Edge computing authorization method and related device

Abstract

The invention provides an authorization method for edge computing and a related device, and the method comprises the steps that a first edge configuration server ECS-A receives a first authorization information request sent by a second edge configuration server ECS-B, and the first authorization information request is used for requesting to issue authorization information; the first authorization information request comprises identification information of a second edge configuration server provider ECSP-B, and the ECS-B is deployed by the ECSP-B; the ECS-A sends authorization information to the ECS-B, the authorization information carries the identification information of the ECSP-B, the authorization information is used for verifying the service provided by a network function request first edge enabled server EES-A, and the EES-A is the EES registered in the ECS-A. As the authorization information is used for verifying the service provided by the network function request EES-A, the identification information of the ECSP to which the ECS-B belongs is carried in the authorization information, and the ECS belonging to other ECSPs can be effectively prevented from pretending to be the ECS-B. And the condition that the EES-A provides the service for the EES-B under the condition that the EES-A is not checked due to the fact that the EES-B requests the service arbitrarily from the EES-A because the behavior of the EES-B is abnormal is avoided.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an edge computing authorization method and related devices. Background Art

[0002] Regarding edge computing scenarios supported by the 3rd Generation Partnership Project (3GPP), for example Figure 1 shown. Figure 1 The figure is a schematic diagram of an edge computing scenario. Specifically, the edge enabler client (EEC) and the application client (AC) are deployed on the user equipment (UE). AC is the application in the UE, and EEC provides the support required for the AC function to be implemented. The edge enabler server (EES) and the edge application server (EAS) are deployed on the edge data network (EDN). EAS is the application server in the EDN. AC connects to EAS to obtain the service of the application, thereby realizing edge computing. EES provides the support required for the EAS service to be implemented. The edge configuration server (ECS) provides the support or configuration function required for the connection between EEC and EES. ECS is deployed by the edge configuration server provider (ECSP). ECS can discover other ECSs through the edge configuration server-edge repository (ECS-ER). ECS-ER is an ECS with edge storage function, and ECS-ER is deployed by ECSP.

[0003] In the above edge computing scenario, an edge node sharing mechanism is supported. Regarding the edge node sharing mechanism, an example scenario is as follows: EEC sends an EAS discovery request message to EES, and the EAS discovery request message is used to request the provision of EAS discovery service to EEC. If the EES cannot provide the EAS discovery service to the EEC because there is no EAS corresponding to the EAS discovery request message, the EES can use the edge node sharing mechanism to discover another EES that supports the corresponding EAS, and the other EES provides the EAS discovery service to the EEC.

[0004] At present, the edge node sharing mechanism can be implemented between the ECSs that manage the EES. For example, the ECS (abbreviated as ECS-A) of the first network service provider (operator-A, OP-A or A) manages the EES (abbreviated as EES-A) of the first network service provider, and the ECS (abbreviated as ECS(OP-B) or ECS-B) of the second network service provider (operator-B, OP-B or B) manages the EES (abbreviated as EES-B) of the second network service provider. ECS-B obtains the relevant information of ECS-A through the information sharing process between the ECS-ER of the second network service provider (abbreviated as ECS-ER-B) and the ECS-ER of the first network service provider (abbreviated as ECS-ER-A), and the relevant information of ECS-A includes the identification information of EES-A managed by ECS-A, and the identification information of EAS supported by EES-A. The retrieve EES request message of EES-B is sent to ECS-B. ECS-B determines EES-A through the relevant information of ECS-A obtained through the information sharing process. ECS-B feeds back the identification information of EES-A to EES-B. EES-B requests EES-A to provide EAS discovery service according to the identification information of EES-A.

[0005] The applicant has found that the above mechanism has the following defects: ECS deployed in other ECSPs (for example, ECS-C deployed in ECSP-C) may impersonate ECS-B. In other words, the identification information of ECS-C impersonates the identification information of ECS-B, and the identification information of ECS-C is consistent with the identification information of ECS-B. Under the current edge node sharing mechanism, since the ECS-C impersonates ECS-B, the ECS-C can also request EES-A to provide EAS discovery service, causing EES to abnormally provide EAS discovery service.

[0006] For the application context relocation (ACR) scenario. When the terminal device moves to a new location, there may be a different or more suitable EAS to serve the application client AC in the UE. At this time, the support of EEC and EES is needed to ensure the continuity of the service so that the application context of EAS-B can be transmitted to the first edge application server EAS-A. Under the current edge node sharing mechanism, since the ECS-C impersonates ECS-B, the ECS-C can also request EES-A to provide application context migration services. Due to the malicious context relocation request, EES abnormally provides application context migration services, resulting in application context leakage. Summary of the invention

[0007] In a first aspect, an embodiment of the present application proposes an edge computing authorization method, the method comprising:

[0008] The first edge configuration server ECS-A receives a first authorization information request sent by the second edge configuration server ECS-B, where the first authorization information request is used to request the issuance of authorization information, and the first authorization information request includes identification information of the second edge configuration server provider ECSP-B, and the ECS-B is deployed by the ECSP-B;

[0009] The ECS-A sends the authorization information to the ECS-B, the authorization information carrying the identification information of the ECSP-B, the authorization information being used to verify the network function request for the first edge enabling server EES-A to provide a service, and the EES-A is an EES registered in the ECS-A.

[0010] In one implementation, the authorization information includes the identification information of ECSP-B. Since the network function requests EES-A to provide services through the network function managed by ECSP-B, by adding the identification information of ECSP-B to the authorization information, it can be ensured that only when the network function requests EES-A to provide services through the network function managed by ECSP-B, the network function may be allowed to obtain the services provided by EES-A. This prevents network functions belonging to other ECSPs from impersonating network functions managed by ECSP-B, thereby improving the security of communications.

[0011] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0012] In combination with the first aspect, in a possible implementation of the first aspect, the authorization information further includes: identification information of the first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A. By adding the identification information of ECSP-A to the authorization information, it can be ensured that when a network function requests EES-A to provide services, only EES-A may be allowed to provide services to the network function. This prevents EES belonging to other ECSPs from providing services to the network function, thereby improving the security of communications.

[0013] In combination with the first aspect, in a possible implementation of the first aspect, the authorization information is used to verify the network function's request for the EES-A to provide services, including: the authorization information is used to verify the edge application server EAS discovery request message or the context relocation request message, the EAS discovery request message is used to request the EES-A to provide the EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide the application context migration service to the network function.

[0014] Exemplarily, the context relocation request message is used to request EES-A to provide application context migration service to EES-B. For example, the context relocation request message is used to request EES-A / EAS-A to transfer application context to EES-B / EAS-B, and the application context can be the context of EAS. Exemplarily, the scenario is an application context relocation (ACR) scenario. When the UE moves to a new location, there may be a different or more suitable EAS to serve the application client AC in the UE. At this time, the support of EEC and EES is needed to ensure the continuity of the service so that the application context of EAS-B can be transferred to EAS-A.

[0015] Through the above method, the leakage of EAS identification information or application context can be avoided, thereby improving the security of communication.

[0016] In combination with the first aspect, in a possible implementation of the first aspect, the first authorization information request also includes identification information of the edge enabling client EEC; the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services. By issuing the first authorization information, the EEC can provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0017] In combination with the first aspect, in a possible implementation of the first aspect, the first authorization information request also includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B; the authorization information includes second authorization information, and the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services. This allows EES-B to provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0018] In combination with the first aspect, in a possible implementation of the first aspect, the first authorization information is carried by a first token, and the client identifier of the first token is the identification information of the EEC; the second authorization information is carried by a second token, and the second token also includes the identification information of the ECSP-A and the identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0019] It should be noted that the first token and the second token can be carried in the same message, or can be carried independently in different messages, and there is no limitation here.

[0020] In combination with the first aspect, in a possible implementation manner of the first aspect, the first authorization information and the second authorization information are carried on a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0021] In combination with the first aspect, in a possible implementation of the first aspect, after the ECS-A sends the first authorization information to the ECS-B, the method further includes: the ECS-A receives trusted information from the EES-A, and the trusted information includes any one or more of the following information: identification information of the EEC obtained by the EES-A, identification information of the second edge enabling server EES-B obtained by the EES-A, identification information of the second edge configuration server provider ECSP-B obtained by the EES-A, or identification information of the first edge configuration server provider ECSP-A obtained by the EES-A; the ECS-A verifies the authorization information based on the trusted information; the ECS-A sends verification indication information to the EES-A based on the result of verifying the authorization information, and the verification indication information is used to indicate whether the authorization information has passed the verification or failed the verification. Through the above method, ECS-A can be responsible for the verification work of EES-A, which improves the implementation flexibility of the solution.

[0022] In combination with the first aspect, in a possible implementation manner of the first aspect, the ECS-A verifies the authorization information according to the trusted information, including: the ECS-A verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information; and / or, the ECS-A verifies the identification information of the EES-B included in the second authorization information according to the identification information of the EES-B in the trusted information; and / or, the ECS-A verifies the identification information of the ECSP-A included in the first authorization information or the identification information of the ECSP-A included in the second authorization information according to the identification information of the EES-B included in the trusted information; and / or, the ECS-A verifies the identification information of the ECSP-B included in the first authorization information or the identification information of the ECSP-B included in the second authorization information according to the identification information of the ECSP-B in the trusted information.

[0023] In combination with the first aspect, in a possible implementation of the first aspect, the first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide the EEC with an edge application server EAS discovery service; the first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EEC with an EAS discovery service. The first authorization information request can be carried in multiple messages, and the corresponding first authorization information can also be carried in multiple messages, which improves the implementation flexibility of the solution.

[0024] In a second aspect, an embodiment of the present application proposes an edge computing authorization method, the method comprising:

[0025] The second edge configuration server ECS-B sends a first authorization information request to the first edge configuration server ECS-A, where the first authorization information request is used to request the issuance of authorization information, and the first authorization information request includes identification information of the second edge configuration server provider ECSP-B, and the ECS-B is deployed by the ECSP-B; the ECS-B receives the authorization information from the ECS-A, where the authorization information carries the identification information of the ECSP-B, and the authorization information is used to verify the network function request for the first edge enabling server EES-A to provide a service, and the EES-A is the EES registered in the ECS-A.

[0026] In one implementation, the authorization information includes the identification information of ECSP-B. Since the network function requests EES-A to provide services through the network function managed by ECSP-B, by adding the identification information of ECSP-B to the authorization information, it can be ensured that only when the network function requests EES-A to provide services through the network function managed by ECSP-B, the network function may be allowed to obtain the services provided by EES-A. This prevents network functions belonging to other ECSPs from impersonating network functions managed by ECSP-B, thereby improving the security of communications.

[0027] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0028] In combination with the second aspect, in a possible implementation of the second aspect, the authorization information further includes: identification information of the first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A. By adding the identification information of ECSP-A to the authorization information, it can be ensured that when a network function requests EES-A to provide services, only EES-A may be allowed to provide services to the network function. Avoiding EES belonging to other ECSPs from providing services to network functions improves the security of communications.

[0029] In combination with the second aspect, in a possible implementation of the second aspect, the authorization information is used to verify the network function's request for the EES-A to provide services, including: the authorization information is used to verify the edge application server EAS discovery request message or the context relocation request message, the EAS discovery request message is used to request the EES-A to provide the EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide the application context migration service to the network function.

[0030] Exemplarily, the context relocation request message is used to request EES-A to provide application context migration service to EES-B. For example, the context relocation request message is used to request EES-A / EAS-A to transfer application context to EES-B / EAS-B, and the application context can be the context of EAS. Exemplarily, the scenario is an application context relocation (ACR) scenario. When the UE moves to a new location, there may be a different or more suitable EAS to serve the application client AC in the UE. At this time, the support of EEC and EES is needed to ensure the continuity of the service so that the application context of EAS-B can be transferred to EAS-A.

[0031] Through the above method, the leakage of EAS identification information or application context can be avoided, thereby improving the security of communication.

[0032] In combination with the second aspect, in a possible implementation of the second aspect, the first authorization information request also includes identification information of the edge enabling client EEC; the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services. By issuing the first authorization information, the EEC can provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0033] In combination with the second aspect, in a possible implementation of the second aspect, the first authorization information request also includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B; the authorization information includes second authorization information, and the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services. This allows EES-B to provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0034] In combination with the second aspect, in a possible implementation of the second aspect, the first authorization information is carried by a first token, and the client identifier of the first token is the identification information of the EEC; the second authorization information is carried by a second token, and the second token also includes the identification information of the ECSP-A and the identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0035] It should be noted that the first token and the second token can be carried in the same message, or can be carried independently in different messages, and there is no limitation here.

[0036] In combination with the second aspect, in a possible implementation manner of the second aspect, the first authorization information and the second authorization information are carried on a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0037] In combination with the second aspect, in a possible implementation of the second aspect, before the ECS-B sends a first authorization information request to the ECS-A, the method further includes: the ECS-B receives a first edge application service request message sent by a second edge enabling server EES-B, the first edge application service request message includes third authorization information, the third authorization information is the authorization information issued by the ECS-B to the EEC, the third authorization information indicates that the EEC is allowed to request services from the EES-B, and the EES-B is provided with support services by the ECS-B; after the ECS-B receives the authorization information of the ECS-A, the method further includes: the ECS-B sends a first edge application service response message to the EES-B, the first edge application service response message carries the first authorization information. Through the above method, the implementation flexibility of the solution is improved.

[0038] In combination with the second aspect, in a possible implementation of the second aspect, after the ECS-B receives the first edge application service request message sent by the EES-B, the method further includes: the ECS-B obtains the authorization request indication information of the EES-A, and the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information; the ECS-B sends the first authorization information request to the ECS-A, including: the ECS-B sends the first authorization information request to the ECS-A according to the authorization request indication information. The embodiment of the present application uses the above method to carry the authorization request indication information when the EES registers with the ECS, so as to avoid the ECS not knowing that the EES needs to perform authorization processing based on the third-party authorization policy due to the lack of the authorization request indication information, thereby causing the ECS not to issue authorization information to the EEC, thereby causing the EEC to fail to request services from the EES. It is ensured that the EEC can successfully request services from the EES.

[0039] In combination with the second aspect, in a possible implementation of the second aspect, before the ECS-B sends the first authorization information request to the ECS-A, the method further includes: the ECS-B receives a first service provision request message sent by the edge enabling client EEC, the first service provision request message includes the identification information of the EEC and the identification information of the EAS; after the ECS-B receives the authorization information from the ECS-A, the method further includes: the ECS-B sends a first service provision response message to the EEC, the first service provision response message includes the first authorization information; the first authorization information is carried in the service provision response message, and the service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC. The first authorization information request can be carried in a variety of messages, and the corresponding first authorization information can also be carried in a variety of messages, which improves the implementation flexibility of the solution.

[0040] In conjunction with the second aspect, in a possible implementation of the second aspect, the first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide the EEC with an edge application server EAS discovery service; the first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EEC with an EAS discovery service. The first authorization information request can be carried in multiple messages, and the corresponding first authorization information can also be carried in multiple messages, which improves the implementation flexibility of the solution.

[0041] In combination with the second aspect, in a possible implementation of the second aspect, before the ECS-B sends the first authorization information request to the ECS-A, the method further includes: the ECS-B receives a second authorization information request sent by a second edge enabling server EES-B, the second authorization information request is used to request the second authorization information, and the second authorization information request message also includes the identification information of the EES-A; after the ECS-B receives the authorization information from the ECS-A, the method further includes: the ECS-B sends a second authorization information response to the EES-B, and the second authorization information response includes the second authorization information. In an embodiment of the present application, when EES-B requests a service from EES-A, it is necessary to send EES-B-related authorization information to EES-A. Avoid unauthorized request for service from EES-A due to abnormal behavior of EES-B, resulting in EES-A providing services to EES-B without verification.

[0042] In conjunction with the second aspect, in a possible implementation of the second aspect, the ECS-B belongs to a first network service provider, and the ECS-A belongs to a second network service provider. Exemplarily, the first network service provider may be a first operator, and the second network service provider may be a second operator.

[0043] In a third aspect, an embodiment of the present application provides a communication method, including:

[0044] The first edge enabling server EES-A receives an edge application server EAS discovery request message sent by the second edge enabling server EES-B, wherein the EAS discovery request message is used to request to provide an EAS discovery service to an edge enabling client EEC, and the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of a second edge configuration server provider ECSP-B, the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B; the EES-A obtains trusted information, wherein the trusted information includes identification information of the ECSP-B obtained by the EES-A; the EES-A verifies the authorization information based on the trusted information; if the authorization information passes the verification, the EES-A sends the identification information of the EAS to the EES-B.

[0045] Optionally, the trusted information also includes any one or more of the following information: identification information of the EEC obtained by the EES-A, identification information of the second edge enabling server EES-B obtained by the EES-A, or identification information of the first edge configuration server provider ECSP-A obtained by the EES-A.

[0046] In the embodiment of the present application, EES-A verifies the identification information of the ECSP in the authorization information of the service requester to prevent the service requester under the management of an illegal ECSP from requesting EES-A to provide services, resulting in EES-A providing services to the service requester without verification, thereby improving the security of communication.

[0047] In combination with the third aspect, in a possible implementation of the third aspect, the authorization information is verified, including: the identification information of ECSP-B included in the authorization information is consistent with the identification information of ECSP-B obtained by the EES-A included in the trusted information. Specifically, the authorization information includes the identification information of ECSP-B. Since the network function requests EES-A to provide services through the network function managed by ECSP-B, by adding the identification information of ECSP-B to the authorization information, it can be ensured that only when the network function requests EES-A to provide services through the network function managed by ECSP-B, the network function may be allowed to obtain the services provided by EES-A. Avoid network functions belonging to other ECSPs from impersonating network functions managed by ECSP-B, thereby improving the security of communications.

[0048] In combination with the third aspect, in a possible implementation of the third aspect, the authorization information also includes: identification information of the first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is the EES registered in the ECS-A; the authorization information is verified, including: the identification information of ECSP-A included in the authorization information is consistent with the identification information of ECSP-A obtained by the EES-A included in the trusted information. By adding the identification information of ECSP-A to the authorization information, it can be ensured that when a network function requests EES-A to provide services, only EES-A may be allowed to provide services to the network function. Avoid EES belonging to other ECSPs from providing services to network functions, thereby improving the security of communications.

[0049] In combination with the third aspect, in a possible implementation of the third aspect, the first authorization information request also includes identification information of the edge enabling client EEC; the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services. By issuing the first authorization information, the EEC can provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0050] In combination with the third aspect, in a possible implementation of the third aspect, the first authorization information request also includes identification information of the EES-B; the authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services. This allows EES-B to provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0051] In combination with the third aspect, in a possible implementation of the third aspect, the first authorization information is carried by a first token, and the client identifier of the first token is the identification information of the EEC; the second authorization information is carried by a second token, and the second token also includes the identification information of the ECSP-A and the identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0052] It should be noted that the first token and the second token can be carried in the same message, or can be carried independently in different messages, and there is no limitation here.

[0053] In combination with the third aspect, in a possible implementation manner of the third aspect, the first authorization information and the second authorization information are carried on a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0054] In conjunction with the third aspect, in a possible implementation of the third aspect, the EES-A obtains the trusted information, including: the EES-A obtains the trusted information from the EES-B by exchanging certificates. Specifically, EES-A exchanges certificates with EES-B, and then obtains the trusted information from EES-B based on the certificates.

[0055] In combination with the third aspect, in a possible implementation manner of the third aspect, the EES-A verifies the authorization information according to the trusted information, including: the EES-A verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information; and / or, the EES-A verifies the identification information of the second edge enabling server EES-B included in the second authorization information according to the identification information of the second edge enabling server EES-B in the trusted information; and / or, the EES-A verifies the identification information of the first edge configuration server provider ECSP-A included in the first authorization information or the identification information of the first edge configuration server provider ECSP-A included in the second authorization information according to the identification information of the first edge configuration server provider ECSP-A included in the trusted information; and / or, the EES-A verifies the identification information of the second edge configuration server provider ECSP-B included in the first authorization information or the identification information of the second edge configuration server provider ECSP-B included in the second authorization information according to the identification information of the second edge configuration server provider ECSP-B in the trusted information.

[0056] In combination with the third aspect, in a possible implementation of the third aspect, the EES-A verifies the authorization information according to the trusted information, including: the EES-A sends the authorization information and the trusted information to the ECS-A; the EES-A receives the verification indication information sent by the ECS-A, and the verification indication information is used to indicate that the authorization information has passed the verification or failed the verification; the EES-A sends the verification indication information to the EES-B. Through the above method, ECS-A can be responsible for the verification work of EES-A, which improves the implementation flexibility of the solution.

[0057] In combination with the third aspect, in a possible implementation of the third aspect, the identification information of the EEC is a CCA parameter of the client credential declaration of the EEC. The CCA parameter is issued by the EEC to itself, and the CCA parameter carries the identification information of the EEC. It should be noted that the identification information in the embodiment of the present application can also be understood as identity information or identity identification, which is not limited here.

[0058] In combination with the third aspect, in a possible implementation of the third aspect, the method further includes: the EES-A sends an EES registration request message to the ECS-A, the EES registration request message includes the authorization request indication information of the EES-A, and the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information. Through the above method, the embodiment of the present application carries the authorization request indication information when the EES registers with the ECS, so as to avoid the ECS not knowing that the EES needs to perform authorization processing based on the third-party authorization policy due to the lack of authorization request indication information, thereby causing the ECS to not issue authorization information to the EEC, thereby causing the EEC to fail to request services from the EES. Ensure that the EEC can successfully request services from the EES.

[0059] In a fourth aspect, an embodiment of the present application proposes a communication method, including: a second edge enabling server EES-B sends an edge application server EAS discovery request message to a first edge enabling server EES-A, wherein the EAS discovery request message is used to request that an EAS discovery service be provided to an edge enabling client EEC, wherein the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of a second edge configuration server provider ECSP-B, wherein the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B; the EES-B receives an EAS discovery response message sent by the EES-A, wherein the EAS discovery response message includes identification information of the EAS; and the EES-B sends the EAS discovery response message to the EEC.

[0060] In the embodiment of the present application, when EES-B sends an EAS discovery request message to EES-A, the EAS discovery request message carries authorization information. The authorization information includes the identification information of the ECSP, which prevents EES-B under the management of an illegal ECSP from requesting EES-A to provide services, causing EES-A to provide services to EES-B without verification, thereby improving the security of communication.

[0061] In combination with the fourth aspect, in a possible implementation of the fourth aspect, the authorization information also includes: identification information of the first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is the EES registered in the ECS-A. By adding the identification information of ECSP-A to the authorization information, it can be ensured that when a network function requests EES-A to provide services, only EES-A may be allowed to provide services to the network function. Avoid EES belonging to other ECSPs from providing services to network functions. Through the above method, the leakage of EAS identification information can be avoided, and the security of communication can be improved.

[0062] In conjunction with the fourth aspect, in a possible implementation of the fourth aspect, the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services. By issuing the first authorization information, the EEC can provide a verification credential when requesting EES-A to provide services, thereby improving the security of communication.

[0063] In combination with the fourth aspect, in a possible implementation of the fourth aspect, before the EES-B sends the EAS discovery request message to the EES-A, the method also includes: the EES-B receives the EAS discovery request message from the EEC, and the EAS discovery request message includes identification information of the EEC.

[0064] In combination with the fourth aspect, in a possible implementation of the fourth aspect, the EES-B sends the EAS discovery request message to the EES-A, including: the EES-B receives the EES identification information request message sent by the EEC, the EES identification information request message carries the EEC identification information and the third authorization information, the third authorization information is the authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request services from the EES-B; the EES-B sends the EES identification information response message to the EEC, the EES identification information response message includes the EES-A identification information and the authorization information; the EES-B receives the EAS discovery request message sent by the EEC; the EES-B forwards the EAS discovery request message to the EES-A. Through the above method, the implementation flexibility of the solution is improved.

[0065] In combination with the fourth aspect, in a possible implementation of the fourth aspect, before the EES-B sends the EAS discovery request message to the EES-A, the method further includes: the EES-B sends a first edge application service request message to the ECS-B, the first edge application service request message includes third authorization information, the third authorization information is the authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request services from the EES-B; the EES-B receives a first edge application service response message sent by the ECS-B, the first edge application service response message carries the first authorization information. Through the above method, the implementation flexibility of the solution is improved.

[0066] In conjunction with the fourth aspect, in a possible implementation of the fourth aspect, the authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to authorize the EES-B to request the EES-A to provide services, so that EES-B can provide verification credentials when requesting EES-A to provide services, thereby improving the security of communication.

[0067] In combination with the fourth aspect, in a possible implementation of the fourth aspect, the first authorization information is carried by a first token, and the client identifier of the first token is the identification information of the EEC; the second authorization information is carried by a second token, and the second token also includes the identification information of the ECSP-A and the identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0068] It should be noted that the first token and the second token can be carried in the same message, or can be carried independently in different messages, and there is no limitation here.

[0069] In combination with the fourth aspect, in a possible implementation manner of the fourth aspect, the first authorization information and the second authorization information are carried on a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0070] In conjunction with the fourth aspect, in a possible implementation of the fourth aspect, the first edge application service response message further includes the second authorization information. Through the above method, the implementation flexibility of the solution is improved.

[0071] In combination with the fourth aspect, in a possible implementation manner of the fourth aspect, the identification information of the EEC is a client credential declaration CCA parameter of the EEC.

[0072] In combination with the fourth aspect, in a possible implementation of the fourth aspect, the method further includes: the EES-B sends an EES registration request message to the ECS-B, the EES registration request message includes the authorization request indication information of the EES-B, and the authorization request indication information of the EES-B is used to indicate that the EES-B needs to perform authorization processing based on the authorization information. Through the above method, the embodiment of the present application carries the authorization request indication information when the EES registers with the ECS, so as to avoid the ECS not knowing that the EES needs to perform authorization processing based on the third-party authorization policy due to the lack of authorization request indication information, thereby causing the ECS to not issue authorization information to the EEC, thereby causing the EEC to fail to request services from the EES. Ensure that the EEC can successfully request services from the EES.

[0073] A fifth aspect of the present application provides a communication device, which can implement the method in the first aspect or any possible implementation of the first aspect. The device includes a corresponding unit or module for executing the above method. The unit or module included in the device can be implemented by software and / or hardware. For example, the device can be an ECS, or the device can be a component in the ECS (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the ECS. Among them, the communication device includes a transceiver module and a processing module.

[0074] In a sixth aspect of the present application, a communication device is provided, which can implement the method in the second aspect or any possible implementation of the second aspect. The device includes a corresponding unit or module for executing the above method. The unit or module included in the device can be implemented by software and / or hardware. For example, the device can be an ECS, or the device can be a component in the ECS (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the ECS. Among them, the communication device includes a transceiver module and a processing module.

[0075] The seventh aspect of the present application provides a communication device, which can implement the method in the third aspect or any possible implementation of the third aspect. The device includes a corresponding unit or module for executing the above method. The unit or module included in the device can be implemented by software and / or hardware. For example, the device can be an EES, or the device can be a component in the EES (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the EES. Among them, the communication device includes a transceiver module and a processing module.

[0076] In an eighth aspect of the present application, a communication device is provided, which can implement the method in the fourth aspect or any possible implementation of the fourth aspect. The device includes a corresponding unit or module for executing the above method. The unit or module included in the device can be implemented by software and / or hardware. For example, the device can be an EES, or the device can be a component in the EES (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the EES. Among them, the communication device includes a transceiver module and a processing module.

[0077] A ninth aspect of an embodiment of the present application provides a communication device, comprising at least one processor, which is coupled to a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the program or instructions so that the device implements any possible implementation method of the first to fourth aspects mentioned above.

[0078] The tenth aspect of an embodiment of the present application provides a communication device, including a communication interface for inputting and / or outputting signaling or data; a processor for executing a computer-executable program so that the device can implement any possible implementation method of the first to fourth aspects mentioned above.

[0079] In the eleventh aspect of an embodiment of the present application, a communication device is provided, comprising at least one logic circuit and an input / output interface; the input / output interface is used to input or output information; the logic circuit is used to execute the method in any possible implementation manner as described in the first to fourth aspects above.

[0080] The twelfth aspect of the embodiment of the present application provides a computer program product (or computer program). When the computer program product is executed by the processor, the processor executes the above-mentioned first to fourth aspects, and any possible implementation method.

[0081] A thirteenth aspect of an embodiment of the present application provides a chip system, which includes at least one processor for supporting a communication device to implement the above-mentioned first to fourth aspects, and any possible implementation method.

[0082] In a possible design, the chip system may also include a memory for storing program instructions and data necessary for the communication device. The chip system may be composed of a chip, or may include a chip and other discrete devices. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data for the at least one processor.

[0083] A fourteenth aspect of an embodiment of the present application provides a communication system, which includes the communication device of the fifth aspect, the communication device of the sixth aspect, the communication device of the seventh aspect, or the communication device of the eighth aspect.

[0084] Among them, the technical effects brought about by any design method in the fifth to fourteenth aspects can refer to the technical effects brought about by different implementation methods in the first to fourth aspects mentioned above, and will not be repeated here.

[0085] It should be understood that, for components in a device, the “sending” mentioned above may be referred to as “output” and the “receiving” may be referred to as “input”.

[0086] In a fifteenth aspect, a communication method proposed in an embodiment of the present application includes:

[0087] The first edge enabling server EES-A sends a context relocation request Context Relocation Request message to the second edge enabling server EES-B, wherein the context relocation request message is used to request that the application context of the second edge application server EAS-B provided by the EES-B be transmitted to the first edge application server EAS-A provided by the EES-A, wherein the application context is a context related to the edge enabling client EEC, and the context relocation request message includes authorization information, wherein the authorization information carries identification information of the first edge configuration server provider ECSP-A and / or identification information of the second edge configuration server provider ECSP-B, the first edge configuration server ECS-A is deployed by the ECSP-A, the second edge configuration server ECS-B is deployed by the ECSP-B, the EES-A is the EES registered in the ECS-A, and the EES-B is the EES registered in the ECS-B;

[0088] If the authorization information passes the verification, the EES-A receives the application context of the EAS-B sent by the EES-B.

[0089] Through the above method, application context leakage can be avoided and the security of communication can be improved.

[0090] Optionally, the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to authorize the EEC to request the service of the EES-A.

[0091] Optionally, the authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to authorize the EES-B to request the service of the EES-A.

[0092] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0093] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0094] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0095] Optionally, before the EES-A sends the context relocation request message to the EES-B, the method further includes:

[0096] The EES-A receives the context relocation request message sent by the EEC;

[0097] If the authorization information passes the verification, after the EES-A receives the application context of the EAS-B sent by the EES-B, the method further includes:

[0098] The EES-A sends the application context to the EEC.

[0099] Optionally, the method further comprises:

[0100] The EES-A sends an EES registration request message to the ECS-A, where the EES registration request message includes authorization request indication information of the EES-A, where the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on authorization information.

[0101] In a sixteenth aspect, an embodiment of the present application provides a communication method, including:

[0102] The second edge enabling server EES-B receives an edge application server context relocation request message sent by the first edge enabling server EES-A, wherein the context relocation request message is used to request to provide the EEC with an EAS function, wherein the context relocation request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of a first edge configuration server provider ECSP-A and identification information of a second edge configuration server provider ECSP-B, wherein the first edge configuration server ECS-A is deployed by the ECSP-A, and the second edge configuration server ECS-B is deployed by the ECSP-B, wherein the EES-A is an EES registered in the ECS-A, and the EES-B is an EES registered in the ECS-B;

[0103] The EES-B obtains trusted information, where the trusted information includes any one or more of the following information: identification information of the EEC obtained by the EES-B, identification information of the second edge enabling server EES-A obtained by the EES-B, identification information of the second edge configuration server provider ECSP-B obtained by the EES-B, or identification information of the first edge configuration server provider ECSP-A obtained by the EES-B;

[0104] The EES-B verifies the authorization information according to the trusted information;

[0105] If the authorization information passes the verification, the EES-B sends the application context of the EAS-B to the EES-A.

[0106] Through the above method, application context leakage can be avoided and the security of communication can be improved.

[0107] Optionally, the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to authorize the EEC to request the service of the EES-A.

[0108] Optionally, the authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to authorize the EES-B to request the service of the EES-A.

[0109] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0110] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0111] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0112] Optionally, the EES-B obtains the trusted information, including:

[0113] The EES-B obtains the trusted information from the EES-A by means of certificate exchange.

[0114] Optionally, the EES-B verifies the authorization information according to the trusted information, including:

[0115] The EES-B verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information;

[0116] and / or, the EES-B verifies the identification information of the second edge enabling server EES-B included in the second authorization information according to the identification information of the second edge enabling server EES-B in the trusted information;

[0117] and / or, the EES-B verifies the identification information of the first edge configuration server provider ECSP-A included in the first authorization information or the identification information of the first edge configuration server provider ECSP-A included in the second authorization information according to the identification information of the first edge configuration server provider ECSP-A included in the trusted information;

[0118] And / or, the EES-B verifies the identification information of the second edge configuration server provider ECSP-B included in the first authorization information or the identification information of the second edge configuration server provider ECSP-B included in the second authorization information according to the identification information of the second edge configuration server provider ECSP-B in the trusted information.

[0119] Optionally, the EES-B verifies the authorization information according to the trusted information, including:

[0120] The EES-B sends the authorization information and the trusted information to the ECS-B;

[0121] The EES-B receives the verification indication information sent by the ECS-B, where the verification indication information is used to indicate whether the authorization information has passed the verification or has failed the verification.

[0122] Optionally, the identification information of the EEC is a client credential declaration CCA parameter of the EEC.

[0123] Optionally, the method further comprises:

[0124] The EES-B sends an EES registration request message to the ECS-B, where the EES registration request message includes authorization request indication information of the EES-B, where the authorization request indication information of the EES-B is used to indicate that the EES-B needs to perform authorization processing based on authorization information.

[0125] A seventeenth aspect of the present application provides a communication device, which can implement the method in the fifteenth aspect or any possible implementation of the fifteenth aspect. The device includes a corresponding unit or module for executing the above method. The unit or module included in the device can be implemented by software and / or hardware. For example, the device can be an EES, or the device can be a component in the EES (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the EES. Among them, the communication device includes a transceiver module and a processing module.

[0126] In aspect 18 of the present application, a communication device is provided, which can implement the method in any possible implementation of aspect 16 or aspect 16. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be an EES, or the device can be a component in the EES (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the EES. Among them, the communication device includes a transceiver module and a processing module.

[0127] A nineteenth aspect of an embodiment of the present application provides a communication device, comprising at least one processor, which is coupled to a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the program or instructions so that the device implements any possible implementation method of the fifteenth to sixteenth aspects mentioned above.

[0128] The twentieth aspect of an embodiment of the present application provides a communication device, comprising a communication interface for inputting and / or outputting signaling or data; and a processor for executing a computer-executable program so that the device implements any possible implementation method of the fifteenth to sixteenth aspects mentioned above.

[0129] A twenty-first aspect of an embodiment of the present application provides a communication device, comprising at least one logic circuit and an input-output interface; the input-output interface is used to input or output information; the logic circuit is used to execute the method as any possible implementation method in the fifteenth to sixteenth aspects described above.

[0130] The twenty-second aspect of the embodiment of the present application provides a computer program product (or computer program). When the computer program product is executed by the processor, the processor executes the methods of the fifteenth to sixteenth aspects above, and any possible implementation method.

[0131] The twenty-third aspect of an embodiment of the present application provides a chip system, which includes at least one processor for supporting a communication device to implement the fifteenth to sixteenth aspects above, and any possible implementation method.

[0132] In a possible design, the chip system may also include a memory for storing program instructions and data necessary for the communication device. The chip system may be composed of a chip, or may include a chip and other discrete devices. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data for the at least one processor.

[0133] A twenty-fourth aspect of an embodiment of the present application provides a communication system, which includes the communication device of the seventeenth aspect and the communication device of the eighteenth aspect.

[0134] In a twenty-fifth aspect, an embodiment of the present application proposes an edge computing authorization method, including:

[0135] The first network service provider ECS-ER-A receives an application information request from the second network service provider ECS-ER-B;

[0136] The ECS-ER-A sends an application information response to the ECS-ER-B based on the application information request, wherein the application information response includes identification information of the first edge enabling server EES-A and authorization request indication information of EES-A, and the authorization request indication information of EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information.

[0137] In the embodiment of the present application, the authorization request indication information of EES can be shared through the ECS-ER of different network service providers. In the edge node sharing scenario, it is avoided that the ECS does not know that EES needs to perform authorization processing based on the third-party authorization policy due to the lack of authorization request indication information, which in turn causes ECS to not issue authorization information to EEC, thereby causing EEC to fail to request services from EES. It is ensured that EEC can successfully request services from EES.

[0138] Optionally, the application information response further includes: identification information of a first edge application server EAS-A, and the EAS-A is provided with support services by the EES-A.

[0139] In aspect 26, the embodiment of the present application proposes an edge computing authorization method, including:

[0140] The second network service provider ECS-ER-B sends an application information request to the first network service provider ECS-ER-A;

[0141] The ECS-ER-B receives an application information response sent by the ECS-ER-A, wherein the application information response includes identification information of the first edge enabling server EES-A and authorization request indication information of EES-A, and the authorization request indication information of EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information.

[0142] In the embodiment of the present application, the authorization request indication information of EES can be shared through the ECS-ER of different network service providers. In the edge node sharing scenario, it is avoided that the ECS does not know that EES needs to perform authorization processing based on the third-party authorization policy due to the lack of authorization request indication information, which in turn causes ECS to not issue authorization information to EEC, thereby causing EEC to fail to request services from EES. It is ensured that EEC can successfully request services from EES.

[0143] Optionally, the application information response further includes: identification information of a first edge application server EAS-A, and the EAS-A is provided with support services by the EES-A. BRIEF DESCRIPTION OF THE DRAWINGS

[0144] Figure 1 This is a schematic diagram of an edge computing scenario;

[0145] Figure 2 This is a schematic diagram of the registration process between EES and ECS;

[0146] Figure 3 A flow chart showing the process of EEC requesting ECS ​​to issue EAS discovery service;

[0147] Figure 4 Another flow chart of EEC requesting ECS ​​to issue EAS discovery service;

[0148] Figure 5 Another flow chart of EEC requesting ECS ​​to issue EAS discovery service;

[0149] Figure 6 Schematic diagram of the registration process of EEC to EES;

[0150] Figure 7 It is a schematic diagram of the information sharing process of ECS-ER;

[0151] Figure 8 It is another schematic diagram of the information sharing process of ECS-ER;

[0152] Fig. 9 It is another schematic diagram of the information sharing process of ECS-ER;

[0153] Fig.10 Schematic diagram of the scenario flow of EAS discovery service through ECS-B;

[0154] Fig.11 A schematic diagram of a scenario flow of EAS discovery service based on ECS-A;

[0155] Fig.12This is another scenario flow diagram of EAS discovery service based on ECS-A;

[0156] Fig.13 This is a schematic diagram of an implementation flow of an edge computing authorization method in an embodiment of the present application;

[0157] Fig.14 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0158] Fig.15 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0159] Fig.16 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0160] Fig.17 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0161] Fig.18 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0162] Fig.19 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0163] Fig. 20 A flowchart of another embodiment of an edge computing authorization method in an embodiment of the present application;

[0164] Fig.21 A schematic diagram of a communication device provided for this application;

[0165] Fig. 22 Another schematic diagram of a communication device provided by the present application;

[0166] Fig.23 Another schematic diagram of a communication device provided by the present application;

[0167] Fig.24 Another schematic diagram of a communication device provided by the present application. DETAILED DESCRIPTION

[0168] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all of the embodiments. The terms "first", "second" and corresponding terminology labels in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, and this is merely a way of distinguishing objects of the same attributes when describing the embodiments of the present application. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product or device that includes a series of units is not necessarily limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or devices.

[0169] In the description of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the present application is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the present application, "at least one" refers to one or more items, and "multiple items" refers to two or more items. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0170] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) system, new generation (NR) communication system or future sixth generation communication system, etc.

[0171] The part operated by the operator in various communication systems can be called an operator network. The operator network can also be called a public land mobile network (PLMN) network, which is a network established and operated by the government or an operator approved by the government for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNO) provide mobile broadband access services to users. The operator network or PLMN network described in the embodiment of the present application can be a network that meets the requirements of the third generation partnership project (3GPP) standard, referred to as a 3GPP network. Usually, the 3GPP network is operated by an operator, including but not limited to the fifth generation mobile communication (5th-generation, 5G) network, the fourth generation mobile communication (4th-generation, 4G) network or the third generation mobile communication technology (3rd-generation, 3G) network. It also includes the future sixth generation mobile communication (6th-generation, 6G) network. For the convenience of description, the operator network will be used as an example in the embodiment of the present application.

[0172] See also Figure 1 , Figure 1 This is a schematic diagram of a network architecture in an embodiment of the present application. Figure 1 As shown, the network architecture takes a multi-access edge computing (MEC) application network as an example. The network architecture may include, but is not limited to: terminal equipment, a 3rd generation partnership project (3GPP) core network, an edge data network (EDN), and an edge configuration server (ECS). Among them, the terminal device may include an application client (application client(s)) and an edge enabler client (edge ​​enabler client, EEC); the edge data network may include an edge application server (edge ​​application server(s)), EAS, and an edge enabler server (edge ​​enabler server(s), EES).

[0173] Below Figure 1 A brief introduction is given to each network function (or network element) shown in the figure.

[0174] 1. Terminal equipment: may be called user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or user device.

[0175] The terminal device may be a device that provides voice / data to users, for example, a handheld device or a vehicle-mounted device with a wireless connection function. At present, some examples of terminals are: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, wearable devices, terminal devices in 5G networks or terminal devices in future evolved public land mobile communication networks, etc., and the embodiments of the present application are not limited to this.

[0176] As an example but not limitation, in the embodiments of the present application, the terminal device may also be a wearable device. Wearable devices may also be referred to as wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also powerful functions achieved through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and fully or partially independent of smartphones, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.

[0177] In addition, in the embodiments of the present application, the terminal device can also be a terminal device in an IoT system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network that interconnects people and machines and things.

[0178] It should be noted that the terminal device and the access network device can communicate with each other using a certain air interface technology (such as NR or LTE technology, etc.). The terminal devices can also communicate with each other using a certain air interface technology (such as NR or LTE technology, etc.).

[0179] In the embodiment of the present application, the terminal device can be replaced by a device for realizing the function of the terminal device, or a device capable of supporting the terminal device to realize the function, such as a chip system or a chip, which can be installed in the terminal device. In addition, the chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0180] 2. Edge data network: In one understanding, EDN only contains one data network, which is a local data network (local DN), which includes edge enabling functions and can be identified by a data network access identifier (DNAI) and a data network name (application instance / edge). It is a network logical concept. In another understanding, EDN is a peer concept of the central cloud, which can be understood as a local data center (geographic location concept), which can be identified by DNAI and can contain multiple local data networks.

[0181] 3. Application instance / edge application: refers to an application deployed in the edge data network, which can specifically refer to an application on a server (for example, social media software, augmented reality (AR), virtual reality (VR)), or an instance deployed and running in an EDN. An application instance / edge application can deploy one or more EAS in one or more EDNs. EASs deployed and running in different EDNs can be considered as different EASs of an application instance / edge application. They can share a domain name, use an IP address, or use different Internet Protocol (IP) addresses.

[0182] In addition, application instances / edge applications may also be referred to as edge applications (servers), EAS, edge application instances, MEC applications (servers), EAS functions, etc.

[0183] 4. Application client: refers to the peer entity of edge application on the terminal device side. Application client is used by application users to obtain application services from application servers. Application client is a client program applied on the terminal device side. Application client can connect to application servers on the cloud to obtain application services, or it can connect to EAS deployed in one or more EDNs to obtain application services.

[0184] 5. Edge enabling server: It can be deployed in the application instance in EDN to provide some enabling capabilities, which can better support the deployment of applications in MEC; it can support the registration of edge applications, authentication and authorization of terminal devices, and provide terminal devices with information such as the IP address of the application instance; it can also obtain the identification and IP address of the application instance, and further send the identification and IP address of the application instance to the edge data network configuration server.

[0185] In addition, EES is deployed in EDN. Generally, EAS is registered to an EES, or information of an EAS is configured on an EES through a management system. The EES is called the EES associated with the EAS, or the EES controls / manages the EAS registered / configured on the EES.

[0186] 6. Edge enabler client (EEC): EEC is used to register EEC information and application client information with EES, perform security authentication and authorization, obtain the IP address of EAS from EES, and provide edge computing enabling capabilities to the application client (for example, provide EAS services and return the IP address of EAS to the application client). It is the peer entity of EES on the terminal device side.

[0187] 7. Edge configuration server (ECS): It can be responsible for the configuration of EDN (for example, providing EES information to terminal devices), and can also directly provide application instance information to terminal devices, or interact with the application's domain name server (DNS) to obtain application instance information. Furthermore, it can also obtain and save application instance and IP address information from other functional entities.

[0188] Among them, the terminal device signs a service agreement with the application provider to provide services for the terminal device, and the terminal device can log in to the application client on the terminal device and communicate with the EAS through the application client. The edge enabling client is a middleware layer, generally located in the operating system, or between the application client and the operating system. The application client can obtain edge enabling services from the edge enabling client through the application programming interface (API).

[0189] ECS provides the support functions or configuration functions required for the connection between EEC and EES. ECS is deployed by an edge configuration server provider (ECSP). ECS can discover other ECSs through an edge configuration server-edge repository (ECS-ER). The ECS-ER is an ECS with edge storage function, and the ECS-ER is deployed by the ECSP.

[0190] To facilitate understanding of the embodiments of the present application, the edge computing and related processes involved in the present application are explained.

[0191] Edge computing refers to an open platform that integrates the core capabilities of network, computing, storage, and application at the edge of the network close to the source of objects or data, providing edge intelligent services nearby to meet the key needs of industry digitalization in terms of agile connection, real-time business, data optimization, application intelligence, security and privacy protection, etc. In other words, edge computing is to analyze the data collected from the terminal device directly in the local device or network close to the data generation, without the need to transmit the data to the cloud data processing center.

[0192] Multi-access edge computing: Wireless access networks can be used to provide services and cloud computing functions nearby, thereby creating a telecom-grade service environment with high performance, low latency and high bandwidth, accelerating the rapid download of various content, services and applications in the network, allowing consumers to enjoy an uninterrupted high-quality network experience.

[0193] Local Data Network: An access point to a data network that is very close to the user's attachment point.

[0194] Data network: refers to the service network of operators or third parties, which can provide services to terminal devices, such as operator services, Internet services, etc.

[0195] Secondly, Figure 1 First, refer to the interaction between edge computing network functions. Figure 2 , Figure 2 The following is a diagram of the registration process between EES and ECS. The registration process between EES and ECS includes:

[0196] Q1. EES sends an EES registration request (EES registration request [EES ID, EAS IDs]) to ECS. The EES registration request includes the identification information of EES and the identification information (EAS IDs) of the EAS supported by EES.

[0197] Q2. ECS stores EES registration information.

[0198] Q3. ECS sends an EES registration response to EES.

[0199] Through the EES registration process, EES provides information to ECS, enabling EES to provide services to EEC.

[0200] See also Figure 3 , Figure 3 The process diagram of EEC requesting EAS discovery service issuance from ECS is shown in Figure 1. The process of EEC requesting EAS discovery service issuance from ECS specifically supports request or response model, or subscription or notification model. The Transport Layer Security (TLS) protocol is used to implement authentication between EEC and ECS.

[0201] The process of EEC requesting ECS ​​to issue EAS discovery service includes:

[0202] W1. EEC sends a service provisioning request (service provisioning request [EEC ID, EASID, generic public subscription identifier (GPSI)]) to ECS.

[0203] W2. ECS processes the request and generates a token.

[0204] In step W2, ECS verifies whether EEC is authorized to request services from EES. If the verification is successful, ECS issues a token. The token specifically includes: the institution that issues the token (issuer): ECS ID; the user who requests the service (client_id): EEC ID; the identity of the terminal device (subject): GPSI; the name of the EES service required; the entity that provides the service: EES ID, and the expiration time.

[0205] W3. ECS sends a service provisioning response (Service provisioning response [token]) to EES. The service provisioning response includes the token issued in step W2.

[0206] For the process of EEC requesting EAS discovery service from ECS, please refer to the subscription or notification model. Figure 4 and Figure 5 . Figure 4 Another flow chart of EEC requesting ECS ​​to issue EAS discovery service. The flow of EEC requesting ECS ​​to issue EAS discovery service includes:

[0207] E1. EEC sends a service provisioning subscription request (Service provisioning subscription request [EEC ID, EAS ID, GPSI]) to ECS.

[0208] E2. ECS processes the request.

[0209] E3. ECS sends a service provisioning subscription response to EEC.

[0210] Figure 5 Another flow chart of EEC requesting ECS ​​to issue EAS discovery service. The flow of EEC requesting ECS ​​to issue EAS discovery service includes:

[0211] R1. ECS service provides notification trigger and generates token (Trigger for service provisioning notification, generate token).

[0212] R2. ECS sends a service provisioning notification (Service provisioning notification [token]) to EEC.

[0213] EEC needs to request registration services from EES, and EES decides whether to issue services to EEC. TLS protocol is used for verification between EEC and EES, and the authorization between EEC and EES adopts third-party authorization (such as OAuth2 authorization strategy) strategy or local authorization strategy.

[0214] Specifically, the registration process from EEC to EES is as follows: Figure 6 As shown, Figure 6 The following is a diagram of the registration process from EEC to EES. The registration process from EEC to EES includes:

[0215] T1. EEC sends an EES registration request (EES registration request [EES ID, EAS IDs]) to EES. The EES registration request may include a token.

[0216] T2. The EES responds to the EES registration request and performs request validation on the EES registration request.

[0217] T3. EES retrieves EEC's context. Step T3 is an optional step.

[0218] T4. EES sends an EEC registration response (EEC registration response) to EEC.

[0219] Based on the foregoing description, a technology involved in an embodiment of the present application is introduced below, edge node sharing. When EEC requests EAS discovery service from EES, for example, EEC sends an EAS discovery request message to EES, EES may be unable to provide EAS discovery service to EEC because there is no corresponding EAS. At this time, EES can adopt an edge node sharing mechanism, and EES finds another EES that supports the EAS discovery service, and then the EES provides EAS discovery service to EEC. Specifically, taking the sharing of application information between edge nodes as an example, regarding the sharing of application information between EES, application information sharing can be achieved between ECS-ERs. These ECS-ERs may belong to different network service providers. The network service provider includes but is not limited to an operator, a campus network provider, or a network slice service provider, etc. Currently, application information sharing between different operators can be achieved through a request or response model, or a subscription or notification model. First, the application information sharing of ECS-ERs of different operators under the request or response model is introduced. Please refer to Figure 7 , Figure 7 The following is a schematic diagram of the information sharing process of ECS-ER. The information sharing process of ECS-ER includes:

[0220] Y1. ECS-ER-A obtains application information request of ECS-ER-B (Fetch application inforequest).

[0221] The ECS-ER-A belongs to the first network service provider, or operator A (OP-A). The ECS-ER-B belongs to the second network service provider, or operator B (OP-B). Similarly, EES-A belongs to the first network service provider, EES-B belongs to the second network service provider; ECS-A belongs to the first network service provider, ECS-B belongs to the second network service provider; EAS-A belongs to the first network service provider, EAS-B belongs to the second network service provider.

[0222] Y2. ECS-ER-B obtains the application information response of ECS-ER-A (Fetch application inforesponse[EES-AIDs, EAS-A IDs]). The application information response includes the identification information (EES-A IDs) of the EES-A corresponding to all ECS-A managed by ECS-ER-A, and the identification information (EAS-AIDs) of the EAS-A supported by each EES-A.

[0223] See also Figure 8 and Fig. 9 , Figure 8 This is another ECS-ER information sharing process diagram. Fig. 9 The following is another ECS-ER information sharing process diagram. The ECS-ER information sharing process includes:

[0224] U1, ECS-ER (ECSP-B) sends a registered EAS information subscription request (Registered EAS Information Subscribe Request) to ECS-ER (ECSP-A). ECS-ER (ECSP-A) is ECS-ER-A, deployed by ECSP-A; ECS-ER (ECSP-B) is ECS-ER-B, deployed by ECSP-B.

[0225] U2 and ECS-ER (ECSP-A) make an authorization request (Authorize therequest) based on the EAS information subscription request.

[0226] U3. ECS-ER (ECSP-A) sends a Registered EAS Information Subscribe Response to ECS-ER (ECSP-B).

[0227] Fig. 9 The following is another ECS-ER information sharing process diagram. The ECS-ER information sharing process includes:

[0228] P1. ECS-ER (ECSP-A) triggers EAS information updated.

[0229] P2. ECS-ER (ECSP-A) sends a registered EAS information notification (RegisteredEAS Information Notification [EES-A IDs, EAS-A IDs]) to ECS-ER (ECSP-B). The registered EAS information notification includes the identification information of EES-A and the identification information of EAS-A.

[0230] Next, we will introduce the specific scenarios of EAS discovery service. Fig.10 , Fig.10 The following is a flow chart of the scenario of discovering services through EAS of ECS-B. Specifically, the process of discovering services through EAS of ECS-B includes:

[0231] A1. EEC sends an EAS discovery request message (EAS discovery request [token]) to EES-B. The EAS discovery request message carries a token. The EAS discovery request message may also carry the identification information of EES-A.

[0232] A2. EES-B verifies the token carried by the EAS discovery request message. If the verification passes, it detects whether EES-B supports the EAS discovery service requested by the EAS discovery request message. If it is determined that EES-B does not support the EAS discovery service requested by the EEC, that is, EES-B does not support the EAS identification information requested by the EEC, it determines edge node sharing. If EES-B already has the identification information of EES-A, skip steps A3 to A5 and proceed to step A6; if EES-B does not have the identification information of EES-A, proceed to step A3.

[0233] A3. EES-B sends a Retrieve EES request message to ECS-B to obtain the identification information of EES-A.

[0234] A4. ECS-B responds to the EES request message and discovers EES-A. Step A4 is an optional step. If ECS-B already has the identification information of EES-A, step A4 may not be performed.

[0235] A5. ECS-B sends a Retrieve EES response message to EES-B. The Retrieve EES response message includes the identification information of EES-A, so that EES-B can discover EES-A.

[0236] A6. EES-B sends an EAS discovery request message (EAS discovery request) to EES-A, requesting EES-A to provide EAS discovery service.

[0237] A7. EES-A sends an EAS discovery response message to EES-B. The EAS discovery response message carries the identification information of the EAS supported by EES-A.

[0238] A8. EES-B sends an EAS discovery response message to EEC. The EAS discovery response message carries the identification information of the EAS supported by EES-A.

[0239] Another scenario for EAS service discovery. Fig.11 , Fig.11 The figure is a flow chart of a scenario of EAS discovery service based on ECS-A.

[0240] First, EEC has obtained the identification information of EES-A, including but not limited to: uniform resource identifier (URI) and IP address of EES-A. EEC has obtained security credentials, which authorize EEC to communicate with EES-A. Specifically, the scenario process of EAS discovery service based on ECS-A includes:

[0241] B1. EEC sends an EAS discovery request message (EAS discovery request) to EES-A.

[0242] B2. EES-A responds to the EAS discovery request message and performs an authorization check. If the authorization check passes, proceed to step B3.

[0243] B3. EES-A sends an EAS discovery response message to EEC. The EAS discovery response message carries the identification information of the EAS supported by EES-A.

[0244] Another scenario for EAS service discovery. Fig.12 , Fig.12 The following is a flow chart of another scenario of EAS discovery service based on ECS-A.

[0245] First, EES-B has obtained the identification information of EES-A, including but not limited to: uniform resource identifier (URI) and IP address of EES-A. EES-B has obtained security credentials, which authorize EES-B to communicate with EES-A. Specifically, the scenario process of EAS discovery service based on ECS-A includes:

[0246] C1. EES-B sends an EAS discovery request message (EAS discovery request) to EES-A.

[0247] C2. EES-A responds to the EAS discovery request message and performs an authorization check. If the authorization check passes, proceed to step C3.

[0248] C3. EES-A sends an EAS discovery response message to EES-B. The EAS discovery response message carries the identification information of the EAS supported by EES-A.

[0249] The applicant has found that the above mechanism has the following defects: ECS deployed in other ECSPs (for example, ECS-C deployed in ECSP-C) may impersonate ECS-B. In other words, the identification information of ECS-C impersonates the identification information of ECS-B, and the identification information of ECS-C is consistent with the identification information of ECS-B. Under the current edge node sharing mechanism, since the ECS-C impersonates ECS-B, the ECS-C can also request EES-A to provide EAS discovery service, causing EES to abnormally provide EAS discovery service.

[0250] Based on this, an embodiment of the present application proposes an authorization method for edge computing, the method comprising: a first edge configuration server ECS-A receives a first authorization information request sent by a second edge configuration server ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes identification information of the second edge configuration server provider ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries identification information of ECSP-B, and the authorization information is used to verify the network function request for the first edge enabling server EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request for EES-A to provide services, carrying the identification information of the ECSP to which ECS-B belongs in the authorization information can effectively prevent ECSs belonging to other ECSPs from impersonating the ECS-B.

[0251] First, see Fig.13 , Fig.13 The following is a flow chart of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application includes:

[0252] F1. EEC sends an EAS discovery request message to EES-B, including the identification information of EEC.

[0253] In step F1, the identification information of the EEC may be carried in a client credentials assertion (CCA) parameter. The CCA parameter is issued by the EEC to itself and carries the identification information of the EEC.

[0254] It should be noted that the identification information in the embodiments of the present application can also be understood as identity information or identity identification, which is not limited here.

[0255] F2. EES-B determines the shared edge node and requests authorization information.

[0256] In step F2, after EES-B receives the EAS discovery request message sent by EEC, EES-B determines the EAS discovery service that needs to be obtained based on the message. Then EES-B determines that the EES that can provide the EAS discovery service is EES-A. If EES-B has obtained the identification information of EES-A, it proceeds to step F3. The first edge application service request message in step F3 can also include the identification information of EES-A. If EES-B has not obtained the identification information of EES-A, the first edge application service request message in step F3 does not include the identification information of EES-A.

[0257] Optionally, EES-B obtains relevant information of EES-A. Specifically, ECS-B obtains relevant information of EES-A through ECS-A, and the relevant information of EES-A includes authorization request indication information of EES-A, and the authorization request indication information of EES-A is used to indicate that EES-A needs to perform authorization processing based on the authorization information. Based on the obtained authorization request indication information of EES-A, EES-B requests ECS-B to issue authorization information in step F3. If the authorization request indication information of EES-A indicates that EES-A does not need to perform authorization processing based on the authorization information, steps F3 to F8 are not executed, and step F9 is entered after step F2.

[0258] Optionally, if EES-B has obtained authorization information, for example, EES-B has obtained authorization information during the previous EEC request to EES-A to provide EAS discovery service. Then after step F2, EES-B sends an EAS discovery request message to EES-A, and the EAS discovery request message carries authorization information and EEC's identification information. Then EES-B receives an EAS discovery response message sent by EES-A, and the EAS discovery response message includes EAS identification information. EES-B forwards the EAS discovery response message to EEC.

[0259] F3. EES-B sends a first edge application service request message to ECS-B, including the third authorization information. The third authorization information indicates that EEC is allowed to request services from EES-B.

[0260] In step F3, the third authorization information is the authorization information issued by ECS-B to EEC, and the third authorization information indicates that EEC is allowed to request services from EES-B. Specifically, the third authorization information includes: issuing authority (issuer): identification information of ECS-B (ECS-B ID); user identification of the service requesting: identification information of EEC (EEC ID); identity of the terminal device (subject): GPSI; required EES service name: identification information of EES-B (EES-B ID); expiration time of the third authorization information.

[0261] The first edge application service request message includes the third authorization information. Optionally, the first edge application service request message also includes identification information of EES-A.

[0262] Optionally, the first edge application service request message may also be replaced by other messages, such as an EES request acquisition message (retrieve EES request). The EES request acquisition message includes the third authorization information.

[0263] In step F3, another implementation manner is: EES-B sends a first edge application service request message to ECS-A; and ECS-A forwards the first edge application service request message to ECS-B.

[0264] Alternatively, the first edge service application request message is replaced with an application context transfer request message, which is used to request EES-A to provide application context migration service to EES-B. For example, the context relocation request message is used to request EES-A / EAS-A to transfer an application context to EES-B / EAS-B, and the application context may be the context of EAS. Exemplarily, the scenario is an application context relocation (ACR) scenario. When the UE moves to a new location, there may be a different or more suitable EAS to serve the application client AC in the UE. At this time, the support of EEC and EES is needed to ensure the continuity of the service so that the application context of EAS-B can be transferred to EAS-A.

[0265] F4, ECS-B discovered EES-A.

[0266] Step F4 is an optional step. After receiving the first edge application service request message (or EES request acquisition message, or context relocation request message) from EES-B, ECS-B finds or searches for EES-A and determines the identification information of EES-A.

[0267] If ECS-B obtains the identification information of EES-A, for example, the first edge application service request message in step F3 also includes the identification information of EES-A, step F4 is not executed.

[0268] Optionally, if in step F4, ECS-B obtains authorization request indication information of EES-A. If the authorization request indication information is used to indicate that EES-A needs to perform authorization processing based on the authorization information, then proceed to step F5; if the authorization request indication information is used to indicate that EES-A does not need to perform authorization processing based on the authorization information, then proceed to step F9.

[0269] F5. ECS-B sends a first authorization information request to ECS-A to request issuance of authorization information, including identification information of ECSP-B.

[0270] In step F5, ECS-B sends a first authorization information request to ECS-A. The first authorization information request is used to request issuance of authorization information. The first authorization information request includes identification information of ECSP-B. ECS-B is deployed by ECSP-B.

[0271] Optionally, the first authorization information request further includes any one or more of the following information: identification information of the EEC, identification information of the EES-B, identification information of the EES-A, identification information of the ECS-B or GPSI.

[0272] Optionally, the first authorization information request may be carried in a second service provisioning request message “serviceprovisioning request”.

[0273] F6. ECS-A generates authorization information in response to the first authorization information request, including identification information of ECSP-A and / or identification information of ECSP-B.

[0274] In step F6, ECS-A generates authorization information in response to the first authorization information request, and the authorization information is used to verify the network function request EES-A to provide services. The authorization information specifically includes: the identification information of ECSP-B, the identification information of ECSP-A, or the identification information of ECSP-A and the identification information of ECSP-B. ECS-A is deployed by ECSP-A, and ECS-B is deployed by ECSP-B. The following are explained separately:

[0275] In one implementation, the authorization information includes the identification information of ECSP-B. Since the network function requests EES-A to provide services through the network function managed by ECSP-B, by adding the identification information of ECSP-B to the authorization information, it can be ensured that only when EES-B managed by ECSP-B requests EES-A to provide services, the EES-B may be allowed to obtain the services provided by EES-A. This prevents EES belonging to other ECSPs from impersonating EES-B managed by ECSP-B.

[0276] In another possible implementation, the authorization information also includes the identification information of ECSP-A. By adding the identification information of ECSP-A to the authorization information, it can be ensured that when EES-B requests EES-A to provide services, only EES-A may be allowed to provide services to the network function. This prevents EES belonging to other ECSPs from providing services to the network function.

[0277] Regarding the authorization information, it can be used to verify the EAS discovery request message (EAS discovery request). The EAS discovery request message is used to request EES-A to provide EAS discovery services to the network function. The network function includes but is not limited to: EEC or EES. For example, EEC requests EAS discovery service, and the EAS discovery request message sent by EEC carries the authorization information. For another example, EES-B requests EAS discovery service, and the EAS discovery request message sent by EES-B carries the authorization information.

[0278] The authorization information can also be used to verify the context relocation request (application context transfer) message. The context relocation request message is used to request EES-A to provide application context migration services to the network function. For example, the context relocation request message is used to request the transfer of application context between EES / EAS, and the application context can be the context of EAS.

[0279] It should be noted that the authorization information can also be used to verify the network function request EES-A to provide other services, which is not limited in this embodiment of the present application.

[0280] Furthermore, the authorization information includes a variety of possible implementations, which are introduced below.

[0281] (I) The authorization information includes first authorization information, which includes identification information of the EEC, and the first authorization information is used to verify the EEC's request to EES-A to provide services. The identification information of the EEC can be obtained by ECS-A from the first authorization information request.

[0282] (ii) The authorization information includes second authorization information, the second authorization information includes identification information of EES-B, and the second authorization information is used to verify EES-B's request for EES-A to provide services. ECS-A can obtain the identification information of EES-B from the first authorization information request.

[0283] (3) The authorization information includes the first authorization information and the second authorization information.

[0284] F7. ECS-A sends authorization information to ECS-B, including identification information of ECSP-A and / or identification information of ECSP-B.

[0285] In step F7, ECS-A sends authorization information to ECS-B, where the authorization information includes identification information of ECSP-B, or the authorization information includes identification information of ECSP-A, or the authorization information includes identification information of ECSP-A and identification information of ECSP-B.

[0286] Specifically, there are multiple ways to carry authorization information, which are described below respectively.

[0287] (I) The first authorization information is carried in the first token. Taking the first authorization information including the identification information of ECSP-B as an example, the first token includes: the issuing authority (issuer): ECS-A; the client identification information (client ID): the identification information of EEC; the identity of the terminal device (subject): GPSI; the required EES service name (audience): the identification information of EES-A; the expiration time of the first token; the ECSP identification information 1 provided by ECS: the identification information of ECSP-B.

[0288] If the first authorization information further includes identification information of ECSP-A, the first token further includes: ECSP identification information 2 providing the ECS: identification information of ECSP-A.

[0289] Specifically, ECS-A sends a first token to ECS-B, where the first token includes first authorization information.

[0290] (ii) The second authorization information is carried in the second token. Taking the second authorization information including the identification information of ECSP-B as an example, the second token includes: the issuing authority (issuer): ECS-A; the client identification information (client ID): the identification information of EES-B; the identity of the terminal device (subject): GPSI; the required EES service name (audience): the identification information of EES-A; the expiration time of the second token; the ECSP identification information 1 provided by ECS: the identification information of ECSP-B.

[0291] If the second authorization information further includes identification information of ECSP-A, the second token further includes: providing ECSP identification information 2 of the ECS: identification information of ECSP-A.

[0292] Specifically, ECS-A sends a second token to ECS-B, where the first token includes second authorization information.

[0293] (III) The first authorization information and the second authorization information are carried in the third token. Taking the first authorization information and the second authorization information including the identification information of ECSP-B as an example, the third token includes: the issuing authority (issuer): ECS-A; the client identification information (client ID) 1: the identification information of EEC; the client identification information 2: the identification information of EES-B; the identity of the terminal device (subject): GPSI; the required EES service name (audience): the identification information of EES-A; the expiration time of the third token; the ECSP identification information 1 providing the ECS: the identification information of ECSP-B.

[0294] If the first authorization information and the second authorization information further include identification information of ECSP-A, the third token further includes: ECSP identification information 2 providing the ECS: identification information of ECSP-A.

[0295] Specifically, ECS-A sends a third token to ECS-B, where the third token includes the first authorization information and the second authorization information.

[0296] Optionally, ECS-A sends the first token and the second token to ECS-B.

[0297] In another possible implementation, if another implementation is adopted in step F3: EES-B sends a first edge application service request message to ECS-A; ECS-A forwards the first edge application service request message to ECS-B. Then in step F7, ECS-A sends the authorization information to EES-B, step F8 is not executed, and step F9 is executed after step F7.

[0298] F8. ECS-B sends a first edge application service response message to EES-B, including authorization information.

[0299] In step F8, after receiving the authorization information from ECS-A, ECS-B sends a first edge application service response message to EES-B in response to the first edge application service request message, where the first edge application service response message includes the authorization information.

[0300] In another possible implementation manner, ECS-B sends a context relocation response message to EES-B, where the context relocation response message includes authorization information.

[0301] F9. EES-A and EES-B exchange certificates.

[0302] In step F9, when EES-B receives the EAS discovery request message from EEC, EES-B triggers a request to EES-A to obtain the EAS discovery service. First, in step F9, EES-A and EES-B authenticate each other based on the TLS protocol. Then, EES-A and EES-B exchange certificates. EES-A obtains trusted information based on the certificate from EES-B. For ease of description, the information obtained by EES-A through certificate exchange in step F9 is referred to as trusted information. EES-A needs to use this trusted information to verify the authorization information.

[0303] In addition to the identification information of ECSP-B obtained by EES-A, the trusted information optionally also includes any one or more of the following information: the identification information of EEC obtained by the EES-A, the identification information of the second edge enabling server EES-B obtained by the EES-A, or the identification information of the first edge configuration server provider ECSP-A obtained by the EES-A.

[0304] F10. EES-B sends an EAS discovery request message to EES-A, including authorization information and EEC identification information.

[0305] In step F10, specifically, the EAS discovery request message includes the identification information and authorization information of the EEC. EES-B can directly forward the EAS discovery request message from the EEC, for example, forwarding the EAS discovery request message received in step F1 to EES-A in step F10. EES-B can also regenerate the EAS discovery request message, for example, in response to the EAS discovery request message received in step F1, generate an EAS discovery request message ', and the EAS discovery request message sent by EES-B to EES-A in step F10 is the EAS discovery request message '.

[0306] Optionally, the EAS discovery request message may also include identification information of EES-B.

[0307] Optionally, the EAS discovery request message includes a CCA parameter, where the CCA parameter includes identification information of the EES.

[0308] In another possible implementation manner, EES-B sends a context relocation request message to EES-A, where the context relocation request message includes authorization information.

[0309] F11, EES-A verifies the authorization information.

[0310] In step F11, after EES-A obtains the authorization information, EES-A verifies the authorization information using the trusted information obtained in step F9. The specific verification method is as follows:

[0311] EES-A verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information;

[0312] and / or, EES-A verifies the identification information of the second edge enabling server EES-B included in the second authorization information according to the identification information of the second edge enabling server EES-B in the trusted information;

[0313] and / or, EES-A verifies the identification information of the first edge configuration server provider ECSP-A included in the first authorization information or the identification information of the first edge configuration server provider ECSP-A included in the second authorization information according to the identification information of the first edge configuration server provider ECSP-A included in the trusted information;

[0314] And / or, EES-A verifies the identification information of the second edge configuration server provider ECSP-B included in the first authorization information or the identification information of the second edge configuration server provider ECSP-B included in the second authorization information according to the identification information of the second edge configuration server provider ECSP-B in the trusted information.

[0315] If any of the above verification results are different, for example, the identification information of ECSP-B in the trusted information is different from the identification information of ECSP-B included in the second authorization information, then it is considered that the verification has failed and the authorization information has not passed the verification. Steps F12 to F13 are not executed. Optionally, after determining that the verification has failed, EES-A can send an EAS request failure notification to EES-B or EEC, and the EAS request failure notification is used to notify EEC that the request for the EAS discovery service has failed.

[0316] If all the above verification results are the same, it is considered that the verification is successful and the authorization information has passed the verification. Go to step F12.

[0317] In another possible implementation, after EES-A obtains the trusted information, it sends the trusted information to ECS-A. ECS-A verifies the authorization information based on the trusted information. Specifically, the method by which ECS-A verifies the authorization information using the trusted information is as follows: ECS-A verifies the identification information of EEC included in the first authorization information based on the identification information of EEC in the trusted information; and / or, ECS-A verifies the identification information of EES-B included in the second authorization information based on the identification information of EES-B in the trusted information; and / or, ECS-A verifies the identification information of ECSP-A included in the first authorization information or the identification information of ECSP-A included in the second authorization information based on the identification information of EES-B included in the trusted information; and / or, ECS-A verifies the identification information of ECSP-B included in the first authorization information or the identification information of ECSP-B included in the second authorization information based on the identification information of ECSP-B in the trusted information. The specific verification method is similar to the method by which EES-A verifies the authorization information, and will not be repeated here. Then, ECS-A sends verification indication information to EES-A according to the result of verifying the authorization information, and the verification indication information is used to indicate whether the authorization information has passed the verification or failed the verification. EES-A determines the verification result according to the verification indication information.

[0318] Similarly, if the verification indication information is used to indicate that the authorization information has not passed the verification, steps F12 to F13 are not performed. Optionally, after determining that the verification has failed, EES-A may send an EAS request failure notification to EES-B or EEC, and the EAS request failure notification is used to notify EEC that the request for the EAS discovery service has failed.

[0319] If the verification indication information is used to indicate that the authorization information has passed the verification, go to step F12.

[0320] F12. EES-A sends an EAS discovery response message to EES-B, including EAS identification information.

[0321] In step F12, if EES-A determines that the EAS discovery request message in step F10 passes verification, then in step F12, EES-A sends an EAS discovery response message to EES-B, and the EAS discovery response message includes the identification information of the EAS requested by the EES-B.

[0322] In another possible implementation, if EES-B sends a context relocation request message to EES-A in step F10, then EES-A sends a context relocation response message to EES-B in step F12, and the context relocation response message carries the context of EAS-A related to EES-A, so that the context migration related to EAS-A is completed between EES-A and EES-B.

[0323] F13. EES-B sends an EAS discovery response message to EEC, including EAS identification information.

[0324] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0325] In combination with the above-mentioned embodiment, during the process of EES registering with ECS, authorization request indication information may also be sent, and the authorization request indication information is used to indicate that the EES needs to perform authorization processing based on the authorization information. Fig.14 , Fig.14 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0326] S1. EES sends an EES registration request (EES registration request [EES ID, EAS ID, authorization request indication information) message to ECS.

[0327] In step S1, specifically, when EES registers with ECS, it carries authorization request indication information. The authorization request indication information indicates that EES needs to perform authorization processing based on the authorization information. For example, the authorization request indication information is "OAuth2-requested indication", and "OAuth2-requested indication" is used to indicate that EES needs a third-party authorization policy, such as OAuth2.

[0328] Alternatively, the authorization request indication information of the EES is used to indicate that the EES does not need to perform authorization processing based on the authorization information.

[0329] S2. ECS responds to the EES registration request message and stores EES registration information (Store EES registrationinformation).

[0330] Specifically, in step S2, the ECS stores the authorization request indication information of the EES.

[0331] S3. ECS sends an EES registration response message to EES.

[0332] In the embodiment of the present application, the authorization request indication information is carried when the EES registers with the ECS through the above method, so as to avoid the ECS not knowing that the EES needs to perform authorization processing based on the third-party authorization policy due to the lack of the authorization request indication information, and then causing the ECS not to issue authorization information to the EEC, thereby causing the EEC to fail to request services from the EES. It is ensured that the EEC can successfully request services from the EES.

[0333] In combination with the above-mentioned embodiment, the authorization request indication information can also be transmitted in the information sharing process of different ECS-ERs. Fig.15 , Fig.15 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0334] D1. ECS-ER-A obtains application information request from ECS-ER-B (Fetch application inforequest).

[0335] D2. ECS-ER-B obtains the application information response of ECS-ER-B (Fetch application inforesponse[EES-AIDs, EAS-A IDs, authorization request indication information]). The application information response includes the authorization request indication information of EES.

[0336] In the embodiment of the present application, the authorization request indication information of EES can be shared through the ECS-ER of different network service providers. In the edge node sharing scenario, it is avoided that the ECS does not know that EES needs to perform authorization processing based on the third-party authorization policy due to the lack of authorization request indication information, which in turn causes ECS to not issue authorization information to EEC, thereby causing EEC to fail to request services from EES. It is ensured that EEC can successfully request services from EES.

[0337] In combination with the above embodiment, EES-B may also forward the EAS discovery request message from EEC, and EES-B forwards the EAS discovery request message from EEC to EES-A. Through the above method, the authorization information may only include the authorization information related to EEC. Fig.16 , Fig.16 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0338] G1. EEC sends an EAS discovery request message to EES-B, including the identification information of EEC.

[0339] In step G1, EEC sends an EAS discovery request message to EES-B. There are multiple implementation methods which are described below.

[0340] (1) EEC sends an EAS discovery request message to EES-B, the EAS discovery request message includes a CCA parameter, and the CCA parameter includes the identification information of EEC. In this implementation, step G9 and step G10 are not performed. Step G11 is performed after step G8.

[0341] Optionally, the CCA parameter also includes identification information of ECSP-B.

[0342] (1.1) If EEC already has the identification information of EES-A, for example, EEC obtains the identification information of EES-A in the process of requesting EES-A to provide EAS discovery service last time, step G4 is not executed. Step G5 is executed after step G3.

[0343] (1.2) If EEC already has the identification information of EES-A, for example, EEC obtains the identification information of EES-A in the process of requesting EES-A to provide EAS discovery service in the previous time, then steps G2 to G4 are not executed. In step G1, it is replaced by: EEC sends a first authorization information request to ECS-B. Step G5 is executed after step G1.

[0344] (2) In another possible implementation of step G1, EEC sends an EES identification information request message to EES-B, and the EES identification information request message carries the third authorization information. In this implementation, steps G9 and G10 are executed. Step G9 is executed after step G8.

[0345] G2, EES-B determines the shared edge node and requests authorization information.

[0346] G3. EES-B sends a first edge application service request message to ECS-B, including the third authorization information. The third authorization information indicates that EEC is allowed to request services from EES-B.

[0347] G4, ECS-B discovered EES-A.

[0348] G5. ECS-B sends a first authorization information request to ECS-A to request issuance of authorization information, including identification information of ECSP-B.

[0349] G6. ECS-A generates authorization information in response to the first authorization information request, including identification information of ECSP-A and / or identification information of ECSP-B.

[0350] It should be noted that in this embodiment, EES-B only forwards the EAS discovery request message of EES, so the authorization information can only include the first authorization information, and ECS-A does not need to issue authorization information to EES-B, that is, ECS-A does not need to issue the second authorization information to EES-B.

[0351] G7. ECS-A sends authorization information to ECS-B, including identification information of ECSP-A and / or identification information of ECSP-B.

[0352] G8. ECS-B sends a first edge application service response message to EES-B, including authorization information.

[0353] Steps G2 to G8 are similar to the aforementioned steps F2 to F8 and are not described in detail here.

[0354] G9. EES-B sends an EES identification information response message to EEC, including EES-A's identification information and authorization information.

[0355] In step G9, after EES-B obtains the authorization information, in response to the EES identification information request message received by EES-B in step G1, EES-B sends an EES identification information response message to EEC, which includes the identification information of EES-A and the authorization information.

[0356] G10. EEC sends an EAS discovery request message to EES-B, including the identification information and authorization information of EEC.

[0357] In step G10, the EEC sends an EAS discovery request message to EES-B in response to the identification information response message of the EES. The EAS discovery request message includes the identification information and authorization information of the EEC.

[0358] In another possible implementation, in step G10, the EEC sends an EAS discovery request message to the EES-A, then steps G11 and G13 are not performed, and step G12 is performed after step G10.

[0359] G11. EES-B sends an EAS discovery request message to EES-A, including authorization information and EEC identification information.

[0360] In step G11, after receiving the EAS discovery request message from the EEC, EES-B directly forwards the EAS discovery request message to EES-A.

[0361] G12, EES-A verifies authorization information.

[0362] G13. EES-A sends an EAS discovery response message to EES-B, including EAS identification information.

[0363] G14. EES-B sends an EAS discovery response message to EEC, including EAS identification information.

[0364] Steps G12 to G14 are similar to the aforementioned steps F11 to F13 and are not described in detail here.

[0365] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0366] In combination with the above-mentioned embodiments, the following describes the scenario of the ECS-A-based EAS discovery service triggered by the EEC according to the embodiments of the present application. Fig.17 , Fig.17 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0367] H1. The EEC sends a first service provision request message to ECS-B, including identification information of the EEC and identification information of the EAS.

[0368] In step H1, the ECC sends a first service provisioning request message "service provisioning request" to ECS-B, the first service provisioning request message including the identification information of the EEC and the identification information of the EAS. Optionally, the first service provisioning request message also includes GPSI.

[0369] In response to the first service provision request message, ECS-B obtains relevant information of ECS-A. Based on the relevant information of ECS-A and the first service provision request message, ECS-B determines that authorization by ECS-A is required, and proceeds to step H2.

[0370] H2. ECS-B sends a second service provision request message to ECS-A, carrying the first authorization information request, including the identification information of ECSP-B.

[0371] In step H2, ECS-B sends a second service provision request message carrying the first authorization information request to ECS-A, and the second service provision request message also includes the identification information of ECSP-B. For the first authorization information request, please refer to the aforementioned step F5, which will not be described here.

[0372] H3. In response to the first authorization information request, ECS-A generates authorization information, including identification information of ECSP-A and / or identification information of ECSP-B.

[0373] Step H3 is similar to the aforementioned step F6 and will not be described in detail here.

[0374] H4. ECS-A sends a second service provision response message to ECS-B, including authorization information.

[0375] In step H4, ECS-A sends authorization information to ECS-B by sending a second service provision response message to ECS-B, and the second service provision response message includes the authorization information.

[0376] H5. ECS-B sends a first service provision response message to EEC, including authorization information.

[0377] In step H5, after receiving the second service provision response message, ECS-B obtains the authorization information from the second service provision response message. Then, ECS-B sends the authorization information to ECS-B by sending the first service provision response message to EEC, and the first service provision response message includes the authorization information.

[0378] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0379] In combination with the above-mentioned embodiments, the following describes the scenario of triggering EAS discovery service by EES-A based on ECS-A involved in the embodiments of the present application. Fig.18 , Fig.18 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0380] J1. EEC sends an EAS discovery request message to EES-A, including authorization information.

[0381] In step J1, after the EEC obtains the authorization information, when the EEC needs to obtain the EAS discovery service from the EES-A, the EEC sends an EAS discovery request message to the EES-A, and the EAS discovery request message includes the authorization information.

[0382] In another possible implementation, after the EEC obtains the authorization information, in the ACR scenario, the EEC sends a context relocation request message to the EES-A.

[0383] J2. EES-A performs an authorization check in response to the EAS discovery request message.

[0384] In step J2, EES-A responds to the EAS discovery request message and performs an authorization check on the authorization information carried in the EAS discovery request message. The specific authorization check method is similar to the aforementioned step F11 and will not be described in detail here.

[0385] If the verification passes, the process proceeds to step J3; if the verification fails, EES-A sends an EAS discovery request failure notification to EEC.

[0386] J3. EES-A sends an EAS discovery response message to EEC, including the EAS identification information.

[0387] In step J3, EES-A sends an EAS discovery response message to EEC, where the EAS discovery response message includes identification information of the EAS.

[0388] In another possible implementation, in an ACR scenario, after EES-A completes the context migration of the EAS, EES-A sends a context relocation response message to the EEC, where the context relocation response message indicates that the context migration of the EAS related to the EES-A has been completed.

[0389] In the embodiment of the present application, when EEC requests services from EES-A, it needs to send EEC-related authorization information to EES-A, so as to avoid EEC's unauthorized request for services from EES-A due to abnormal behavior, resulting in EES-A providing services to EEC without verification.

[0390] In combination with the above-mentioned embodiments, the following describes the scenario of EES-B triggering EAS discovery service based on ECS-A involved in the embodiments of the present application. First, how EES-B obtains authorization information in this scenario is described. Fig.19 , Fig.19 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0391] K1. EES-B sends a second authorization information request to ECS-B, including the identification information of EES-A.

[0392] In step K1, EES-B sends a second authorization information request to ECS-B, the second authorization information request includes identification information of EES-A. Optionally, the second authorization information request may also include identification information of EES-B and identification information of ECSP-B.

[0393] K2. ECS-B sends a first authorization information request to ECS-A, including the identification information of EES-B, the identification information of EES-A, and the identification information of ECSP-B.

[0394] K3. ECS-A generates second authorization information in response to the first authorization information request, including identification information of ECSP-A and / or identification information of ECSP-B.

[0395] K4. ECS-A sends a first authorization information response to ECS-B, including the second authorization information.

[0396] Steps K2 to K4 are consistent with the aforementioned steps F5 to F7 and are not described in detail here.

[0397] K5. ECS-B sends a second authorization information response to EES-B, including the second authorization information.

[0398] In step K5, in response to the second authorization information request, ECS-B sends a second authorization information response to EES-B, where the second authorization information response includes the second authorization information.

[0399] In an embodiment of the present application, ECS-A receives a first authorization information request sent by ECS-B, the first authorization information request is used to request the issuance of authorization information, the first authorization information request includes the identification information of ECSP-B, and ECS-B is deployed by ECSP-B; ECS-A sends authorization information to ECS-B, the authorization information carries the identification information of ECSP-B, and the authorization information is used to verify the network function request EES-A to provide services, and EES-A is the EES registered in ECS-A. Since the purpose of the authorization information is to verify the network function request EES-A to provide services, the identification information of the ECSP to which ECS-B belongs is carried in the authorization information, which can effectively prevent the ECS belonging to other ECSPs from impersonating the ECS-B. When EES-B requests services from EES-A, it is necessary to send EES-B related authorization information to EES-A. Avoid unauthorized request for services from EES-A due to abnormal behavior of EES-B, which causes EES-A to provide services to EES-B without verification.

[0400] Next, we will introduce how EES-B triggers the EAS discovery service. Fig. 20 , Fig. 20 The following is a flow chart of another embodiment of an edge computing authorization method in an embodiment of the present application. The edge computing authorization method proposed in an embodiment of the present application further includes:

[0401] L1. EES-B sends an EAS discovery request message to EES-A, including the second authorization information.

[0402] In step L1, in another possible implementation, after EES-B obtains authorization information, in the ACR scenario, EES-B sends a context relocation request message to EES-A.

[0403] L2. In response to the EAS discovery request message, EES-A performs an authorization check.

[0404] In step L2, EES-A responds to the EAS discovery request message and performs an authorization check on the authorization information carried in the EAS discovery request message. The specific authorization check method is similar to the aforementioned step F11 and will not be described in detail here.

[0405] If the verification passes, the process proceeds to step L3; if the verification fails, EES-A sends an EAS discovery request failure notification to EES-B.

[0406] L3. EES-A sends an EAS discovery response message to EES-B, including EAS identification information.

[0407] In step L3, EES-A sends an EAS discovery response message to EES-B, where the EAS discovery response message includes identification information of the EAS.

[0408] In another possible implementation, in an ACR scenario, after EES-A completes the context migration of the EAS, EES-A sends a context relocation response message to EES-B, where the context relocation response message indicates that the context migration of the EAS related to EES-A has been completed.

[0409] In the embodiment of the present application, when EES-B requests services from EES-A, it needs to send EES-B-related authorization information to EES-A, so as to avoid EES-B requesting services from EES-A without authorization due to abnormal behavior, resulting in EES-A providing services to EES-B without verification.

[0410] The present application is described above from the perspective of method, and other embodiments provided by the present application will be further described below.

[0411] See also Fig.21 , is a schematic diagram of an implementation of the communication device provided in the present application, and the communication device 2100 includes a processing module 2101 and a transceiver module 2102. The communication device 2100 can implement the functions of the communication device (including EES, ECS and / or ECS-ER, etc.) in the above method embodiment, and thus can also achieve the beneficial effects possessed by the above method embodiment. In the embodiment of the present application, the communication device 2100 can be EES, ECS and / or ECS-ER, or an integrated circuit or component inside EES, ECS and / or ECS-ER, such as a chip.

[0412] In a possible example, the communication device 2100 is applied to a first edge configuration server ECS-A, and the communication device 2100 includes:

[0413] The transceiver module 2102 is configured to receive a first authorization information request sent by a second edge configuration server ECS-B, where the first authorization information request is used to request issuance of authorization information, and the first authorization information request includes identification information of a second edge configuration server provider ECSP-B, where the ECS-B is deployed by the ECSP-B;

[0414] The transceiver module 2102 is used to send the authorization information to the ECS-B, where the authorization information carries the identification information of the ECSP-B. The authorization information is used to verify the network function request for the first edge enabling server EES-A to provide services, where the EES-A is the EES registered in the ECS-A.

[0415] Optionally, the authorization information further includes: identification information of a first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A.

[0416] Optionally, the authorization information is used to verify the edge application server EAS discovery request message or the context relocation request message, the EAS discovery request message is used to request the EES-A to provide the EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide the application context migration service to the network function.

[0417] Optionally, the first authorization information request further includes identification information of an edge enabling client EEC;

[0418] The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

[0419] Optionally, the first authorization information request further includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B;

[0420] The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

[0421] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0422] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0423] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0424] Optionally, the transceiver module 2102 is used to receive trusted information from the EES-A, where the trusted information includes any one or more of the following information: identification information of the EEC acquired by the EES-A, identification information of the second edge enabling server EES-B acquired by the EES-A, identification information of the second edge configuration server provider ECSP-B acquired by the EES-A, or identification information of the first edge configuration server provider ECSP-A acquired by the EES-A;

[0425] Processing module 2101, used for verifying the authorization information according to the trusted information;

[0426] The transceiver module 2102 is used to send verification indication information to the EES-A according to the result of verifying the authorization information, and the verification indication information is used to indicate whether the authorization information has passed the verification or failed the verification.

[0427] Optionally, the processing module 2101 is used to verify the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information;

[0428] and / or, the processing module 2101 is used to verify the identification information of EES-B included in the second authorization information according to the identification information of EES-B in the trusted information;

[0429] and / or, a processing module 2101, configured to verify, according to the identification information of EES-B included in the trusted information, the identification information of ECSP-A included in the first authorization information or the identification information of ECSP-A included in the second authorization information;

[0430] And / or, the processing module 2101 is configured to verify the identification information of ECSP-B included in the first authorization information or the identification information of ECSP-B included in the second authorization information according to the identification information of ECSP-B in the trusted information.

[0431] Optionally, the first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide an edge application server EAS discovery service to the EEC;

[0432] The first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

[0433] In yet another example, the communication device 2100 is applied to the second edge configuration server ECS-B, and the communication device 2100 includes:

[0434] The transceiver module 2102 is configured to send a first authorization information request to a first edge configuration server ECS-A, where the first authorization information request is used to request issuance of authorization information, and the first authorization information request includes identification information of a second edge configuration server provider ECSP-B, where the ECS-B is deployed by the ECSP-B;

[0435] The transceiver module 2102 is used to receive the authorization information from the ECS-A, the authorization information carries the identification information of the ECSP-B, and the authorization information is used to verify the network function request for the first edge enabling server EES-A to provide services. The EES-A is the EES registered in the ECS-A.

[0436] Optionally, the authorization information further includes: identification information of a first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A.

[0437] Optionally, the authorization information is used to verify the edge application server EAS discovery request message or the context relocation request message, the EAS discovery request message is used to request the EES-A to provide the EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide the application context migration service to the network function.

[0438] Optionally, the first authorization information request further includes identification information of an edge enabling client EEC;

[0439] The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

[0440] Optionally, the first authorization information request further includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B;

[0441] The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

[0442] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0443] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0444] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0445] Optionally, the transceiver module 2102 is used to receive a first edge application service request message sent by a second edge enabling server EES-B, where the first edge application service request message includes third authorization information, where the third authorization information is the authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B, and the EES-B is provided with support services by the ECS-B;

[0446] The transceiver module 2102 is used to send a first edge application service response message to the EES-B, where the first edge application service response message carries the first authorization information.

[0447] Optionally, the transceiver module 2102 is used to obtain authorization request indication information of the EES-A, where the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information;

[0448] The transceiver module 2102 is used to send the first authorization information request to the ECS-A, including:

[0449] The transceiver module 2102 is configured to send the first authorization information request to the ECS-A according to the authorization request indication information.

[0450] Optionally, the transceiver module 2102 is configured to receive a first service provision request message sent by an edge enabling client EEC, where the first service provision request message includes identification information of the EEC and identification information of the EAS;

[0451] The transceiver module 2102 is configured to send a first service provision response message to the EEC, where the first service provision response message includes the first authorization information;

[0452] The first authorization information is carried in a service provision response message, and the service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

[0453] Optionally, the first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide an edge application server EAS discovery service to the EEC;

[0454] The first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

[0455] Optionally, the transceiver module 2102 is used to receive a second authorization information request sent by the second edge enabling server EES-B, where the second authorization information request is used to request the second authorization information, and the second authorization information request message also includes identification information of the EES-A;

[0456] The transceiver module 2102 is configured to send a second authorization information response to the EES-B, where the second authorization information response includes the second authorization information.

[0457] Optionally, the ECS-B belongs to a first network service provider, and the ECS-A belongs to a second network service provider.

[0458] In another example, the communication device 2100 is applied to a first edge enabling server EES-A, and the communication device 2100 includes:

[0459] The transceiver module 2102 is used to receive an edge application server EAS discovery request message sent by the second edge enabling server EES-B, wherein the EAS discovery request message is used to request to provide an EAS discovery service to the edge enabling client EEC, and the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of the second edge configuration server provider ECSP-B, the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B;

[0460] The transceiver module 2102 is used to obtain trusted information, where the trusted information includes the identification information of ECSP-B obtained by the EES-A;

[0461] Processing module 2101, used for verifying the authorization information according to the trusted information;

[0462] The transceiver module 2102 is configured to send the identification information of the EAS to the EES-B if the authorization information passes the verification.

[0463] Optionally, the authorization information passes verification, including:

[0464] The identification information of ECSP-B included in the authorization information is consistent with the identification information of ECSP-B acquired by the EES-A and included in the trusted information.

[0465] Optionally, the authorization information further includes: identification information of a first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is an EES registered in the ECS-A;

[0466] The authorization information passes verification, including:

[0467] The identification information of ECSP-A included in the authorization information is consistent with the identification information of ECSP-A acquired by the EES-A and included in the trusted information.

[0468] Optionally, the first authorization information request further includes identification information of an edge enabling client EEC;

[0469] The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

[0470] Optionally, the first authorization information request further includes identification information of the EES-B;

[0471] The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

[0472] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0473] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0474] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0475] Optionally, the transceiver module 2102 is configured to obtain the trusted information from the EES-B by means of certificate exchange.

[0476] Optionally, the processing module 2101 is used to verify the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information;

[0477] And / or, the processing module 2101 is used to verify the identification information of the second edge enabling server EES-B included in the second authorization information according to the identification information of the second edge enabling server EES-B in the trusted information;

[0478] And / or, the processing module 2101 is configured to verify, according to the identification information of the first edge configuration server provider ECSP-A included in the trusted information, the identification information of the first edge configuration server provider ECSP-A included in the first authorization information or the identification information of the first edge configuration server provider ECSP-A included in the second authorization information;

[0479] And / or, the processing module 2101 is used to verify the identification information of the second edge configuration server provider ECSP-B included in the first authorization information or the identification information of the second edge configuration server provider ECSP-B included in the second authorization information according to the identification information of the second edge configuration server provider ECSP-B in the trusted information.

[0480] Optionally, the transceiver module 2102 is used to send the authorization information and the trusted information to the ECS-A;

[0481] The transceiver module 2102 is used to receive the verification indication information sent by the ECS-A, where the verification indication information is used to indicate whether the authorization information has passed the verification or failed the verification;

[0482] The transceiver module 2102 is used to send the verification indication information to the EES-B.

[0483] Optionally, the identification information of the EEC is a client credential declaration CCA parameter of the EEC.

[0484] Optionally, the transceiver module 2102 is used to send an EES registration request message to the ECS-B, wherein the EES registration request message includes authorization request indication information of the EES-B, and the authorization request indication information of the EES-B is used to indicate that the EES-B needs to perform authorization processing based on authorization information.

[0485] In another example, the communication device 2100 is applied to the second edge enabling server EES-B, and the communication device 2100 includes:

[0486] The transceiver module 2102 is used to send an edge application server EAS discovery request message to the first edge enabling server EES-A, wherein the EAS discovery request message is used to request to provide an EAS discovery service to the edge enabling client EEC, wherein the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of a second edge configuration server provider ECSP-B, wherein the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B;

[0487] The transceiver module 2102 is configured to receive an EAS discovery response message sent by the EES-A, wherein the EAS discovery response message includes identification information of the EAS;

[0488] The transceiver module 2102 is configured to send the EAS discovery response message to the EEC.

[0489] Optionally, the authorization information further includes: identification information of a first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is an EES registered in the ECS-A.

[0490] Optionally, the authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

[0491] Optionally, the transceiver module 2102 is configured to receive the EAS discovery request message from the EEC, where the EAS discovery request message includes identification information of the EEC.

[0492] Optionally, the transceiver module 2102 is used to receive an identification information request message of the EES sent by the EEC, the identification information request message of the EES carries the identification information of the EEC and third authorization information, the third authorization information is the authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B;

[0493] The transceiver module 2102 is used to send an identification information response message of the EES to the EEC, wherein the identification information response message of the EES includes the identification information of the EES-A and the authorization information;

[0494] The transceiver module 2102 is used to receive the EAS discovery request message sent by the EEC;

[0495] The transceiver module 2102 is used to forward the EAS discovery request message to the EES-A.

[0496] Optionally, the transceiver module 2102 is configured to send a first edge application service request message to the ECS-B, wherein the first edge application service request message includes third authorization information, and the third authorization information is authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B;

[0497] The transceiver module 2102 is configured to receive a first edge application service response message sent by the ECS-B, where the first edge application service response message carries the first authorization information.

[0498] Optionally, the authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to authorize the EES-B to request the EES-A to provide services.

[0499] Optionally, the first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC;

[0500] The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

[0501] Optionally, the first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

[0502] Optionally, the first edge application service response message also includes the second authorization information.

[0503] Optionally, the identification information of the EEC is a client credential declaration CCA parameter of the EEC.

[0504] Optionally, the transceiver module 2102 is used to send an EES registration request message to the ECS-B, wherein the EES registration request message includes authorization request indication information of the EES-B, and the authorization request indication information of the EES-B is used to indicate that the EES-B needs to perform authorization processing based on authorization information.

[0505] See also Fig. 22 , is another schematic structural diagram of a communication device 2200 provided in the present application, and the communication device 2200 at least includes an input and output interface 2202. The communication device 2200 may be a chip or an integrated circuit.

[0506] Optionally, the communication device also includes a logic circuit 2201.

[0507] in, Fig.21 The transceiver module 2102 shown may be a communication interface, which may be Fig. 22 The input / output interface 2202 in the communication interface may include an input interface and an output interface. Alternatively, the communication interface may also be a transceiver circuit, which may include an input interface circuit and an output interface circuit.

[0508] Optionally, when the communication device 2200 is a session management function (or a component of a session management function) in the aforementioned embodiment, the input / output interface 2202 is used to input / output information; the logic circuit 2201 is used to execute the aforementioned Figure 13-Figure 20 and methods performed by EES, ECS and / or ECS-ER in related embodiments.

[0509] The logic circuit 2201 and the input / output interface 2202 may also execute other steps executed by the communication device in any embodiment and achieve corresponding beneficial effects, which will not be described in detail here.

[0510] In one possible implementation, Fig.21 The processing module 2101 shown can be Fig. 22 The logic circuit 2201 in.

[0511] Optionally, the logic circuit 2201 may be a processing device, and the functions of the processing device may be partially or completely implemented by software. The functions of the processing device may be partially or completely implemented by software.

[0512] Optionally, the processing device may include a memory and a processor, wherein the memory is used to store a computer program, and the processor reads and executes the computer program stored in the memory to perform corresponding processing and / or steps in any one of the method embodiments.

[0513] Alternatively, the processing device may include only a processor. A memory for storing a computer program is located outside the processing device, and the processor is connected to the memory via a circuit / wire to read and execute the computer program stored in the memory. The memory and the processor may be integrated together, or may be physically independent of each other.

[0514] Optionally, the processing device may be one or more chips, or one or more integrated circuits. For example, the processing device may be one or more field-programmable gate arrays (FPGA), application specific integrated circuits (ASIC), system on chip (SoC), central processor unit (CPU), network processor (NP), digital signal processor (DSP), microcontroller unit (MCU), programmable logic device (PLD) or other integrated chips, or any combination of the above chips or processors.

[0515] See also Fig.23 , is the communication device 2300 involved in the above embodiments provided in the embodiments of the present application, and the communication device 2300 can specifically be the communication device as EES, ECS and / or ECS-ER in the above embodiments.

[0516] Among them, a possible logical structure diagram of the communication device 2300 is shown, and the communication device 2300 may include but is not limited to at least one processor 2301 and a communication port 2302.

[0517] Further optionally, the device may also include at least one of a memory 2303 and a bus 2304 . In an embodiment of the present application, the at least one processor 2301 is used to control and process the actions of the communication device 2300 .

[0518] In addition, the processor 2301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0519] It should be noted that Fig.23The communication device 2300 shown can be specifically used to implement the steps implemented by EES, ECS and / or ECS-ER in the aforementioned method embodiments, and to achieve the corresponding technical effects of EES, ECS and / or ECS-ER. Fig.23 The specific implementation methods of the communication device shown can all refer to the description in the aforementioned method embodiment, and will not be repeated here.

[0520] See also Fig.24 , is a schematic diagram of the structure of the communication device 2400 involved in the above embodiments provided in the embodiments of the present application. The communication device 2400 may specifically be a communication device as EES, ECS and / or ECS-ER in the above embodiments. The structure of the communication device may refer to Fig.24 The structure shown.

[0521] The communication device 2400 includes at least one processor 2401 and at least one network interface 2404. Further optionally, the communication device also includes at least one memory 2402, at least one transceiver 2403 and one or more antennas 2405. The processor 2401, the memory 2402, the transceiver 2403 and the network interface 2404 are connected, for example, through a bus. In an embodiment of the present application, the connection may include various interfaces, transmission lines or buses, etc., which are not limited in this embodiment. The antenna 2405 is connected to the transceiver 2403. The network interface 2404 is used to enable the communication device to communicate with other communication devices through a communication link. For example, the network interface 2404 may include a network interface between the communication device and the core network device, such as an S1 interface, and the network interface may include a network interface between the communication device and other communication devices (such as other wireless access networks or core network devices), such as an X2 or Xn interface.

[0522] The processor 2401 is mainly used to process the communication protocol and communication data, and to control the entire communication device, execute the software program, and process the data of the software program, for example, to support the communication device to perform the actions described in the embodiment. The communication device may include a baseband processor and a central processing unit, the baseband processor is mainly used to process the communication protocol and communication data, and the central processing unit is mainly used to control the entire terminal device, execute the software program, and process the data of the software program. Fig.24The processor 2401 in the embodiment can integrate the functions of the baseband processor and the central processor. It can be understood by those skilled in the art that the baseband processor and the central processor can also be independent processors, which are interconnected through technologies such as buses. It can be understood by those skilled in the art that the terminal device can include multiple baseband processors to adapt to different network formats, and the terminal device can include multiple central processors to enhance its processing capabilities. The various components of the terminal device can be connected through various buses. The baseband processor can also be described as a baseband processing circuit or a baseband processing chip. The central processor can also be described as a central processing circuit or a central processing chip. The function of processing the communication protocol and the communication data can be built into the processor, or it can be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.

[0523] The memory is mainly used to store software programs and data. The memory 2402 can be independent and connected to the processor 2401. Optionally, the memory 2402 can be integrated with the processor 2401, for example, integrated into a chip. Among them, the memory 2402 can store program codes for executing the technical solutions of the embodiments of the present application, and the execution is controlled by the processor 2401. The various types of computer program codes executed can also be regarded as drivers of the processor 2401.

[0524] Fig.24 Only one memory and one processor are shown. In an actual terminal device, there may be multiple processors and multiple memories. The memory may also be referred to as a storage medium or a storage device, etc. The memory may be a storage element on the same chip as the processor, i.e., an on-chip storage element, or an independent storage element, which is not limited in the embodiments of the present application.

[0525] The transceiver 2403 can be used to support the reception or transmission of radio frequency signals between the communication device and the terminal, and the transceiver 2403 can be connected to the antenna 2405. The transceiver 2403 includes a transmitter Tx and a receiver Rx. Specifically, one or more antennas 2405 can receive radio frequency signals, and the receiver Rx of the transceiver 2403 is used to receive the radio frequency signal from the antenna, and convert the radio frequency signal into a digital baseband signal or a digital intermediate frequency signal, and provide the digital baseband signal or the digital intermediate frequency signal to the processor 2401, so that the processor 2401 further processes the digital baseband signal or the digital intermediate frequency signal, such as demodulation processing and decoding processing. In addition, the transmitter Tx in the transceiver 2403 is also used to receive a modulated digital baseband signal or a digital intermediate frequency signal from the processor 2401, and convert the modulated digital baseband signal or the digital intermediate frequency signal into a radio frequency signal, and send the radio frequency signal through one or more antennas 2405. Specifically, the receiver Rx can selectively perform one or more stages of down-mixing and analog-to-digital conversion processing on the RF signal to obtain a digital baseband signal or a digital intermediate frequency signal, and the order of the down-mixing and analog-to-digital conversion processing is adjustable. The transmitter Tx can selectively perform one or more stages of up-mixing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a RF signal, and the order of the up-mixing and digital-to-analog conversion processing is adjustable. The digital baseband signal and the digital intermediate frequency signal can be collectively referred to as a digital signal.

[0526] The transceiver 2403 may also be referred to as a transceiver module, a transceiver, a transceiver device, etc. Optionally, a device in the transceiver module for implementing a receiving function may be regarded as a receiving unit, and a device in the transceiver module for implementing a sending function may be regarded as a sending unit, that is, the transceiver module includes a receiving unit and a sending unit, the receiving unit may also be referred to as a receiver, an input port, a receiving circuit, etc., and the sending unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

[0527] It should be noted that Fig.24 The communication device 2400 shown can be specifically used to implement the steps implemented by EES, ECS and / or ECS-ER in the aforementioned method embodiments, and to achieve the corresponding technical effects of EES, ECS and / or ECS-ER. Fig.24 The specific implementation methods of the communication device 2400 shown can all be referred to the description in the aforementioned method embodiment, and will not be repeated here.

[0528] An embodiment of the present application also provides a computer-readable storage medium storing one or more computer-executable instructions. When the computer-executable instructions are executed by a processor, the processor executes the method as a possible implementation method of the session management function or the wireless access network in the aforementioned embodiment.

[0529] An embodiment of the present application also provides a computer program product (or computer program) storing one or more computers. When the computer program product is executed by the processor, the processor executes the above-mentioned session management function or a method of possible implementation of the wireless access network.

[0530] The embodiment of the present application also provides a chip system, which includes at least one processor for supporting a communication device to implement the functions involved in the possible implementation methods of the above-mentioned communication device. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data to the at least one processor. In one possible design, the chip system may also include a memory, which is used to store the necessary program instructions and data for the communication device. The chip system can be composed of a chip, or it can include a chip and other discrete devices, wherein the communication device can specifically be a session management function or a wireless access network in the aforementioned method embodiment.

[0531] An embodiment of the present application also provides a communication system, which includes the EES, ECS and / or ECS-ER in any of the above embodiments.

[0532] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0533] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0534] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a wireless access network, etc.) to perform all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. An edge computing authorization method, characterized in that: The method comprises: The first edge configuration server ECS-A receives a first authorization information request sent by the second edge configuration server ECS-B, where the first authorization information request is used to request the issuance of authorization information, and the first authorization information request includes identification information of the second edge configuration server provider ECSP-B, and the ECS-B is deployed by the ECSP-B; The ECS-A sends the authorization information to the ECS-B, the authorization information carrying the identification information of the ECSP-B, the authorization information being used to verify the network function request for the first edge enabling server EES-A to provide a service, and the EES-A is an EES registered in the ECS-A.

2. The method according to claim 1, characterized in that The authorization information also includes: identification information of a first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A.

3. The method according to claim 1 or 2, characterized in that: The authorization information is used to verify the network function's request for the EES-A to provide services, including: The authorization information is used to verify the edge application server EAS discovery request message or context relocation request message, the EAS discovery request message is used to request the EES-A to provide EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide application context migration service to the network function.

4. The method according to any one of claims 1 to 3, characterized in that The first authorization information request also includes identification information of the edge enabling client EEC; The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

5. The method according to claim 4, characterized in that The first authorization information request also includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B; The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

6. The method according to claim 5, characterized in that The first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC; The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

7. The method according to claim 5, characterized in that The first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

8. The method according to any one of claims 1 to 7, characterized in that After the ECS-A sends the first authorization information to the ECS-B, the method further includes: The ECS-A receives trusted information from the EES-A, where the trusted information includes any one or more of the following information: identification information of the EEC acquired by the EES-A, identification information of the second edge enabling server EES-B acquired by the EES-A, identification information of the second edge configuration server provider ECSP-B acquired by the EES-A, or identification information of the first edge configuration server provider ECSP-A acquired by the EES-A; The ECS-A verifies the authorization information according to the trusted information; The ECS-A sends verification indication information to the EES-A according to the result of verifying the authorization information, where the verification indication information is used to indicate whether the authorization information has passed the verification or failed the verification.

9. The method according to claim 8, characterized in that The ECS-A verifies the authorization information according to the trusted information, including: The ECS-A verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information; and / or, the ECS-A verifies the identification information of EES-B included in the second authorization information according to the identification information of EES-B in the trusted information; and / or, the ECS-A verifies the identification information of ECSP-A included in the first authorization information or the identification information of ECSP-A included in the second authorization information according to the identification information of EES-B included in the trusted information; And / or, the ECS-A verifies the identification information of ECSP-B included in the first authorization information or the identification information of ECSP-B included in the second authorization information according to the identification information of ECSP-B in the trusted information.

10. The method according to any one of claims 1 to 3, characterized in that: The first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide an edge application server EAS discovery service to the EEC; The first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

11. An edge computing authorization method, characterized in that: The method comprises: The second edge configuration server ECS-B sends a first authorization information request to the first edge configuration server ECS-A, where the first authorization information request is used to request the issuance of authorization information, and the first authorization information request includes identification information of the second edge configuration server provider ECSP-B, and the ECS-B is deployed by the ECSP-B; The ECS-B receives the authorization information from the ECS-A, the authorization information carries the identification information of the ECSP-B, the authorization information is used to verify the network function request for the first edge enabling server EES-A to provide a service, and the EES-A is the EES registered in the ECS-A.

12. The method according to claim 11, characterized in that The authorization information also includes: identification information of a first edge configuration server provider ECSP-A, and the ECS-A is deployed by the ECSP-A.

13. The method according to claim 11 or 12, characterized in that: The authorization information is used to verify the network function's request for the EES-A to provide services, including: The authorization information is used to verify the edge application server EAS discovery request message or context relocation request message, the EAS discovery request message is used to request the EES-A to provide EAS discovery service to the network function, and the context relocation request message is used to request the EES-A to provide application context migration service to the network function.

14. The method according to any one of claims 11 to 13, characterized in that The first authorization information request also includes identification information of the edge enabling client EEC; The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

15. The method according to claim 14, characterized in that The first authorization information request also includes identification information of a second edge enabling server EES-B, and the EES-B is provided with support services by the ECS-B; The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

16. The method according to claim 15, characterized in that The first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC; The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

17. The method according to claim 15, characterized in that The first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

18. The method according to any one of claims 14 to 17, characterized in that: Before the ECS-B sends the first authorization information request to the ECS-A, the method further includes: The ECS-B receives a first edge application service request message sent by a second edge enabling server EES-B, wherein the first edge application service request message includes third authorization information, wherein the third authorization information is authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B, and the EES-B is provided with support services by the ECS-B; After the ECS-B receives the authorization information from the ECS-A, the method further includes: The ECS-B sends a first edge application service response message to the EES-B, where the first edge application service response message carries the first authorization information.

19. The method according to claim 18, characterized in that After the ECS-B receives the first edge application service request message sent by the EES-B, the method further includes: The ECS-B obtains authorization request indication information of the EES-A, where the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on the authorization information; The ECS-B sends the first authorization information request to the ECS-A, including: The ECS-B sends the first authorization information request to the ECS-A according to the authorization request indication information.

20. The method according to any one of claims 11 to 17, characterized in that Before the ECS-B sends the first authorization information request to the ECS-A, the method further includes: The ECS-B receives a first service provision request message sent by the edge enabling client EEC, where the first service provision request message includes identification information of the EEC and identification information of the EAS; After the ECS-B receives the authorization information from the ECS-A, the method further includes: The ECS-B sends a first service provision response message to the EEC, where the first service provision response message includes the first authorization information; The first authorization information is carried in a service provision response message, and the service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

21. The method according to claim 20, characterized in that The first authorization information request is carried in a second service provision request message, and the second service provision request message is used to request the EES-A to provide an edge application server EAS discovery service to the EEC; The first authorization information is carried in a second service provision response message, and the second service provision response message is used to instruct the EES-A to provide the EAS discovery service to the EEC.

22. The method according to any one of claims 15 to 17, characterized in that Before the ECS-B sends the first authorization information request to the ECS-A, the method further includes: The ECS-B receives a second authorization information request sent by the second edge enabling server EES-B, where the second authorization information request is used to request the second authorization information, and the second authorization information request message further includes identification information of the EES-A; After the ECS-B receives the authorization information from the ECS-A, the method further includes: The ECS-B sends a second authorization information response to the EES-B, where the second authorization information response includes the second authorization information.

23. The method according to any one of claims 1 to 22, characterized in that The ECS-B belongs to a first network service provider, and the ECS-A belongs to a second network service provider.

24. A communication method, characterized in that: include: The first edge enabling server EES-A receives an edge application server EAS discovery request message sent by the second edge enabling server EES-B, wherein the EAS discovery request message is used to request to provide an EAS discovery service to the edge enabling client EEC, and the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of the second edge configuration server provider ECSP-B, the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B; The EES-A acquires trusted information, where the trusted information includes identification information of ECSP-B acquired by the EES-A; The EES-A verifies the authorization information according to the trusted information; If the authorization information passes the verification, the EES-A sends the identification information of the EAS to the EES-B.

25. The method according to claim 24, characterized in that The authorization information passes verification, including: The identification information of ECSP-B included in the authorization information is consistent with the identification information of ECSP-B acquired by the EES-A and included in the trusted information.

26. The method according to claim 24 or 25, characterized in that The authorization information also includes: identification information of a first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is an EES registered in the ECS-A; The authorization information passes verification, including: The identification information of ECSP-A included in the authorization information is consistent with the identification information of ECSP-A acquired by the EES-A and included in the trusted information.

27. The method according to any one of claims 24 to 26, characterized in that The first authorization information request also includes identification information of the edge enabling client EEC; The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

28. The method according to claim 27, characterized in that The first authorization information request also includes identification information of the EES-B; The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to verify the EES-B's request for the EES-A to provide services.

29. The method according to claim 28, characterized in that The first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC; The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

30. The method according to claim 28, characterized in that The first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

31. The method according to any one of claims 24 to 30, characterized in that The EES-A obtains the trusted information, including: The EES-A obtains the trusted information from the EES-B by means of certificate exchange.

32. The method according to any one of claims 24 to 31, characterized in that The EES-A verifies the authorization information according to the trusted information, including: The EES-A verifies the identification information of the EEC included in the first authorization information according to the identification information of the EEC in the trusted information; and / or, the EES-A verifies the identification information of the second edge enabling server EES-B included in the second authorization information according to the identification information of the second edge enabling server EES-B in the trusted information; and / or, the EES-A verifies the identification information of the first edge configuration server provider ECSP-A included in the first authorization information or the identification information of the first edge configuration server provider ECSP-A included in the second authorization information according to the identification information of the first edge configuration server provider ECSP-A included in the trusted information; And / or, the EES-A verifies the identification information of the second edge configuration server provider ECSP-B included in the first authorization information or the identification information of the second edge configuration server provider ECSP-B included in the second authorization information according to the identification information of the second edge configuration server provider ECSP-B in the trusted information.

33. The method according to any one of claims 24 to 32, characterized in that The EES-A verifies the authorization information according to the trusted information, including: The EES-A sends the authorization information and the trusted information to the ECS-A; The EES-A receives the verification indication information sent by the ECS-A, where the verification indication information is used to indicate whether the authorization information has passed the verification or has not passed the verification; The EES-A sends the verification instruction information to the EES-B.

34. The method according to any one of claims 24 to 33, characterized in that The identification information of the EEC is the client credential declaration CCA parameter of the EEC.

35. The method according to any one of claims 24 to 34, characterized in that The method further comprises: The EES-A sends an EES registration request message to the ECS-A, where the EES registration request message includes authorization request indication information of the EES-A, where the authorization request indication information of the EES-A is used to indicate that the EES-A needs to perform authorization processing based on authorization information.

36. A communication method, characterized in that: include: The second edge enabling server EES-B sends an edge application server EAS discovery request message to the first edge enabling server EES-A, wherein the EAS discovery request message is used to request to provide an EAS discovery service to the edge enabling client EEC, wherein the EAS discovery request message includes identification information and authorization information of the EEC, wherein the authorization information carries identification information of the second edge configuration server provider ECSP-B, wherein the second edge configuration server ECS-B is deployed by the ECSP-B, and the EES-B is an EES registered in the ECS-B; The EES-B receives the EAS discovery response message sent by the EES-A, where the EAS discovery response message includes the identification information of the EAS; The EES-B sends the EAS discovery response message to the EEC.

37. The method according to claim 36, characterized in that The authorization information also includes: identification information of a first edge configuration server provider ECSP-A, the ECS-A is deployed by the ECSP-A, and the EES-A is an EES registered in the ECS-A.

38. The method according to claim 36 or 37, characterized in that The authorization information includes first authorization information, the first authorization information includes identification information of the EEC, and the first authorization information is used to verify the EEC's request for the EES-A to provide services.

39. The method according to any one of claims 36 to 38, characterized in that Before the EES-B sends the EAS discovery request message to the EES-A, the method further includes: The EES-B receives the EAS discovery request message from the EEC, where the EAS discovery request message includes identification information of the EEC.

40. The method according to any one of claims 36 to 38, characterized in that The EES-B sends the EAS discovery request message to the EES-A, including: The EES-B receives the EES identification information request message sent by the EEC, the EES identification information request message carries the EEC identification information and third authorization information, the third authorization information is the authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B; The EES-B sends an EES identification information response message to the EEC, wherein the EES identification information response message includes the identification information of the EES-A and the authorization information; The EES-B receives the EAS discovery request message sent by the EEC; The EES-B forwards the EAS discovery request message to the EES-A.

41. The method according to any one of claims 36 to 40, characterized in that Before the EES-B sends the EAS discovery request message to the EES-A, the method further includes: A first edge application service request message sent by the EES-B to the ECS-B, wherein the first edge application service request message includes third authorization information, the third authorization information is authorization information issued by the ECS-B to the EEC, and the third authorization information indicates that the EEC is allowed to request a service from the EES-B; The EES-B receives a first edge application service response message sent by the ECS-B, where the first edge application service response message carries the first authorization information.

42. The method according to any one of claims 36 to 38 or 41, characterized in that The authorization information includes second authorization information, the second authorization information includes identification information of the EES-B, and the second authorization information is used to authorize the EES-B to request the EES-A to provide services.

43. The method according to claim 42, characterized in that The first authorization information is carried in a first token, and the client identifier of the first token is the identifier information of the EEC; The second authorization information is carried in a second token, the second token also includes identification information of the ECSP-A and identification information of the ECSP-B, the client identifier of the second token is the identification information of the EES-B, and the first token and the second token are independent of each other.

44. The method according to claim 42, characterized in that The first authorization information and the second authorization information are carried in a third token, and identification information of the third token is identification information of the EEC and identification information of the EES-B.

45. A method according to any one of claims 42 to 44, characterized in that The first edge application service response message also includes the second authorization information.

46. ​​The method according to any one of claims 36 to 45, characterized in that The identification information of the EEC is the client credential declaration CCA parameter of the EEC.

47. The method according to any one of claims 36 to 46, characterized in that The method further comprises: The EES-B sends an EES registration request message to the ECS-B, where the EES registration request message includes authorization request indication information of the EES-B, where the authorization request indication information of the EES-B is used to indicate that the EES-B needs to perform authorization processing based on authorization information.

48. A communication device, characterized in that: Including transceiver module and processing module: The transceiver module is used to input and / or output signaling or data; The processing module is used to execute, through the communication unit: the method described in any one of claims 1-10, or the method described in any one of claims 11-23, or the method described in any one of claims 24-35, or the method described in any one of claims 36-47.

49. A communication device, characterized in that: Including communication interface and processor: The communication interface is used to input and / or output signaling or data; The processor is used to execute a computer executable program so that the method described in any one of claims 1 to 10 is executed, or the method described in any one of claims 11 to 23 is executed, or the method described in any one of claims 24 to 35 is executed, or the method described in any one of claims 36 to 47 is executed.

50. A communication device, characterized in that: including a processor and memory, The memory is used to store computer programs or instructions; The processor is used to execute the computer program or instructions in the memory, so that the method described in any one of claims 1 to 10 is executed, or the method described in any one of claims 11 to 23 is executed, or the method described in any one of claims 24 to 35 is executed, or the method described in any one of claims 36 to 47 is executed.

51. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed by a processor, the method of any one of claims 1-10, or claims 11-23, or claims 24-35, or claims 36-47 is implemented.

52. A computer program product comprising a program, characterized in that When the program is executed by a processor, the method of any one of claims 1-10, or claims 11-23, or claims 24-35, or claims 36-47 is implemented.

53. A chip system, characterized in that: The chip system includes at least one processor, and when the program instructions are executed in the at least one processor, the method described in any one of claims 1-10, or claims 11-23, or claims 24-35, or claims 36-47 is implemented.

54. A communication system, characterized in that: It comprises a communication device for executing the method described in any one of claims 1 to 10, a communication device for executing the method described in any one of claims 11 to 23, a communication device for executing the method described in any one of claims 24 to 35, and a communication device for executing the method described in any one of claims 36 to 47.

Images