Communication method and communication device

Abstract

The invention provides a communication method and a communication device. The method comprises the following steps: a certificate management network element acquires first certificate information corresponding to a first service certificate of a first network element and second certificate information corresponding to a second service certificate of a second network element; and under the condition that the network element types to which the first network element and the second network element belong are the same and the first service certificate and the second service certificate need to be updated, the certificate management network element determines an updating strategy corresponding to the first service certificate and the second service certificate, and controls the updating of the first service certificate and the second service certificate according to the updating strategy. In the process of determining the update strategy corresponding to the service certificate, the certificate management network element identifies the network element types to which different network elements belong, and formulates an appropriate update strategy for the network elements with the same network element type, so as to avoid system faults caused by the fact that the network element types are not considered in the service certificate update process and improve the system performance.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method and a communication device. Background Art

[0002] The certificate management related topics in the 3rd Generation Partnership Project (3GPP) define a certificate application management framework (Certificate Enrolment and MAnagement Framework, CEMAF), which includes a certificate management network element (CeMF), a certificate issuance network element (CeEF) and a network function (NF) that needs to request a service certificate. Among them, the certificate management network element can implement service certificate update management. In the existing service certificate update process, there may be a large number of certificates updated at the same time, and the certificate update process will cause the corresponding network elements to be unusable. In particular, if the network elements that provide the same service in the network update their certificates at the same time, the network will be unable to provide the corresponding service.

[0003] Therefore, how to optimize the service certificate update process while ensuring network security to avoid the impact of certificate updates on corresponding services in the network has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present application provides a communication method, in order to identify the network element type to which the network element belongs in the service certificate update process, and consider the impact of the network element type on the service certificate update, so as to avoid the impact of the certificate update on the corresponding service in the network and improve the performance of the system.

[0005] In a first aspect, a communication method is provided. The method may be executed by a certificate management network element, or may be executed by a component (such as a chip or a circuit) of the certificate management network element, without limitation.

[0006] The communication method includes: obtaining first certificate information corresponding to a first business certificate of a first network element and second certificate information corresponding to a second business certificate of a second network element, the first certificate information including a validity period of the first business certificate and information on a network element type to which the first network element belongs, and the second certificate information including a validity period of the second business certificate and information on a network element type to which the second network element belongs; when it is determined that the first network element and the second network element belong to the same network element type according to the information on the network element type to which the first network element belongs and the information on the network element type to which the second network element belongs, and when it is determined that the first business certificate and the second business certificate need to be updated according to the validity period of the first business certificate and the validity period of the second business certificate, determining an update policy corresponding to the first business certificate and the second business certificate; and controlling the updating of the first business certificate and the second business certificate according to the update policy.

[0007] Based on the above scheme, the first certificate information corresponding to the first service certificate of the first network element obtained by the certificate management network element includes the validity period of the first service certificate and the information of the network element type to which the first network element belongs, and the second certificate information corresponding to the second service certificate of the second network element obtained includes the validity period of the second service certificate and the information of the network element type to which the second network element belongs. Among them, the information of the network element type to which the first network element belongs indicates the network element type to which the first network element belongs, the information of the network element type to which the second network element belongs indicates the network element type to which the second network element belongs, the validity period of the first service certificate indicates when the first service certificate needs to be updated, and the validity period of the second service certificate indicates when the second service certificate needs to be updated.

[0008] When the first network element and the second network element belong to the same network element type, and the first service certificate and the second service certificate need to be updated, the certificate management network element determines the update policy corresponding to the first service certificate and the second service certificate. And the certificate management network element can control the update of the first service certificate and the second service certificate according to the determined update policy. In this technical solution, the certificate management network element, in the process of determining the update policy corresponding to the service certificate, takes into account the network element type to which the network element belongs, and formulates a suitable update policy for network elements of the same network element type, in order to avoid system failures due to failure to consider the network element type in the service certificate update process, and to avoid the impact of certificate updates on corresponding services in the network, thereby improving system performance.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the first certificate information includes the first service certificate, the network element type nfTypes field of the first service certificate includes information about the network element type to which the first network element belongs, the second certificate information includes the second service certificate, the network element type nfTypes field of the second service certificate includes information about the network element type to which the second network element belongs, and the method further includes: reading information about the network element type to which the first network element belongs from the nfTypes field of the first service certificate, and reading information about the network element type to which the second network element belongs from the nfTypes field of the second service certificate. Optionally, the nfTypes field may be a field in the extension domain of the service certificate, or a field in other domains, which is not limited in this application.

[0010] Based on the above scheme, the information of the network element type to which the first network element included in the first certificate information belongs can be carried in the network element type nfTypes field of the first service certificate, and the information of the network element type to which the second network element included in the second certificate information belongs can be carried in the network element type nfTypes field of the second service certificate. The certificate management network element can read the information of the network element type from the nfTypes field of the service certificate, that is, the information of the network element type can be implicitly carried in the first certificate information.

[0011] In combination with the first aspect, in some implementations of the first aspect, obtaining the first certificate information and the second certificate information includes: receiving the first certificate information and the second certificate information from a certificate issuing authority; or, receiving the first certificate information from the first network element, and receiving the second certificate information from the second network element; or, receiving the first certificate information and the second certificate information from operations administration and maintenance (OAM) equipment.

[0012] Based on the above solution, the certificate management network element can obtain the first certificate information and the second certificate information in different ways, for example, receiving the first certificate information and the second certificate information from the certificate issuing authority in the issuance process of the service certificate; for example, receiving the certificate information corresponding to the service certificate of the network element from different network elements; for example, receiving the certificate information corresponding to the service certificates of different network elements from the OAM device, etc., so as to improve the flexibility of the solution.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: determining that the network element type to which the first network element belongs and the network element type to which the second network element belongs are the same based on information about the network element type to which the first network element belongs and information about the network element type to which the second network element belongs; and determining that the first business certificate and the second business certificate need to be updated based on the validity period of the first business certificate and the validity period of the second business certificate.

[0014] Based on the above solution, the certificate management network element can determine that the network element types to which the first network element belongs and the second network element belong are the same based on the acquired information about the network element type to which the first network element belongs and the acquired information about the network element type to which the second network element belongs, such as the first network element and the second network element are both AMFs. In addition, the certificate management network element can determine that the first service certificate and the second service certificate need to be updated based on the acquired validity period of the first service certificate and the validity period of the second service certificate.

[0015] In combination with the first aspect, in certain implementations of the first aspect, determining that the first business certificate and the second business certificate need to be updated based on the validity period of the first business certificate and the validity period of the second business certificate includes: determining, based on the validity period of the first business certificate and the validity period of the second business certificate, that the time interval between the expiration time of the first business certificate and the expiration time of the second business certificate is less than a first preset threshold.

[0016] Based on the above scheme, the certificate management network element determines that the first business certificate and the second business certificate need to be updated: according to the validity period of the first business certificate and the validity period of the second business certificate, determine that the time interval between the expiration time of the first business certificate and the expiration time of the second business certificate is less than the first preset threshold, that is, the certificate management network element determines that the first business certificate and the second business certificate need to be updated at a similar time. If the time when the first business certificate and the second business certificate need to be updated is determined according to the expiration time of the first business certificate and the expiration time of the second business certificate, it may cause the first network element and the second network element to update their business certificates at the same time, and there is no available network element of the network element type to which the first network element belongs in the system. In order to avoid this situation, the certificate management network element in this technical scheme formulates an update strategy.

[0017] In combination with the first aspect, in certain implementations of the first aspect, determining the update policies corresponding to the first business certificate and the second business certificate includes: determining a first update policy corresponding to the first business certificate, and determining a second update policy corresponding to the second business certificate, the first update policy is used to indicate the update time of the first business certificate, the second update policy is used to indicate the update time of the second business certificate, and the update time of the first business certificate is different from the update time of the second business certificate; controlling the update of the first business certificate and the second business certificate according to the update policy includes: sending the first update policy to the first network element, and sending the second update policy to the second network element.

[0018] Based on the above scheme, the update policy formulated by the certificate management network element may be: formulate a first update policy for the first service certificate, and formulate a second update policy for the second service certificate. Specifically, the first update policy is used to indicate the update time of the first service certificate, and the second update policy is used to indicate the update time of the second service certificate, and the update time of the first service certificate is different from the update time of the second service certificate. The certificate management network element sends the first update policy and the second update policy to the first network element and the second network element respectively, so that the first network element and the second network element initiate the service certificate update at different times, thereby avoiding the first network element and the second network element from updating the service certificates at the same time.

[0019] In combination with the first aspect, in certain implementations of the first aspect, the determining the update policy corresponding to the first business certificate and the second business certificate includes: determining a total update policy corresponding to the first business certificate and the second business certificate, the total update policy being used to indicate an update time of the first business certificate and an update time of the second business certificate, the update time of the first business certificate and the update time of the second business certificate being different; controlling the update of the first business certificate and the second business certificate according to the update policy includes: if a first request message requesting an update of the first business certificate is received from the first network element before the update time of the first business certificate, refusing to respond to the first request message; if a second request message requesting an update of the second business certificate is received from the second network element before the update time of the second business certificate, refusing to respond to the second request message.

[0020] Based on the above solution, the update policy formulated by the certificate management network element may be: formulate a general update policy for the first service certificate and the second service certificate, the general update policy is used to indicate the update time of the first service certificate and the update time of the second service certificate, and the update time of the first service certificate and the update time of the second service certificate are different. After the certificate management network element formulates the general update policy, the update of the first service certificate and the update of the second service certificate are controlled based on the general update policy to avoid the first network element and the second network element from updating the service certificates at the same time.

[0021] In combination with the first aspect, in certain implementations of the first aspect, determining the update policy corresponding to the first business certificate and the second business certificate includes: determining a total update policy corresponding to the first business certificate and the second business certificate, the total update policy being used to indicate controlling the update of the first business certificate and the second business certificate according to the number of online network elements in the multiple network elements corresponding to the network element type, the multiple network elements corresponding to the network element type including, in addition to the first network element and the second network element, N online third network elements, where N is a positive integer; controlling the update of the first business certificate and the second business certificate according to the update policy includes: if N is greater than a second preset threshold, determining that the first business certificate and the second business certificate can be updated simultaneously; if N is less than or equal to the second preset threshold, determining that the first business certificate and the second business certificate cannot be updated simultaneously.

[0022] Based on the above solution, the update policy formulated by the certificate management network element may be: formulate a general update policy for the first service certificate and the second service certificate, and the general update policy is used to indicate the number of online network elements in multiple network elements corresponding to the network element type, and control the update of the first service certificate and the second service certificate. After the certificate management network element formulates the general update policy, the update of the first service certificate and the update of the second service certificate are controlled based on the general update policy to avoid the first network element and the second network element from updating the service certificates at the same time.

[0023] In combination with the first aspect, in certain implementations of the first aspect, the method also includes: receiving a first request message from the first network element requesting to update the first business certificate, and receiving a second request message from the second network element requesting to update the second business certificate; when it is determined that the first business certificate and the second business certificate can be updated at the same time, responding to the first request message and the second request message; when it is determined that the first business certificate and the second business certificate cannot be updated at the same time, refusing to respond to the first request message and / or the second request message.

[0024] In combination with the first aspect, in some implementations of the first aspect, the obtaining of the network element information corresponding to the network element type includes: sending a third request message to the storage function network element, the third request message is used to request the provision of information of multiple network elements corresponding to the network element type, the third request message includes the information of the network element type; receiving a response message from the storage function network element, the response message includes information of some or all of the multiple network elements corresponding to the network element type, wherein the information of the multiple network elements corresponding to the network element type is used to indicate the number of online network elements in the multiple network elements corresponding to the network element type. It should be understood that the storage function network element can provide the certificate management network element with the information of the multiple network elements corresponding to the network element type through at least one response message (e.g., through multiple response messages, one of which carries the information of some of the multiple network elements), so that the certificate management network element determines the number of online network elements in the multiple network elements corresponding to the network element type according to the information of the multiple network elements corresponding to the network element type.

[0025] In combination with the first aspect, in certain implementations of the first aspect, the information of multiple network elements corresponding to the network element type includes: one or more of the identifiers, formal domain names FQDNs, or Internet Protocol (IP) address information of the multiple network elements corresponding to the network element type.

[0026] On the second aspect, a communication method is provided, which can be executed by a functional network element that needs to request a service certificate (such as the first network element or the second network element mentioned above), or can also be executed by a component (such as a chip or circuit) of the functional network element that needs to request a service certificate, without limitation.

[0027] The communication method comprises: receiving a first update policy from a certificate management network element, wherein the first update policy is used to indicate an update time of a first service certificate; and sending an update request message of the first service certificate to a certificate issuing network element at the update time of the first service certificate.

[0028] In combination with the second aspect, in certain implementation methods of the second aspect, the sending of the update request message for the first service certificate to the certificate issuing network element includes: directly sending the update request message for the first service certificate to the certificate issuing network element; or, sending the update request message for the first service certificate to the certificate issuing network element through the certificate management network element.

[0029] The technical effects of the method shown in the above second aspect and its possible design can refer to the technical effects in the first aspect and its possible design.

[0030] On the third aspect, a communication method is provided, which can be executed by a storage function network element, or can also be executed by a component of the storage function network element (such as a chip or circuit), without limitation.

[0031] The communication method includes: receiving a third request message from a certificate management network element, the third request message is used to request information of multiple network elements corresponding to the network element type, and the third request message includes information of the network element type; determining, based on a local policy, that the certificate management network element is able to obtain information of multiple network elements corresponding to the network element type; and sending a response message to the certificate management network element, the response message including information of some or all of the multiple network elements corresponding to the network element type.

[0032] In combination with the third aspect, in certain implementation methods of the third aspect, determining according to local policy that the certificate management network element can obtain information of multiple network elements corresponding to the network element type includes: determining according to the identifier of the certificate management network element that the identifier of the certificate management network element belongs to a certificate management network element that can obtain information of multiple network elements corresponding to the network element type.

[0033] Based on the above scheme, the storage function network element can determine whether the certificate management network element is a network element that can obtain information of multiple network elements corresponding to the network element type according to the identifier of the certificate management network element, thereby preventing unauthorized certificate management network elements from obtaining information of network elements and avoiding information leakage.

[0034] In combination with the third aspect, in some implementations of the third aspect, the third request message includes a subscription request message or a discovery request message.

[0035] In combination with the third aspect, in certain implementations of the third aspect, the information of the multiple network elements corresponding to the network element type includes: one or more of the identifiers, formal domain names FQDNs, or Internet Protocol IP address information of the multiple network elements corresponding to the network element type.

[0036] The technical effects of the method shown in the third aspect and its possible design above can refer to the technical effects in the first aspect and its possible design.

[0037] In a fourth aspect, a communication device is provided, which is used to execute the method provided in the first to third aspects. Specifically, the device may include a unit and / or module, such as a processing unit and / or a communication unit, for executing the method provided in any one of the above implementations of the first to third aspects.

[0038] In one implementation, the apparatus is a terminal device. When the apparatus is a terminal device, the communication unit may be a transceiver, or an input / output interface; the processing unit may be at least one processor. Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0039] In another implementation, the device is a chip, a chip system or a circuit used in a terminal device. When the device is a chip, a chip system or a circuit used in a terminal device, the communication unit may be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip, the chip system or the circuit; the processing unit may be at least one processor, a processing circuit or a logic circuit.

[0040] In a fifth aspect, a communication device is provided, comprising: a memory for storing programs; and at least one processor for executing computer programs or instructions stored in the memory to execute any one of the implementations of the first to third aspects, or a method provided by any one of the implementations of the second to third aspects.

[0041] In one implementation, the apparatus is a terminal device.

[0042] In another implementation, the apparatus is a chip, a chip system or a circuit used in a terminal device.

[0043] In a sixth aspect, the present application provides a processor for executing the methods provided in the above aspects.

[0044] For the operations such as sending and acquiring / receiving involved in the processor, unless otherwise specified, or unless they conflict with their actual function or internal logic in the relevant description, they can be understood as operations such as processor output, reception, input, etc., or as sending and receiving operations performed by the radio frequency circuit and antenna, and this application does not limit this.

[0045] In a seventh aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a method for executing any one of the above-mentioned implementations of the first to third aspects.

[0046] In an eighth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer is enabled to execute the method provided in any one of the implementations of the first to third aspects.

[0047] In a ninth aspect, a chip is provided, the chip comprising a processor and a communication interface, the processor reads instructions stored in a memory through the communication interface, and executes the method provided by any one of the above-mentioned implementation methods of the first to third aspects.

[0048] Optionally, as an implementation method, the chip also includes a memory, in which a computer program or instructions are stored, and the processor is used to execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the processor is used to execute the method provided in any one of the above-mentioned implementation methods of the first to third aspects.

[0049] In a tenth aspect, a communication system is provided, comprising the certificate management network element of the first aspect and the functional network element of the second aspect that needs to request a service certificate.

[0050] In an eleventh aspect, a communication system is provided, comprising the certificate management network element of the first aspect and the storage function network element of the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a schematic diagram of the network architecture 100 provided in this application.

[0052] Figure 2 A CEMAF schematic diagram.

[0053] Figure 3 It is a schematic flow chart of a communication method provided by the present application.

[0054] Figure 4 This is a schematic flowchart of a business certificate request process provided by this application.

[0055] Figure 5 It is a schematic flow chart of another communication method provided by the present application.

[0056] Figure 6 It is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.

[0057] Figure 7 It is a schematic diagram of another communication device 20 provided in an embodiment of the present application.

[0058] Figure 8 It is a schematic diagram of a chip system 30 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0060] The technical solution provided in this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD) system, etc. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0061] In the communication system, the part operated by the operator can be called a public land mobile network (PLMN), or an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The PLMN described in the embodiments of the present application may specifically be a network that meets the requirements of the 3GPP standard, referred to as a 3GPP network. 3GPP networks generally include but are not limited to 5G networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as (6th-generation, 6G) networks, etc.

[0062] For the convenience of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0063] Figure 1 This is a schematic diagram of a network architecture 100 provided by the present application, taking the 5G network architecture based on the service-based architecture SBA in the non-roaming scenario defined in the 3GPP standardization process as an example. As shown in the figure, the network architecture may include three parts, namely, the terminal device part, the DN and the operator network PLMN part. The functions of the network elements of each part are briefly described below.

[0064] The terminal equipment part may include a terminal device 110, which may also be referred to as a user equipment (UE). The terminal device 110 in the present application is a device with wireless transceiver functions, which may communicate with one or more core network (CN) devices via an access network device (or may also be referred to as an access device) in a radio access network (RAN) 140. The terminal device 110 may also be referred to as an access terminal, a terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a user agent or a user device, etc. The terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on the water (e.g., a ship, etc.); it may also be deployed in the air (e.g., on an airplane, a balloon, and a satellite, etc.). The terminal device 110 may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, the terminal device 110 may also be a handheld device with wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or a terminal in the Internet of Things or the Internet of Vehicles, a terminal in any form in a 5G network and future networks, a relay user device or a terminal in a future evolved 6G network, etc. Among them, the relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device 110 can be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiment of the present application does not limit the type or type of terminal device. For ease of explanation, the following description of the present application takes UE as an example to refer to the terminal device.

[0065] The operator network PLMN part may include but is not limited to the (radio) access network ((R)AN) 120 and the core network (CN) part.

[0066] (R)AN 120 can be regarded as a sub-network of the operator network, and is an implementation system between the service nodes in the operator network and the terminal device 110. To access the operator network, the terminal device 110 first passes through (R)AN 120, and then can connect to the service nodes of the operator network through (R)AN 120. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 110, and can also be called a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network. In systems using different wireless access technologies, the names of the devices with access network device functions may be different. For the convenience of description, in all embodiments of the present application, the above-mentioned devices that provide wireless communication functions for the terminal device 110 are collectively referred to as access network devices or RAN or AN for short. It should be understood that this document does not limit the specific type of access network equipment.

[0067] In some deployments, (R)AN 120 may include a centralized unit (CU) and a distributed unit (DU). CU implements some functions of gNB, and DU implements some functions of gNB. For example, CU is responsible for processing non-real-time protocols and services, and implementing the functions of radio resource control (RRC) and packet data convergence protocol (PDCP) layers. DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of radio link control (RLC) layer, media access control (MAC) layer and physical (PHY) layer. It can be understood that (R)AN 120 can be a device including one or more of CU nodes and DU nodes. In addition, CU can be divided into a network device in the access network (RAN), and CU can also be divided into a network device in the core network (CN), which is not limited in this application.

[0068] The CN part may include but is not limited to the following NFs: user plane function (UPF) 130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function (PCF) 133, unified data management function (UDM) 134, unified data repository function (UDR) 135, network data analytics function (NWDAF) 136, authentication server function (AUSF) 137, access and mobility management function (AMF) 138, session management function (SMF) 139.

[0069] The data network DN 140, which may also be referred to as a packet data network (PDN), is usually a network located outside the operator network, such as a third-party network. Of course, in some implementations, the DN may also be deployed by the operator, that is, the DN is part of the PLMN. This application does not limit whether the DN belongs to the PLMN. The operator network PLMN may access multiple data networks DN 140, and multiple services may be deployed on the data network DN 140, which may provide services such as data and / or voice to the terminal device 110. For example, the data network DN 140 may be a private network of a smart factory, and the sensors installed in the workshop of the smart factory may be the terminal devices 110. The control server in which the sensors are deployed in the data network DN 140 may provide services for the sensors. The sensors may communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, the data network DN 140 may be an internal office network of a company, and the mobile phones or computers of the company's employees may be the terminal devices 110, and the employees' mobile phones or computers may access information, data resources, etc. on the company's internal office network. The terminal device 110 can establish a connection with the operator network through an interface (such as N1, etc.) provided by the operator network, and use data and / or voice services provided by the operator network. The terminal device 110 can also access the data network DN 140 through the operator network, and use the operator services deployed on the data network DN 140, and / or services provided by a third party.

[0070] The NF functions included in the network architecture 100 are further briefly described below.

[0071] 1. UPF 130 is a gateway provided by the operator and is the gateway for the operator network to communicate with the data network DN 140. UPF network function 130 includes user-plane related functions such as data packet routing and transmission, data packet detection, service usage reporting, quality of service (QoS) processing, legal monitoring, uplink data packet detection, downlink data packet storage, etc.

[0072] 2. NEF 131 is a control plane function provided by the operator. It mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, provides PLMN security configuration information from external applications, and converts the interactive information inside and outside the PLMN. It provides an API interface for the operator network to be open to the outside world, and provides it for the interaction between external servers and internal operator networks.

[0073] 3. NRF 132 is a control plane function provided by the operator, which can be used to maintain real-time information of network functions and services in the network. For example, it supports network service discovery, maintains the services supported by the NF profile of the NF instance, supports service discovery of the service communication proxy (SCP), maintains the SCP profile of the SCP instance, sends notifications about newly registered, unregistered, and updated NFs and SCPs, and maintains the health status of NF and SCP operations.

[0074] In this application, NRF can provide the certificate management network element with the number of available network elements corresponding to different network element types in a certain area through network service discovery or network service subscription process. The functions of NRF will be explained with specific examples below, which will not be repeated here.

[0075] 4. PCF 133 is a control plane function provided by the operator. It supports a unified policy framework to govern network behavior, provide policy rules to other control functions, and contract information related to policy decisions.

[0076] 5. UDM 134 is a control plane function provided by the operator, which is responsible for storing the subscriber permanent identifier (SUPI) of the subscriber in the operator network, the generic public subscription identifier (GPSI) of the subscriber, the credential and other information. The SUPI will be encrypted during the transmission process, and the encrypted SUPI is called the hidden user subscription identifier (SUCI). The information stored by the UDM network function 134 can be used for the authentication and authorization of the terminal device 110 to access the operator network. Among them, the subscribers of the above-mentioned operator network can specifically be users who use the services provided by the operator network, such as users who use China Telecom's mobile phone core card (subscriber identity module, SIM) card, or users who use China Mobile's mobile phone core card, etc. The credential of the above-mentioned subscriber can be a small file storing long-term keys stored in the mobile phone core card or information related to the encryption of the mobile phone core card, which is used for authentication and / or authorization. It should be noted that permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to verification / authentication and authorization-related information. In the embodiments of the present application, no distinction or restriction is made for the sake of convenience of description.

[0077] 6. UDR 135 is a control plane function provided by the operator, which provides the functions of storing and retrieving subscription data for UDM, storing and retrieving policy data for PCF, storing and retrieving user's NF group ID information, etc.

[0078] 7. NWDAF 136 is a control plane function provided by the operator. Its main function is to collect data from NF, external application function AF and OAM equipment, and provide NWDAF service registration, data opening and data analysis to NF and AF.

[0079] 8. AUSF 137 is a control plane function provided by the operator, and is usually used for primary authentication, i.e., authentication between the terminal device 110 (subscriber) and the operator network. After receiving the authentication request initiated by the subscriber, the AUSF network function 137 may authenticate and / or authorize the subscriber through the authentication information and / or authorization information stored in the UDM network function 134, or generate the authentication and / or authorization information of the subscriber through the UDM network function 134. The AUSF network function 137 may feed back the authentication information and / or authorization information to the subscriber.

[0080] 9. AMF 138 is a control plane network function provided by the operator network, responsible for access control and mobility management of the terminal device 110 accessing the operator network, such as mobility status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0081] AMF 138 is used to establish NAS connection with UE and has the same 5G NAS security context as UE. The 5G NAS security context includes KAMF, key identification information with the same NAS layer key, UE security capability, and uplink and downlink NASCOUNT values. NAS layer keys include NAS encryption keys and NAS integrity protection keys, which are used for confidentiality protection and integrity protection of NAS messages respectively.

[0082] 10. SMF 139 is a control plane network function provided by the operator network, responsible for managing the PDU session of the terminal device 110. The PDU session is a channel for transmitting PDUs. The terminal device needs to transmit PDUs to and from the data network DN 140 through the PDU session. The PDU session is established, maintained, and deleted by the SMF network function 139. The SMF network function 139 includes session management (such as session establishment, modification, and release, including tunnel maintenance between the user plane function UPF 130 and (R)AN 120), selection and control of the UPF network function 130, service and session continuity (SSC) mode selection, roaming and other session-related functions.

[0083] 11. AF 141 is a control plane network function provided by the operator network, which is used to provide application layer information. It can interact with the policy framework through the network open function network element or directly interact with the policy framework to make policy decision requests, etc. It can be located inside or outside the operator network.

[0084] It is understandable that the above network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). In short, an NF can be implemented by hardware or software.

[0085] Figure 1 Among them, Nnef, Nnrf, Npcf, Nudm, Nudr, Nnwdaf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can refer to the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that the interface name between the various network functions in the figure is only an example. In the specific implementation, the interface name of the system architecture may also be other names, which is not limited by this application. In addition, the name of the message (or signaling) transmitted between the above-mentioned network elements is also only an example, and does not constitute any limitation on the function of the message itself.

[0086] For the convenience of explanation, in the embodiments of the present application, the network functions (such as NEF 131 ... SMF139) are collectively referred to as NFs, that is, the NFs described later in the embodiments of the present application can be replaced by any network function. Figure 1 Only some network functions are schematically described. The NF described below is not limited to Figure 1 The network functions shown in .

[0087] It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only a network architecture described from the perspective of a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.

[0088] It should also be understood that the AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in the figure can be understood as network elements for implementing different functions, for example, they can be combined into network slices as needed. These core network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0089] The network element types involved in the following embodiments may be: network elements are divided into different network element types according to functions, deployment locations, or domains. For example, the network elements may be divided into the above-mentioned SMF, AMF, UPF, NEF, etc. according to service functions; for example, the network elements may be divided into access network elements or non-access network elements according to deployment locations; for example, the network elements may be divided into visited network elements or home network elements according to home domains, etc.

[0090] Exemplarily, network elements belonging to different network element types provide different services. For example, network elements belonging to AMF are responsible for access control and mobility management of terminal devices accessing the operator network; for example, network elements belonging to SMF are responsible for managing PDU sessions of terminal devices.

[0091] It should be understood that in the service certificate update process, there may be a large number of certificates updated at the same time, and during the certificate update process, the corresponding network elements will be unusable. In particular, if the network elements providing the same service in the network update their certificates at the same time, the network will be unable to provide the corresponding service. For example, if all AMFs in the network execute the service certificate update, there will be no available AMFs in the network.

[0092] It should also be understood that the above naming is only defined for the convenience of distinguishing different functions and should not constitute any limitation to this application. This application does not exclude the possibility of using other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may use the terminology in 5G, or may use other names.

[0093] To facilitate understanding of the embodiments of the present application, some basic concepts involved in the present application are briefly described. It should be understood that the basic concepts introduced below are illustrated by taking the basic concepts specified in the NR protocol as an example, but the embodiments of the present application are not limited to the NR system. Therefore, the standard names that appear when describing the NR system as an example are all functional descriptions, and the specific names are not limited. They only indicate the functions of the device and can be correspondingly extended to other systems in the future.

[0094] 1. Certificate Authority (CA): Responsible for managing the entire life cycle of the public key, including issuing certificates, defining the validity period of certificates and revoking certificates. It should be noted that CA may also include a registration authority (RA), which is used to obtain and authenticate the user's identity and then submit a certificate issuance request to the CA. Among them, RA can be a function integrated in CA or deployed separately. This application assumes that CA integrates the function of RA. The certificate enrolment function (CeEF) mentioned below may be part of the interactive function module in CA or RA.

[0095] 2. Certificate management protocol (CMP): It is an Internet protocol used to obtain digital certificates that comply with the X.509 standard in a public key infrastructure (PKI) system. Specifically, CMP provides online interactions between PKI components, including interactions between CA and client systems, and protocol message definitions are used for certificate creation and management. The term "certificate" in CMP refers to the X.509v3 certificate defined in X509. It is described in detail in prior art documents (such as IETF RFC4210) and will not be described in detail in this application.

[0096] 3. X.509 certificate: The X.509 standard specifies what information a certificate can contain and describes the method (data format) of recording information. The relevant certificate profile is defined in existing technical documents (e.g., RFC5280). The X.509 certificate includes the following information listed in Table 1:

[0097] Table 1: X509 certificate format

[0098]

[0099]

[0100] In addition, the network function types (nfTypes) field can be added to the extension of the X509 certificate. IETF RFC 9310 specifies the certificate extension name that contains the network function type (nfTypes) field of the 5G system in the X.509v3 public key certificate described in RFC 5280. For example, the nfTypes field will be carried in the network element certificate to indicate the network element type to which the certificate applies. In addition, it should be noted that this application does not limit the nfTypes field to be located in the extension domain of the certificate, but can also be located in other locations of the certificate. There is no limitation on the specific location of the nfTypes field in the certificate.

[0101] 4. Certificate Enrolment and MAnagement Framework (CEMAF):

[0102] Specifically, the certificate management framework defined in the certificate management related topics of the 3rd Generation Partnership Project (3GPP) is as follows: Figure 2 As shown, Figure 2 A CEMAF schematic diagram.

[0103] from Figure 2 As can be seen, CEMAF includes a certificate management network element (CeMF) and CeEF, where CeEF is the network element of the operator and is used to issue certificates. In this application, the function of CeEF can refer to the function of CA shown above; CeMF is a network element in the trust domain and is used to manage and apply for certificates. There can be multiple CeMFs in CEMAF (such as Figure 2 As shown in the CeMF#1, CeMF#2, ..., CeMF#n), different CeMFs may be located in different trust domains or in the same trust domain.

[0104] Specifically, the communication interface between NF and CeEF (such as Figure 2 The ce1 interface shown in ) is used to register programs related to certificate provisioning and updating; the communication interface between NF and CeMF (such as Figure 2 The ce2 interface shown in Figure 1 is used for certificate status checking.

[0105] That is to say, the corresponding functions in CEMAF have been divided into two network elements (eg, CeEF and CeMF). The registration function network element (CeEF) of CEMAF is used to issue certificates. The management network element (CeMF) of CEMAF is used to manage and apply for certificates.

[0106] It should be understood that the specific deployment form of CeEF and CeMF is relatively free. For example, it can be a network element in the network, or it can be a function in the CA. For another example, CeEF may also be a dedicated network element specifically responsible for contacting the CA (or RA) and deployed in the operator network (that is, CeEF is not included in the CA). For another example, CeEF and CeMF can be deployed in the certificate network management entity. Examples are not given here one by one.

[0107] 5. Certificate Update Orchestrator Function (CUOF): a network element used to implement certificate updates and apply for network element certificates.

[0108] Exemplarily, in the present application, CUOF and the CeMF mentioned above may be equivalent, and CUOF in the following text may be replaced by CeMF.

[0109] Exemplarily, CUOF may be a network element newly added to the above-mentioned CEMAF for implementing certificate update and applying for network element certificates, which is different from the CeMF mentioned above.

[0110] For the convenience of description, CUOF and CeMF are collectively referred to as certificate management network elements in the following text. The certificate management network element in this application can implement the functions of CeMF management and certificate application, and can also implement the function of CUOF certificate update.

[0111] 6. Business certificate: refers to the certificate that NF needs for user plane or signaling plane user transmission, which can also be called formal certificate or actual certificate, etc. For example, the Transport Layer Security (TLS) certificate or Datagram Transport Layer Security (DTLS) certificate required to establish a secure connection between NFs, or the certificate required to establish an Internet Protocol Security (IPSEC) channel.

[0112] Exemplarily, a business certificate may be a certificate used for a specific purpose (e.g., encryption protection, integrity protection, authentication, etc.), including but not limited to:

[0113] Certificates for specific purposes such as TLS client EE certificates, TLS server EE certificates, Certificates for signing the access tokens for service access authorization, Certificates for encrypting HTTP application layer protection of messages between SEPPs, or Certificates for signing Client credentials assertion (CCA) tokens (for NF consumers).

[0114] In addition, in order to facilitate understanding of the embodiments of the present application, the following points are explained.

[0115] First, in this application, "used for indication" may include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used for indicating A, it may include that the indication information directly indicates A or indirectly indicates A, but it does not mean that A must be included in the indication information.

[0116] The information indicated by the indication information is called the information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated. The information to be indicated can be sent as a whole, or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The specific sending method is not limited in this application. Among them, the sending period and / or sending time of these sub-information can be pre-defined, for example, pre-defined according to the protocol, or can be configured by the transmitting end device by sending configuration information to the receiving end device.

[0117] Second, "at least one" shown in the present application refers to one or more, and "multiple" refers to two or more. In addition, in the embodiments of the present application, "first", "second" and various digital numbers (for example, "#1", "#2", etc.) are only for the convenience of description, and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of each process below does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. It should be understood that the objects described in this way can be interchanged in appropriate circumstances, so that the schemes other than the embodiments of the present application can be described. In addition, in the embodiments of the present application, the words "310", "320" and the like are only for the convenience of description, and are not to limit the order of execution steps.

[0118] Third, in this application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a specific way.

[0119] Fourth, the “protocol” involved in the embodiments of the present application may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, which is not limited in the present application.

[0120] Fifth, in the embodiments of the present application, "under the circumstances", "when", and "if" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0121] Sixth, in the embodiments of the present application, various terms and English abbreviations, such as radio resource control (RRC), etc., are illustrative examples given for the convenience of description and should not constitute any limitation to the present application. The present application does not exclude the possibility of defining other terms that can achieve the same or similar functions in existing or future protocols.

[0122] Seventh, the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0123] Combination of the above Figure 1The application scenarios of the communication method provided by the embodiment of the present application are briefly introduced, as well as the basic concepts that may be involved in the embodiment of the present application, and the certificate-related concepts are introduced in the basic concepts. It should be understood that if a large number of NF instances and services need to update certificates at the same time (such as due to the same expiration date of the certificates, or due to the revocation of the public CA certificate, or due to the compromise of the encryption algorithm used, etc.), the certificate management framework may trigger the certificate update process of all affected terminal entities at the same time. If there is no mechanism to manage this situation, it may cause congestion and / or overload in the automatic certificate management framework, resulting in temporary service unavailability.

[0124] Currently, one certificate update process is as follows: CUOF performs the following operations to reduce the risk of service unavailability caused by automatic certificate management.

[0125] 1) Query the certificate expiration alarm reported by the network management;

[0126] 2) Check the CA announcement of certificate revocation.

[0127] In the above certificate renewal process, CUOF can subscribe to CA announcement notifications, query CRL or Online Certificate Status Protocol (OCSP) data storage for certificate revocation, and according to the query results, CUOF can stagger certificate renewal in time so that only a small number of certificate renewals are carried out at the same time, while ensuring that the renewal is completed within the specified time, especially for those certificates that are about to expire. In addition, CUOF can determine the priority of certificate renewal for certificates with a shorter remaining expiration time.

[0128] However, the above certificate update process does not consider the problems that network element types may bring to certificate updates. For example, if there are few AMFs in the network, even if there are not a large number of NF service certificates updated at the same time, but the network elements that update service certificates are all AMFs, there will be no AMFs available in the network. Since network elements of different network element types are responsible for different tasks, problems may occur, resulting in reduced availability of the core network system, and even possible system failures.

[0129] The present application provides a communication method which can be applied in Figure 2 In the certificate management framework shown, the network element type to which the network element belongs is identified in the certificate update process, and the impact of the network element type on the service certificate update is considered to avoid system failures and prevent the certificate update from affecting the corresponding services in the network, thereby improving system performance.

[0130] It should be understood that the communication method provided in the embodiment of the present application can be applied to a 5G system, for example, Figure 1 The communication system shown in .

[0131] It should also be understood that the embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided in the embodiments of the present application, as long as it is possible to communicate according to the method provided in the embodiments of the present application by running a program that records the code of the method provided in the embodiments of the present application. For example, the execution subject of the method provided in the embodiments of the present application may be a network element, or a functional module in the network element that can call and execute the program.

[0132] Figure 3 This is a schematic flow chart of a communication method provided by the present application. It includes the following steps:

[0133] S310, the certificate management network element obtains first certificate information corresponding to a first service certificate of a first network element, and second certificate information corresponding to a second service certificate of a second network element.

[0134] The certificate management network element involved in this embodiment may be a network element such as CUOF or CeMF mentioned above that can implement certificate update and apply for network element certificates. In this embodiment, the name of the certificate management network element is not limited.

[0135] The first service certificate of the first network element is the service certificate required by the first network element, for example, the TLS certificate or DTLS certificate required for the first network element to establish a secure connection with other network elements, or the certificate required to establish an IPSEC channel, or a certificate used for specific purposes (such as encryption protection, integrity protection, authentication, etc.); similarly, the second service certificate of the second network element is the service certificate required by the second network element, for example, the TLS certificate required for the second network element to establish a secure connection with other network elements, or the certificate required to establish an IPSEC channel, or a certificate used for specific purposes (such as encryption protection, integrity protection, authentication, etc.).

[0136] It should be understood that the specific form of the service certificate is not limited in this embodiment, and it may be a service certificate defined in an existing protocol or introduced in a future protocol.

[0137] Specifically, the first certificate information includes the validity period of the first service certificate and information about the network element type to which the first network element belongs, and the second certificate information includes the validity period of the second service certificate and information about the network element type to which the second network element belongs.

[0138] Exemplarily, the validity period of the first service certificate can be indicated by: the expiration time of the first service certificate, the validity period of the first service certificate, the expiration time of the first service certificate, etc., wherein the expiration time, the expiration time, etc. can be absolute time or relative time, which is not limited in this embodiment. The validity period of the second service certificate can be indicated by: the expiration time of the second service certificate, the validity period of the second service certificate, the expiration time of the second service certificate, etc.

[0139] For example, the validity period of the first business certificate is: The first business certificate expires on January 1, 2022, which means that the validity period of the first business certificate is until December 31, 2019. For another example, the validity period of the first business certificate is: The validity period of the first business certificate is 3 months, which means that the validity period of the first business certificate is valid for 3 months from the time of issuance. For another example, the validity period of the first business certificate is: The expiration date of the first business certificate is December 31, 2019, which means that the validity period of the first business certificate is until December 31, 2019.

[0140] Exemplarily, the information of the network element type to which the network element belongs may be an identifier (ID) of the network element type. For example, if the network element type to which the first network element belongs is AMF, then the information of the network element type to which the first network element belongs is information indicating AMF; if the network element type to which the second network element belongs is AMF, then the information of the network element type to which the second network element belongs is information indicating AMF.

[0141] In this embodiment, the division method of the network element type to which the network element belongs includes but is not limited to: division by service function, division by deployment location, or division by home domain, etc. For example, division by service function may be division into network element types such as SMF or AMF; for another example, division by deployment location may be division into access network element or non-access network element; for another example, division by home domain may be division into visited network element or home network element, etc.

[0142] It should be noted that, in addition to the validity period of the first service certificate and the information on the type of network element to which the first network element belongs, the above-mentioned first certificate information may also include other information, for example, the first certificate information also includes the identification of the first network element, the version of the first service certificate, the issuer information of the first service certificate and other information related to the first service certificate, which is not limited in this embodiment. In addition to the validity period of the second service certificate and the information on the type of network element to which the second network element belongs, the second certificate information may also include other information, for example, the second certificate information also includes the identification of the second network element, the version of the second service certificate, the issuer information of the second service certificate and other information related to the second service certificate, which is not limited in this embodiment.

[0143] In this embodiment, the manner in which the information of the network element type to which the network element belongs is carried in the certificate information (such as the first certificate information or the second certificate information) includes but is not limited to the following two possible implementation manners:

[0144] As a possible implementation, the information of the network element type to which the network element belongs can be explicitly carried in the certificate information. For example, the first certificate information includes the information of the network element type to which the first network element belongs: the first certificate information carries an indication field #1 (such as nfTypes field #1), and the indication field #1 is used to indicate the network element type to which the first network element belongs. For another example, the second certificate information includes the information of the network element type to which the second network element belongs: the second certificate information carries an indication field #2 (such as nfTypes field #2), and the indication field #2 is used to indicate the network element type to which the second network element belongs.

[0145] As another possible implementation, the information of the network element type to which the network element belongs can be implicitly carried in the certificate information. For example, the first certificate information includes the first service certificate, and the network element type nfTypes field of the first service certificate includes the information of the network element type to which the first network element belongs. For another example, the second certificate information includes the second service certificate, and the network element type nfTypes field of the second service certificate includes the information of the network element type to which the second network element belongs. In this implementation, the certificate management network element can read the information of the network element type to which the first network element belongs from the network element type nfTypes field of the first service certificate, and read the information of the network element type to which the second network element belongs from the network element type nfTypes field of the second service certificate.

[0146] It should be understood that the above two possible implementation methods of carrying the information of the network element type to which the network element belongs are just examples of the carrying methods of the information of the network element type to which the network element belongs, and do not constitute any limitation on the protection scope of this application. Other methods of carrying the information of the network element type to which the network element belongs in the certificate information are also within the protection scope of this application. For example, the certificate information carries indication information #1, and the indication information #1 instructs the certificate management network element to obtain the information of the network element type to which the network element belongs from a specific network element.

[0147] It should also be understood that the certificate management network element shown in step S310 in this embodiment obtains the first certificate information corresponding to the first service certificate of the first network element and the second certificate information corresponding to the second service certificate of the second network element is only an example, and does not constitute any limitation on the protection scope of this application. The certificate management network element can also obtain information on service certificates of other network elements. For example, the certificate management network element can also obtain third certificate information corresponding to the third service certificate of the third network element. The third network element can be a network element of the same or different type as the network element to which the first network element belongs, and examples are not given here one by one.

[0148] In this embodiment, the way in which the certificate management network element obtains the certificate information includes but is not limited to the following possible implementations:

[0149] As a possible implementation manner, the certificate management network element may obtain the first certificate information in a first service certificate request process of the first network element, and obtain the second certificate information in a second service certificate request process of the second network element.

[0150] For example, the certificate management network element receives and stores the first certificate information in the service certificate request process of the first network element; and receives and stores the second certificate information in the service certificate request process of the second network element. In this application, the timing relationship between the first network element initiating the certificate request and the second network element initiating the certificate request is not limited.

[0151] For ease of understanding, the following will be combined Figure 4 How the certificate management network element obtains the certificate information corresponding to the service certificate of a certain network element (such as the first network element or the second network element) in the service certificate request process of the network element is introduced in detail, which will not be repeated here.

[0152] As another possible implementation, the certificate management network element may obtain the information of the first certificate and the second certificate through an OAM device query. For example, in this implementation, the certificate management network element obtains the first certificate information and the second certificate information from the OAM through a query request message.

[0153] As another possible implementation, the certificate management network element obtains information push of the service certificate of the network element through a subscription process or a query process. For example, in this implementation, the certificate management network element subscribes to the first certificate information and the second certificate information from the first network element and the second network element respectively through a subscription request message; for another example, the certificate management network element queries the first certificate information and the second certificate information from the first network element and the second network element respectively through a query request message.

[0154] It should be noted that the above-mentioned several implementation methods of the certificate management network element obtaining certificate information are only examples of how the certificate management network element obtains the certificate information corresponding to the business certificates of different network elements, and do not constitute any limitation on the scope of protection of this application. The certificate management network element can also obtain the certificate information corresponding to the business certificates of different network elements through other methods, which will not be explained one by one here.

[0155] Exemplarily, after the certificate management network element obtains the certificate information corresponding to the service certificates of different network elements, it may maintain a mapping table between different network elements and the certificate information locally.

[0156] For example, the certificate management network element obtains the first certificate information corresponding to the first service certificate of the first network element and the second certificate information corresponding to the second service certificate of the second network element, and the mapping table locally maintained by the certificate management network element is shown in Table 2 below:

[0157] Table 2:

[0158] NE number (optional) Network element identification Network element type Certificate expiration date Certificate ID (optional) 1 NF1:319000 AMF 20220303 319000acb234ff 2 NF2:319001 AMF 20220305 319000acb234fd

[0159] In Table 2, NF1 is the first network element, NF2 is the second network element, and both the first network element and the second network element are AMFs.

[0160] Exemplarily, the certificate management network element may also obtain and save the third certificate information corresponding to the third service certificate of the third network element. For example, the mapping table locally maintained by the certificate management network element is shown in Table 3 below:

[0161] Table 3:

[0162] NE number (optional) Network element identification Network element type Certificate expiration date Certificate ID (optional) 1 NF1:319000 AMF 20220303 319000acb234ff 2 NF2:319001 AMF 20220305 319000acb234fd 3 NF2:319002 SMF 20221009 319000acb234aa

[0163] In Table 3, NF1 is the first network element, NF2 is the second network element, and NF3 is the third network element. Both the first network element and the second network element are AMFs, and the third network element is SMF, which is a different type of network element from the first network element or the second network element.

[0164] S320: The certificate management network element determines an update policy corresponding to the first service certificate and the second service certificate.

[0165] Specifically, in this embodiment, the certificate management network element determines the update policy corresponding to the first business certificate and the second business certificate when it is determined that the first network element and the second network element belong to the same network element type based on the information of the network element type to which the first network element belongs and the information of the network element type to which the second network element belongs, and when it is determined that the first business certificate and the second business certificate need to be updated based on the validity period of the first business certificate and the validity period of the second business certificate.

[0166] In this embodiment, the certificate management network element may determine that the first network element and the second network element belong to the same network element type based on the information of the network element type to which the first network element belongs and the information of the network element type to which the second network element belongs. For example, the certificate management network element determines that the first network element and the second network element are both AMFs; or, the certificate management network element determines that the first network element and the second network element are both SMFs; or, the certificate management network element determines that the first network element and the second network element are both DUs; or, the certificate management network element determines that the first network element and the second network element are both CUs, etc.

[0167] It should be noted that in this embodiment, the first network element and the second network element belong to the same network element type, which can be understood as: the first network element and the second network element are responsible for the same work in the system, but the specific network element types of the first network element and the second network element are not limited.

[0168] Exemplarily, the certificate management network element determines that the first business certificate and the second business certificate need to be updated based on the validity period of the first business certificate and the validity period of the second business certificate, including: the certificate management network element determines that the time interval between the expiration time of the first business certificate and the expiration time of the second business certificate is less than a first preset threshold based on the validity period of the first business certificate and the validity period of the second business certificate.

[0169] Among them, the time interval between the expiration time of the first business certificate and the expiration time of the second business certificate is less than the first preset threshold value, which means that the time when the first business certificate needs to be updated is similar to the time when the second business certificate needs to be updated. If the first business certificate and the second business certificate are updated according to the time when the first business certificate needs to be updated and the time when the second business certificate needs to be updated, it may cause the time when the first network element and the second network element are in the certificate update state to overlap or partially overlap.

[0170] It should be understood that in this embodiment, the certificate management network element determines that the service certificate needs to be updated according to the validity period of the service certificate, which is only an example. The certificate management network element may also determine that the service certificate needs to be updated in other ways. For example, the certificate management network element may determine that the first service certificate and the second service certificate need to be updated because: the root certificate of the public CA is revoked, or the encryption algorithm used is outdated and is considered to need to be replaced.

[0171] Exemplarily, in this embodiment, the update strategy corresponding to the first service certificate and the second service certificate determined by the certificate management network element includes the following methods:

[0172] Method 1: The certificate management network element determines a first update policy corresponding to the first service certificate, and determines a second update policy corresponding to the second service certificate.

[0173] Specifically, the first update policy is used to indicate the update time of the first service certificate, and the second update policy is used to indicate the update time of the second service certificate. The update time of the first service certificate is different from the update time of the second service certificate.

[0174] Exemplarily, the first update policy is used to indicate the update time of the first service certificate, including:

[0175] The first update strategy includes the update time of the first service certificate, wherein the update time of the first service certificate is an absolute time or a relative time, such as the update time of the first service certificate is an absolute first moment, or the update time of the first service certificate is a moment after the first network element receives the first update strategy for a first period of time.

[0176] Similarly, the second update policy is used to indicate the update time of the second service certificate, including:

[0177] The second update policy includes the update time of the second service certificate, wherein the update time of the second service certificate is an absolute time or a relative time, such as the update time of the second service certificate is an absolute first moment, or the update time of the second service certificate is a moment after the second network element receives the second update policy for a second period of time.

[0178] In this embodiment, the update time of the first business certificate determined by the certificate management network element is earlier than the expiration time of the first business certificate, the update time of the second business certificate determined by the certificate management network element is earlier than the expiration time of the second business certificate, and the update time of the first business certificate and the update time of the second business certificate are different, while the expiration time of the first business certificate and the expiration time of the second business certificate are similar to or the same, which can ensure that the first business certificate and the second business certificate can be updated before expiration and are not updated at the same time.

[0179] As a possible implementation manner, the update time of the first service certificate is time #1, and the update time of the second service certificate is time #2, and time #1 and time #2 are different.

[0180] As another possible implementation manner, the update time of the first service certificate is time slot #1, and the update time of the second service certificate is time slot #2, and time slot #1 and time slot #2 are different.

[0181] Exemplarily, in this embodiment, the certificate management network element can determine the certificate update policy of different network elements according to the locally maintained mapping table (such as the above-mentioned Table 2 or Table 3). For example, the certificate management network element determines the service certificate update policy of different network elements according to the expiration time of the service certificates of different network elements.

[0182] Optionally, the update time of the first service certificate and the update time of the second service certificate are separated by a first duration, and the first duration is greater than or equal to the duration required for the first network element or the second network element to obtain the updated service certificate. For example, the duration required for the first network element to obtain the updated first service certificate is duration #1, and the duration required for the second network element to obtain the updated second service certificate is duration #2, then the first duration is greater than or equal to duration #1 or duration #2; for another example, the first duration is greater than or equal to the average of duration #1 and duration #2.

[0183] Further, in the case shown in method 1, after the certificate management network element determines the service certificate update policy of different network elements, it sends an update policy message to the network element for indicating the network element certificate update policy, so that different network elements can update the service certificate based on different update policies. In the case shown in method 1, Figure 3 The method flow shown also includes:

[0184] S331, the certificate management network element sends a first update policy to the first network element, and sends a second update policy to the second network element.

[0185] It should be understood that in this embodiment, there is no restriction on how the certificate management network element sends the update policy of the service certificate to a certain network element, and the update policy of the service certificate can be transmitted through the communication interface between the certificate management network element and the network element, such as transmitting the update policy of the service certificate through a service-oriented interface (Service interface, SBI) or a southbound interface of the network management. Among them, the southbound interface of the network management is an interface for the network management to connect to the device, which is used to manage the device.

[0186] S341: The first network element updates the first service certificate based on the first update policy.

[0187] Specifically, in this embodiment, after receiving the first update policy, the first network element updates the first service certificate based on the first update policy. For example, the first network element initiates a service certificate update process at the update time of the first service certificate.

[0188] Exemplarily, the first network element initiates a service certificate update process at the update time of the first service certificate, including: sending an update request message of the first service certificate to the certificate issuing network element at the update time of the first service certificate.

[0189] In this embodiment, the first network element sends an update request message of the first service certificate to the certificate issuing network element, including the following two possible implementation methods:

[0190] As a possible implementation manner, the first network element may directly send an update request message of the first service certificate to the certificate issuing network element to initiate an update process of the first service certificate.

[0191] As another possible implementation, the first network element may indirectly (e.g., through the certificate management network element #1) send an update request message of the first service certificate to the certificate issuing network element to initiate the update process of the first service certificate. The certificate management network element #1 may be the certificate management network element that provides the first update policy, or may be a certificate management network element different from the certificate management network element that provides the first update policy, which is not limited in this embodiment.

[0192] S351. The second network element updates the second service certificate based on the second update policy.

[0193] Specifically, in this embodiment, after receiving the second update policy, the second network element updates the second service certificate based on the second update policy. For example, the second network element initiates a service certificate update process at the update time of the second service certificate.

[0194] Exemplarily, the second network element initiates a service certificate update process at the update time of the second service certificate, including: sending an update request message of the second service certificate to the certificate issuing network element at the update time of the second service certificate.

[0195] In this embodiment, the second network element sends an update request message of the second service certificate to the certificate issuing network element, including the following two possible implementation methods:

[0196] As a possible implementation manner, the second network element may directly send an update request message of the second service certificate to the certificate issuing network element to initiate an update process of the second service certificate.

[0197] As another possible implementation, the second network element may indirectly (e.g., through the certificate management network element #2) send an update request message of the second service certificate to the certificate issuing network element to initiate the update process of the second service certificate. The certificate management network element #2 may be the certificate management network element that provides the second update policy, or may be a certificate management network element different from the certificate management network element that provides the second update policy, which is not limited in this embodiment.

[0198] In the case shown in method 1, the update policy formulated by the certificate management network element may be: formulate a first update policy for the first service certificate, and formulate a second update policy for the second service certificate. Specifically, the first update policy is used to indicate the update time of the first service certificate, and the second update policy is used to indicate the update time of the second service certificate, and the update time of the first service certificate and the update time of the second service certificate are different. The certificate management network element sends the first update policy and the second update policy to the first network element and the second network element respectively, so that the first network element and the second network element initiate the service certificate update at different times, thereby avoiding the first network element and the second network element from updating the service certificates at the same time.

[0199] Method 2: The certificate management network element determines the overall update policy corresponding to the first service certificate and the second service certificate.

[0200] For the sake of distinction, in the case shown in mode 2, the total update policy determined by the certificate management network element is recorded as total update policy #1. Specifically, total update policy #1 is used to indicate the update time of the first service certificate and the update time of the second service certificate, and the update time of the first service certificate is different from the update time of the second service certificate.

[0201] It should be noted that in the case shown in method 2, the update time of the first business certificate and the update time of the second business certificate determined by the certificate management network element are the same as the case shown in the above method 1, and they are not repeated here.

[0202] The difference between method 2 and method 1 is:

[0203] In the case shown in method 2, after the certificate management network element determines the update time of the first business certificate and the update time of the second business certificate, there is no need to provide an update policy to the first network element and the second network element. Instead, the update of the first business certificate and the second business certificate is controlled according to the overall update policy #1.

[0204] Specifically, in the case shown in method 2, Figure 3 The method flow shown also includes:

[0205] S332, the certificate management network element controls the update of the first service certificate and the second service certificate according to the overall update strategy #1.

[0206] If, before the update time of the first service certificate, the certificate management network element receives a first request message from the first network element requesting to update the first service certificate, the certificate management network element refuses to respond to the first request message;

[0207] If the certificate management network element receives a second request message from the second network element requesting to update the second service certificate before the update time of the second service certificate, the certificate management network element refuses to respond to the second request message.

[0208] The certificate management network element responds to the service certificate update request message of the network element (eg, the first network element or the second network element) specifically including: requesting the certificate issuing network element to update the certificate on behalf of the network element.

[0209] In the case shown in the second method, the update policy formulated by the certificate management network element may be: formulate a general update policy for the first service certificate and the second service certificate, the general update policy is used to indicate the update time of the first service certificate and the update time of the second service certificate, and the update time of the first service certificate and the update time of the second service certificate are different. After the certificate management network element formulates the general update policy, the update of the first service certificate and the update of the second service certificate are controlled based on the general update policy to avoid the first network element and the second network element from updating the service certificates at the same time.

[0210] Method three: The certificate management network element determines the overall update policy #2 corresponding to the first service certificate and the second service certificate.

[0211] Total update strategy #2 is used to indicate the number of online network elements among multiple network elements corresponding to the network element type, and control the update of the first service certificate and the second service certificate. In addition to the first network element and the second network element, the multiple network elements corresponding to the network element type also include N online third network elements, where N is a positive integer.

[0212] Exemplarily, the service certificate of an online network element is in use. If the service certificate of a network element is in an unusable state (eg, being updated), the network element does not belong to the online network element.

[0213] Specifically, in the case shown in method 3, Figure 3 The method flow shown also includes:

[0214] S333, the certificate management network element controls the update of the first service certificate and the second service certificate according to the overall update strategy #2.

[0215] If N is greater than a second preset threshold, determining that the first service certificate and the second service certificate can be updated at the same time;

[0216] If N is less than or equal to the second preset threshold, it is determined that the first service certificate and the second service certificate cannot be updated at the same time.

[0217] It should be understood that the second preset threshold value may be predefined, indicating the number of network elements of the network element type in the system that should be online. If the number of online network elements is less than the second preset threshold value, it may cause the system availability to be reduced or even cause a system failure. In this embodiment, no limitation is imposed on the specific value of the second preset threshold value.

[0218] Exemplarily, if the certificate management network element determines that the first service certificate and the second service certificate cannot be updated at the same time, when the certificate management network element simultaneously receives a first request message from the first service certificate of the first network element requesting to update the first service certificate, and receives a second request message from the second service certificate of the second network element requesting to update the second service certificate, the certificate management network element determines to reject the response to the first request message and / or the second request message. For example, the certificate management network element sends a rejection response #1 to the first network and sends a rejection response #2 to the second first network.

[0219] Exemplarily, if the certificate management network element determines that the first service certificate and the second service certificate can be updated at the same time, when the certificate management network element simultaneously receives a first request message from the first network element for requesting to update the first service certificate, and receives a second request message from the second network element for requesting to update the second service certificate, the certificate management network element determines to respond to the first request message and / or the second request message. For example, the certificate management network element requests the certificate issuing network element to update the certificate instead of the network element.

[0220] As can be seen from the above, in the case shown in method 3, the certificate management network element can control the update of the first service certificate and the second service certificate according to the number of online network elements in the multiple network elements corresponding to the network element type. Optionally, the certificate management network element can obtain information of multiple network elements corresponding to different network element types from the storage function network element (such as NRF). For ease of understanding, the following will be combined with Figure 5 The detailed description of the process by which the certificate management network element obtains information of multiple network elements corresponding to different network element types from the storage function network element, and determines whether to respond to the service certificate update request message of the network element according to the overall update strategy #2 is not described in detail here.

[0221] In the case shown in the third method, the update policy formulated by the certificate management network element may be: formulate a general update policy for the first service certificate and the second service certificate, and the general update policy is used to indicate the situation of multiple network elements corresponding to the network element type, and control the update of the first service certificate and the second service certificate. After the certificate management network element formulates the general update policy, it controls the update of the first service certificate and the update of the second service certificate based on the general update policy to avoid the first network element and the second network element from updating the service certificates at the same time.

[0222] Figure 3 In the communication method shown, the certificate management network element can determine the service certificate update policy of the network element according to the network element type to which the different network elements belong. This can prevent network elements of a certain type in the system from simultaneously executing service certificate updates, and there are network elements of this type available in the network, thereby improving system availability and avoiding system failures.

[0223] As can be seen from the above step S310, the certificate management network element can obtain the service certificate information of a certain network element (such as the first network element or the second network element) in the service certificate request process of the network element. Figure 4 Provide detailed explanation.

[0224] Figure 4 This is a schematic flow chart of a service certificate request process provided by this application. It includes the following steps:

[0225] S410, network element #1 sends a certificate request message #1 to the certificate management network element.

[0226] Network element #1 may be the first network element or the second network element mentioned above, or other network elements, which is not limited in this embodiment.

[0227] The certificate request message #1 is used to request the issuance of a service certificate #1. The certificate request message #1 includes the identifier #1 of the network element #1, which refers to the identifier (identify, ID) used by the network element #1 when applying for a service certificate, which can be the network element instance ID, or the sender ID in the certificate request, or the content in the subject name (Subject alt Name), or the IP address of the network element, etc., any ID that can mark the network element #1 instance within a period of time.

[0228] S420, the certificate management network element sends a certificate request message #2 to the certificate authority.

[0229] The certificate request message #2 is used to request the issuance of service certificate #1. The certificate request message #2 includes the identifier #2 of the network element #1, and the identifier #2 of the network element #1 is the same as or different from the identifier #1 of the network element #1 carried by the certificate request message #1 in the above step S410. For example, the identifier #1 of the network element #1 is the NF instance ID inside the network, and the identifier #2 of the network element #1 is the Sender ID used by the certificate issuing authority to identify the NF.

[0230] In this embodiment, the certificate issuing authority may be a network element that issues certificates, such as a CA or an RA.

[0231] S430, the certificate issuing authority sends a certificate response message #2 to the certificate management network element.

[0232] Specifically, the certificate response message #2 includes the service certificate #1, the identifier of the network element #1, and the information of the network element type to which the network element #1 belongs. Figure 3 The first network element in the communication method shown in the figure, the service certificate #1 is the above-mentioned first service certificate, and the information of the network element type to which the network element #1 belongs is the information of the network element type to which the above-mentioned first network element belongs; for example, the network element #1 is the above-mentioned Figure 3 For the second network element in the communication method shown, the service certificate #1 is the above-mentioned second service certificate, and the information of the network element type to which the network element #1 belongs is the information of the network element type to which the above-mentioned second network element belongs.

[0233] Business certificate #1 can be a TLS or IPSEC certificate, or a certificate of a virtual machine or container, and this application does not impose any restrictions on this.

[0234] The identifier of network element #1 is used to identify network element #1, and may be the identifier #2 of network element #1 carried in the above step S420.

[0235] Optionally, the identifier of network element #1 may be carried explicitly or in service certificate #1, for example, part or all of the content in the Subject Alt Name (SAN) or a field in sender ID may be considered as the identifier of network element #1.

[0236] The network element type to which the network element #1 belongs may be AMF, SMF, etc. Optionally, the NF type in the extension field (extension) of the service certificate #1 may be regarded as carrying information on the network element type to which the network element #1 belongs.

[0237] S440, the certificate management network element records the certificate information of the service certificate #1.

[0238] Specifically, the certificate management network element records the identifier of the network element #1 corresponding to the service certificate #1, the network element type to which the network element #1 belongs, the expiration time of the service certificate #1, and the like.

[0239] As a possible implementation manner, if the certificate response message #2 carries the identifier of the network element #1, the certificate management network element can directly obtain the identifier of the network element #1 from the certificate response message #2.

[0240] As another possible implementation method, the certificate response message #2 does not carry the identifier of network element #1, and the identifier of network element #1 is carried together with the service certificate #1. The certificate management network element can obtain the identifier of network element #1 according to the Subject Alt Name (SAN) field of the service certificate #1.

[0241] As a possible implementation manner, if the certificate response message #2 carries information about the network element type to which the network element #1 belongs, the certificate management network element can directly obtain the network element type to which the network element #1 belongs from the certificate response message #2.

[0242] As another possible implementation method, the certificate response message #2 does not carry the information about the network element type to which network element #1 belongs. The information about the network element type to which network element #1 belongs is carried together with the service certificate #1. The certificate management network element can obtain the network element type to which network element #1 belongs from the extension field (such as the nfTypes field) in the service certificate #1.

[0243] In addition, it should be noted that when the certificate management network element cannot obtain one or more of the above-mentioned information such as the identification of network element #1, the network element type to which network element #1 belongs, and the expiration time of service certificate #1, the certificate management network element can provide the unobtained information to the corresponding network element. For example, the certificate management network element can request to supplement the unobtained information by sending a supplement request message to the certificate issuing authority or the corresponding network element (such as network element #1).

[0244] S450, the certificate management network element sends a certificate response message #1 to network element #1.

[0245] The certificate response message #1 includes the service certificate #1 and the identifier of the network element #1.

[0246] Figure 4 In the business certificate request process shown, the certificate management network element can receive information about the business certificate of a certain network element from the certificate issuing authority. When the certificate response message #2 sent by the certificate issuing authority does not display information about the network element type to which the network element belongs, the certificate management network element can extract and record information about the network element type to which the network element belongs from the network element type nfTypes field of the business certificate.

[0247] The present application also provides a communication method, where the certificate management network element does not need to configure the update strategy of the service certificate for the network element in advance, but directly determines whether to agree to the update process of the service certificate of the network element based on the query result from the storage function network element when the network element initiates the service certificate update, so that a certain type of network element in the system will not execute the service certificate update at the same time, and there are network elements of this type available in the network, thereby improving system availability and avoiding system failures. Figure 5 This communication method is described in detail.

[0248] Figure 5 It is a schematic flow chart of another communication method provided by the present application. It includes the following steps:

[0249] S510: The certificate management network element sends a third request message to the storage function network element.

[0250] The third request message is used to request information about network elements corresponding to different network element types. For example, the third request message is used to request information about AMF, information about SMF, etc.

[0251] Exemplarily, the storage function network element in this embodiment may be an NRF. After the network element goes online, it is registered in the NRF through a registration message (e.g., Nnrf_NF Management_NF Register request), so the NRF can record the addition of network elements of a certain network element type. The NRF knows the information of network elements corresponding to different network element types through the above method.

[0252] The third request message may be a discovery request message or a subscription request message. If the third request message is a subscription request message, it can be understood that the NRF has a new subscription function, which is used for the certificate management network element to allow the NRF to feedback the network element information corresponding to different network element types. The network element information may be one or more of the instance ID, the fully qualified domain name (FQDN), or the Internet Protocol IP address information.

[0253] The third request message includes the identifier of the certificate management network element and information of at least one network element type. The storage function network element is requested to provide the number of network elements corresponding to at least one network element type. Among them, the identifier of the certificate management network element is used to directly or indirectly identify the identity of the certificate management network element. For example, the identifier of the certificate management network element may be the instance ID of the certificate management network element, or the NF type of the certificate management network element, or the identifier of the land public mobile communication network (Public Land Mobile Network, PLMN) where the certificate management network element is located. For example, the identifier of the certificate management network element may be a joint identifier of multiple parameters, such as the identifier of the certificate management network element includes the NF type of the certificate management network element and the identifier of the PLMN where the certificate management network element is located. Exemplarily, the network element type to which the certificate management network element belongs is a management network element, and the PLMN ID is 001, indicating that the certificate management network element is a certificate management network element located in PLMN 001.

[0254] Optionally, the third request message also includes information of the first area, in order to request to obtain information of network elements corresponding to different network element types in the first area. For example, the third request message includes an IP address of a certificate management network element.

[0255] Exemplarily, if the third request message is a subscription request message, the subscription event may be information about network elements corresponding to multiple different network element types.

[0256] S520, the storage function network element determines whether the certificate management network element can call the service.

[0257] As a possible implementation method, the storage function network element pre-configures the correspondence between the first area information and the identifier of the certificate management network element that can call the service (such as the instance ID of the certificate management network element, the IP address of the certificate management network element). If the identifier of the certificate management network element that sends the third request message belongs to one of the identifiers of multiple certificate management network elements corresponding to the first area, the storage function network element determines that the third request message can be responded to based on the correspondence.

[0258] As another possible implementation method, the identifier of the certificate management network element includes NF type and PLMN ID, and the storage function network element determines whether the certificate management network element can request information about the network elements in the PLMN or area identified by the PLMN ID through the NF type and PLMN ID. If the certificate management network element that sends the third request message determines whether the certificate management network element can request information about the network elements in the PLMN or area identified by the PLMN ID, the storage function network element determines whether the third request message can be responded to based on the corresponding relationship.

[0259] S530: The storage function network element sends a response message to the certificate management network element.

[0260] The response message includes information about network elements corresponding to different network element types.

[0261] For the convenience of description, in this embodiment, the response message includes information about the network element corresponding to the network element type #1. Figure 3 In the communication method shown, the first network element and the second network element belong to the network element type #1.

[0262] S540, the certificate management network element obtains first certificate information corresponding to the first service certificate of the first network element, and second certificate information corresponding to the second service certificate of the second network element.

[0263] Specifically, the way in which the certificate management network element obtains the certificate information is described in the above step S310, which will not be repeated here.

[0264] S550: The certificate management network element determines an update policy corresponding to the first service certificate and the second service certificate.

[0265] Figure 5 In the communication method shown, the certificate management network element determines the update policy corresponding to the first service certificate and the second service certificate, including: the certificate management network element determines the total update policy #2 corresponding to the first service certificate and the second service certificate. The total update policy #2 is used to indicate the number of online network elements in multiple network elements corresponding to the network element type, and control the update of the first service certificate and the second service certificate.

[0266] S560: The certificate management network element receives a first request message from the first network element, and receives a second request message from the second network element.

[0267] The first request message is used to request to update the first service certificate, and the second request message is used to request to update the second service certificate.

[0268] As a possible implementation method, the certificate management network element can decide, based on the expiration time of the service certificate, to send an update notification #1 to the first network element when the first service certificate of the first network element is about to expire, instructing the first network element to initiate a service certificate update process; and to send an update notification #2 to the second network element when the second service certificate of the second network element is about to expire, instructing the second network element to initiate a service certificate update process.

[0269] As another possible implementation, the first network element and the second network element may initiate a service certificate update process on their own. For example, when the first service certificate is about to expire, the first network element initiates a service certificate update process; when the second service certificate is about to expire, the second network element initiates a service certificate update process.

[0270] S570, the certificate management network element controls the update of the first service certificate and the second service certificate according to the overall update strategy #2.

[0271] Specifically, the certificate management network element may control the updating of the first service certificate and the second service certificate according to the number of online network elements among the multiple network elements corresponding to the network element type.

[0272] As a possible implementation manner, the certificate management network element obtains information of network elements corresponding to different network element types from the NRF through steps S510 to S530, including: identifiers of network elements corresponding to different network element types.

[0273] Thus, the certificate management network element can record the total number of online network elements corresponding to different network element types. For example, the information of different network elements locally maintained by the certificate management network element is shown in Table 4 below:

[0274] Table 4:

[0275] Network element type Online quantity AMF 4 SMF 0 UPF 1

[0276] Among them, the certificate of the online network element is in use (or normal).

[0277] Under this implementation method, after the certificate management network element receives a first request message from the first network element corresponding to network element type #1 and a second request message from the second network element corresponding to network element type #1, it determines whether the number of online network elements corresponding to network element type #1 meets the requirements if the first network element and the second network element update their service certificates at the same time.

[0278] For ease of understanding, a specific example is used to illustrate how the certificate management network element controls the update of the first service certificate and the second service certificate according to the general update strategy #2:

[0279] Example 1: Both the first network element and the second network element are AMFs, and it is specified that there must be more than one AMF online in the system (at least two).

[0280] In the case shown in Example 1, if the certificate management network element simultaneously receives the first request message of the first network element and the second request message of the second network element, according to the situation shown in Table 4 above, there are a total of 4 online AMFs. Even if the first network element and the second network element update the service certificates at the same time, there are still 4-2=2 AMFs online in the system, which meets the requirements.

[0281] In this case, the first network element and the second network element may simultaneously update the service certificate, that is, the certificate management network element may respond to the first request message and the second request message.

[0282] It should be noted that after the certificate management network element responds to the first request message and the second request message, the above-mentioned Table 4 can be updated, and the number of online AMFs should be reduced by 2, then the above-mentioned Table 4 is updated to the following Table 5:

[0283] Table 5:

[0284] Network element type Online quantity AMF 2 SMF 0 UPF 1

[0285] As another possible implementation, the certificate management network element obtains information of network elements corresponding to different network element types from the NRF through steps S510 to S530, including: identifiers of network elements corresponding to different network element types. The certificate management network element can obtain and record the certificate status of different network elements according to the identifiers of different network elements.

[0286] Thus, the certificate management network element can record the certificate status of network elements corresponding to different network element types. For example, the information of different network elements locally maintained by the certificate management network element is shown in Table 6 below:

[0287] Table 6:

[0288] NF logo NF type Certificate Status 1001 AMF Expiring Soon 1002 AMF Updating 1003 AMF normal 1004 AMF Updating

[0289] The certificate status of the online network element is in use (or normal).

[0290] Optionally, the certificate management network element determines to respond to the certificate update request message, sends a certificate update request message to the certificate authority, and updates the certificate. If the table locally maintained by the certificate management network element is the above-mentioned Table 4, after the certificate update of the first network element and the second network element is completed, the number of online network elements corresponding to the AMF can be increased by 2. If the table locally maintained by the certificate management network element is the above-mentioned Table 6, the certificate status corresponding to the first network element and the second network element is changed to normal.

[0291] If the certificate management network element determines to reject the certificate update request, it sends a certificate rejection response to the network elements (the first network element and the second network element). The rejection response may carry a reason value. For example, the reason value is used to indicate that the certificate cannot be updated during this period and needs to be retried after waiting.

[0292] For example, the certificate management network element sends a rejection response #1 to the first network element, and the rejection response #1 carries indication information, instructing the first network element to wait for a first period of time before re-initiating a certificate update request; the certificate management network element sends a rejection response #2 to the second network element, and the rejection response #2 carries indication information, instructing the second network element to wait for a second period of time before re-initiating a certificate update request, and the first period of time and the second period of time are different.

[0293] In addition, it should be noted that Figure 5 In the communication method shown, the certificate management network element can control the service certificate update of the first network element and the second network element according to the number of online network elements corresponding to the network element type #1. This is just an example. In this embodiment, the certificate management network element also controls a single network element to initiate a service certificate update according to the overall update strategy #2. For example, the certificate management network element obtains the number of online AMFs as M through the above steps S510 to S530 (as shown in Table 4 above). After an AMF initiates the certificate update process, the certificate management network locally maintains the number of unavailable AMFs plus 1 (or the number of online AMFs minus 1). When the number of unavailable AMFs is close to or equal to the total number of AMFs M, the certificate management network element will refuse to respond to the network element's certificate update request.

[0294] It should be understood that the sequence numbers of the above processes do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0295] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0296] It should also be understood that in some of the above embodiments, the devices in the existing network architecture are mainly used as examples for exemplary description (such as a certificate management network element, a first network element, a second network element, or a storage function network element, etc.), and it should be understood that the specific form of the device is not limited in the embodiments of the present application. For example, devices that can achieve the same function in the future are applicable to the embodiments of the present application.

[0297] It can be understood that in the above-mentioned method embodiments, the methods and operations implemented by the device (such as the certificate management network element, the first network element, the second network element or the storage function network element, etc.) can also be implemented by components of the device (such as chips or circuits).

[0298] Above, combined Figures 3 to 5 The communication method provided by the embodiment of the present application is described in detail. The above communication method is mainly introduced from the perspective of interaction between various protocol layers of the terminal device. It can be understood that in order to realize the above functions, the terminal device includes a hardware structure and / or software module corresponding to each function.

[0299] Those skilled in the art should be aware that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0300] The following combination Figures 6 to 8 The communication device provided by the present application is described in detail. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, the content not described in detail can be referred to the method embodiment above, and some content will not be repeated for the sake of brevity.

[0301] The embodiment of the present application can divide the functional modules of the transmitting end device or the receiving end device according to the above method example. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0302] Figure 6 1 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application. The device 10 includes a transceiver module 11 and a processing module 12. The transceiver module 11 can implement corresponding communication functions, and the processing module 12 is used to perform data processing, or in other words, the transceiver module 11 is used to perform operations related to receiving and sending, and the processing module 12 is used to perform other operations besides receiving and sending. The transceiver module 11 can also be called a communication interface or a communication unit.

[0303] Optionally, the device 10 may further include a storage module 13, which may be used to store instructions and / or data. The processing module 12 may read the instructions and / or data in the storage module so that the device implements the actions of the devices in the aforementioned method embodiments.

[0304] In one design, the device 10 may correspond to the certificate management network element in the above method embodiment, or be a component (such as a chip) of the certificate management network element.

[0305] The device 10 can implement the steps or processes executed by the certificate management network element in the above method embodiment, wherein the transceiver module 11 can be used to execute operations related to the sending and receiving of the certificate management network element in the above method embodiment, and the processing module 12 can be used to execute operations related to the processing of the certificate management network element in the above method embodiment.

[0306] In one possible implementation, the transceiver module 11 is used to obtain first certificate information corresponding to a first business certificate of a first network element and second certificate information corresponding to a second business certificate of a second network element, wherein the first certificate information includes information on the validity period of the first business certificate and information on the network element type to which the first network element belongs, and the second certificate information includes information on the validity period of the second business certificate and information on the network element type to which the second network element belongs; the processing module 12 may be used to determine an update policy corresponding to the first business certificate and the second business certificate when it is determined that the first network element and the second network element belong to the same network element type based on information on the network element type to which the first network element belongs and information on the network element type to which the second network element belongs, and when it is determined that the first business certificate and the second business certificate need to be updated based on the validity period of the first business certificate and the validity period of the second business certificate; the processing module 12 may be used to control the updating of the first business certificate and the second business certificate based on the update policy.

[0307] Wherein, when the device 10 is used to perform Figure 3 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as step S331; the processing module 12 can be used to execute the processing steps in the method, such as steps S320, S332 and S333.

[0308] When the device 10 is used to perform Figure 4 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S410, S420, S430 and S450; the processing module 12 can be used to execute the processing steps in the method, such as step S440.

[0309] When the device 10 is used to perform Figure 5 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S510, S530 and S560; the processing module 12 can be used to execute the processing steps in the method, such as steps S540, S550 and S570.

[0310] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0311] In another design, the device 10 may correspond to the first network element or the second network element in the above method embodiment, or a component (such as a chip) of the first network element or the second network element.

[0312] The device 10 can implement steps or processes corresponding to those executed by the first network element or the second network element in the above method embodiment, wherein the transceiver module 11 can be used to execute operations related to the transceiver of the first network element or the second network element in the above method embodiment, and the processing module 12 can be used to execute operations related to the processing of the first network element or the second network element in the above method embodiment.

[0313] In one possible implementation, the transceiver module 11 is used to receive a first update policy from a certificate management network element, where the first update policy is used to indicate an update time of a first service certificate; the processing module 12 is used to send an update request message of the first service certificate to the certificate issuing network element at the update time of the first service certificate.

[0314] Wherein, when the device 10 is used to perform Figure 3 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as step S331; the processing module 12 can be used to execute the processing steps in the method, such as step S341.

[0315] When the device 10 is used to perform Figure 4 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S410 and S450; the processing module 12 can be used to execute the processing steps in the method.

[0316] When the device 10 is used to perform Figure 5 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as step SS560; the processing module 12 can be used to execute the processing steps in the method.

[0317] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0318] In another design, the device 10 may correspond to the storage function network element in the above method embodiment, or be a component of the storage function network element (such as a chip).

[0319] The device 10 can implement the steps or processes corresponding to the storage function network element in the above method embodiment, wherein the transceiver module 11 can be used to perform operations related to the transmission and reception of the storage function network element in the above method embodiment, and the processing module 12 can be used to perform operations related to the processing of the storage function network element in the above method embodiment.

[0320] In one possible implementation, the transceiver module 11 is used to receive a third request message from a certificate management network element, wherein the third request message is used to request information of multiple network elements corresponding to the network element type, and the third request message includes information of the network element type; the processing module 12 is used to determine, based on local policies, that the certificate management network element can obtain information of multiple network elements corresponding to the network element type; the transceiver module 11 is used to send a response message to the certificate management network element, wherein the response message includes information of some or all of the multiple network elements corresponding to the network element type.

[0321] Wherein, when the device 10 is used to perform Figure 5 When the method is performed, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S510 and S530; the processing module 12 can be used to execute the processing steps in the method, such as step S520.

[0322] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0323] It should also be understood that the device 10 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art may understand that the device 10 may be specifically a mobile management network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the mobile management network element in the above-mentioned method embodiments; or, the device 10 may be specifically a terminal device in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the terminal device in the above-mentioned method embodiments. To avoid repetition, it will not be repeated here.

[0324] The device 10 of each of the above schemes has the function of implementing the corresponding steps performed by the equipment (such as the certificate management network element, the first network element, the second network element or the storage function network element, etc.) in the above method. This function can be implemented by hardware, or it can be implemented by hardware executing the corresponding software. The hardware or software includes one or more modules corresponding to the above functions; for example, the transceiver module can be replaced by a transceiver (for example, the sending unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as processing modules, can be replaced by processors to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0325] In addition, the transceiver module 11 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing module may be a processing circuit.

[0326] Figure 7 2 is a schematic diagram of another communication device 20 provided in an embodiment of the present application. The device 20 includes a processor 21, and the processor 21 is used to execute a computer program or instruction stored in a memory 22, or read data / signaling stored in the memory 22 to execute the method in each method embodiment above. Optionally, there are one or more processors 21.

[0327] Alternatively, if Figure 7 As shown, the device 20 also includes a memory 22, which is used to store computer programs or instructions and / or data. The memory 22 can be integrated with the processor 21, or can also be separately set. Optionally, the memory 22 is one or more.

[0328] Alternatively, if Figure 7 As shown, the device 20 further includes a transceiver 23, and the transceiver 23 is used for receiving and / or sending signals. For example, the processor 21 is used to control the transceiver 23 to receive and / or send signals.

[0329] As a solution, the device 20 is used to implement the operations performed by the certificate management network element in each of the above method embodiments.

[0330] As another solution, the device 20 is used to implement the operations performed by the first network element and the second network element in the above method embodiments.

[0331] As another solution, the device 20 is used to implement the operations performed by the storage function network element in the above method embodiments.

[0332] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0333] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0334] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0335] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0336] Figure 8 Schematic diagram of a chip system 30 provided in an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32.

[0337] Among them, the logic circuit 31 can be a processing circuit in the chip system 30. The logic circuit 31 can be coupled to the storage unit and call the instructions in the storage unit so that the chip system 30 can implement the methods and functions of each embodiment of the present application. The input / output interface 32 can be an input / output circuit in the chip system 30, outputting information processed by the chip system 30, or inputting data or signaling information to be processed into the chip system 30 for processing.

[0338] As a solution, the chip system 30 is used to implement the operations performed by the certificate management network element, the first network element, the second network element or the storage function network element in the above method embodiments.

[0339] For example, the logic circuit 31 is used to implement the processing-related operations performed by the certificate management network element, the first network element, the second network element or the storage function network element in the above method embodiments; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the certificate management network element, the first network element, the second network element or the storage function network element in the above method embodiments.

[0340] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions are stored for implementing the methods executed by the certificate management network element, the first network element, the second network element or the storage function network element in the above-mentioned method embodiments.

[0341] For example, when the computer program is executed by a computer, the computer can implement the method performed by the certificate management network element, the first network element, the second network element or the storage function network element in each embodiment of the above method.

[0342] An embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by the certificate management network element, the first network element, the second network element or the storage network element in the above-mentioned method embodiments.

[0343] An embodiment of the present application also provides a communication system, including the aforementioned certificate management network element, a first network element, and a second network element.

[0344] An embodiment of the present application also provides a communication system, including the aforementioned certificate management network element, a first network element, a second network element and a storage function network element.

[0345] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0346] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0347] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium includes, but is not limited to, various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0348] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: Obtaining first certificate information corresponding to a first service certificate of a first network element and second certificate information corresponding to a second service certificate of a second network element, wherein the first certificate information includes information on a validity period of the first service certificate and a network element type to which the first network element belongs, and the second certificate information includes information on a validity period of the second service certificate and a network element type to which the second network element belongs; In a case where it is determined that the first network element and the second network element belong to the same network element type according to the information of the network element type to which the first network element belongs and the information of the network element type to which the second network element belongs, and it is determined that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate, determining an update policy corresponding to the first service certificate and the second service certificate; According to the update policy, the update of the first service certificate and the second service certificate is controlled.

2. The method according to claim 1, characterized in that The first certificate information includes the first service certificate, the network element type nfTypes field of the first service certificate includes information about the network element type to which the first network element belongs, the second certificate information includes the second service certificate, the network element type nfTypes field of the second service certificate includes information about the network element type to which the second network element belongs, and the method further includes: Information on the network element type to which the first network element belongs is read from the nfTypes field of the first service certificate, and information on the network element type to which the second network element belongs is read from the nfTypes field of the second service certificate.

3. The method according to claim 1 or 2, characterized in that: The obtaining of the first certificate information and the second certificate information includes: receiving the first certificate information and the second certificate information from a certificate authority; or, receiving the first certificate information from the first network element, and receiving the second certificate information from the second network element; or, The first certificate information and the second certificate information are received from an operation, maintenance and management device OAM.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Determining, according to the information about the network element type to which the first network element belongs and the information about the network element type to which the second network element belongs, that the network element type to which the first network element belongs is the same as that to which the second network element belongs; According to the validity period of the first service certificate and the validity period of the second service certificate, it is determined that the first service certificate and the second service certificate need to be updated.

5. The method according to any one of claims 1 to 4, characterized in that The determining that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate includes: According to the validity period of the first service certificate and the validity period of the second service certificate, it is determined that a time interval between the expiration time of the first service certificate and the expiration time of the second service certificate is less than a first preset threshold.

6. The method according to any one of claims 1 to 5, characterized in that The determining the update strategy corresponding to the first service certificate and the second service certificate includes: Determine a first update policy corresponding to the first service certificate, and determine a second update policy corresponding to the second service certificate, wherein the first update policy is used to indicate an update time of the first service certificate, and the second update policy is used to indicate an update time of the second service certificate, and the update time of the first service certificate is different from the update time of the second service certificate; The controlling the updating of the first service certificate and the second service certificate according to the updating policy includes: The first update policy is sent to the first network element, and the second update policy is sent to the second network element.

7. The method according to any one of claims 1 to 5, characterized in that The determining the update strategy corresponding to the first service certificate and the second service certificate includes: Determine a total update policy corresponding to the first service certificate and the second service certificate, the total update policy is used to indicate an update time of the first service certificate and an update time of the second service certificate, and the update time of the first service certificate and the update time of the second service certificate are different; The controlling the updating of the first service certificate and the second service certificate according to the updating policy includes: If a first request message for requesting to update the first service certificate is received from the first network element before the update time of the first service certificate, refusing to respond to the first request message; If a second request message for updating the second service certificate is received from the second network element before the update time of the second service certificate, the second request message is rejected.

8. The method according to any one of claims 1 to 5, characterized in that The determining the update strategy corresponding to the first service certificate and the second service certificate includes: Determine a total update policy corresponding to the first service certificate and the second service certificate, the total update policy being used to indicate controlling the update of the first service certificate and the second service certificate according to the number of online network elements in the multiple network elements corresponding to the network element type, the multiple network elements corresponding to the network element type including, in addition to the first network element and the second network element, N online third network elements, where N is a positive integer; The controlling the updating of the first service certificate and the second service certificate according to the updating policy includes: If N is greater than a second preset threshold, determining that the first service certificate and the second service certificate can be updated at the same time; If N is less than or equal to the second preset threshold, it is determined that the first service certificate and the second service certificate cannot be updated at the same time.

9. The method according to claim 8, characterized in that The method further comprises: receiving a first request message from the first network element requesting to update the first service certificate, and receiving a second request message from the second network element requesting to update the second service certificate; In a case where it is determined that the first service certificate and the second service certificate can be updated at the same time, responding to the first request message and the second request message; In the case of determining that the first service certificate and the second service certificate cannot be updated at the same time, refusing to respond to the first request message and / or the second request message.

10. The method according to claim 8 or 9, characterized in that: The method further comprises: Sending a third request message to the storage function network element, the third request message is used to request to provide information of multiple network elements corresponding to the network element type, and the third request message includes the information of the network element type; receiving a response message from the storage function network element, wherein the response message includes information of some or all of the network elements in the plurality of network elements corresponding to the network element type, The information of the multiple network elements corresponding to the network element type is used to determine the number of online network elements among the multiple network elements corresponding to the network element type.

11. The method according to claim 9 or 10, characterized in that: The information of multiple network elements corresponding to the network element type includes: One or more of the identifiers, formal domain names (FQDNs), or Internet Protocol (IP) address information of multiple network elements corresponding to the network element type.

12. A communication system, characterized in that: It includes the certificate management network element, the first network element and the second network element: The certificate management network element is used to obtain first certificate information corresponding to a first service certificate of a first network element and second certificate information corresponding to a second service certificate of a second network element, wherein the first certificate information includes a validity period of the first service certificate and information about a network element type to which the first network element belongs, and the second certificate information includes a validity period of the second service certificate and information about a network element type to which the second network element belongs; In a case where it is determined that the network element type to which the first network element belongs and the network element type to which the second network element belongs are the same, and it is determined that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate, the certificate management network element is used to determine a first update policy corresponding to the first service certificate and a second update policy corresponding to the second service certificate, the first update policy is used to indicate an update time of the first service certificate, the second update policy is used to indicate an update time of the second service certificate, and the update time of the first service certificate is different from the update time of the second service certificate; The certificate management network element is used to send the first update policy to the first network element, and send the second update policy to the second network element; The first network element is used to send an update request message of the first service certificate to the certificate issuing network element at the update time of the first service certificate; The second network element is used to send an update request message of the second service certificate to the certificate issuing network element at the update time of the second service certificate.

13. A communication system, characterized in that: Including certificate management network elements and storage function network elements: The certificate management network element is used to obtain first certificate information corresponding to a first service certificate of a first network element and second certificate information corresponding to a second service certificate of a second network element, wherein the first certificate information includes a validity period of the first service certificate and information about a network element type to which the first network element belongs, and the second certificate information includes a validity period of the second service certificate and information about a network element type to which the second network element belongs; The certificate management network element is used to send a third request message to the storage function network element, where the third request message is used to request information of multiple network elements corresponding to the network element type, and the third request message includes information of the network element type; The storage function network element is used to send a response message to the certificate management network element, where the response message includes information about some or all of the multiple network elements corresponding to the network element type, and the information about the multiple network elements corresponding to the network element type is used to determine the number of online network elements among the multiple network elements corresponding to the network element type; In a case where it is determined that the first network element and the second network element belong to the same network element type according to information about the network element type to which the first network element belongs and information about the network element type to which the second network element belongs, and it is determined that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate, the certificate management network element is used to determine a total update policy corresponding to the first service certificate and the second service certificate, the total update policy is used to indicate that according to the number of online network elements in multiple network elements corresponding to the network element type, the update of the first service certificate and the second service certificate is controlled, and the multiple network elements corresponding to the network element type include, in addition to the first network element and the second network element, N online third network elements, where N is a positive integer; The certificate management network element is used to control the update of the first service certificate and the second service certificate according to the update policy.

14. The system according to claim 13, characterized in that The storage function network element is further used to determine, according to a local policy, that the certificate management network element can obtain information of multiple network elements corresponding to the network element type.

15. The system according to any one of claims 12 to 14, characterized in that The first certificate information includes the first service certificate, the network element type nfTypes field of the first service certificate includes information about the network element type to which the first network element belongs, the second certificate information includes the second service certificate, the network element type nfTypes field of the second service certificate includes information about the network element type to which the second network element belongs, The certificate management network element is also used to read information about the network element type to which the first network element belongs from the nfTypes field of the first service certificate, and to read information about the network element type to which the second network element belongs from the nfTypes field of the second service certificate.

16. The system according to any one of claims 12 to 15, characterized in that The certificate management network element is used to obtain the first certificate information and the second certificate information, including: The certificate management network element is used to receive the first certificate information and the second certificate information from a certificate issuing authority; or, The certificate management network element is configured to receive the first certificate information from the first network element, and receive the second certificate information from the second network element; or, The certificate management network element is used to receive the first certificate information and the second certificate information from the operation, maintenance and management equipment OAM.

17. The system according to any one of claims 12 to 16, characterized in that The certificate management network element is further used to determine that the network element type to which the first network element belongs and the network element type to which the second network element belongs are the same according to the information about the network element type to which the first network element belongs and the information about the network element type to which the second network element belongs; The certificate management network element is further used to determine that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate.

18. The system according to claim 17, characterized in that The certificate management network element is used to determine that the first service certificate and the second service certificate need to be updated according to the validity period of the first service certificate and the validity period of the second service certificate, including: The certificate management network element is used to determine, based on the validity period of the first service certificate and the validity period of the second service certificate, that the time interval between the expiration time of the first service certificate and the expiration time of the second service certificate is less than a first preset threshold.

19. A communication device, characterized in that: The apparatus comprises: a module for executing the method according to any one of claims 1 to 11.

20. A communication device, characterized in that: include: A processor, configured to execute a computer program stored in a memory, so that the apparatus performs the method according to any one of claims 1 to 11.

21. A computer program product, characterized in that The computer program product comprises instructions for performing the method of any one of claims 1 to 11.

22. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program; when the computer program is executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 11.

Images