Communication method and device

Abstract

The invention discloses a communication method and device, and the method comprises the steps: a terminal transmits a first request which is used for requesting to cancel a first token; wherein the first request comprises first information, the first information is used for determining a first token, and the first token is a token for authorizing the first service to the first user. According to the method, the terminal can initiate the process of cancelling the first token by containing the first information in the first request. Therefore, a user can initiate a process of cancelling the first token through the control terminal, so that authorization of the first service corresponding to the first token can be cancelled.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] The capability open architecture of the 3rd generation partnership project (3GPP) network provides a way for the 3GPP network to provide services to the outside world. Under this architecture, the application function (AF) can use the capabilities provided by the 3GPP network to process and / or obtain 3GPP-related data information, which may include processing and / or obtaining 3GPP network data, as well as processing and / or obtaining 3GPP network user-related data. When processing and / or obtaining user-related data, the AF must obtain the user's authorization. For example, the AF can request the 3GPP network to send the user's location information to the outside world. If the user's authorization is not obtained, the user's privacy information may be exposed. For another example, the AF can request the 3GPP network to change the user's network service quality (quality of service, QoS). If the user's authorization is not obtained, the user experience will be inconsistent with the expected value, and the user may also be charged additional fees.

[0003] After a user authorizes a service, the authorization for the service may be revoked. How to design the service revocation process requires further research. Summary of the invention

[0004] The present application provides a communication method and device for revoking authorization for a service.

[0005] In a first aspect, an embodiment of the present application provides a communication method, which can be applied to a terminal, or to a module in a terminal, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the terminal functions. The following is an illustration of the application of the method to a terminal. The method includes: the terminal can determine first information, and the first information is used to determine a first token, and the first token is a token that authorizes a first service for a first user. The terminal sends a first request, and the first request includes first information, and the first request is used to request the revocation of the first token.

[0006] Through this method, the terminal can initiate the process of revoking the first token by including the first information in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization of the first service corresponding to the first token.

[0007] In one possible design, the first information includes a random number, and the random number is used to determine the first token. With this design, the terminal can initiate a process of revoking the first token by including the random number in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization of the first service corresponding to the first token.

[0008] In a possible design, the random number can be used to determine the second information through a one-way function, and the second information is used to determine the first token. In this design, the random number can be protected by a one-way function. In this way, other applications on the terminal or AF except the user agent cannot obtain information related to the random number, and thus cannot initiate a revocation process for the first token, thereby improving the communication security of the terminal.

[0009] In a possible design, the terminal may also receive a first response. The first response is used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. The first response includes a random number or second information, and the second information is obtained according to the one-way function and the random number. Through this design, the terminal can promptly know one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received.

[0010] In one possible design, the terminal may generate a random number and second information, and the second information is obtained based on a one-way function and a random number. Then, the terminal may send the second information to the authorization function network element, and the second information corresponds to the first token. With this design, the random number used to initiate the revocation process of the first token is generated by the terminal and can be protected by a one-way function. In this way, other applications on the terminal or AF except the user agent cannot obtain information related to the random number, and thus cannot initiate a revocation process for the first token, thereby improving the communication security of the terminal.

[0011] In a possible design, before the terminal generates the random number and the second information, the terminal may detect a first operation of the first user, where the first operation is used to indicate that the first user agrees to authorize the first service to the first user. With this design, the terminal generates the random number and the second information only after detecting the first operation of the user, so that the terminal does not need to generate a random number for a token that the user does not agree to, thereby reducing the energy consumption of the terminal.

[0012] In one possible design, the first information includes auxiliary information for identifying the first token. With this design, the terminal can initiate a process of revoking the first token by including the auxiliary information in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization for the first service corresponding to the first token.

[0013] Optionally, the auxiliary information includes at least one of the following:

[0014] information for identifying the authorization scope of the first token;

[0015] Information for identifying a service application programming interface (API) corresponding to the first token;

[0016] Information used to identify the AzF corresponding to the first token;

[0017] information used to identify the first user;

[0018] Information used to identify the API open function corresponding to the first token;

[0019] Information for identifying the validity period of the first token;

[0020] Information for identifying the issuance time of the first token.

[0021] In one possible design, the terminal can detect a first operation of a first user, and the first operation is used to indicate that the first user agrees to authorize the first service to the first user. Then, the terminal obtains and stores the auxiliary information. With this design, the terminal obtains and saves the auxiliary information only after detecting the first operation of the user. In this way, the terminal does not need to obtain and save the auxiliary information for the token that the user does not agree to, thereby reducing the energy consumption of the terminal and saving the storage resources of the terminal.

[0022] In one possible design, the terminal may receive an authorization code corresponding to the first token, and the authorization code is used to determine that the first token corresponding to the auxiliary information is a token authorized by the authorization function network element. In this way, after receiving the authorization code, the terminal may determine that the first token corresponding to the auxiliary information is a token authorized by the authorization function network element, and thus may initiate a token revocation process based on the auxiliary information.

[0023] In one possible design, the first information includes an authorization code corresponding to the first token. With this design, the terminal can initiate a process of revoking the first token by including the authorization code in the first request. In this way, the user can initiate a process of revoking the first token by controlling the terminal, thereby revoking the authorization for the first service corresponding to the first token.

[0024] In a possible design, the terminal can receive an authorization code corresponding to the first token from the authorization function network element. In this way, the terminal can obtain the authorization code corresponding to the first token in a timely manner.

[0025] In one possible design, the first request also includes: indication information of the first user, and the indication information of the first user and the first information are used to determine the first token. The indication information of the first user can be used to quickly narrow the scope of tokens to be determined and improve the speed of determining the first token. For example, the first device saves tokens of multiple users. The first device can select the token of the first user from the tokens of the multiple users based on the indication information of the first user, and select the first token from the tokens of the first user based on the first information. Since the first device can use the user's indication information as an index of the tokens of multiple users, the first device can quickly exclude tokens of users other than the first user, narrow the scope of tokens to be determined, and improve the speed of determining the first token.

[0026] In a possible design, the terminal sends the first request to AzF according to the address information of AzF; or, the terminal sends the first request to AzF through an API caller. Through this design, the terminal can flexibly send the first request to AzF.

[0027] In the second aspect, an embodiment of the present application provides a communication method, which can be applied to a first device, which can be an API caller, a device including an API caller (for example, a terminal or AF) or AzF, or a module applied to an API caller, a device including an API caller or AzF, such as a chip, a chip system, or a processor, or a logical node, a logical module or software that can implement all or part of the functions of an API caller, a device including an API caller or AzF. Among them, the method includes: the first device can receive a first request from a terminal, the first request is used to request the revocation of a first token, the first request includes first information, the first information is used to determine the first token, and the first token is a token that authorizes a first service for a first user. The first device can determine the first token based on the first request.

[0028] Through this method, the terminal can initiate the process of revoking the first token by including the first information in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization of the first service corresponding to the first token.

[0029] In one possible design, the first information includes a random number, and the random number is used to determine the first token. With this design, the terminal can initiate a process of revoking the first token by including the random number in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization for the first service corresponding to the first token.

[0030] In one possible design, the random number is used to determine the second information through a one-way function, and the second information is used to determine the first token. In this design, the random number can be protected by a one-way function. In this way, other applications on the terminal or AF except the user agent cannot obtain information related to the random number, and thus cannot initiate a revocation process for the first token, thereby improving the communication security of the terminal.

[0031] In a possible design, the first device may also send a first response to the terminal. The first response is used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. The first response includes a random number or second information, and the second information is obtained based on the one-way function and the random number. Through this design, the terminal can promptly know one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received.

[0032] In one possible design, the first device may receive second information from the terminal, where the second information is obtained based on a one-way function and a random number. Then, the first device may match the second information with the first token. With this design, the first device may quickly determine the corresponding first token based on the second information.

[0033] In one possible design, the first device may send a notification message to the API caller, and the notification message may be used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received, and the notification message includes indication information of the first token. Through this design, the API caller can promptly know one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received.

[0034] In one possible design, the first information includes auxiliary information for identifying the first token. With this design, the terminal can initiate a process of revoking the first token by including the auxiliary information in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization for the first service corresponding to the first token.

[0035] Optionally, the auxiliary information includes at least one of the following:

[0036] information for identifying the authorization scope of the first token;

[0037] Information used to identify the service API corresponding to the first token;

[0038] Information used to identify the AzF corresponding to the first token;

[0039] information used to identify the first user;

[0040] Information used to identify the API open function corresponding to the first token;

[0041] Information for identifying the validity period of the first token;

[0042] Information for identifying the issuance time of the first token.

[0043] In one possible design, the first information includes an authorization code corresponding to the first token. With this design, the terminal can initiate a process of revoking the first token by including the authorization code in the first request. In this way, the user can initiate a process of revoking the first token by controlling the terminal, thereby revoking the authorization for the first service corresponding to the first token.

[0044] In a possible design, the first device may send an authorization code corresponding to the first token to the terminal. In this way, the terminal may obtain the authorization code corresponding to the first token in a timely manner.

[0045] In one possible design, the first request also includes: indication information of the first user, and the indication information of the first user and the first information are used to determine the first token. The indication information of the first user can be used to quickly narrow the scope of tokens to be determined and improve the speed of determining the first token. For example, the first device saves tokens of multiple users. The first device can select the token of the first user from the tokens of the multiple users based on the indication information of the first user, and select the first token from the tokens of the first user based on the first information. Since the first device can use the user's indication information as an index of the tokens of multiple users, the first device can quickly exclude tokens of users other than the first user, narrow the scope of tokens to be determined, and improve the speed of determining the first token.

[0046] In one possible design, the first device may revoke the first token; or, the first device sends a second request to AzF, the second request being used to request the revocation of the first token. With this design, the first device may revoke the first token or request AzF to revoke the first token.

[0047] In one possible design, the first device may receive the first request sent by the terminal according to the address information of the AzF network element; or, the first device may receive the first request from the terminal through an API caller. Through this design, the first device can flexibly receive the first request from the terminal.

[0048] In a third aspect, an embodiment of the present application provides a communication method, which can be applied to a terminal, or to a module in a terminal, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the terminal functions. The following is an illustration of the method applied to a terminal. The method includes: the terminal may receive a third message, and the third message is used to indicate that the authorization to be revoked is a first authorization that allows a first user to use a first service. After detecting a second operation of the first user, the terminal may send a fourth message, and the second operation is used to indicate that the first user agrees to revoke the first authorization, and the fourth message is used to trigger the revocation of the first authorization.

[0049] Through this method, after detecting the second operation of the first user, the terminal sends the fourth information for triggering the revocation of the first authorization, that is, triggering the token process of the token, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0050] In a possible design, before receiving the third information, the terminal sends a third request, and the third request includes indication information of the first service. Through this design, the terminal can trigger the revocation of the first authorization by including the indication information of the first service in the third request.

[0051] In a fourth aspect, an embodiment of the present application provides a communication method, which can be applied to a third device, and the third device can be AzF, or a module applied to AzF, such as a chip, a chip system, or a processor, or a logical node, a logical module, or software that can implement all or part of the AzF functions. Among them, the method includes: the third device sends a third message to the terminal, and the third message is used to indicate that the authorization to be revoked is the first authorization that allows the first user to use the first service. The third device can receive a fourth message sent by the terminal based on the second operation of the first user, and the second operation is used to indicate that the first user agrees to revoke the first authorization, and the fourth message is used to trigger the revocation of the first authorization.

[0052] Through this method, after detecting the second operation of the first user, the terminal sends the fourth information for triggering the revocation of the first authorization, that is, triggering the token process of the token, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0053] In one possible design, before sending the third information, the third device may receive a third request from the terminal, the third request including indication information of the first service. With this design, the terminal may trigger the revocation of the first authorization by including indication information of the first service in the third request.

[0054] In a possible design, the third device may send the fifth information to the API caller, and the fifth information is used to revoke the first authorization. Through this design, the API caller can obtain the fifth information of the user revoking the first authorization, and thus can use the fifth information to revoke the first authorization.

[0055] In one possible design, the fifth information is a second token. Optionally, the type of the second token is a revocation token; or, the value of the first field in the second token is a set value. The design provides a variety of ways in which the second token is used to revoke the first authorization.

[0056] In a fifth aspect, the present application provides a communication device, which may be a terminal or a module in a terminal (such as a circuit or a chip), or a logical node, a logical module or software that can implement all or part of the terminal functions. The communication device has the function of implementing the first aspect above. For example, the communication device includes a module or unit or means corresponding to the operations involved in the first or third aspect above, and the module or unit or means may be implemented by software, or by hardware, or the corresponding software may be implemented by hardware.

[0057] In a possible design, the communication device includes a processing unit and an interface unit, wherein the interface unit can be used to send and receive signals to achieve communication between the communication device and other devices; the processing unit can be used to perform some internal operations of the communication device. The functions performed by the processing unit and the interface unit can correspond to the operations involved in the first aspect or the third aspect above.

[0058] In one possible design, the communication device includes a processor, which can be used to couple with a memory. The memory can store necessary computer programs or instructions for implementing the functions involved in the first aspect or the third aspect. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design of the first aspect or the third aspect.

[0059] In one possible design, the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for implementing the functions involved in the first aspect or the third aspect. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design of the first aspect or the third aspect.

[0060] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design of the first aspect or the third aspect above.

[0061] In a sixth aspect, the present application provides a communication device, which may be an API caller, a device including an API caller (e.g., a terminal or AF), or an AzF. It may also be an API caller, a device including an API caller, or a module in AzF (e.g., a circuit or chip). It may also be a logical node, a logical module, or software that can implement all or part of the functions of an API caller, a device including an API caller, or an AzF. The communication device has the function of implementing the second or fourth aspect mentioned above. For example, the communication device includes a module or unit or means corresponding to the operations involved in the second or fourth aspect mentioned above, and the module or unit or means may be implemented by software, or by hardware, or the corresponding software may be implemented by hardware.

[0062] In one possible design, the communication device includes a processing unit and an interface unit, wherein the interface unit can be used to send and receive signals to achieve communication between the communication device and other devices; the processing unit can be used to perform some internal operations of the communication device. The functions performed by the processing unit and the interface unit can correspond to the operations involved in the second aspect or the fourth aspect.

[0063] In one possible design, the communication device includes a processor, which can be used to couple with a memory. The memory can store necessary computer programs or instructions for implementing the functions involved in the second aspect or the fourth aspect. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design of the second aspect or the fourth aspect.

[0064] In one possible design, the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for implementing the functions involved in the second aspect or the fourth aspect. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design of the second aspect or the fourth aspect.

[0065] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design of the second aspect or the fourth aspect above.

[0066] It can be understood that in the fifth aspect or the sixth aspect above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory can be separately set from the processor. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0067] In a seventh aspect, the present application provides a communication system, which may include the communication device described in the fifth aspect and the communication device described in the sixth aspect. Optionally, when the communication device described in the fifth aspect executes the method described in the first aspect, the communication device described in the sixth aspect executes the method described in the second aspect. When the communication device described in the fifth aspect executes the method described in the third aspect, the communication device described in the sixth aspect executes the method described in the fourth aspect.

[0068] In an eighth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes a method in any possible design of any one of the first to fourth aspects above.

[0069] In a ninth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes a method in any possible design of any one of the first to fourth aspects above.

[0070] In a tenth aspect, the present application provides a chip for reading a computer program stored in a memory to execute a method in any possible design of any one of the first to fourth aspects above.

[0071] The technical effects that can be achieved in any of the fifth to tenth aspects mentioned above can refer to the description of the technical effects that can be achieved by any possible design in any of the first to fourth aspects mentioned above, and the repetitions will not be discussed here. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 An architecture diagram of a communication system provided in an embodiment of the present application;

[0073] Figure 2 An architecture diagram of another communication system provided in an embodiment of the present application;

[0074] Figure 3 A flowchart of a first communication method provided in an embodiment of the present application;

[0075] Figure 4 A flowchart of a first method for applying for a token provided in an embodiment of the present application;

[0076] Figure 5 A flowchart of a first method for revoking a token provided in an embodiment of the present application;

[0077] Figure 6 A flowchart of a second token application method provided in an embodiment of the present application;

[0078] Figure 7 A flowchart of a second token revocation method provided in an embodiment of the present application;

[0079] Figure 8 A flowchart of a third method for applying for a token provided in an embodiment of the present application;

[0080] Fig. 9 A flowchart of a third token revocation method provided in an embodiment of the present application;

[0081] Fig.10 A flowchart of a second communication method provided in an embodiment of the present application;

[0082] Fig.11 A flowchart of a third communication method provided in an embodiment of the present application;

[0083] Fig.12 A structural diagram of a communication device provided in an embodiment of the present application;

[0084] Fig.13 A structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0086] The following introduces the architecture of the communication system to which the method provided in this application is applied.

[0087] Figure 1 The present invention is applicable to a communication system architecture diagram, which shows the fifth generation (the5 th generation, 5G) network architecture. Figure 1As shown, the communication system may include three parts, namely, a terminal part, an operator network part and a data network (DN). The functions of some network elements are described below.

[0088] A terminal, also known as a terminal device or user equipment (UE), is a device with wireless transceiver capabilities that can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water (such as ships); it can also be deployed in the air (such as airplanes, balloons, and satellites). A terminal can be a mobile phone, a tablet computer (pad), a computer with wireless transceiver capabilities, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0089] The above-mentioned terminal can establish a connection with the operator network through the interface provided by the operator network (such as N1, etc.), and use the data and / or voice services provided by the operator network. The terminal can also access the DN through the operator network, use the operator services deployed on the DN, and / or services provided by a third party. Among them, the above-mentioned third party may be a service provider other than the operator network and the terminal, and can provide data and / or voice services to the terminal. Among them, the specific form of expression of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.

[0090] The operator network may be a network deployed by an operator, and may include access network equipment and core network equipment. In a possible implementation method, the operator network also includes an AF network element. Alternatively, the AF network element may not belong to the operator network, but to a third party.

[0091] Access network equipment is equipment in a wireless network, such as a radio access network (RAN) node or a radio access network device that connects a terminal to a wireless network. At present, some examples of access network equipment include: next-generation base stations (gNodeB, gNB) in 5G, transmission reception points (TRP), evolved Node B (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved NodeB, or home Node B, HNB), base band unit (BBU), wireless fidelity (Wifi) access point (AP), integrated access and backhaul (IAB), etc. In one implementation, the access network equipment may also be a future communication system (e.g., the 6th generation (the 7th generation) of the wireless communication system). th Access network equipment in generation, 6G) communication system.

[0092] The core network device may include at least one of the following network elements: a mobility management network element, a session management network element, a user plane network element (e.g., a user plane function (UPF) network element), a data management network element (e.g., a unified data management (UDM) network element), a unified data repository (UDR) network element, a network exposure network element (e.g., a network exposure function (NEF) network element), a policy control network element (e.g., a policy control function (PCF) network element), or an authentication function network element (e.g., an authentication server function (AUSF) network element), etc. Some of the network elements are described below.

[0093] In this application, the mobility management network element is a control plane network element provided by the operator network, which is responsible for the access control and mobility management of the terminal accessing the operator network, such as mobile state management, allocation of user temporary identity, authentication and authorization of users, etc. In 5G, the mobility management network element can be an access and mobility management function (AMF) network element. In future communications such as 6G, the mobility management network element can still be an AMF network element, or have other names, which are not limited in this application.

[0094] In this application, the session management network element is a control plane network element provided by the operator network, which is responsible for managing the protocol data unit (PDU) session of the terminal. The PDU session is a channel for transmitting PDUs, and the terminal needs to transmit PDUs to each other with the DN through the PDU session. The SMF network element is responsible for establishing, maintaining and deleting the PDU session. The functions of the session management network element include: session management (such as session establishment, modification and release, including tunnel maintenance between user plane network elements and access network devices), selection and control of user plane network elements, service and session continuity (SSC) mode selection, roaming, etc. In 5G, the session management network element can be a session management function (SMF) network element. In future communications such as 6G, the session management network element can still be an SMF network element, or a network element with other names but with all or part of the functions of a session management network element, which is not limited in this application.

[0095] In the present application, the network open network element is a control plane network element provided by the operator. The network open network element opens the external interface of the operator network to the third party in a secure manner, and the interface is, for example, a service API. For example, when the session management network element needs to communicate with the network element of a third party, the network open network element can serve as a relay for the communication between the session management network element and the network element of the third party. When the network open network element acts as a relay, it can be used as a translator of the identification information of the contracted user, as well as the identification information of the third-party network element. For example, when the network open network element sends the subscriber permanent identifier (SUPI) of the contracted user from the operator network to the third party, the SUPI can be translated into its corresponding external identity (ID). Conversely, when the network open network element sends the external ID (network element ID of the third party) to the operator network, it can be translated into SUPI. In 5G, the network open network element can be a NEF network element. In future communications such as 6G, the network open network element can still be a NEF network element, or have other names, which are not limited in this application.

[0096] In the embodiments of the present application, the communication device for realizing the function of the access network device, terminal or core network device may be the access network device, terminal or core network device itself, or may be a device capable of supporting the access network device, terminal or core network device to realize the function, such as a chip system, which may be installed in the access network device, terminal or core network device. In the technical solution provided in the embodiments of the present application, the technical solution provided in the embodiments of the present application is described by taking the device for realizing the function of the access network device as the access network device, the device for realizing the function of the terminal as the terminal, and the device for realizing the function of the core network device as the core network device as an example.

[0097] DN is a network outside the operator network. The operator network can access multiple DNs. Multiple services can be deployed on DN, which can provide data and / or voice services to terminals. For example, DN is the private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminals. The control server of the sensors is deployed in DN, and the control server can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is the internal office network of a company. The mobile phones or computers of the company's employees can be terminals. The employees' mobile phones or computers can access information, data resources, etc. on the company's internal office network.

[0098] Figure 1 N1, N2, N3 and N4 are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol and are not limited here.

[0099] Figure 2 An exemplary API system architecture that may be applicable to the embodiments of the present application is given, which may be a common API framework (CAPIF) architecture. Figure 2As shown, the CAPIF architecture may include: API invoker, CAPIF core function (CCF) network element, authorization function (AuF or AzF) network element and API exposing function (AEF) network element. Optionally, the CAPIF architecture may also include at least one of the following: API publishing function (APF) network element, API management function (API management function) network element or resource owner client (RO Client). The components of the CAPIF architecture are described below.

[0100] API callers are generally third-party applications that have signed service agreements with public land mobile network (PLMN) operators. These applications can run in the terminal or AF, so the API caller can be part of the terminal or part of the AF. The API caller can have the following functions: provide the identity information of the API caller and other information required to authenticate the API caller; support mutual authentication with the CCF; obtain authorization before accessing the service API; discover the service API; find and call the service API, etc. The location of the API caller in the communication network can be seen in Figure 1 AF network element or UE in.

[0101] CCF may have the following functions: authenticate API callers based on their identity information and other information required to authenticate API callers; support mutual authentication with API callers; provide authorization to API callers before they access service APIs; publish and store service API information, and support discovery of service APIs; control access to service APIs based on policies configured by PLMN operators; monitor service API calls; store service API call logs, and provide service API call logs to authorization function network elements; perform billing based on service API call logs; add new API callers and delete API callers; store CAPIF and service API-related policy configurations; support auditing based on access logs (e.g., detecting whether there is abuse); support publishing and / or discovering service APIs using another CAPIF core function in CAPIF docking. Optionally, CCF may be a device in the core network or in other networks, and this application does not limit this.

[0102] AzF is used to obtain user authorization. In this application, AuF and AzF can be replaced with each other. In addition, both AzF and CCF have authorization functions, and AzF and CCF can be set in the same device or in different devices. The following is an example of AzF and CCF being set in the same device. At this time, AzF and CCF can be used without distinction. That is to say, AzF and CCF can be replaced with each other in the following, and can also be called authorization server.

[0103] AEF is used to provide service API and is the entry point for API callers to call service API. AEF can have the following functions: authenticate API callers based on the identity information and other information required for API caller authentication provided by CCF; verify the authorization provided by CCF; record the number of times the service API in CCF is called. For example, AEF can be NEF, that is, the location of AEF in the communication network can be seen in Figure 1 NEF network element in.

[0104] The API publishing function network element is a function network element that enables API providers to publish APIs. It can publish service API information to CCF so that API callers can find service API information in CCF. It should be noted that the API publishing function network element and NEF can be set together.

[0105] The API management function network element performs management of the service API, such as monitoring the status of the service API, recording call information, etc. It should be noted that the API management function network element can be co-located with the NEF.

[0106] RO Client is an application client used by users, which can display the operation interface to users. RO Client is, for example, an operating system or a browser. RO Client can be Figure 1 In this application, RO client may also be referred to as user agent, and the two may be used interchangeably.

[0107] Figure 2 CAPIF-1, CAPIF-1e, CAPIF-2, CAPIF-2e, etc. are reference points. The meanings of these reference points can be found in the meanings defined in the 3GPP standard protocol and are not limited here.

[0108] It should be noted that Figure 1 and Figure 2The communication system shown does not constitute a limitation on the communication system to which the embodiments of the present application can be applied. Therefore, the communication method provided in the embodiments of the present application can also be applied to communication systems of various standards, such as: long term evolution (LTE) communication system, 5G communication system, 6G communication system and future communication system, vehicle to everything (V2X), long term evolution-vehicle network (LTE-vehicle, LTE-V), vehicle to vehicle (V2V), vehicle network, machine type communication (MTC), Internet of things (IoT), long term evolution-machine to machine (LTE-machine to machine, LTE-M), machine to machine (machine to machine, M2M), Internet of things, etc. In addition, the communication system provided in the present application can be used in terrestrial network (TN) and / or non-terrestrial network (NTN), without limitation. In addition, it should be noted that the embodiments of the present application do not limit the names of the network elements in the communication system. For example, in communication systems of different standards, each network element may have other names; for example, when multiple network elements are integrated into the same physical device, the physical device may also have other names.

[0109] To facilitate understanding of the present application, the terms used in the present application are explained below.

[0110] 1) A token is a digital object, data field, or string that contains authorization information or authentication information. For example, a token can be used to indicate authorization of one or more services or resources for one or more users.

[0111] There are many types of tokens according to their usage, such as access tokens (access_token), refresh tokens (refresh_token), identity tokens (ID token), etc. Among them, the access token is a credential used to access protected resources. For example, it can be used to authorize API callers to access the API services corresponding to the access token through AEF, such as QoS services. The refresh token is a credential used to obtain an access token. For example, it can be used to authorize API callers to request a new token from CCF when the current access token expires, that is, the refresh token can be used to update the usage time of the current token. In addition, the refresh token can also be used to shorten the validity period of the current access token or reduce the scope of the current access token.

[0112] A token may include a claim. The claim is a short piece of asserted information about the subject of the token and may include at least one of the following:

[0113] 1. Timeout: It can be used to determine the timeout of the token. For example, in the token declaration, the timeout: {December 2, 23} means that the token will be invalid from December 2, 2023.

[0114] 2. API caller identifier (ID): used to indicate the API caller corresponding to the token. For example, the token declaration includes API Invoker ID#1. If the token is an access token, it means that the API caller corresponding to API Invoker ID#1 is authorized to access the API service corresponding to the access token through AEF. If the token is an update token, it means that the API caller corresponding to API Invoker ID#1 is authorized to request an updated token from CCF.

[0115] 3. AEF ID: used to indicate the AEF corresponding to the token. For example, the token declaration includes AEF ID#1. If the token is an access token, it means that the API caller is authorized to access the API service corresponding to the access token through the AEF corresponding to AEF ID#1.

[0116] 4. Service indication information: used to indicate the service authorized by the token. The service indication information can be an API service ID (API service ID), which can also be called a service API ID (service API ID) or a service ID (serviceID). For example, the token declaration includes API service ID#1. If the token is an access token, it means that the API caller is authorized to access the API service corresponding to API service ID#1 through AEF.

[0117] 5. User indication information: used to indicate the user corresponding to the token. The user indication information can be the user's ID or the ID of the terminal corresponding to the user.

[0118] 6. Scope: used to determine the authorization scope of the token. For example, the scope statement of the token includes AEFID#1: API service ID#1, API service ID#2, which means that the API caller is authorized to access the API services corresponding to API service ID#1 and API service ID#2 through AEF#1.

[0119] Optionally, each information in the above declaration can be a separate declaration. For example, the timeout period is one declaration, and the scope is another declaration. It should be noted that the indication information of the service can be a separate declaration or included in the declaration scope. This application does not limit in which declaration the indication information of the service is included.

[0120] It should be noted that tokens can also be classified according to whether they include information such as declarations. For example, a structured type token includes one or more of the above declaration information. The recipient or verifier of the token (such as AEF) can obtain the declaration information from the token. For another example, an opaque type token does not include the above declaration information, and the recipient or verifier of the token (such as AEF) needs to request other network elements through other information in the token to indirectly obtain the declaration information or verify the declaration information. Optionally, the other information may be index information, and the index information is, for example, a token ID or a reference ID. Tokens can also be classified in other ways. For example, a bearer type token means that the owner of the token is authorized to use the resources or services corresponding to the token; a message authentication code (MAC) type token requires the owner of the token to further prove that he has the corresponding MAC key before being authorized to use the resources or services corresponding to the token. This application does not limit the classification method of tokens.

[0121] Optionally, the token may further include a signature, which may be a signature of the CCF's statement on the token, and may be used to protect the integrity and / or confidentiality of the token.

[0122] In this application, the token can be encrypted; or, the token can also be unencrypted. If the token is encrypted, the holder of the token (for example, the API caller) needs to obtain the decryption key to read the statement in the token. This application does not restrict whether the token is encrypted.

[0123] 2) User agent, also known as RO Client, can be an application corresponding to the user and can initiate various requests on behalf of the user. The user agent can include at least one of the following: a browser, an application on the terminal, a client, a command line tool or an Internet robot. The user agent can be set on the terminal.

[0124] In this application, the communication channel between two network elements is protected by security, and this application does not limit the specific method of security protection. The two network elements are, for example: a user agent and an API caller, a user agent and an AZF, or an API caller and an AZF.

[0125] In the following text of this application, association can be replaced by binding.

[0126] In the following text of this application, "sending information to...(terminal)" can be understood as the destination of the information being the terminal, and can include directly or indirectly sending information to the terminal. "Receiving information from...(terminal)" can be understood as the source of the information being the terminal, and can include directly or indirectly receiving information from the terminal. The information may be processed as necessary between the source and destination of the information, such as format changes, but the destination can understand the valid information from the source. Similar expressions in this application can be understood similarly and will not be repeated here.

[0127] Currently, the 3GPP network can provide services to the outside world. For example, the services provided by the 3GPP network to the outside world include providing user location information. After the API caller obtains authorization for the user's location information, the user's location information can be obtained through the 3GPP network. For another example, the services provided by the 3GPP network to the outside world include QoS services. The API caller can request the 3GPP network to change the QoS service level of the user or terminal. After obtaining authorization for a certain level of QoS service, the API caller can establish or modify a PDU session corresponding to the level for the user or terminal through the 3GPP network, so that the quality of communication of the user or terminal meets the requirements of the level.

[0128] After the API caller obtains authorization, the authorization may be withdrawn. The Internet Engineering Task Force (IETF) standard supports a mechanism for revoking authorization (i.e., revoking tokens) initiated by the API caller (i.e., client). However, the token revocation process initiated by the API caller cannot guarantee that the token revocation process is authorized by the user. For example, when there are malicious applications in devices such as terminals or cloud platforms, the malicious applications may obtain the client's information, thereby initiating a token revocation process, resulting in a service interruption for the user, i.e., the user is denied service (denial of service, DoS). For example, for an update token, when a malicious application obtains the ID of the update token, the malicious application can initiate a revocation process for the update token. Therefore, how to design a service revocation authorized by the user, for example, how to design a token revocation process authorized by the user, requires further research.

[0129] In view of this, an embodiment of the present application provides a communication method. Figure 3 A flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 3 The method is illustrated by taking the terminal and the first device as the execution subject of the interaction, but the present application does not limit the execution subject of the interaction. The first device may be an API caller or AzF, or a module applied to the API caller or AzF, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the API caller or AzF functions. Optionally, Figure 3 The terminal in can be replaced by the user agent.

[0130] like Figure 3 As shown, the method comprises the following steps:

[0131] S301: The terminal determines first information, where the first information can be used to determine a first token, and the first token can be a token that authorizes a first user to provide a first service.

[0132] The specific content of the first information will be described in the following methods a1, a2 and a3, and will not be expanded here.

[0133] S302: The terminal sends a first request; correspondingly, the first device receives the first request.

[0134] The first request may include first information, and the first request is used to request the revocation of the first token. Thus, based on the first information in the first request, the first device may determine that the first request is used to request the revocation of the first token. The first request may be an existing message (e.g., a revocation request) or a new message, which is not limited in this application.

[0135] In some examples, the terminal may send the first request directly to the first device. For example, the first device is an API caller, and the terminal may send the first request to the API caller according to the address information of the API caller. The address information of the API caller is, for example, the Internet Protocol (IP) address and / or the Uniform Resource Locator (URL) address of the API caller. For another example, the first device is AzF, and the terminal may send the first request to AzF according to the address information of AzF. The address information of AzF is, for example, the IP address and / or URL of AzF. The address information of AzF may be obtained by the terminal from the API caller.

[0136] In some other examples, the terminal may send the first request to the first device through the second device. The second device may include one or more devices. For example, the first device is AzF, and the second device is an API caller. The terminal may send the first request to AzF through the API caller.

[0137] Optionally, the first request further includes: indication information of the first user. The indication information of the first user is, for example, the name or ID of the first user, or the ID of the terminal corresponding to the first user (for example, SUPI or generic public subscription identifier (GPSI)). The indication information of the first user and the first information can be used to determine the first token. For example, the first device saves tokens of multiple users. The first device can select the token of the first user from the tokens of the multiple users according to the indication information of the first user, and select the first token from the token of the first user according to the first information. Since the first device can use the indication information of the user as an index of the tokens of multiple users, through this example, the first device can quickly exclude the tokens of users other than the first user, narrow the range of tokens to be determined, and increase the speed of determining the first token. For another example, the first information corresponds to multiple tokens, and the token corresponding to the first user among the multiple tokens is the first token. In this way, the first device can first find multiple tokens according to the first information, and select the token corresponding to the first user from the multiple tokens as the first token according to the indication information of the first user. Among them, the multiple tokens can be tokens of multiple users, and the tokens of the multiple users can be saved by the first device.

[0138] S303: The first device determines a first token according to the first request.

[0139] The first device may determine the first token according to the first information in the first request. The specific content of the first device determining the first token will be described in the following methods a1, a2 and a3, which will not be expanded here.

[0140] In some possible ways, the first device is an API caller. After determining the first token, the API caller may send a second request to AzF, and the second request may include the first token or indication information (e.g., ID) of the first token, for requesting to revoke the first token. Then, AzF may revoke the first token. The specific process of AzF revoking the first token is not limited in this application.

[0141] In some other possible embodiments, the first device is AzF. After determining the first token, AzF may revoke the first token. The specific process of AzF revoking the first token is not limited in this application.

[0142] pass Figure 3 In the method shown, the terminal can initiate the process of revoking the first token by including the first information in the first request. In this way, the user can initiate the process of revoking the first token by controlling the terminal, thereby revoking the authorization of the first service corresponding to the first token.

[0143] As mentioned above, the first information can be used to determine the first token. There are many ways to use the first information to determine the first token, for example, way a1, way a2 or way a3.

[0144] Mode a1: The first information includes a random number, and the random number can be used to determine the first token.

[0145] There are many ways to use the random number to determine the first token, for example, method b1 or method b2.

[0146] Mode b1: There is a correspondence #1 between the random number and the first token. The correspondence #1 is stored in the first device. Thus, in S303, after receiving the first request including the random number, the first device can determine the first token according to the random number and the correspondence #1, and further determine that the first request is used to request the revocation of the first token.

[0147] Optionally, the first device may obtain the corresponding relationship #1 through the following steps A1 to A3:

[0148] A1: The terminal generates the random number.

[0149] The random number may be generated by the terminal after detecting the first operation of the first user. The first operation may be used to indicate that the first user agrees to authorize the first service to the first user. For example, in the process of applying for the first token, the terminal displays a pop-up window #1, which includes a display area for "Do you agree to authorize the first service to the first user", and an operation area for "Yes" and "No". The first operation may include a touch screen operation of the first user in the operation area for "Yes".

[0150] Optionally, after generating the random number, the terminal may save the random number.

[0151] In some possible ways, the terminal may save the correspondence between the random number and the first service and / or the first user, so that the terminal determines the first token according to the correspondence. For example, the terminal may include the indication information of the first service corresponding to the random number, so that the terminal can determine the first service according to the random number. For another example, the terminal may save the indication information of the first user corresponding to the random number, so that the terminal can determine the first user according to the random number. For another example, the terminal may save the indication information of the first service corresponding to the random number and the indication information of the first user, so that the terminal can determine the first service of the first user according to the random number. Optionally, the terminal may also save the correspondence between the random number and the authorization information other than the indication information of the first service and the indication information of the first user, so as to more accurately determine the first token. For example, the authorization information may include but is not limited to at least one of the following: information on the scope of authorization, information on the service API, information on AzF, information on AEF, information on the validity period of authorization, or information on the time of authorization, etc.

[0152] A2: The terminal sends the random number; correspondingly, the first device receives the random number.

[0153] Among them, the way in which the terminal sends the random number can refer to the way in which the terminal sends the first request in S302, except that the first request is replaced by a random number, which will not be repeated here. The random number can be included in an existing message or in a new message, and this application does not limit this. Optionally, the terminal can encrypt the random number before sending it or when sending it; accordingly, the first device can decrypt the received message to obtain the random number. This application does not limit whether to encrypt the random number.

[0154] Optionally, the terminal may send a random number during the process of applying for the first token. Exemplarily, after detecting the first operation and generating the random number, the terminal may send the random number. The specific content of detecting the first operation can be referred to step A1, which will not be repeated here.

[0155] A3: The first device associates the random number with the first token or the authorization code corresponding to the first token to obtain a correspondence #1. The correspondence #1 may be a direct correspondence between the random number and the first token, or a correspondence between the random number and the authorization code corresponding to the first token. Optionally, after obtaining the correspondence #1, the first device may save the correspondence #1.

[0156] In some possible methods, in method b1, after S303, Figure 3 The method further comprises step A4:

[0157] A4: The first device sends a first response; accordingly, the terminal receives the first response.

[0158] Among them, the first response can be used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. Optionally, the first response includes a random number. In this way, after receiving the first response, the terminal can determine one of the following based on the random number and the correspondence #1 between the random number and the first token: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. The first response can be an existing message (for example, a revocation response) or a new message, which is not limited in this application.

[0159] In some examples, the first device may directly send the first response to the terminal. For example, the first device is AzF, and AzF may send the first response to the terminal according to the address information of the terminal. The address information of the terminal is, for example, the IP address of the terminal.

[0160] In some other examples, the first device may send the first response to the terminal through the second device. The second device may include one or more devices. For example, the first device is AzF, and the second device is an API caller. AzF may send the first response to the terminal through the API caller.

[0161] In this way, the terminal can promptly learn that the first token has been successfully revoked, the process of revoking the first token has been triggered, or the first device has received the first request.

[0162] Mode b2: The random number is used to determine the second information through a one-way function; in other words, there is a functional relationship between the random number and the second information, or the second information is determined based on the random number and the one-way function. The second information can be used to determine the first token. Exemplarily, the one-way function can be a hash function or a key derivation function (KDF), etc. The following description takes the one-way function as a hash function as an example.

[0163] In some possible ways, there is a corresponding relationship #2 between the second information and the first token. The corresponding relationship #2 and the hash function are stored in the first device. In this way, in S303, after receiving the first request containing the random number, the first device can determine the second information based on the random number and the hash function, and determine the first token based on the second information and the corresponding relationship #2, and then determine that the first request is used to request the revocation of the first token. For example, the random number is rand. After receiving the first request, the first device can calculate Utid=hash(rand), and Utid is the second information. Then, the first device can determine the first token corresponding to Utid based on Utid and the corresponding relationship #2. Optionally, when calculating Utid, the one-way function can also include other parameters besides the random number. For example, the one-way function can be expressed as: Utid=hash(rand, other parameters). Exemplarily, other parameters can include at least one of the following: the ID of the terminal or the ID of the first device, etc. It should be noted that the present application does not limit the number and values ​​of other parameters. The method by which the first device calculates the second information (for example, the one-way function) and the number and / or type of parameters required to calculate the second information may be pre-configured or determined by negotiation between the first device and the terminal, and this application does not limit this.

[0164] Optionally, the first device may obtain the corresponding relationship #2 through the following steps B1 to B3:

[0165] B1: The terminal generates the random number and the second information.

[0166] The specific content of the terminal generating the random number can be referred to step A1, which will not be repeated here. After generating the random number, the terminal can calculate the random number through a one-way function to obtain the second information. The method for the terminal to calculate the second information is the same as the method for the first device to calculate the second information. The description of the first device determining the second information based on the random number and the hash function in method b2 can be referred to, which will not be repeated here.

[0167] Optionally, after generating the random number, the terminal may save the random number.

[0168] B2: The terminal sends the second information; correspondingly, the first device receives the second information.

[0169] The way in which the terminal sends the second information may refer to the way in which the terminal sends the random number in step A2, except that the random number is replaced by the second information, which will not be described in detail here.

[0170] B3: The first device associates the second information with the first token to obtain a correspondence #2. The correspondence #2 may be a direct correspondence between the second information and the first token, or a correspondence between the second information and the authorization code corresponding to the first token. When the correspondence #2 is a direct correspondence between the second information and the first token, there may be a one-to-one correspondence between the second information and the first token, thereby improving the accuracy of determining the first token based on the second information. Optionally, after obtaining the correspondence #2, the first device may save the correspondence #2.

[0171] In some possible methods, in method b2, after S303, Figure 3 The method further comprises step B4:

[0172] B4: The first device sends a first response; accordingly, the terminal receives the first response.

[0173] Among them, the first response can be used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. In some examples, the first response includes a random number. In this way, after receiving the first response, the terminal can determine the second information based on the random number and the hash function, and determine the first token based on the second information and the corresponding relationship #2, and then determine that the first response is used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first device has received the first request. In some other examples, the first response includes the second information. In this way, after receiving the first response, the terminal can determine one of the following based on the second information and the corresponding relationship #2: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first device has received the first request. The first response can be an existing message (for example, a revocation response) or a new message, and this application does not limit this.

[0174] The manner in which the first device sends the first response may refer to step A4 and will not be described in detail here.

[0175] In this way, the terminal can be informed in time that the first token is successfully revoked.

[0176] In some possible ways, after S303, Figure 3 The method further comprises step B5:

[0177] B5: The first device sends a notification message to the API caller; correspondingly, the API caller receives the notification message from the first device.

[0178] The notification message is used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first request has been received. Exemplarily, the notification message may include indication information of the first token (e.g., token ID). In this way, after receiving the notification message, the API caller can determine one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the first device has received the first request.

[0179] This application does not limit the execution order of step B4 and step B5.

[0180] Through this method a1, the terminal can initiate the revocation process of the first token according to the random number. In this way, the user can control the terminal to initiate the revocation process of the first token through the user agent on the terminal, so that the revocation process is authorized by the user, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0181] Furthermore, in the mode a1, the random number used to initiate the revocation process of the first token is generated by the terminal and can be protected by a one-way function. In this way, other applications on the terminal or AF except the user agent cannot obtain information related to the random number, and thus cannot initiate the revocation process for the first token, thereby improving the communication security of the terminal.

[0182] Mode a2: The first information includes auxiliary information for identifying the first token. Thus, in S303, the first device can determine the first token according to the auxiliary information.

[0183] Exemplarily, the auxiliary information may include at least one of the following:

[0184] 1. Information for identifying the authorized scope of the first token (hereinafter referred to as information #1): For example, the information #1 may indicate at least one of the following: an authorized service scope, an authorized permission scope (e.g., read or write), or a method for verifying the user's indication information (e.g., an open identification (openID) method), etc. The authorized service scope may include an authorized service scope corresponding to each AEF. Optionally, the information #1 may be used to determine the scope in the declaration of the first token.

[0185] 2. Information for identifying the service API corresponding to the first token (hereinafter referred to as information #2): For example, the information #2 may indicate at least one of the following: QoS service, obtaining the location information of the terminal, and the service subscribed by the first user. Optionally, the information #2 may be used to determine the API service ID in the declaration of the first token.

[0186] 3. Information for identifying the AzF corresponding to the first token (hereinafter referred to as information #3): For example, the information #3 may include at least one of the following: a name, a uniform resource locator (URL) or an ID of the issuer of the first token. The information #3 may be used to determine the “iss” claim (or parameter) in the claim set of the first token, and the “iss” claim is used to indicate the issuer of the first token. For example, the issuer of the first token may be the AzF corresponding to the first token.

[0187] 4. Information for identifying the user's indication information (hereinafter referred to as information #4): For example, the information #4 may include: the indication information of the first user. The specific content of the indication information of the first user can refer to the description of the indication information of the first user in S302, which will not be repeated here. The information #4 can be used to determine the "sub" statement in the statement set of the first token, which is used to indicate the subject of the first token, that is, the authorized user of the first token. For example, the subject of the first token can be the first user or the terminal corresponding to the first user.

[0188] 5. Information for identifying the AEF network element corresponding to the first token (hereinafter referred to as information #5): For example, the information #5 may include at least one of the following: the name, URL or ID of the AEF network element corresponding to the first token. Information #5 may be used to determine the "aud" parameter in the declaration of the first token, which is used to indicate the recipient (audience) of the first token. The recipient of the first token may include the AEF network element corresponding to the first token.

[0189] 6. Information used to identify the validity period of the first token (hereinafter referred to as information #6): Information #6 can be used to determine the "exp" parameter in the declaration of the first token, which is used to indicate the expiration time of the first token.

[0190] 7. Information used to identify the issuance time of the first token (hereinafter referred to as information #7): Information #7 can be used to determine the "iat" (i.e., issued at) statement or parameter in the statement set of the first token, which is used to indicate the issuance time of the first token.

[0191] It should be noted that the auxiliary information may also include other information besides the above 7 types of information. Optionally, the auxiliary information may include information corresponding to any statement in the first token and / or any information in the declaration of the first token. The first device determines the first token by identifying the statement corresponding to the auxiliary information, or identifying the information in the statement corresponding to the auxiliary information. The auxiliary information helps to narrow the search scope for determining the first token in multiple tokens, so that the first token can be accurately determined. For example, if the declaration of the token includes an API caller identifier, the auxiliary information may include information for identifying the API caller identifier. The first device may identify the API caller identifier in the declaration based on the information for identifying the API caller identifier, thereby determining the first token including the API caller identifier.

[0192] Optionally, the information in the auxiliary information and the declaration of the first token may be different in format and / or accuracy, etc. For example, information #7 in the auxiliary information may include July 2023. The declaration "iat" of the first token may include July 27, 23.

[0193] After receiving the auxiliary information, the first device may search for a first token matching the auxiliary information from a token database based on the auxiliary information. The token database may be stored in the first device or in a device other than the first device, and this application does not limit this. Optionally, the first device may compare the auxiliary information with the declaration of the token in the token database, and select a token whose declaration is consistent with the auxiliary information as the first token. For example, in the auxiliary information, information #2 indicates QoS service, information #4 indicates user #1, information #5 indicates AEF network element #1, and information #6 indicates September 10, 2023. The token database includes token #1, in which the API service ID indicates QoS service, the "sub" declaration indicates user #1, the "aud" declaration indicates AEF network element #1, and the "exp" declaration indicates September 10, 2023. The first device may determine token #1 as the first token.

[0194] In some possible ways, the auxiliary information may be acquired and stored by the terminal after detecting the first operation of the first user. The specific content of the first operation of the first user detected by the terminal is referred to way a1, which will not be repeated here.

[0195] Optionally, AzF may also send an authorization code corresponding to the first token; accordingly, the terminal receives the authorization code corresponding to the first token. The terminal may determine, based on the authorization code, that the first token corresponding to the auxiliary information is a token authorized by AzF; that is, the authorization code may be used to determine that the first token corresponding to the auxiliary information is a token authorized by AzF.

[0196] Through this method a2, the terminal can initiate the revocation process of the first token according to the auxiliary information. In this way, the user can control the terminal to initiate the revocation process of the first token through the user agent on the terminal, so that the revocation process is authorized by the user, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0197] Mode a3: The first information includes an authorization code corresponding to the first token. Thus, in S303, the first device can determine the first token according to the authorization code.

[0198] The authorization code may be obtained by the terminal from AzF. For example, in the process of applying for the first token, AzF sends the authorization code to the terminal. The way in which AzF sends the authorization code to the terminal can refer to the way in which the first device sends the first response in step A4, except that the first device is replaced by AzF and the first response is replaced by the authorization code, which will not be repeated here.

[0199] Optionally, the terminal may save at least one of the following: a correspondence between the authorization code and the first service and / or the first user, or a correspondence between the authorization code and authorization information other than the indication information of the first service and the indication information of the first user, so that the terminal determines the first token according to the correspondence. The manner in which the terminal saves the above correspondence may refer to the description of the following contents in step A1: the terminal saves the correspondence between the random number and the first service and / or the first user, and the terminal saves the correspondence between the random number and the authorization information other than the indication information of the first service and the indication information of the first user, but replaces the random number with the authorization code, which will not be repeated here.

[0200] It should be understood that the authorization code may correspond to one or more tokens, and the one or more tokens include a first token. In some examples, the first device may determine the one or more tokens based on the authorization code, and trigger the revocation of each of the one or more tokens. The following takes the first token as an example to illustrate how the first device determines the one or more tokens. For example, the first device saves a correspondence #3 between the authorization code and the first token. After receiving the authorization code, the first device may determine the first token based on the authorization code and the correspondence #3. In other examples, the first request in S302 includes: an authorization code and indication information of the first service. The first device determines one or more tokens based on the authorization code; the first device selects the token corresponding to the indication information of the first service among the one or more tokens as the first token, and triggers the revocation of the first token.

[0201] Through this method a3, the terminal can initiate the revocation process of the first token according to the authorization code. In this way, the user can control the terminal to initiate the revocation process of the first token through the user agent on the terminal, so that the revocation process is authorized by the user, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0202] The present application embodiment provides another communication method. Figure 3 A possible example of the method shown is shown. In this method, the first information is a random number, and the user agent can initiate a revocation process of the first token according to the random number. Figure 4 and Figure 5 The flowchart shown takes the first device as AzF and the second device as the API caller as an example to specifically illustrate the process of the method.

[0203] Figure 4 A method for applying for a first token is shown, the method comprising:

[0204] S401: The API caller sends an authorization request to the user agent in the terminal.

[0205] The authorization request may be used to request authorization of the first service for the first user. Optionally, the authorization request may include at least one of the following: indication information of the API caller (e.g., the ID of the API caller) or the scope of the requested authorization. The scope of the requested authorization may include indication information of the first service.

[0206] S402: The user agent sends the authorization request to AzF.

[0207] S403: AzF sends message #a1 to the user agent.

[0208] The message #a1 is used to request confirmation of whether the first user agrees to authorize the first service for the first user. Optionally, the message #a1 may include a scope of the requested authorization.

[0209] S404: The user agent detects a first operation of the first user, where the first operation may be used to indicate that the first user agrees to authorize a first service for the first user.

[0210] The specific content of the first operation of the first user detected by the user agent can be referred to step A1, which will not be repeated here.

[0211] S405: The user agent generates a random number and second information.

[0212] The specific content of S405 may refer to step B1, which will not be described in detail here.

[0213] S406: The user agent sends message #a2 to AzF.

[0214] The message #a2 is used to indicate that the first user agrees to authorize the first service to the first user. The message #a2 also includes second information.

[0215] S407: AzF associates the second information with the authorization code corresponding to the first token. Optionally, AzF may save the corresponding relationship between the second information and the authorization code.

[0216] S408: AzF sends the authorization code corresponding to the first token to the user agent.

[0217] This application does not limit the execution order of S407 and S408.

[0218] S409: The user agent sends the authorization code to the API caller.

[0219] S410: The API caller sends a request #a1 to AzF.

[0220] The request #a1 includes an authorization code, which can be used to request to obtain the first token.

[0221] S411: AzF sends a first token to the API caller.

[0222] For the specific contents of S401 to S404, S406, and S408 to S411, please refer to the description of the token application process in the IETF standard.

[0223] S407 is an optional step. For example, after S410, Figure 4 The method shown also includes S412: AzF associates the second information with the first token. Optionally, AzF can save the corresponding relationship between the second information and the first token. The present application does not limit the execution order of S411 and S412. Figure 4 When the method includes S412, Figure 4 The method shown may not include S407 .

[0224] pass Figure 4 In the method shown, the user agent may generate a random number and second information, and the AzF may associate the second information with the first token or the authorization code corresponding to the first token.

[0225] Figure 5 A method of revoking a first token is shown, the method comprising:

[0226] S501: The user agent saves the random number.

[0227] The random number may be generated by the user agent in S405.

[0228] Optionally, the user agent in the terminal may also store the indication information of the first user. The specific content of the indication information of the first user may refer to the description of the indication information of the first user in S302, which will not be repeated here.

[0229] S502: After detecting an operation of the first user for running the user agent, the terminal starts the user agent.

[0230] S502 is an optional step. For example, when the user agent is already in the startup state, Figure 5 The method shown may not include S502 .

[0231] S503: The user agent sends a revocation request #a1 including a random number to AzF.

[0232] The cancellation request #a1 may be the first request in S302. Accordingly, S503 may refer to S302, and the repeated parts will not be repeated.

[0233] S504: AzF determines a first token according to the random number.

[0234] The specific content of S504 may refer to method b2 and will not be described in detail here.

[0235] S505: AzF sends a revocation request #a2 to AEF, where the revocation request #a2 is used to request the release of resources corresponding to the first token.

[0236] In some examples, the revocation request #a2 may include information in the first token, for example, the revocation request #a2 may include at least one of the following information in the first token: service indication information, scope and other declaration information. Thus, after receiving the revocation request #a2, the AEF may determine that the revocation request #a2 is used to request the release of the resources corresponding to the first token.

[0237] In some other examples, the revocation request #a2 may include: the first token and / or indication information of the first token (eg, the ID of the first token). Thus, after receiving the revocation request #a2, the AEF may determine that the revocation request #a2 is used to request the release of resources corresponding to the first token.

[0238] S506: AEF triggers the release of resources corresponding to the first token.

[0239] The present application does not limit the specific process of AEF triggering the release of resources corresponding to the first token.

[0240] S507: AEF sends a revocation response #a2 to AzF.

[0241] The revocation response #a2 is a response message of the revocation request #a2, and is used to indicate one of the following: the resource corresponding to the first token has been successfully released or has been triggered to release, or the revocation request #a2 has been received.

[0242] S508: AzF sends a revocation notification to the API caller, where the revocation notification may be used to indicate one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the revocation request #a2 has been received.

[0243] The revocation notification may be the notification message in step B5. Accordingly, the specific content of S508 may refer to step B5, which will not be described in detail here.

[0244] Optionally, after receiving the revocation notification, the API caller may update the token database, for example, marking the first token as revoked in the token database.

[0245] S509: AzF sends a revocation response #a1 to the user agent.

[0246] The revocation response #a1 is a response message to the revocation request #a1, which indicates one of the following: the first token is successfully revoked, the process of revoking the first token has been triggered, or the revocation request #a1 has been received. The revocation response #a1 may be the first response in step B4. Accordingly, the specific content of S509 may refer to step B4, which will not be repeated here.

[0247] This application does not limit the execution order of S508 and S509.

[0248] S509 is an optional step.

[0249] pass Figure 4 and Figure 5 In the method shown, the user agent can initiate the revocation process of the first token based on the random number, so that the revocation process is authorized by the user, and AzF associates the second information with the first token or the authorization code corresponding to the first token, so that the first token can be accurately identified and the first token that the user wants to revoke can be revoked, thereby avoiding the interruption of the service that the user expects to obtain due to the revocation of authorization, that is, avoiding the user from being denied service. Moreover, in this method, the random number used to initiate the revocation process of the first token is generated by the terminal and can be protected by a one-way function. In this way, third-party applications on the terminal or AF cannot obtain information related to the random number, and thus cannot initiate the revocation process for the first token, thereby improving the security of the token revocation process.

[0250] The present application embodiment provides another communication method, which is Figure 3Another possible example of the method shown. In this method, the first information is auxiliary information, and the user agent can initiate a revocation process of the first token based on the auxiliary information. Figure 6 and Figure 7 The flowchart shown takes the first device as AzF or API caller as an example to specifically illustrate the process of the method.

[0251] Figure 6 A method for applying for a first token is shown, the method comprising:

[0252] S601: The API caller sends an authorization request to the user agent in the terminal.

[0253] S602: The user agent sends the authorization request to AzF.

[0254] S603: AzF sends message #a1 to the user agent.

[0255] S604: The user agent detects a first operation of the first user, where the first operation may be used to indicate that the first user agrees to authorize the first service for the first user.

[0256] The specific contents of S601 to S604 may refer to S401 to S404 and will not be repeated here.

[0257] S605: The user agent saves the auxiliary information used to identify the first token.

[0258] The specific content of the auxiliary information can refer to the description of the auxiliary information in method a2, which will not be repeated here.

[0259] This application does not limit the execution order of S605 and S604. For example, S605 can be executed before S604 (after receiving S603). It should be noted that the advantage of storing the auxiliary information after S605 is that the token corresponding to the auxiliary information has been authorized by the user. The auxiliary information stored before S604, and its corresponding token application have not yet been authorized by the user. Optionally, if after storing the auxiliary information, the user agent detects that the user does not agree to authorize the first service for the first user, the user agent may delete the stored auxiliary information.

[0260] S606: The user agent sends message #a2 to AzF.

[0261] The message #a2 is used to indicate that the first user agrees to authorize the first service to the first user.

[0262] S607: AzF sends the authorization code corresponding to the first token to the user agent.

[0263] S608: The user agent confirms the auxiliary information according to the authorization code.

[0264] Specifically, after receiving the authorization code corresponding to the first token, the user agent can confirm that the token request corresponding to the auxiliary information has successfully obtained the authorization code, and the auxiliary information saved in S605 can continue to be retained. Optionally, if the user agent does not receive the authorization code within the set time, the user agent can delete the auxiliary information saved in S605. The set time can be pre-set, determined by the user agent, or set by the network side for the user agent, and this application does not limit this.

[0265] S608 is an optional step.

[0266] S609: The user agent sends the authorization code to the API caller.

[0267] This application does not limit the execution order of S608 and S609.

[0268] S610: The API caller sends a request #a1 to AzF.

[0269] The request #a1 includes an authorization code, which can be used to request to obtain the first token.

[0270] S611: AzF sends a first token to the API caller.

[0271] For the specific contents of S601 to S604, S606 to S607, and S609 to S611, please refer to the description of the token application process in the IETF standard.

[0272] pass Figure 6 In the method shown, the user agent may save auxiliary information for identifying the first token.

[0273] Figure 7 A method of revoking a first token is shown, the method comprising:

[0274] S701: After detecting an operation of a first user for running a user agent, the terminal starts the user agent.

[0275] The specific content of S701 can be referred to S502 and will not be repeated here.

[0276] S702: A secure channel is established between the user agent and the API caller.

[0277] For example, the user agent is a web browser, and a transport layer security (TLS) channel can be established between the user agent and the API caller. The TLS channel can be a Hypertext transfer protocol secure (HTTPS) channel.

[0278] S702 is an optional step. For example, when the communication between the user agent and the API caller is secure or has been protected by other means, Figure 7 The method shown may not include S702 .

[0279] S703: The user agent sends a cancellation request #b1 containing auxiliary information to the API caller.

[0280] The cancellation request #b1 may be the first request in S302. Accordingly, S703 may refer to S302 and will not be described in detail here.

[0281] In implementation a1, the first device may be an API caller. After S703, Figure 7 The method shown includes S704 to S705.

[0282] S704: The API caller determines the first token according to the auxiliary information.

[0283] The specific content of S704 can be referred to method a2, which will not be repeated here.

[0284] S705: The API caller sends a cancellation request #b2 to AzF.

[0285] The revocation request #b2 may include the first token and / or indication information of the first token, for requesting the revocation of the first token. After receiving the revocation request #b2, AzF may revoke the first token. The present application does not limit the specific process of AzF revoking the first token.

[0286] In implementation a2, the first device may be AzF. After S703, Figure 7 The method shown includes S706 to S707.

[0287] S706: The API caller sends a cancellation request #b1 containing auxiliary information to AzF.

[0288] S707: AzF determines the first token according to the auxiliary information.

[0289] The specific content of S707 can be referred to method a2, which will not be repeated here.

[0290] After determining the first token, the AzF may revoke the first token. The present application does not limit the specific process of the AzF revoking the first token.

[0291] After S705 or S707, Figure 7 The method shown also includes S708.

[0292] S708: AzF sends a revocation response #b1 to the API caller, which may be used to indicate one of the following: the first token has been successfully revoked, the process of revoking the first token has been triggered, or a revocation request has been received for requesting the revocation of the first token (for example, revocation request #b2 in S705 or revocation request #b1 in S706).

[0293] Optionally, after receiving the revocation response #b1, the API caller may update the token database, for example, marking the first token as revoked in the token database.

[0294] In some possible ways, the API caller may also forward the revocation response #b1 to the user agent.

[0295] pass Figure 6 and Figure 7 In the method shown, the user agent can initiate a revocation process of the first token based on the auxiliary information, so that the revocation process is authorized by the user, thereby avoiding interruption of the service the user expects to obtain due to revocation of authorization, that is, avoiding denial of service to the user.

[0296] The present application embodiment provides another communication method. Figure 3 The method shown is another possible example. In this method, the first information is an authorization code, and the user agent can initiate a revocation process of the first token according to the authorization code. Figure 8 and Fig. 9 The flowchart shown takes the first device as AzF or API caller as an example to specifically illustrate the process of the method.

[0297] Figure 8 A method for applying for a first token is shown, the method comprising:

[0298] S801: The API caller sends an authorization request to the user agent in the terminal.

[0299] S802: The user agent sends the authorization request to AzF.

[0300] S803: AzF sends message #a1 to the user agent.

[0301] S804: The user agent detects a first operation of the first user, where the first operation may be used to indicate that the first user agrees to authorize the first service for the first user.

[0302] S805: The user agent sends message #a2 to AzF.

[0303] S806: AzF sends the authorization code corresponding to the first token to the user agent.

[0304] The specific contents of S801 to S806 can be referred to S401 to S404 and S606 to S607, and will not be repeated here.

[0305] S807: The user agent saves the authorization code.

[0306] S808: The user agent sends the authorization code to the API caller.

[0307] This application does not limit the execution order of S807 and S808.

[0308] S809: The API caller sends a request #a1 to AzF.

[0309] S810: AzF sends a first token to the API caller.

[0310] The specific contents of S808 to S810 may refer to S609 to S611 and will not be repeated here.

[0311] For the specific contents of S801 to S806 and S808 to S810, please refer to the description of the token application process in the IETF standard.

[0312] pass Figure 8 According to the method shown, the user agent can save the authorization code corresponding to the first token.

[0313] Fig. 9 A method of revoking a first token is shown, the method comprising:

[0314] S901: After detecting an operation of a first user for running a user agent, the terminal starts the user agent.

[0315] The specific content of S901 can be found in S502 and will not be repeated here.

[0316] Optionally, the user agent may also save the indication information of the first user. The specific content of the indication information of the first user may refer to the description of the indication information of the first user in S302, which will not be repeated here.

[0317] S902: A secure channel is established between the user agent and the API caller.

[0318] The specific content of S902 can be referred to S702 and will not be repeated here.

[0319] S903: The user agent sends a revocation request #c1 including the authorization code to the API caller.

[0320] The cancellation request #c1 may be the first request in S302. Accordingly, S903 may refer to S302, which will not be described in detail here.

[0321] In implementation b1, the first device may be an API caller. After S903, Fig. 9 The method shown includes S904 to S905.

[0322] S904: The API caller determines the first token according to the verification code.

[0323] The specific content of S904 may refer to method a3 and will not be described in detail here.

[0324] S905: The API caller sends a cancellation request #c2 to AzF.

[0325] The specific content of S905 can be found in S705 and will not be repeated here.

[0326] In implementation b2, the first device may be AzF. After S903, Fig. 9 The method shown includes S906 to S907.

[0327] S906: The API caller sends a revocation request #c1 including the authorization code to AzF.

[0328] S907: AzF determines the first token according to the authorization code.

[0329] The specific content of S907 may refer to method a3 and will not be described in detail here.

[0330] After determining the first token, the AzF may revoke the first token. The present application does not limit the specific process of the AzF revoking the first token.

[0331] After S905 or S907, Fig. 9 The method shown also includes S908.

[0332] S908: AzF sends a revocation response #c1 to the API caller, which may be used to indicate one of the following: the first token has been successfully revoked, the process of revoking the first token has been triggered, or a revocation request has been received for requesting the revocation of the first token (for example, revocation request #c2 in S905 or revocation request #c1 in S906).

[0333] The specific content of S908 can refer to S708, except that the revocation response #b1 is replaced by the revocation response #c1, which will not be repeated here.

[0334] pass Figure 8 and Fig. 9 In the method shown, the user agent can initiate a revocation process of the first token according to the authorization code, so that the revocation process is authorized by the user, thereby avoiding interruption of the service expected by the user due to revocation of authorization, that is, avoiding denial of service to the user.

[0335] An embodiment of the present application provides yet another communication method. Fig.10 A flow chart corresponding to the communication method provided in the embodiment of the present application. Fig.10 The method is illustrated by taking the terminal and the third device as the execution subject of the interaction, but the present application does not limit the execution subject of the interaction. The third device may be AzF, or a module applied to AzF, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the AzF functions. Optionally, Fig.10 The terminal in can be replaced by the user agent.

[0336] S1001: The terminal sends a third request; accordingly, the third device receives the third request.

[0337] The third request includes the indication information of the first service, which can be used to request the revocation of the authorization of the first service. The specific content of the indication information of the first service can be referred to the "indication information of the service" in the above terminology description part, which will not be repeated here.

[0338] The way in which the terminal sends the third request can refer to the way in which the terminal sends the first request in S302, except that the first device is replaced by the third device, and the first request is replaced by the third request, which will not be repeated here.

[0339] S1002: The third device sends third information; accordingly, the terminal receives the third information.

[0340] The third information may be used to indicate that the authorization to be revoked is the first authorization that allows the first user to use the first service. Exemplarily, the third information may include indication information of the first service, and the indication information of the first service is included in a set field or message. In this way, when the terminal parses the indication information of the first service in the set field or message, the terminal may determine that the authorization to be revoked is the first authorization that allows the first user to use the first service.

[0341] The way in which the third device sends the third information can refer to the way in which the first device sends the first response in step A4, except that the first device is replaced by the third device, and the first response is replaced by the third information, which will not be repeated here.

[0342] S1003: The terminal detects a second operation of the first user, where the second operation may be used to indicate that the first user agrees to revoke the first authorization.

[0343] After receiving the third information, the terminal may ask the first user whether to agree to revoke the first authorization. For example, after receiving the third information, the terminal displays a pop-up window #2, which includes a display area for "Do you agree to revoke the authorization of the first service for the first user", and an operation area for "Yes" and "No". The second operation may include a touch screen operation of the first user in the operation area for "Yes".

[0344] S1004: The terminal sends fourth information; correspondingly, the third device receives the fourth information.

[0345] The fourth information may be sent by the terminal in response to the second operation. The fourth information may be used to trigger the revocation of the first authorization.

[0346] The way in which the terminal sends the fourth information can refer to the way in which the terminal sends the first request in S302, except that the first device is replaced by the third device, and the first request is replaced by the fourth information, which will not be repeated here.

[0347] S1005: The third device sends the fifth information; accordingly, the API caller receives the fifth information.

[0348] The fifth information is information for revoking the first authorization. Optionally, the fifth information is a second token.

[0349] In some examples, the type of the second token is a revocation token. Field #1 in the second token may be related to the first authorization. For example, the first token is a token that authorizes the first user to provide the first service, and field #1 of the second token is the indication information of the first token. Thus, after receiving the second token, the API caller may determine to revoke the first authorization based on the indication information of the first token in field #1.

[0350] In some other examples, the value of the first field in the second token is a set value. The set value is, for example, an invalid (null) value or other value. For example, the type of the second token is an access token. Field #1 in the second token is related to the first authorization, and the value of the first field in the second token is the set value. In this way, after receiving the second token, the API caller can determine whether to revoke the first authorization based on field #1 and the first field.

[0351] S1001 and S1005 are optional steps.

[0352] pass Fig.10 In the method shown, the terminal sends the fourth information for triggering the revocation of the first authorization, i.e., triggering the token process of the token, only after detecting the second operation of the first user, thereby avoiding the interruption of the service expected by the user due to the revocation of authorization, i.e., avoiding the user being denied service.

[0353] The present application embodiment provides another communication method. Fig.10 One possible example of the method shown is shown below. Fig.11 The flowchart shown takes the first device AzF as an example to specifically illustrate the process of the method.

[0354] S1101: After detecting an operation of a first user for running a user agent, the terminal starts the user agent.

[0355] The specific content of S1101 can be referred to S502 and will not be repeated here.

[0356] S1102: The user agent sends a cancellation request #d1 to the API caller.

[0357] The revocation request #d1 includes indication information of the first service, and is used to request revocation of the first authorization for the first service.

[0358] S1103: The API caller sends a cancellation request #d2 to the user agent.

[0359] The revocation request #d2 includes indication information of the first service, and is used to request revocation of the first authorization for the first service.

[0360] S1104: The user agent sends a revocation request #d2 to AzF.

[0361] The cancellation request #d2 may be the third request in S1001. Accordingly, the specific content of S1104 may refer to S1001, which will not be described in detail here.

[0362] S1105: AzF sends third information to the user agent.

[0363] The specific content of S1105 can be found in S1002 and will not be repeated here.

[0364] S1106: The user agent detects a second operation of the first user, where the second operation may be used to indicate that the first user agrees to revoke the first user's authorization for the first service.

[0365] S1107: The user agent sends fourth information to the AzF.

[0366] The specific content of S1107 can be found in S1004 and will not be repeated here.

[0367] S1108: AzF sends the authorization code corresponding to the second token to the user agent.

[0368] Among them, the specific content of the second token can refer to the description of the second token in S1005, which will not be repeated here.

[0369] S1109: The user agent sends the authorization code corresponding to the second token to the API caller.

[0370] S1110: The API caller sends a request #d1 to AzF, wherein the request #d1 includes an authorization code corresponding to the second token, which can be used to request to obtain the second token.

[0371] S1008 to S1110 are optional steps.

[0372] S1111: AzF sends a second token to the API caller.

[0373] S1112: The API caller sends a second token to the AEF.

[0374] S1113: The AEF revokes the first authorization according to the second token, and releases the resources corresponding to the first authorization.

[0375] pass Fig.11 In the method shown, the user agent can initiate an authorization revocation process based on the second token, so that the revocation process is authorized by the user, thereby avoiding interruption of the service expected by the user due to the revocation of authorization, that is, avoiding the user from being denied service.

[0376] Based on the same technical concept as the above method embodiment, the embodiment of the present application is Fig.12 A communication device is provided, which can be used to perform the functions of the relevant steps in the above method embodiment. The functions can be implemented by hardware, or by software or hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The structure of the communication device is as follows Fig.12 As shown, it includes an interface unit 1201 and a processing unit 1202. The communication device 1200 can be a terminal, an API caller, a device including an API caller (for example, a terminal or AF) or an AzF, or a module applied to a terminal, an API caller, a device including an API caller or an AzF, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the functions of a terminal, an API caller, a device including an API caller or an AzF. In addition, the communication device 1200 can implement the communication method provided in the above embodiments and examples of the present application. The functions of each unit in the communication device 1200 are introduced below.

[0377] The interface unit 1201 is used to input and / or output information. When outputting information, the interface unit 1201 can output information to other devices outside the communication device 1200, or can output information to other units in the communication device 1200. In some embodiments, the interface unit 1201 can be implemented by at least one of a physical interface, a communication module, a communication interface, and an input / output interface. In other embodiments, the interface unit 1201 can be implemented by an interface circuit, for example, a mobile communication module. Among them, the mobile communication module may include one or more of at least one antenna, at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc.

[0378] The processing unit 1202 can be used to support the communication device 1200 to perform the processing actions in the above method embodiment. The processing unit 1202 can be implemented by a processor. For example, the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0379] In one embodiment, the communication device 1200 is applied to Figure 3 The terminal in the embodiment of the present application is shown. The specific functions of the processing unit 1202 in this implementation are introduced below.

[0380] The processing unit 1202 is used to: determine first information, the first information is used to determine a first token, the first token is a token that authorizes a first service for a first user; send a first request through the interface unit 1201, the first request includes first information, and the first request is used to request revocation of the first token.

[0381] In some possible embodiments, the processing unit 1202 is also used to: receive a first response through the interface unit 1201, the first response is used to indicate one of the following: successful revocation of the first token, the process of revoking the first token has been triggered, or the first request has been received, the first response includes a random number or second information, and the second information is obtained based on a one-way function and a random number.

[0382] In some other possible methods, the processing unit 1202 is also used to: generate a random number and second information, the second information is obtained based on a one-way function and the random number; send the second information to the authorization function network element through the interface unit 1201, and the second information corresponds to the first token.

[0383] Optionally, the processing unit 1202 is further used to: before generating the random number and the second information, detect a first operation of the first user, where the first operation is used to indicate that the first user agrees to authorize the first service to the first user.

[0384] In some examples, the processing unit 1202 is further used to: detect a first operation of the first user, the first operation is used to indicate that the first user agrees to authorize the first service to the first user; and obtain and store auxiliary information.

[0385] In some possible embodiments, the processing unit 1202 is further used to: receive an authorization code corresponding to the first token through the interface unit 1201, and the authorization code is used to determine that the first token corresponding to the auxiliary information is a token authorized by the authorization function network element.

[0386] In some other possible embodiments, the processing unit 1202 is further used to: receive, through the interface unit 1201, an authorization code corresponding to the first token from an authorization function network element.

[0387] Optionally, the processing unit 1202 is further used to: send a first request to the authorization function network element through the interface unit 1201 according to the address information of the authorization function network element; or send a first request to the authorization function network element through an application software programming interface caller.

[0388] In another embodiment, the communication device 1200 is applied to Figure 3 The first device in the embodiment of the present application is shown. The specific functions of the processing unit 1202 in this implementation are introduced below.

[0389] The processing unit 1202 is used to: receive a first request from the terminal through the interface unit 1201, the first request is used to request the revocation of a first token, the first request includes first information, the first information is used to determine the first token, the first token is a token that authorizes a first service for a first user; determine the first token according to the first request.

[0390] In some possible embodiments, the processing unit 1202 is also used to: send a first response to the terminal through the interface unit 1201, the first response is used to indicate one of the following: successful revocation of the first token, the process of revoking the first token has been triggered, or the first request has been received, the first response includes a random number or second information, and the second information is obtained based on a one-way function and a random number.

[0391] Optionally, the processing unit 1202 is further used to: receive second information from the terminal through the interface unit 1201, where the second information is obtained based on a one-way function and a random number; and match the second information with the first token.

[0392] In some possible embodiments, the processing unit 1202 is also used to: send a notification message to the application software programming interface caller through the interface unit 1201, the notification message is used to indicate one of the following: successful revocation of the first token, the process of revoking the first token has been triggered, or the first request has been received, and the notification message includes indication information of the first token.

[0393] Optionally, the processing unit 1202 is further used to: send an authorization code corresponding to the first token to the terminal through the interface unit 1201.

[0394] Exemplarily, the processing unit 1202 is further used to: revoke the first token; or, send a second request to the authorization function network element through the interface unit 1201, where the second request is used to request to revoke the first token.

[0395] In some possible embodiments, the processing unit 1202 is further used to: receive, through the interface unit 1201, a first request sent by the terminal according to the address information of the authorization function network element; or, receive, through an application software programming interface caller, a first request from the terminal.

[0396] In yet another embodiment, the communication device 1200 is applied to Fig.10 The terminal in the embodiment of the present application is shown. The specific functions of the processing unit 1202 in this implementation are introduced below.

[0397] The processing unit 1202 is used to: receive third information through the interface unit 1201, the third information is used to indicate that the authorization to be revoked is the first authorization allowing the first user to use the first service; detect a second operation of the first user, the second operation is used to indicate that the first user agrees to revoke the first authorization; send fourth information through the interface unit 1201, the fourth information is used to trigger the revocation of the first authorization.

[0398] In some possible embodiments, the processing unit 1202 is further configured to: before receiving the third information, send a third request through the interface unit 1201, where the third request includes indication information of the first service.

[0399] In yet another embodiment, the communication device 1200 is applied to Fig.10 The third device in the embodiment of the present application is shown below. The specific functions of the processing unit 1202 in this implementation are introduced below.

[0400] The processing unit 1202 is used to: send third information to the terminal through the interface unit 1201, the third information is used to indicate that the authorization to be revoked is the first authorization that allows the first user to use the first service; receive fourth information sent by the terminal based on the second operation of the first user through the interface unit 1201, the second operation is used to indicate that the first user agrees to revoke the first authorization, and the fourth information is used to trigger the revocation of the first authorization.

[0401] In some possible embodiments, the processing unit 1202 is further configured to: receive a third request from the terminal through the interface unit 1201, where the third request includes indication information of the first service.

[0402] In some examples, the processing unit 1202 is further used to: send fifth information to the application software programming interface caller through the interface unit 1201, and the fifth information is used to revoke the first authorization.

[0403] For a more detailed description of the processing unit 1202 and the interface unit 1201, please refer to Figure 3 and Figure 5 The relevant description in the method embodiment shown is directly obtained and will not be repeated here.

[0404] It should be noted that the division of modules in the above embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0405] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0406] Based on the same technical concept, the embodiments of the present application are Fig.13 A communication device is provided as shown, which can be used to execute the relevant steps in the above method embodiments. The communication device can be a terminal, an API caller, a device including an API caller (for example, a terminal or AF) or an AzF, or a module applied to a terminal, an API caller, a device including an API caller or an AzF, such as a chip, a chip system or a processor, or a logical node, a logical module or software that can implement all or part of the functions of a terminal, an API caller, a device including an API caller or an AzF. In addition, the communication device can implement the communication method provided in the above embodiments and examples of the present application, having Fig.12 The functions of the communication device shown. Fig.13 As shown, the communication device 1300 includes: a processor 1302. Optionally, the communication device 1300 also includes: an interface circuit 1301 and a memory 1303. The interface circuit 1301, the processor 1302 and the memory 1303 are coupled to each other.

[0407] Optionally, the interface circuit 1301, the processor 1302 and the memory 1303 are coupled to each other via a bus 1304. The bus 1304 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0408] The interface circuit 1301 is used to input and / or output information. When outputting information, the interface circuit 1301 can output information to other devices outside the communication device 1300, or can output information to other units in the communication device 1300. Exemplarily, the interface circuit 1301 can be implemented by at least one of a physical interface, a communication module, a communication interface, an input / output interface, and a mobile communication module. The mobile communication module may include one or more of at least one antenna, at least one filter, a switch, a power amplifier, an LNA, etc.

[0409] The processor 1302 may be used to support the communication device 1300 in executing the processing actions in the above method embodiment. When the communication device 1300 is used to implement the above method embodiment, the processor 1302 may also be used to implement the functions of the above processing unit 1202. The processor 1302 may be a CPU, or other general-purpose processors, DSPs, ASICs, FPGAs, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, or any conventional processor.

[0410] In one embodiment, the communication device 1300 is applied to Figure 3 The terminal in the embodiment of the present application is shown. The specific functions of the processor 1302 in this implementation are introduced below.

[0411] The processor 1302 is used to: determine first information, the first information is used to determine a first token, the first token is a token that authorizes a first service for a first user; send a first request through the interface circuit 1301, the first request includes first information, and the first request is used to request revocation of the first token.

[0412] In another embodiment, the communication device 1300 is applied to Figure 3 The first device in the embodiment of the present application is shown. The specific functions of the processor 1302 in this implementation are introduced below.

[0413] The processor 1302 is used to: receive a first request from the terminal through the interface circuit 1301, the first request is used to request the revocation of the first token, the first request includes first information, the first information is used to determine the first token, the first token is a token that authorizes the first service for the first user; determine the first token according to the first request.

[0414] In yet another embodiment, the communication device 1300 is applied to Fig.10 The terminal in the embodiment of the present application is shown. The specific functions of the processor 1302 in this implementation are introduced below.

[0415] The processor 1302 is used to: receive third information through the interface circuit 1301, the third information is used to indicate that the authorization to be revoked is the first authorization allowing the first user to use the first service; detect a second operation of the first user, the second operation is used to indicate that the first user agrees to revoke the first authorization; send fourth information through the interface circuit 1301, the fourth information is used to trigger the revocation of the first authorization.

[0416] In yet another embodiment, the communication device 1300 is applied to Fig.10The third device in the embodiment of the present application is shown. The specific functions of the processor 1302 in this implementation are introduced below.

[0417] The processor 1302 is used to: send third information to the terminal through the interface circuit 1301, the third information is used to indicate that the authorization to be revoked is the first authorization that allows the first user to use the first service; receive fourth information sent by the terminal based on the second operation of the first user through the interface circuit 1301, the second operation is used to indicate that the first user agrees to revoke the first authorization, and the fourth information is used to trigger the revocation of the first authorization.

[0418] The specific functions of the processor 1302 may refer to the description of the communication method provided in the above embodiments and examples of the present application, and Fig.12 The specific functional description of the communication device 1200 in the embodiment of the present application is not repeated here.

[0419] The memory 1303 is used to store program instructions and / or data, etc. Specifically, the program instructions may include program codes, and the program codes include computer operation instructions. The memory 1303 may include RAM, and may also include non-volatile memory (non-volatile memory), such as at least one disk storage. The processor 1302 executes the program instructions stored in the memory 1303, and uses the data stored in the memory 1303 to implement the above functions, thereby realizing the communication method provided in the above embodiment of the present application. The memory 1303 can be integrated with the processor 1302, or it can be a memory outside the communication device.

[0420] It is understandable that this application Fig.13The memory 1303 in can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. Among them, the non-volatile memory can be a ROM, a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a RAM, which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (DoubleData Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (Synchlink DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM). It should be noted that memory of the systems and methods described herein is intended to comprise, without being limited to, these and any other suitable types of memory.

[0421] Based on the above embodiments, the embodiments of the present application further provide a computer program product including computer executable instructions. When the computer program product is run, the method provided in the above embodiments is executed.

[0422] Based on the above embodiments, the embodiments of the present application further provide a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a computer, the computer executes the method provided in the above embodiments.

[0423] The storage medium may be any available medium that can be accessed by a computer. For example, but not limited to, a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer.

[0424] Based on the above embodiments, an embodiment of the present application further provides a chip, which is used to read a computer program stored in a memory to implement the method provided in the above embodiments.

[0425] Based on the above embodiments, the embodiments of the present application provide a chip system, which includes a processor for supporting a computer device to implement the functions involved in each device in the above embodiments. In a possible design, the chip system also includes a memory, which is used to store the necessary programs and data for the computer device. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0426] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0427] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0428] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0429] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0430] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0431] In the various embodiments of the present application, unless otherwise specified or provided for in any logical conflict, the terms and / or descriptions between the different embodiments are consistent and may be referenced to each other, and the technical features in the different embodiments may be combined to form new embodiments according to their inherent logical relationships.

[0432] In this application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of this application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0433] It is understood that the various numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic.

[0434] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: include: The terminal determines first information, where the first information is used to determine a first token, where the first token is a token for authorizing a first user to provide a first service; The terminal sends a first request, where the first request includes the first information, and the first request is used to request revocation of the first token.

2. The method according to claim 1, characterized in that The first information includes a random number, and the random number is used to determine the first token.

3. The method according to claim 2, characterized in that The random number is used to determine second information through a one-way function, and the second information is used to determine the first token.

4. The method according to claim 2 or 3, characterized in that Also includes: The terminal receives a first response, where the first response is used to indicate one of the following: successful revocation of the first token, triggering of the process for revoking the first token, or receipt of the first request, and the first response includes the random number or second information, where the second information is obtained based on a one-way function and the random number.

5. The method according to any one of claims 2 to 4, characterized in that: Also includes: The terminal generates the random number and second information, where the second information is obtained according to a one-way function and the random number; The terminal sends the second information to the authorization function network element, where the second information corresponds to the first token.

6. The method according to claim 5, characterized in that Before the terminal generates the random number and the second information, the method further includes: The terminal detects a first operation of the first user, where the first operation is used to indicate that the first user agrees to authorize the first service to the first user.

7. The method according to claim 1, characterized in that The first information includes auxiliary information for identifying the first token.

8. The method according to claim 7, characterized in that The auxiliary information includes at least one of the following: information for identifying the authorization scope of the first token; Information for identifying a service application software programming interface corresponding to the first token; Information used to identify the authorization function network element corresponding to the first token; information for identifying the first user; Information for identifying an open function of an application software programming interface corresponding to the first token; information for identifying the validity period of the first token; Information for identifying the issuance time of the first token.

9. The method according to claim 7 or 8, characterized in that Also includes: The terminal detects a first operation of the first user, where the first operation is used to indicate that the first user agrees to authorize the first service to the first user; The terminal acquires and stores the auxiliary information.

10. The method according to claim 9, characterized in that Also includes: The terminal receives an authorization code corresponding to the first token, where the authorization code is used to determine that the first token corresponding to the auxiliary information is a token authorized by an authorization function network element.

11. The method according to claim 1, characterized in that The first information includes an authorization code corresponding to the first token.

12. The method according to claim 11, characterized in that Also includes: The terminal receives an authorization code corresponding to the first token from an authorization function network element.

13. The method according to claim 11 or 12, characterized in that The first request also includes: indication information of the first user, and the indication information of the first user and the first information are used to determine the first token.

14. The method according to any one of claims 1 to 13, characterized in that The terminal sends a first request, including at least one of the following: The terminal sends the first request to the authorization function network element according to the address information of the authorization function network element; or The terminal sends the first request to the authorization function network element through an application software programming interface caller.

15. A communication method, characterized in that: include: Receiving a first request from a terminal, the first request being used to request the revocation of a first token, the first request comprising first information, the first information being used to determine the first token, the first token being a token for authorizing a first user to provide a first service; According to the first request, the first token is determined.

16. The method according to claim 15, characterized in that The first information includes a random number, and the random number is used to determine the first token.

17. The method according to claim 16, characterized in that The random number is used to determine second information through a one-way function, and the second information is used to determine the first token.

18. The method according to claim 16 or 17, characterized in that Also includes: A first response is sent to the terminal, where the first response is used to indicate one of the following: successful revocation of the first token, triggering of the process for revoking the first token, or receipt of the first request, and the first response includes the random number or second information, where the second information is obtained based on a one-way function and the random number.

19. The method according to any one of claims 16 to 18, characterized in that Also includes: receiving second information from the terminal, where the second information is obtained according to a one-way function and the random number; The second information is matched with the first token.

20. The method according to any one of claims 16 to 19, characterized in that Also includes: A notification message is sent to the caller of the application software programming interface, where the notification message is used to indicate one of the following: successful revocation of the first token, triggering of the process of revoking the first token, or receipt of the first request, and the notification message includes indication information of the first token.

21. The method of claim 15, wherein: The first information includes auxiliary information for identifying the first token.

22. The method according to claim 21, characterized in that The auxiliary information includes at least one of the following: information for identifying the authorization scope of the first token; Information for identifying a service application software programming interface corresponding to the first token; Information used to identify the authorization function network element corresponding to the first token; information for identifying the first user; Information for identifying an open function of an application software programming interface corresponding to the first token; information for identifying the validity period of the first token; Information for identifying the issuance time of the first token.

23. The method of claim 15, wherein: The first information includes an authorization code corresponding to the first token.

24. The method of claim 23, wherein: Also includes: An authorization code corresponding to the first token is sent to the terminal.

25. The method according to claim 23 or 24, characterized in that The first request also includes: indication information of the first user, and the indication information of the first user and the first information are used to determine the first token.

26. The method according to any one of claims 15 to 25, characterized in that Also includes: Revoking the first token; or, A second request is sent to the authorization function network element, where the second request is used to request revocation of the first token.

27. The method according to any one of claims 15 to 26, characterized in that Receiving a first request from a terminal includes at least one of the following: receiving the first request sent by the terminal according to the address information of the authorization function network element; or The first request from the terminal is received through an application software programming interface caller.

28. A communication device, characterized in that: include: A communication unit for receiving and sending information; A processing unit, configured to execute the method according to any one of claims 1 to 27 through the communication unit.

29. A communication device, characterized in that: comprising a processor configured to execute the method according to any one of claims 1 to 27.

30. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is executed, the method according to any one of claims 1 to 27 is implemented.

Images