embodiments of the network system disclosed in the present invention are as follows Fig.12 shown.

[0132] AIoTF network element 1201 can be Fig. 9 The network device in the illustrated embodiment can perform any of the functions mentioned above that are performed by the AIoTF network element.

[0133] The NEF network element 1202 can obtain the AF request from the AF network element, and authenticate the authority and AF request of the UDM network element to the AF network element; if the authentication is passed, the AF request is sent to the AIoTF network element;

[0134] PCF network element 1204 can obtain query requests from AIoTF for services corresponding to AF requests; determine the verification strategy for the services based on pre-stored security policy information, and feed it back to the AIoTF network element.

[0135] Based on the network system in the embodiment shown above, it is possible to manage the security verification policy of the Internet of Things service on the network side, provide verification information before the service is executed for the Internet of Things terminal, and verify the information provided by the Internet of Things terminal after the service is executed, thereby realizing two-way security verification for some services with higher requirements, while avoiding the waste of resources caused by security protection for all services, and avoiding excessive burden on the network and passive Internet of Things terminals while improving security.

[0136] In some embodiments, Fig.12 As shown in , the network system of the present disclosure also includes a UDM network element 1203 that can determine the first password according to the request from the AIoTF network element and the pre-stored password information, and feed it back to the AIoTF network element. Such a network system can manage the password of the Internet of Things service on the network side, and improve the management capability and acquisition efficiency of the password.

[0137] In some embodiments, the AIoTF network element 1201 can parse the first password from the AF request when the UDM network element fails to query the first password of the service according to the pre-stored password information. Such a network system can provide two options for the service: network-side management password and AF-side management password, thereby improving the flexibility of the service. In addition, the AIoTF network element 1201 can also reject the AF request and provide a prompt message that the request is illegal when the first password fails to be parsed from the AF request, thereby improving the security of the service.

[0138] In some embodiments, the NEF network element 1202 can also obtain the authentication information of the AF from the BOSS, deploy the signing and authorization information of the AF according to the authentication information, and feedback the deployment result to the BOSS; the UDM network element 1203 can also obtain the Internet of Things password information from the BOSS, deploy and generate pre-stored password information according to the Internet of Things password information, and feedback the deployment result to the BOSS, wherein, after the AF signs the Internet of Things network service with the BOSS and provides the Internet of Things password information to the BOSS, the BOSS sends the authentication information of the AF to the NEF network element, and sends the Internet of Things password information to the UDM network element.

[0139] In some embodiments, the AF network element can sign a contract directly with the NEF, and the AF sends the AF's identification and authentication information and the AIoT password information to the NEF for NEF to save and use. In some embodiments, the NEF network element obtains the authentication information and IoT password information from the AF network element; the NEF network element deploys the AF's contract and authorization information based on the authentication information; the UDM network element deploys and generates pre-stored password information based on the IoT password information, thereby eliminating the need for BOSS participation and simplifying the system process.

[0140] Such a network system can flexibly set policies based on external request identification and configuration policies, improve the network's ability to configure flexible and diverse policies for different external customers, business types, and terminal types, and improve service flexibility.

[0141] Schematic diagrams of other embodiments of the network system disclosed in the present invention are as follows Fig.13 shown.

[0142] AIoT terminal is an IoT device with extremely low energy storage, extremely low power consumption, and no SIM card. It is divided into weak terminals that only support backscatter communication and strong terminals that can support self-generated signals or use backscatter communication based on whether it is equipped with an amplifier. The specific classification of AIoT is as follows:

[0143] Device 1: Peak power consumption is about 1 uW, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, no DL or UL amplification in the device, and the uplink transmission of this device is backscattered on an externally provided carrier;

[0144] Device 2a: less than or equal to a few hundred uW peak power consumption, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, downlink and / or uplink amplification function in the device; the uplink transmission of this device is backscattered on an externally provided carrier;

[0145] Device 2b: less than or equal to a few hundred uW peak power consumption, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, downlink and / or uplink amplification function in the device; the uplink transmission of the device is generated internally by the device;

[0146] RAN Reader, including terminal reading and writing device UE Reader and base station reading and writing device Base Station Reader.

[0147] UDM: Mainly responsible for managing AIoT-related contract data and authentication information, responding to AIoT business requests from AIoTF, and managing password information of contracted AIoT terminals.

[0148] AIoTF network element: responsible for managing the access and service execution of AIoT terminals, discovering and selecting the UE Reader required by the requested AIoT. AIoTMF can send control signaling and transmit / collect data to Reader and AIoT, and can work with UDM / PCF to identify and authenticate the access and services of AIoT, and undertake the password verification function for AIoT devices.

[0149] PCF: Responsible for the policy configuration function of AIoT specific business. Its core function is to configure corresponding policies for the AIoT requested business, determine whether the specific AIoT business needs to trigger the AIoT password verification process, and instruct AIoTF to execute specific related processes.

[0150] NEF: accepts AF's request, and works with UDM to authenticate and authorize AF's permissions and requests, and forwards AF's request to the corresponding AIoTF.

[0151] AIoT AF: A third party responsible for AIoT-related services, which can send AIoT-related information to the network and request the network to perform AIoT-related services, or receive the network's requests for AIoT and provide corresponding data and information. AIoT AF itself can also be the manager and owner of the AIoT password.

[0152] Based on the network system in the embodiment shown in the above text of the present disclosure, it has the function of identifying passive Internet of Things services initiated from the outside and configuring corresponding policies; a variety of policy schemes are derived according to actual business needs and deployment methods, so that the network can flexibly set policies on the basis of identifying and configuring policies for external requests, so that the network can configure flexible and diverse policies for different external customers or business types or terminal types; by using different password storage and management methods, the network can flexibly configure the password information of AIoT according to actual business deployment, contract signing, customer needs, customer types, etc.; two-way security verification for passive Internet of Things terminals is realized, thereby improving the security of passive Internet of Things services.

[0153] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0157] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0158] It should be noted that the terms "first", "second", etc. in the specification, claims, and drawings of the present disclosure are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0159] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present disclosure rather than to limit it. Although the present disclosure has been described in detail with reference to the preferred embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present disclosure can still be modified or some technical features can be replaced by equivalents without departing from the spirit of the technical solution of the present disclosure, which should be included in the scope of the technical solution for protection of the present disclosure.

Claims

1. A method for managing Internet of Things services, comprising: The passive IoT function AIoTF network element obtains the application function AF request for the IoT terminal; The AIoTF obtains the verification policy of the service corresponding to the AF request through the policy control function PCF network element according to the AF request; In the case where the verification strategy requires password verification, the AIoTF network element obtains the first password of the service, and sends an IoT service request and the first password to the IoT terminal through a wireless side reader / writer, wherein the IoT terminal executes the service when the first password is verified, and feeds back the service execution result and the second password to the AIoTF network element through the wireless side reader / writer; When the second password is verified successfully, the AIoTF network element feeds back the service execution result or the service data corresponding to the service execution result to the source node of the AF request.

2. The management method according to claim 1, further comprising: The network opening function NEF network element and the unified data management function UDM network element authenticate the AF request from the AF network element and the authority of the AF network element; When the authentication is successful, the AF request is sent to the AIoTF network element so that the AIoTF network element can perform the operation of obtaining the AF request for the Internet of Things terminal.

3. The management method according to claim 1, wherein: The verification strategy of the AIoTF network element obtaining the service corresponding to the AF request through the PCF network element includes: The AIoTF network element sends a query request for the service corresponding to the AF request to the PCF network element; The PCF network element determines the verification strategy of the service based on the pre-stored security policy information and feeds it back to the AIoTF network element.

4. The management method according to claim 3, wherein: The security policy information includes at least one of the following: The type of IoT operation that requires password verification, wherein the IoT operation type includes at least one of read, write, enable, disable, register, deregister, activate, deactivate, and inventory; The identification of the enterprise requiring password verification; Identification of application functions that require password authentication; The type of IoT terminal that requires password authentication; The ID of the application that requires password authentication.

5. The management method according to claim 1, wherein: The AIoTF network element obtains the first password of the service including: The AIoTF network element requests the first password of the service from the UDM network element; The UDM network element determines the first password based on the pre-stored password information and feeds it back to the AIoTF network element.

6. The management method according to claim 5, wherein: The AIoTF network element obtains the first password of the service further comprising: In the case where the UDM network element fails to query the first password of the service according to the pre-stored password information, The AIoTF network element parses the first password from the AF request.

7. The management method according to claim 6, wherein: The AIoTF network element obtains the first password of the service further comprising: When the UDM network element fails to query the first password of the service according to the pre-stored password information, and the AIoTF network element fails to parse the first password from the AF request, The AIoTF network element rejects the AF request and provides a prompt message that the request is illegal.

8. The management method according to claim 2, further comprising: The NEF network element obtains the authentication information of the AF from the business operation support system BOSS, and the UDM network element obtains the IoT password information from the BOSS. Wherein, after the AF signs an Internet of Things network service with the BOSS and provides the BOSS with Internet of Things password information, the BOSS sends the authentication information of the AF to the NEF network element and sends the Internet of Things password information to the UDM network element; The NEF network element deploys the subscription and authorization information of the AF according to the authentication information; The UDM network element deploys and generates pre-stored password information according to the IoT password information; The NEF network element and the UDM network element feed back deployment results to the BOSS.

9. The management method according to claim 2, further comprising: The NEF network element obtains the authentication information and IoT password information from the AF network element; The NEF network element deploys the subscription and authorization information of the AF according to the authentication information; The UDM network element deploys and generates pre-stored password information according to the Internet of Things password information.

10. The management method according to claim 6 or 9, wherein: The pre-stored password information includes at least one of the following: an association between the identifier of the IoT terminal and the first password; The association between the enterprise's identification and the first password; an association between the identifier of the application and the first password; The association relationship between the identifier of the application function and the first password.

11. The management method according to claim 1, wherein: When the AIoTF network element determines that the second password is the same as the first password, the second password is verified.

12. The management method according to claim 1, wherein: The method meets at least one of the following requirements: The Internet of Things is a passive Internet of Things; The wireless side reading and writing device includes at least one of a terminal reading and writing device and a base station reading and writing device.

13. A method for executing an Internet of Things service, executed by an Internet of Things terminal, comprising: Obtaining the IoT service request and the first password from the network side; If the first password is verified successfully, executing the IoT service request and obtaining a service execution result; The service execution result and the stored second password are fed back to the network side, wherein the device on the network side executes at least one of the methods described in claims 1 to 12.

14. A network device comprising: A request acquisition unit, configured to acquire an application function AF request for an IoT terminal; A policy determination unit, configured to obtain, according to the AF request, a verification policy for the service corresponding to the AF request through a policy control function PCF network element; The service request unit is configured to obtain the first password of the service when the verification policy requires password verification, and send the Internet of Things service request and the first password to the Internet of Things terminal through the wireless side reading and writing device, wherein the Internet of Things terminal executes the service when the first password is verified, and feeds back the service execution result and the second password to the network device through the wireless side reading and writing device; The feedback unit is configured to feed back the service execution result or the service data corresponding to the service execution result to the source node of the AF request when the second password is verified successfully.

15. A network device comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method according to any one of claims 1 to 13 based on instructions stored in the memory.

16. A computer-readable storage medium having computer instructions stored thereon, wherein the instructions, when executed by a processor, implement the method according to any one of claims 1 to 13.

17. A computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the method according to any one of claims 1 to 13 is implemented.

18. A network system comprising: A passive Internet of Things function AIoTF network element, configured to perform the method according to claim 1; The network open function NEF network element is configured as follows: Obtain the AF request from the AF network element, and authenticate the authority of the unified data management function UDM network element to the AF network element and the AF request; if the authentication is successful, send the AF request to the AIoTF network element; The policy control function (PCF) network element is configured as follows: Obtaining a query request from the AIoTF network element for the service corresponding to the AF request; According to the pre-stored security policy information, the verification strategy of the service is determined and fed back to the AIoTF network element.

19. The network system according to claim 18, further comprising: The UDM network element is configured to determine the first password according to a request from the AIoTF network element and pre-stored password information, and feed it back to the AIoTF network element.

20. The network system according to claim 18, wherein: The AIoTF network element is further configured to parse the first password from the AF request when the UDM network element fails to query the first password of the service according to the pre-stored password information; In the case where parsing the first password from the AF request fails, the AF request is rejected and a prompt message indicating that the request is illegal is provided.

21. The network system according to claim 19, wherein: The NEF network element is further configured to: obtain authentication information of the AF network element, and deploy the contract and authorization information of the AF according to the authentication information; The UDM network element is also configured to: obtain the Internet of Things password information of the AF network element, and deploy and generate pre-stored password information based on the Internet of Things password information.

Images