Iot service management, execution method, network device and system

Abstract

The present disclosure provides an Internet of Things service management and execution method, network device and system, and relates to the technical field of Internet of Things. The Internet of Things service management method of the present disclosure comprises: a passive Internet of Things function AIoTF network element obtaining an application function AF request for an Internet of Things terminal; the AIoTF network element obtaining a verification policy of a service corresponding to the AF request through a policy control function PCF network element; in the case that the verification policy is a password verification, the AIoTF network element obtains a first password of the service and sends an Internet of Things service request and the first password to the Internet of Things terminal through a wireless side read-write device, wherein the Internet of Things terminal executes the service in the case that the first password is verified, and feeds back the service execution result and a second password to the AIoTF network element through the wireless side read-write device; and the AIoTF network element feeds back the service execution result or service data corresponding to the service execution result to a source node of the AF request in the case that the second password is verified.

Description

Technical Field

[0001] This disclosure relates to the field of Internet of Things (IoT) technology, and in particular to an IoT business management, execution method, network device, and system. Background Technology

[0002] Passive IoT differs from traditional IoT in that it maintains device operation by collecting micro-energy from the environment, such as radio wave energy, heat energy, and vibration energy. It offers advantages such as no need for built-in batteries, low cost, and flexible deployment. The emergence of passive IoT is of great significance in areas such as logistics tracking, environmental monitoring, and building automation.

[0003] According to 3GPP's existing definition of AIoT (Ambient IoT) terminals, an AIoT terminal is an IoT device with extremely low energy storage, extremely low power consumption, and no SIM card. Based on whether it has an amplifier, it is divided into weak terminals that only support backscatter communication and strong terminals that can generate signals on their own or use backscatter communication.

[0004] Although power limitations restrict application functionality, passive IoT can still perform various types of tasks, such as reading, writing, logging off, and permanent logging off. Summary of the Invention

[0005] One objective of this disclosure is to improve business security within the limits of what passive Internet of Things (IoT) can handle.

[0006] According to one aspect of some embodiments of this disclosure, an Internet of Things (IoT) service management method is proposed, executed by a network-side device, comprising: an AIoTF (Ambient IoT Function) network element acquiring an AF (Application Function) request for an IoT terminal; the AIoTF network element acquiring, based on the AF request, an authentication policy for the service corresponding to the AF request through a PCF (Policy Control Function) network element; if the authentication policy requires password verification, the AIoTF network element acquiring a first password for the service and sending the IoT service request and the first password to the IoT terminal through a wireless reading / writing device; wherein, if the IoT terminal successfully verifies the first password, it executes the service and feeds back the service execution result and the second password to the AIoTF network element through the wireless reading / writing device; if the AIoTF network element successfully verifies the second password, it feeds back the service execution result or the service data corresponding to the service execution result to the source node of the AF request.

[0007] In some embodiments, the method further includes: obtaining an AF request from an AF network element; authenticating the permissions of the AF network element and the AF request by the NEF (Network Exposure Function) network element and the UDM (Unified Data Management) network element; and, if the authentication is successful, sending the AF request to the AIoTF network element to perform the operation of the AIoTF network element obtaining the AF request for the IoT terminal.

[0008] In some embodiments, the AIoTF network element obtains the verification strategy of the service corresponding to the AF request through the PCF network element, including: the AIoTF network element sending a query request for the service corresponding to the AF request to the PCF network element; the PCF network element determining the verification strategy of the service according to the pre-stored security policy information and feeding it back to the AIoTF network element.

[0009] In some embodiments, the security policy information includes at least one of the following: the type of IoT operation requiring password verification, which includes at least one of read, write, enable, disable, register, deregister, activate, deactivate, and inventory; the identifier of the enterprise requiring password verification; the identifier of the application function requiring password verification; the type of IoT terminal requiring password verification; and the identifier of the application requiring password verification.

[0010] In some embodiments, the process of an AIoTF network element obtaining a first password for a service includes: the AIoTF network element requesting a first password for the service from a UDM network element; and the UDM network element determining the first password based on pre-stored password information and feeding it back to the AIoTF network element.

[0011] In some embodiments, the AIoTF network element obtaining the first password for the service further includes: if the UDM network element fails to query the first password for the service based on the pre-stored password information, the AIoTF network element parses the first password from the AF request.

[0012] In some embodiments, the AIoTF network element obtaining the first password for the service further includes: if the UDM network element fails to query the first password for the service based on the pre-stored password information, and the AIoTF network element fails to parse the first password from the AF request, the AIoTF network element rejects the AF request and provides a message indicating that the request is invalid.

[0013] In some embodiments, the method further includes: the NEF network element obtaining authentication information from the AF (Agent Authentication Center) of the BOSS (Business Operation Support System), and the UDM network element obtaining IoT password information from the BOSS. Specifically, after the AF subscribes to IoT network services with the BOSS and provides IoT password information to the BOSS, the BOSS sends the AF's authentication information to the NEF network element and the IoT password information to the UDM network element; the NEF network element deploys the AF's subscription and authorization information based on the authentication information; the UDM network element deploys and generates pre-stored password information based on the IoT password information; and the NEF network element and the UDM network element report the deployment results back to the BOSS.

[0014] In some embodiments, the method further includes: the NEF network element obtaining authentication information and IoT cryptographic information from the AF network element; the NEF network element deploying the AF's signing and authorization information based on the authentication information; and the UDM network element deploying pre-stored cryptographic information based on the IoT cryptographic information.

[0015] In some embodiments, the pre-stored password information includes at least one of the following: the association between the identifier of the IoT terminal and the first password; the association between the identifier of the enterprise and the first password; the association between the identifier of the application and the first password; and the association between the identifier of the application function and the first password.

[0016] In some embodiments, the AIoTF network element verifies the second password if it determines that the second password is the same as the first password.

[0017] In some embodiments, the method conforms to at least one of the following: the Internet of Things is a passive Internet of Things; the wireless side read / write device includes at least one of a terminal read / write device and a base station read / write device.

[0018] According to one aspect of some embodiments of this disclosure, an Internet of Things (IoT) service execution method is proposed, executed by an IoT terminal device, comprising: obtaining an IoT service request and a first password from a network side; executing the IoT service request and obtaining a service execution result if the first password is verified; and feeding back the service execution result and a stored second password to the network side, wherein the device on the network side executes any of the IoT service management methods described above.

[0019] According to one aspect of some embodiments of this disclosure, a network device is proposed, comprising: a request acquisition unit configured to acquire an AF request for an Internet of Things (IoT) terminal; a policy determination unit configured to acquire an authentication policy for a service corresponding to the AF request through a PCF network element; a service request unit configured to acquire a first password for the service if the authentication policy requires password authentication, and send an IoT service request and the first password to the IoT terminal through a wireless side read / write device, wherein the IoT terminal executes the service if the first password is successfully authenticated, and feeds back the service execution result and the second password to the AIoTF network element through the wireless side read / write device; and a feedback unit configured to feed back the service execution result or service data corresponding to the service execution result to the source node of the AF request if the second password is successfully authenticated.

[0020] According to one aspect of some embodiments of this disclosure, a network device is provided, including: a memory; and a processor coupled to the memory, the processor being configured to execute any of the methods mentioned above based on instructions stored in the memory.

[0021] According to one aspect of some embodiments of the present disclosure, a computer-readable storage medium is provided having computer instructions stored thereon that, when executed by a processor, implement any of the methods mentioned above.

[0022] According to one aspect of some embodiments of this disclosure, a computer program product is proposed, including a computer program or instructions that, when executed by a processor, implement any of the methods mentioned above.

[0023] According to one aspect of some embodiments of this disclosure, a network system is proposed, comprising: an AIoTF network element configured to perform operations executed by the AIoTF network element in the IoT service management method described above; a NEF network element configured to: obtain an AF request from an AF network element and authenticate the permissions of the UDM network element to the AF network element and the AF request; and, if the authentication is successful, send the AF request to the AIoTF network element; and a PCF network element configured to: obtain a query request from the AIoTF network element for a service corresponding to the AF request; determine a service verification policy based on pre-stored security policy information and feed it back to the AIoTF network element.

[0024] In some embodiments, the network system further includes: a UDM network element configured to determine a first password based on pre-stored password information according to a request from an AIoTF network element, and to feed it back to the AIoTF network element.

[0025] In some embodiments, the AIoTF network element is further configured to parse the first password from the AF request if the UDM network element fails to query the first password for the service based on the pre-stored password information; and to reject the AF request and provide an invalid request message if the parse of the first password from the AF request fails.

[0026] In some embodiments, the NEF network element is further configured to: obtain the authentication information of the AF network element and deploy the AF's subscription and authorization information based on the authentication information; the UDM network element is further configured to: obtain the IoT password information of the AF network element and deploy the generated pre-stored password information based on the IoT password information. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of this disclosure and are used to explain this disclosure, but do not constitute an undue limitation of this disclosure.

[0028] Figure 1 Flowcharts showing some embodiments of the IoT business management method disclosed herein.

[0029] Figure 2 This is a signaling flowchart of some embodiments of the IoT service management method disclosed herein.

[0030] Figure 3 Signaling flowcharts for some other embodiments of the IoT service management method disclosed herein.

[0031] Figure 4 This is a signaling flowchart of some embodiments of the IoT service management method disclosed herein.

[0032] Figure 5 This is a signaling flowchart of some embodiments of the IoT service management method disclosed herein.

[0033] Figure 6 This is a schematic diagram of some embodiments of the PCF storage security policy information in the IoT business management method disclosed herein.

[0034] Figure 7 These are schematic diagrams illustrating some embodiments of the cryptographic information pre-stored in the Internet of Things (IoT) business management method disclosed herein.

[0035] Figure 8 Flowcharts are provided for some embodiments of the IoT service execution method disclosed herein.

[0036] Figure 9 These are schematic diagrams illustrating some embodiments of the network devices disclosed herein.

[0037] Figure 10These are schematic diagrams illustrating other embodiments of the network devices disclosed herein.

[0038] Figure 11 These are schematic diagrams illustrating further embodiments of the network devices disclosed herein.

[0039] Figure 12 This is a schematic diagram of some embodiments of the network system disclosed herein.

[0040] Figure 13 These are schematic diagrams illustrating other embodiments of the network system disclosed herein. Detailed Implementation

[0041] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments.

[0042] The inventors discovered that due to the different business characteristics of passive IoT (such as read-only, write-only, logout, permanent logout, etc.), different businesses may have different security requirements. However, ensuring the security of these businesses places significant pressure on passive IoT and passive IoT terminals.

[0043] To address the aforementioned issues, this disclosure proposes an IoT service management and execution method, network equipment, and system that provides security assurance for certain high-requirement services while avoiding the waste of resources caused by providing security assurance for all services and preventing excessive burden on the network and passive IoT terminals.

[0044] Flowcharts of some embodiments of the IoT service management method disclosed herein are as follows: Figure 1 As shown, the method is executed by a network-side device and includes steps S11-S16. In some embodiments, the Internet of Things (IoT) of this disclosure is a passive IoT, the IoT terminal is a passive IoT terminal, and the IoT AF is a passive IoT AF.

[0045] In step S11, the AIoTF network element obtains an AF request for the IoT terminal. In some embodiments, the AF request is issued by the IoT AF network element and reaches the AIoTF network element through the interface core network device.

[0046] In some embodiments, before step S11, the method further includes: obtaining an AF request from an AF network element; authenticating the permissions of the AF network element and the AF request by the NEF network element and the UDM network element; and, if the authentication is successful, sending the AF request to the AIoTF network element to trigger the execution of step S11. This method allows for the authentication of the AF request before proceeding with subsequent processing, reducing the probability of invalid subsequent operations.

[0047] In step S12, the AIoTF network element obtains the verification policy of the service corresponding to the AF request through the PCF network element. The PCF network element stores security policy information for various IoT services.

[0048] In some embodiments, the AIoTF can parse the AF request, obtain its content, and send a query request for the service corresponding to the AF request to the PCF network element based on the content. The query request carries a service identifier. In some embodiments, the query request may carry one or more of the following: operation type identifier, service-owning enterprise identifier, IoT terminal identifier, and application identifier. The PCF network element uses the information carried in the query request to perform a query based on pre-stored security policy information, determines the service verification policy, and feeds it back to the AIoTF network element.

[0049] In step S13, if the verification strategy fed back by the PCF requires password verification, then step S14 is executed; otherwise, the corresponding IoT service is executed through a process that does not require password verification, using the methods in related technologies.

[0050] In step S14, the AIoTF network element obtains the first password for the service and sends the IoT service request and the first password to the IoT terminal through the wireless side read / write device. In some embodiments, the IoT service request can be generated based on the AF request, or the AF request itself can be used as the IoT service request.

[0051] In some embodiments, the wireless-side read / write device may include a base station read / write device located on the network side and a terminal read / write device located on the terminal. After receiving an IoT service request and a first password, the IoT terminal verifies the first password using its own stored password. If the first password verification is successful, the terminal executes the service corresponding to the IoT service request and feeds back the service execution result and the second password (which is the password stored by the IoT terminal itself) to the AIoTF network element via the wireless-side read / write device.

[0052] In some embodiments, the first password can be stored by the UDM network element, and the AIoTF network element requests the first password for the service from the UDM network element; the UDM network element determines the first password based on the pre-stored password information and feeds it back to the AIoTF network element to obtain the first password.

[0053] In some embodiments, the first password mentioned above can be stored by the AF network element and sent to the AIoTF network element via an AF request.

[0054] In some embodiments, the AIoTF network element can first send a request to the UDM network element. If the UDM responds with a first password, the operation of sending the IoT service request and the first password to the IoT terminal via the wireless side read / write device is executed. If the UDM does not respond with a first password, it checks whether the AF request carries the first password, and uses the first password carried in the AF request to send the IoT service request and the first password to the IoT terminal via the wireless side read / write device. This method can increase the probability of obtaining the first password.

[0055] In some embodiments, if the first password cannot be obtained from either the UDM or AF request, the AF request is rejected, and the corresponding AF network element is notified that the AF request is illegitimate. This method can improve the security of IoT services, promptly intercept illegitimate requests, and reduce the probability of subsequent invalid operations.

[0056] After successfully verifying the first password, the IoT terminal executes the service and feeds back the service execution result and the second password to the AIoTF network element via a wireless reading and writing device. In some embodiments, the wireless reading and writing device actively reads the service execution result generated by the IoT terminal and the second password stored in the IoT terminal, thereby eliminating the need for the IoT terminal to have an active reporting function and ensuring smooth service execution.

[0057] The IoT terminal disclosed herein possesses a device identifier, which includes identifiers defined by 3GPP. Optionally, it may also include application-defined identifiers / application identifiers (defined by a third-party service). The 3GPP-defined identifiers include a home network identifier, an enterprise identifier, and an instance identifier. The home network identifier includes MCC (Mobile Country Code) + MCN (Mobile Network Code) and also includes a PLMN (Public Land Mobile Network) identifier. The enterprise identifier is service provider information, public platform information, or manufacturer information. The instance identifier is an AIoT device identifier located within the network (similar to a unique network identifier for a mobile phone number).

[0058] The IoT terminal stores a password. It determines whether authentication is successful by matching a first password with its own stored password. If the password stored in the IoT terminal matches the first password (e.g., they are identical or the relationship between them conforms to a predetermined rule), authentication is successful, and the service can be executed. If the password stored in the IoT terminal does not match the first password, authentication fails, and the service is refused. In some embodiments, the IoT terminal can remain silent and not respond to IoT service requests for refused services, thereby reducing energy consumption.

[0059] In step S15, the AIoTF network element receives the service execution result and the second password transmitted by the wireless side read / write device, and verifies the second password. If the verification passes, step S16 is executed. In some embodiments, if the verification fails, the result reporting process fails verification, preventing result feedback.

[0060] In some embodiments, the AIoTF network element can compare the first password obtained in the preceding process (managed and provided by UDM or AF) with the second password (managed and provided by IoT terminal). If the two match (they are the same or the relationship between the two conforms to a predetermined rule), the second password is verified; otherwise, the verification is considered to have failed.

[0061] In step S16, the business execution result or the business data corresponding to the business execution result is fed back to the source node of the AF request.

[0062] Based on the method in the above embodiments, it is possible to provide IoT terminals with verification information before business execution and to verify the information provided by IoT terminals after business execution. This enables two-way security verification for some high-requirement businesses, while avoiding the waste of resources caused by providing security for all businesses. This improves security while avoiding placing an excessive burden on the network and passive IoT terminals.

[0063] In some embodiments, the above Figure 1 The signaling flowchart of the IoT service management method shown is as follows: Figure 2 As shown in the image.

[0064] In step 201, the AIoT AF network element initiates an AF request to the network for the contracted AIoT terminal, requesting the network to perform specific operations on the AIoT terminal.

[0065] In 202, NEF and UDM authenticate and authorize AF permissions and AF requests.

[0066] In 203, the NEF will forward the authorized AF request to the corresponding AIoTF.

[0067] In 204, the AF request is identified. After receiving the AF request forwarded by the NEF, the AIoTF requests the PCF to provide the policy configuration for the AIoT service, that is, to query whether the AIoT service requires AIoT password verification.

[0068] In step 205, the PCF result is returned. The PCF issues the policy result regarding whether password verification is required for this AIoT service.

[0069] In section 206, the AIoTF requests a password. When the PCF instructs the AF to send an AIoT service request that requires password verification, the AIoTF requests the UDM to query the password for that AIoT, and to check whether the UDM contains the AIoT Password (first password) corresponding to that AIoT ID.

[0070] In 207, UDM returns the query results to AIoTF.

[0071] Furthermore, the execution is determined based on whether the query results returned by UDM include the AIoT Password. Figure 3 or Figure 4 The signaling process in the process.

[0072] If the password is managed by the network side, meaning the UDM holds the AIoT password, then the UDM will provide the AIoT password in the query results and execute the command. Figure 3 The signaling process in the process.

[0073] In section 301, the AIoTF requests a service. The AIoTF initiates an AIoT service request to the Reader (RAN (Radio Access Network) Reader), requesting the Reader to execute the relevant AIoT service and simultaneously providing the Reader with the corresponding password for the AIoT to verify itself.

[0074] In 302, AIoT service execution begins. The Reader sends the AIoT request and AIoT password to the AIoT terminal simultaneously. The AIoT terminal first verifies the password. If the password verification is successful, the AIoT terminal executes the actual request sent by the Reader.

[0075] In 303, the Reader checks the result. After the AIoT terminal completes its business process, the Reader checks or collects the business execution result again. After confirming that the AIoT terminal has successfully executed the relevant business, the Reader reads the password stored in the AIoT device. This method takes into account the difficulty for AIoT terminals to actively report execution results. To enable operations such as data writing or terminal deregistration, and to ensure smooth business execution, the Reader provides a final confirmation of whether the AIoT business has been successfully executed.

[0076] In 304, the Reader reports the results. The Reader uploads the AIoT business execution results or business data, along with the AIoT Password (secondary password) stored by the AIoT terminal, to AIoTF.

[0077] In step 305, the network verifies the password. AIoTF verifies whether the AIoT Password read by the Reader matches the AIoT Password provided by the UDM.

[0078] In 306, the result is returned. After AIoTF verifies that the AIoT Password matches, AIoTF will report the AIoT service execution result or service data to the AIoT service requester AF.

[0079] If the password is managed by AF, then in step 207 above, the query result returned by UDM shows that UDM has not saved the AIoT Password, and the execution... Figure 4 In the signaling process, AIoTF checks whether the AF request contains the AIoT Password.

[0080] If the AF request does not contain the AIoT Password, execute 401a; if the AF request contains the AIoT Password, execute 401b.

[0081] In 401a, AIoTF rejects AF's AIoT service request and notifies AF that the request is illegal, the process ends, and no further operations are performed.

[0082] In 401b, AIoTF forwards the AF's request to the corresponding Reader to request the execution of the business, and executes step 402.

[0083] In a 402 error, the Reader sends the AIoT request and password to the AIoT terminal simultaneously. The AIoT terminal first verifies the password. If the AIoT password verification is successful, the AIoT terminal executes the actual request sent by the Reader.

[0084] In a 403 error, the Reader checks the results. After the AIoT terminal completes its service execution, the Reader will check or collect the results again. Once it confirms that the AIoT terminal has successfully executed the relevant service, the Reader will read the password stored in the AIoT terminal.

[0085] In a 404 error, the Reader reports the results. The Reader uploads the business execution results or business data from the AIoT terminal, along with the read AIoT Password (secondary password), to AIoTF.

[0086] In 405, the network verifies the password. AIoTF verifies whether the AIoT Password read by the Reader matches the AIoT Password provided by AF.

[0087] In 406, the result is returned. After AIoTF verifies that the AIoT Password matches, AIoTF will report the AIoT service execution result or service data to the AIoT service requester AF.

[0088] Based on the method in the above embodiment, two-way security verification can be achieved. The network first sends the password to AIoT for verification. Only after successful verification will AIoT execute the operation. When the business result or data is uploaded, the network collects the password of AIoT and performs a second verification on the network side. Only after successful verification can the relevant data of AIoT be transmitted back to the business AF.

[0089] The IoT service management method disclosed herein also includes preliminary subscription and configuration operations. In some embodiments, the subscription process requires the cooperation of the BOSS. The NEF network element obtains the AF authentication information from the BOSS, and the UDM network element obtains the IoT password information from the BOSS. Specifically, after the AF subscribes to the IoT network service with the BOSS and provides the IoT password information to the BOSS, the BOSS sends the AF authentication information to the NEF network element and the IoT password information to the UDM network element. The NEF network element deploys the AF's subscription and authorization information based on the authentication information; the UDM network element deploys and generates pre-stored password information based on the IoT password information; the NEF network element and the UDM network element report the deployment results back to the BOSS. In some embodiments, during the subscription process, the AF can choose the password management method, including network-side management or AF-provided passwords, thereby improving flexibility.

[0090] Signaling flowcharts for some embodiments of the subscription configuration process are as follows: Figure 5 As shown in the image.

[0091] In Section 501, the AF (Asynchronous Attachment) signs an agreement. The AF signs an agreement with the operator for AIoT network services, meaning the operator needs to provide network access services to the AF and related AIoT terminals. In some embodiments, the operator's BOSS (Business Support System) participates in the signing process. The BOSS consists of two parts: the BSS and the OSS (Operation Support System). In some embodiments, this disclosure describes the operator as the business system provider responsible for signing AIoT-related business agreements with third-party AFs, and also as the leading party and initiator of the operator's deployment of AIoT-related businesses.

[0092] In a 502 error, the AF provides the password. After signing a contract with the operator (BOSS), the AF provides the BOSS with the password information corresponding to the contracted AIoT terminal.

[0093] In some embodiments, AF can provide corresponding password information tables as needed. Different password information tables are provided depending on the contract method (password management method, business deployment).

[0094] In 503, the AF authorization information is deployed. The operator's BOSS deploys the signing and authorization information of the signed AF to the network-side NEF, namely the server address information and authentication information related to the AF, as well as the corresponding AIoT information and signed service content.

[0095] In the 504 error, AIoT ciphers are deployed. The operator's BOSS deploys the cipher information of the AIoT terminals provided by the contracted AF to the UDM side.

[0096] In 505, UDM is deployed. After receiving the password information table of AIoT terminals provided by AF, UDM deploys and saves the table for subsequent access by AIoT devices in the table or for requests to services from AF.

[0097] In step 506, result notification occurs. After deployment, the UDM notifies the actual AIoT terminal of the deployment results of its subscription data location information table.

[0098] By using the methods in the embodiments shown above, the network can flexibly set policies based on the identification and configuration of external requests, thereby improving the network's ability to configure flexible and diverse policies for different external customers, service types, and terminal types, and enhancing the flexibility of services.

[0099] In some embodiments, the AF network element can directly sign an agreement with the NEF, sending its identification and authentication information and AIoT cryptographic information to the NEF for storage and use. In some embodiments, the NEF network element obtains the authentication information and IoT cryptographic information from the AF network element; the NEF network element deploys the AF's signing and authorization information based on the authentication information; and the UDM network element deploys and generates pre-stored cryptographic information based on the IoT cryptographic information. This method simplifies the system process without the need for a BOSS (Browser Controller).

[0100] In some embodiments, the security policy information mentioned in step S12 above includes IoT operation types that require password verification, and the security policies corresponding to different operation types are stored using IoT operation types as indexes. IoT operation types include at least one of read, write, enable, disable, register, deregister, activate, deactivate, and inventory. For example... Figure 6 The leftmost table is shown below:

[0101] • When the AIoT Operation requested by the AF is in the table, the PCF needs to instruct the AIoTF and UDM to trigger the password verification process.

[0102] • The AIoT Operations listed in this table are the actual business operations of AIoT, such as Read, write, enable, disable, register, deregister, activate, deactivate, inventory, etc.

[0103] • The AIoT service operation table is deployed on the PCF side by default, and as a strategy design for AIoT services, it is effective for all AIoT requests.

[0104] In some embodiments, security policy information includes the identifier of the enterprise (organization) that requires password verification. For example... Figure 6 The second table from the left shows that IoT businesses belonging to the same company have the same security policies.

[0105] In some embodiments, security policy information includes identifiers of application functions that require password verification. For example... Figure 6 The third table from the left shows that IoT services belonging to the same AF have the same security policy.

[0106] In some embodiments, security policy information includes the types of IoT terminals that require password authentication. For example... Figure 6 As shown in the fourth table from the left, IoT services belonging to the same IoT terminal type have the same security policy.

[0107] In some embodiments, security policy information includes the identifier of the application that requires password verification. For example... Figure 6 As shown in the rightmost column, IoT services belonging to the same application have the same security policy.

[0108] The tables 2-5 from left to right above relate to the actual network and AF contract signing level. These tables can be deployed in the PCF or directly on the UDM side. Thus, in step S12 above, the AIoTF network element can obtain the verification policy through interaction with the UDM, reducing the processing burden of the PCF in the network.

[0109] Considering that different AFs, different AIoT terminal types, and different enterprise or business types may have different security requirements in actual business deployments, the network can customize the AIoT security policy according to the actual AF subscription situation. That is, different security policies can be arranged for different Enterprise IDs, different AF IDs, different APP IDs, and different AIoT terminal types. The network can determine the specific situations and scenarios in which password verification of AIoT needs to be triggered based on the actual business deployment needs.

[0110] Based on the method in the embodiments shown above, it is possible to reduce the number of entries that need to be stored in the security policy information, improve query efficiency, and achieve enhanced management from the perspective of actual network and AF contract signing.

[0111] In some embodiments, the pre-stored password information mentioned in step S14 above can be as follows: Figure 7 As shown, including information shown in at least one of the tables.

[0112] The pre-stored password information includes the association between the IoT terminal's identifier and the initial password. For example... Figure 7 The first table from left to right shows Per-AIoT Device Management: If the network or AF services require management of each AIoT device individually, then the network needs to store the AIoT ID and corresponding password information for each device. This solution requires significant storage capacity, but also offers the greatest flexibility and management complexity.

[0113] The pre-stored password information includes the association between the enterprise's identifier and the primary password. The pre-stored password information also includes the association between the application's identifier and the primary password. For example... Figure 7 The second and third tables from left to right show Per-AIoT Group management: If the network's AIoT management needs or the actual deployment requirements of AF can be managed through grouping instead of managing each device individually, then the network's AIoT Password management can be solved through grouping. One approach is to manage it through Enterprise ID (which typically has industry standards and uniformity; different Enterprise IDs represent different enterprises or AIoT services). The other approach is to manage it through APP ID (APP IDs are usually designed by third-party companies, offering relatively high flexibility and customization capabilities; companies can also implement related security designs based on APP IDs).

[0114] The pre-stored password information includes the association between the application function identifier and the primary password. For example... Figure 7 The fourth table from left to right shows Per-AF management: Unlike the management at the AIoT Device level mentioned above, the management method in this table is AF-oriented. That is, when the AIoT service request is initiated by a specified AF, the network can directly select to manage the AF at the AIoT Password level. In other words, each AIoT password matches the corresponding AF (this situation usually depends on the actual deployment of the AF and can be determined according to the specific circumstances).

[0115] Based on the methods in the embodiments shown above, passwords can be stored in UDM in various forms, thereby improving the flexibility of password storage, retrieval and management.

[0116] Flowcharts of some embodiments of the IoT service execution method disclosed herein are as follows: Figure 8 As shown, this is executed by an IoT terminal. In some embodiments, the IoT terminal of this disclosure is a passive IoT terminal. During the execution of the IoT service execution method, the network-side device executes any of the IoT service management methods described above.

[0117] In step S81, the IoT terminal obtains the IoT service request and the first password from the network side.

[0118] In step S82, if the first password verification is successful, the IoT service request is executed, and the service execution result is obtained. In some embodiments, the IoT terminal compares its stored password with the obtained first password. If they match (are consistent or conform to predetermined rules), the verification is successful; otherwise, the verification fails, and the service execution is refused. In some embodiments, if the service execution is refused, a rejection message can be sent to the network side so that the network side can react promptly.

[0119] In step S83, the business execution result and the stored second password are fed back to the network side. In some embodiments, the second password is a password kept by the IoT terminal itself.

[0120] Based on the method in the above embodiments, the password provided by the network side can be verified before the business is executed, and the password can be fed back to the network side after the business is executed so that the network side can verify it. This enables two-way security verification for some high-requirement businesses, while avoiding the waste of resources caused by providing security for all businesses. This improves security and avoids putting too much burden on the network and passive IoT terminals.

[0121] Schematic diagrams of some embodiments of the network devices disclosed herein are shown below. Figure 9 As shown. Figure 9 The network device shown is an AIoTF network element.

[0122] The request acquisition unit 901 is capable of acquiring AF requests for IoT terminals. In some embodiments, the request acquisition unit 901 can perform any of the functions executed by the AIoTF network element in step S11 above.

[0123] The policy determination unit 902 can obtain the verification policy of the service corresponding to the AF request through the PCF network element. In some embodiments, the policy determination unit 902 can send a query request for the service corresponding to the AF request to the PCF network element, carrying a service identifier in the query request. In some embodiments, the query request may carry one or more of the following: operation type identifier, service-owning enterprise identifier, IoT terminal identifier, and application identifier. The PCF network element performs a query based on the pre-stored security policy information and the information carried in the query request to determine the verification policy of the service, and feeds it back to the AIoTF.

[0124] The service request unit 903 can obtain the first password for a service when the verification policy requires password verification, and send the IoT service request and the first password to the IoT terminal via the wireless side read / write device. If the IoT terminal successfully verifies the first password, it executes the service and feeds back the service execution result and the second password to the AIoTF via the wireless side read / write device.

[0125] Feedback unit 904 can verify the second password. If the second password is verified, it will feed back the business execution result or the business data corresponding to the business execution result to the source node of the AF request.

[0126] Based on the network elements in the above embodiments, information on the network side can be queried and scheduled. AF requests and information stored on the network side can be used to provide IoT terminals with verification information before business execution, and to verify the information provided by IoT terminals after business execution. This enables bidirectional security verification for some high-requirement businesses, while avoiding the waste of resources caused by providing security for all businesses. While improving security, it avoids placing an excessive burden on the network and passive IoT terminals.

[0127] A schematic diagram of the structure of an embodiment of the network device disclosed herein is shown below. Figure 10 As shown. The network device disclosed herein can be any one or more network-side devices mentioned above, or an IoT terminal. The network device includes a memory 1001 and a processor 1002. The memory 1001 can be a disk, flash memory, or any other non-volatile storage medium. The memory is used to store instructions in the corresponding embodiments of the IoT service management method or IoT service execution method described above. The processor 1002 is coupled to the memory 1001 and can be implemented as one or more integrated circuits, such as a microprocessor or microcontroller. The processor 1002 is used to execute the instructions stored in the memory, which can improve the security of services within the limits of passive IoT.

[0128] In one embodiment, it can also be as follows: Figure 11As shown, network device 1100 includes memory 1101 and processor 1102. Processor 1102 is coupled to memory 1101 via BUS bus 1103. Network device 1100 can also be connected to external storage device 1105 via storage interface 1104 to access external data, and can also be connected to a network or another computer system (not shown) via network interface 1106. Further details are omitted here.

[0129] In this embodiment, by storing data instructions in a memory and then processing the instructions by a processor, the security of services can be improved within the limits that passive IoT can withstand.

[0130] In another embodiment, a computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the steps of the method in the corresponding embodiment of the network service management method or the Internet of Things service execution method. Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, apparatus, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0131] Schematic diagrams of some embodiments of the network system disclosed herein are shown below. Figure 12 As shown.

[0132] The AIoTF network element 1201 can be used for the above-mentioned... Figure 9 The network device in the illustrated embodiment is capable of performing any of the functions described above that are performed by the AIoTF network element.

[0133] The NEF network element 1202 can obtain AF requests from the AF network element and authenticate the permissions and AF requests of the UDM network element to the AF network element; if the authentication is successful, the AF request is sent to the AIoTF network element.

[0134] PCF network element 1204 can obtain query requests from AIoTF for services corresponding to AF requests; determine the service verification strategy based on pre-stored security policy information, and feed it back to the AIoTF network element.

[0135] Based on the network system in the above embodiment, the security verification strategy for IoT services can be managed on the network side. It can provide IoT terminals with verification information before service execution and verify the information provided by IoT terminals after service execution. This enables bidirectional security verification for some services with high requirements, while avoiding the waste of resources caused by providing security for all services. It improves security while avoiding placing an excessive burden on the network and passive IoT terminals.

[0136] In some embodiments, such as Figure 12 As shown, the network system of this disclosure also includes a UDM network element 1203 capable of determining a first password based on pre-stored password information according to a request from an AIoTF network element, and feeding it back to the AIoTF network element. Such a network system enables the management of passwords for IoT services on the network side, improving password management capabilities and acquisition efficiency.

[0137] In some embodiments, the AIoTF network element 1201 can parse the first password from the AF request if the UDM network element fails to query the first password for the service based on pre-stored password information. Such a network system can provide services with two options: a network-side management password and an AF-side management password, improving service flexibility. Furthermore, the AIoTF network element 1201 can also reject the AF request and provide an invalid request message if parsing the first password from the AF request fails, thereby improving service security.

[0138] In some embodiments, the NEF network element 1202 can also obtain the AF authentication information from the BOSS, deploy the AF's subscription and authorization information according to the authentication information, and report the deployment result to the BOSS; the UDM network element 1203 can also obtain the IoT password information from the BOSS, deploy the generated pre-stored password information according to the IoT password information, and report the deployment result to the BOSS. In this case, after the AF subscribes to the IoT network service with the BOSS and provides the IoT password information to the BOSS, the BOSS sends the AF's authentication information to the NEF network element and sends the IoT password information to the UDM network element.

[0139] In some embodiments, the AF network element can directly sign an agreement with the NEF, and the AF sends its identification and authentication information as well as AIoT cryptographic information to the NEF for storage and use. In some embodiments, the NEF network element obtains the authentication information and IoT cryptographic information from the AF network element; the NEF network element deploys the AF's signing and authorization information based on the authentication information; the UDM network element deploys and generates pre-stored cryptographic information based on the IoT cryptographic information, thereby simplifying the system process without the need for BOSS involvement.

[0140] Based on the identification and configuration of external requests, such a network system can flexibly set policies, improving the network's ability to configure flexible and diverse policies for different external customers, service types, and terminal types, thereby enhancing service flexibility.

[0141] Schematic diagrams of other embodiments of the network system disclosed herein are shown below. Figure 13 As shown.

[0142] An AIoT terminal is an IoT device with extremely low energy storage and power consumption, and does not have a SIM card. Based on whether it has an amplifier, it is divided into weak terminals that only support backscatter communication and strong terminals that can generate signals themselves or use backscatter communication. The specific classifications of AIoT are as follows:

[0143] Device 1: Peak power consumption is about 1 uW, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, no DL or UL amplification in the device, the uplink transmission of this device is backscattered on an externally provided carrier.

[0144] Device 2a: Peak power consumption less than or equal to several hundred uW, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, and downlink and / or uplink amplification function in the device; the uplink transmission of this device is backscattered on an externally provided carrier.

[0145] Device 2b: Peak power consumption less than or equal to several hundred uW, with energy storage function, initial sampling frequency offset (SFO) up to 10X ppm, and downlink and / or uplink amplification function in the device; the uplink transmission of the device is generated internally;

[0146] RAN Reader includes UE Reader and Base Station Reader.

[0147] UDM: Primarily responsible for managing AIoT-related contract data and authentication information, responding to AIoT service requests from AIoTF, and managing the password information of contracted AIoT terminals.

[0148] The AIoTF network element is responsible for managing the access and service execution of AIoT terminals, discovering and selecting the UE Readers required by the requested AIoT devices. The AIoTMF can send control signaling and transmit / collect data to the Readers and AIoT devices, and can collaborate with the UDM / PCF to identify and authenticate AIoT access and services, and also performs password verification for AIoT devices.

[0149] PCF: It is responsible for the policy configuration function of specific AIoT services. Its core function is to configure the corresponding policy for the requested AIoT services, determine whether the specific AIoT service needs to trigger the AIoT password verification process, and instruct the AIoTF to execute the specific related process.

[0150] NEF: Accepts requests from AF and works with UDM to authenticate and authorize the permissions of AF and the requests issued by AF, and forwards the requests of AF to the corresponding AIoTF.

[0151] AIoT AF: A third party responsible for AIoT-related services. It can send AIoT-related information to the network and request the network to execute AIoT-related services, or receive AIoT-related requests from the network and provide corresponding data and information. The AIoT AF itself can also be the manager and owner of the AIoT password.

[0152] Based on the network system in the embodiments shown above in this disclosure, it has the function of identifying and configuring corresponding policies for passive IoT services initiated from the outside; it has derived a variety of policy schemes according to actual business needs and deployment methods, enabling the network to flexibly set policies based on the identification and configuration of external requests, and enabling the network to configure flexible and diverse policies for different external customers, business types or terminal types; it has utilized different password storage and management methods, enabling the network to flexibly configure AIoT password information according to actual business deployment, contract signing, customer needs, customer types, etc.; it has achieved two-way security authentication for passive IoT terminals, improving the security of passive IoT services.

[0153] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0154] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0155] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0156] This concludes the detailed description of the present disclosure. To avoid obscuring the concept of the disclosure, some details known in the art have not been described. Those skilled in the art will fully understand how to implement the technical solutions disclosed herein based on the above description.

[0157] The methods and apparatus of this disclosure may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of this disclosure are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, this disclosure may also be implemented as a program recorded on a recording medium, the program including machine-readable instructions for implementing the methods according to this disclosure. Thus, this disclosure also covers recording media storing programs for performing the methods according to this disclosure.

[0158] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0159] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this disclosure and not to limit them; although this disclosure has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications can still be made to the specific implementation of this disclosure or equivalent substitutions can be made to some technical features without departing from the spirit of the technical solutions of this disclosure, and all such modifications and substitutions should be covered within the scope of the technical solutions claimed in this disclosure.

Claims

1. An Internet of Things (IoT) business management method, comprising: Passive IoT Function (AIoTF) network elements acquire application function (AF) requests for IoT terminals. The AIoTF obtains the verification policy of the service corresponding to the AF request through the policy control function PCF network element according to the AF request, including: the AIoTF sends a query request carrying the service identifier to the PCF network element according to the content parsed from the AF request, so that the PCF network element determines the verification policy of the service according to the pre-stored security policy information and the query request and provides feedback. When the verification strategy requires password verification, the AIoTF network element obtains the first password for the service and sends the IoT service request and the first password to the IoT terminal through the wireless side read / write device. The first password is carried in the AF request, or the first password is stored by the UDM network element. The AIoTF network element obtains the first password for the service by requesting it from the UDM network element. The IoT terminal verifies the first password using its own stored password. If the first password verification is successful, the service corresponding to the IoT service request is executed, and the service execution result and the second password stored by the IoT terminal are fed back to the AIoTF network element through the wireless side read / write device. The AIoTF network element compares the obtained first password with the second password. If they match, the second password is verified and the service execution result or the service data corresponding to the service execution result is fed back to the source node of the AF request.

2. The management method according to claim 1 further includes: The Network Open Function (NEF) network element and the Unified Data Management Function (UDM) network element authenticate the AF request from the AF network element and the permissions of the AF network element. If authentication is successful, the AF request is sent to the AIoTF network element so that the AIoTF network element can perform the operation of obtaining the AF request for the IoT terminal.

3. The management method according to claim 1, wherein, The security policy information includes at least one of the following: IoT operation types that require password verification include at least one of the following: read, write, enable, disable, register, deregister, activate, deactivate, and inventory. The identifier of the enterprise that requires password verification; Identifiers for application functions that require password verification; Types of IoT terminals that require password verification; An identifier for applications that require password verification.

4. The management method according to claim 1, wherein, The first password for the AIoTF network element to obtain the service includes: The AIoTF network element requests the first password of the service from the UDM network element; The UDM network element determines the first password based on the pre-stored password information and feeds it back to the AIoTF network element.

5. The management method according to claim 4, wherein, The first password for the AIoTF network element to obtain the service also includes: If the UDM network element fails to retrieve the first password for the service based on the pre-stored password information, The AIoTF network element parses the first password from the AF request.

6. The management method according to claim 5, wherein, The first password for the AIoTF network element to obtain the service also includes: If the UDM network element fails to query the first password for the service based on the pre-stored password information, and the AIoTF network element fails to parse the first password from the AF request, The AIoTF network element rejects the AF request and provides a message indicating that the request is invalid.

7. The management method according to claim 2 further includes: The NEF network element obtains the AF authentication information from the Business Operation Support System (BOSS), and the UDM network element obtains the IoT password information from the BOSS. Specifically, after the AF and the BOSS sign up for IoT network services and provide IoT password information to the BOSS, the BOSS sends the AF's authentication information to the NEF network element and sends the IoT password information to the UDM network element. The NEF network element deploys the AF's signing and authorization information based on the authentication information; The UDM network element deploys and generates pre-stored password information based on the IoT password information; The NEF network element and the UDM network element report the deployment results back to the BOSS.

8. The management method according to claim 2 further includes: The NEF network element obtains authentication information and IoT password information from the AF network element; The NEF network element deploys the AF's signing and authorization information based on the authentication information; The UDM network element deploys and generates pre-stored password information based on the IoT password information.

9. The management method according to claim 5 or 8, wherein, The pre-stored password information includes at least one of the following: The association between the identifier of the IoT terminal and the first password; The association between the company's identifier and the first password; The association between the application's identifier and the first password; The association between the application function identifier and the first password.

10. The management method according to claim 1, wherein, The method meets at least one of the following criteria: The Internet of Things (IoT) mentioned is a passive IoT; The wireless side read / write device includes at least one of a terminal read / write device and a base station read / write device.

11. An Internet of Things (IoT) service execution method, executed by an IoT terminal, comprising: Obtain IoT service requests and the first password from the network side; If the first password verification is successful, the IoT service request is executed, and the service execution result is obtained; The service execution result and the stored second password are fed back to the network side, wherein the device on the network side executes the method described in any one of claims 1 to 10.

12. A network device, comprising: The request acquisition unit is configured to acquire application function (AF) requests for IoT terminals. The strategy determination unit is configured to obtain the verification strategy of the service corresponding to the AF request through the policy control function PCF network element according to the AF request, including: the AIoTF sends a query request carrying a service identifier to the PCF network element according to the content parsed from the AF request, so that the PCF network element determines the verification strategy of the service according to the pre-stored security policy information and the query request and provides feedback. The service request unit is configured to, when the verification policy requires password verification, obtain the first password for the service and send the IoT service request and the first password to the IoT terminal via a wireless side read / write device. The first password is carried in the AF request, or the first password is stored by the UDM network element. The AIoTF network element obtains the first password for the service by requesting it from the UDM network element. The IoT terminal verifies the first password using its own stored password. If the first password verification is successful, the service corresponding to the IoT service request is executed, and the service execution result and the second password stored by the IoT terminal are fed back to the network device via the wireless side read / write device. The feedback unit is configured to compare the obtained first password with the second password. If they match, the second password is verified and the service execution result or the service data corresponding to the service execution result is fed back to the source node of the AF request.

13. A network device, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to perform the method as described in any one of claims 1 to 11 based on instructions stored in the memory.

14. A computer-readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the method of any one of claims 1 to 11.

15. A computer program product comprising a computer program or instructions which, when executed by a processor, implement the method of any one of claims 1 to 11.

16. A network system, comprising: A passive Internet of Things (AIoT) network element is configured to perform the method described in claim 1; The Network Open Function (NEF) network element is configured as follows: The system obtains the AF request from the AF network element and authenticates the permissions of the Unified Data Management Function (UDM) network element to the AF network element and the AF request; if the authentication is successful, the system sends the AF request to the AIoTF network element. The policy control function PCF network element is configured as follows: Obtain the query request from the AIoTF network element for the service corresponding to the AF request; Based on the pre-stored security policy information, the verification policy for the service is determined and fed back to the AIoTF network element.

17. The network system according to claim 16, further comprising: The UDM network element is configured to determine the first password based on pre-stored password information according to a request from the AIoTF network element, and then feed it back to the AIoTF network element.

18. The network system according to claim 16, wherein, The AIoTF network element is also configured to parse the first password from the AF request if the UDM network element fails to query the first password for the service based on the pre-stored password information. If parsing the first password from the AF request fails, the AF request is rejected, and an invalid request message is provided.

19. The network system according to claim 17, wherein, The NEF network element is also configured to: obtain authentication information from the AF network element, and deploy the AF's subscription and authorization information based on the authentication information; The UDM network element is also configured to: obtain the IoT password information of the AF network element, and deploy and generate pre-stored password information based on the IoT password information.

Images