Service access method and device of network function, electronic equipment and storage medium

Abstract

The invention discloses a service access method and device of a network function, applied to a first network function, the service access method comprises the following steps: sending an authentication request file to an authentication center; the authentication request file at least carries a credibility measurement value of the first network function; under the condition that an authentication certificate which is sent by the authentication center and passes authentication of the authentication request file is received, carrying the trusted measurement value to execute registration application operation on a network storage library function; and under the condition of receiving notification information which is sent by the network storage library function and indicates that the first network function is successfully registered, executing service access operation with the second network function by utilizing the credibility measurement value. According to the technical scheme provided by the embodiment of the invention, the message access between network functions can be ensured to be carried out in a trusted environment, and the security risk that a core network is attacked is avoided.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communications, and in particular to a method and device for accessing a network function service. Background Art

[0002] In some mobile communication technologies, such as the fifth generation mobile communication technology (5G), support for network function virtualization (NFV) is required. The NFV architecture requires software to run on general hardware, and the gradual sinking of core network services may lead to the direct deployment of some network functions (NF) to the edge side. In the 5G system architecture, all control plane NFs are located on a bus, which means that all control plane NFs use the same protocol stack, requiring mutual authentication and authorization of message legitimacy for interactions between NFs.

[0003] In some current solutions, NF supports the secure transport layer protocol (TLS) with both server-side and client-side certificates, so as to authenticate each other between NFs. It is optional to authorize the legitimacy of the message based on tokens or local policies, but NF only authenticates whether it is legal. This strategy can ensure that the NF entity completes the legitimacy authentication of both NFs in an environment that has not been tampered with, and then authorizes the legitimacy of the access message. The current message legitimacy authorization scheme is to authenticate the legitimacy of both NFs through TLS two-way authentication. Then, if token-based authorization is selected, NF needs to register in the Network Repository Function (NRF). Among them, after the consumer NF requests an access token from NRF, it accesses the service provider NF through the access token. If token-based authorization is not used, the service provider NF should also check the authorization of the consumer NF based on the local policy before granting access to the consumer NF to ensure the legitimacy of the consumer NF and the access message.

[0004] In the 5G communication system, each NF in the core network is deployed in a virtualized manner. When there are vulnerabilities in the system, there is a risk of the system being attacked. Although the identity and access information are authenticated and authorized during the access process between NFs, there is no security risk assessment and authentication of the environment in which the entire authorization process runs. In addition, some NFs are deployed in insecure environments, there are differences in understanding of security protocol implementations, and they are maliciously infected in specific circumstances. Even NFs within the trust domain are at risk. Summary of the invention

[0005] In order to solve the above technical problems, the embodiments of the present application provide a service access method and device for a network function.

[0006] In a first aspect, an embodiment of the present application provides a service access method for a network function, the service access method comprising:

[0007] Sending an authentication request file to an authentication center; the authentication request file carries at least a trust metric value of the first network function; the authentication request file is used by the authentication center to perform an authentication operation on the authentication request file;

[0008] Upon receiving the authentication certificate sent by the authentication center that authenticates the authentication request file, carrying the trust metric value to perform a registration application operation to the network repository function;

[0009] Upon receiving notification information of successful registration of the first network function sent by the network repository function, performing a service access operation with the second network function using the trust metric value;

[0010] The first network function is a consumer network function, and the second network function is a service provider network function; or, the first network function is a service provider network function, and the second network function is a consumer network function.

[0011] In a second aspect, an embodiment of the present application provides a service access device for a network function, the service access device being applied to a first network function, the service access device comprising:

[0012] A sending unit, configured to send an authentication request file to an authentication center; the authentication request file carries at least a trust metric value of the first network function; the authentication request file is used by the authentication center to perform an authentication operation on the authentication request file;

[0013] A registration application unit, configured to carry the trust metric value and perform a registration application operation to a network repository function upon receiving an authentication certificate sent by the authentication center indicating that the authentication request file has been authenticated;

[0014] The service access unit is configured to perform a service access operation with the second network function by using the trust metric value.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory stores computer executable instructions, and when the processor runs the computer executable instructions on the memory, the service access method of the network function described in the above embodiment can be implemented.

[0016] In a fourth aspect, an embodiment of the present application provides a computer storage medium having executable instructions stored thereon, which, when executed by a processor, implements a service access method that can implement the network functions described in the above embodiments.

[0017] The technical solution of the embodiment of the present application introduces a trusted metric as a part of the legitimacy authorization of the access message during the legitimacy authentication process of both NFs. First, the trusted computing environment of the NF is authenticated by the authentication center based on the trusted metric value of the NF. After the authentication center authenticates the trusted metric value of the NF, the NF applies for registration to the network repository function and performs a service access operation with the second network function with the trusted metric value authenticated by the authentication center. The authenticated trusted metric value is used in the subsequent registration application of the NF to the network repository function and the service access operation with the second network function. The authenticated trusted metric value meets the requirements of the corresponding security level and can ensure that the message access is carried out in a trusted environment, thereby avoiding the security risk of the core network being attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Schematic diagram of the process of the service access method of the network function provided in the embodiment of the present application Figure 1 ;

[0019] Figure 2 A schematic diagram of the certification application process provided for the embodiment of the present application;

[0020] Figure 3 A schematic diagram of a registration process for a first network function provided in an embodiment of the present application;

[0021] Figure 4 A schematic diagram of the application process for a service access token provided in an embodiment of the present application;

[0022] Figure 5 A schematic diagram of a service access process for a network function provided in an embodiment of the present application;

[0023] Figure 6 Schematic diagram of the process of the service access method of the network function provided in the embodiment of the present application Figure 2 ;

[0024] Figure 7 A flowchart of network function registration and application for service access token in a roaming scenario provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of a service access process of a network function in a roaming scenario provided in an embodiment of the present application;

[0026] Fig. 9A schematic diagram of the structural composition of a service access device for a network function provided in an embodiment of the present application;

[0027] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0029] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not necessarily need to be defined or explained in the subsequent drawings.

[0030] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0031] The technical solution of the embodiment of the present application provides a scheme for legitimacy authentication of NF and legitimacy authorization of access messages in a trusted environment by introducing a trusted metric value. The scheme of the embodiment of the present application first performs local trusted measurement on NF. For example, the network security level protection policy is used to take the first, second, third and fourth level requirements of the secure computing environment, trusted root and trusted verification of NF as the trusted metric value of NF, and then the trusted metric value of NF is authenticated by the authentication center. After the authentication is passed, the message legitimacy authorization process is performed. The authenticated trusted metric values ​​used in the subsequent message legitimacy authorization process are all met. The authenticated trusted metric values ​​meet the requirements of the corresponding network security level. For example, the fourth level of security protection requires dynamic trusted verification in all execution links of NF local applications. In the distributed deployment and heterogeneous scenarios of different manufacturers, the authenticated trusted metric avoids the situation where the subsequent service access link fails to meet the security requirements of this level, resulting in the distortion or counterfeiting of the NF process.

[0032] Next, the service access method of the network function provided in the embodiment of the present application is introduced.

[0033] The following Table 1 is a comparison table of Chinese, English and English abbreviations of the relevant terms involved in the embodiments of the present application.

[0034] Table 1 Comparison table of Chinese, English and English abbreviations of relevant terms

[0035] Chinese expression Complete English statement English abbreviations Network Features Network Function NF Consumer Network Features Consumer Network Function CNF Service Provider Network Functionality Provider Network Function PNF Network repository functionality Network Repository Function NRF Transport Layer Security Transport Layer Security TLS Network Function Virtualization Network Function Virtualization NFV Certification Center Certificate Authority CA Public Land Mobile Network Public Land Mobile Network PLMN Access domain network repository functionality Visit Network Repository Function vNRF Home domain network repository function Home Network Repository Function hNRF Access Domain Security Edge Protection Agent Visit Security Edge Protection Proxy vSEPP Home Domain Security Edge Protection Agent Home Security Edge Protection Proxy hSEPP

[0036] Figure 1 Schematic diagram of the process of the service access method of the network function provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, the service access method of the network function is applied to the first network function, comprising the following steps:

[0037] S101: Send a certification request file to the certification center.

[0038] In an embodiment of the present application, the authentication request file carries at least the trust metric value of the first network function; the authentication request file is used by the authentication center to perform an authentication operation on the authentication request file.

[0039] In an embodiment of the present application, after the authentication center authenticates the authentication request file sent by the first network function, it sends an authentication certificate that authenticates the first network function to the first network function.

[0040] In the embodiment of the present application, the CA may be a root CA or a CA of any level, which is used to protect the credibility of the NF after its authentication.

[0041] Below, Figure 2Take this as an example to introduce the authentication request process of network functions. Figure 2 As shown, the authentication request process of the network function NF includes the following steps:

[0042] S201: NF generates a public-private key pair, confirms the application information, and generates an authentication request file.

[0043] NF generates a public-private key pair locally to confirm the application information. In addition to the general information such as domain name / applicant / public key, the application information also needs to add fields in the extension items of the application information and add the NF's trust measurement value as one of the application information, and then generate an authentication request file based on the application information.

[0044] Trusted metrics can ensure the integrity of the NF system and ensure that the NF system or software runs in the trusted state expected by the design goal. Trusted metrics are the identification of trusted metrics level requirements. Trust is not the same as security, but it is the basis of security. Because security solutions and policies can only further ensure security purposes when they run in an environment that has not been tampered with, and can be discovered in time after being attacked and changed. Trust is ensured by using algorithms and keys in the underlying trusted hardware as the trusted root and measuring and verifying the software stack step by step.

[0045] S202: CA reviews the certification request document and signs the certificate after passing the review.

[0046] CA reviews the information contained in the certification request file online or offline, and returns it if the review fails. After the review passes, the certificate plain text information is hashed after adding the issuing agency, validity period and other information, and then signed with the local private key. The CA's review process for the trusted metric value first needs to review the NF's local underlying hardware trusted root's immutability as the basis for the high-level security level, and then the hardware layer security virtualization is transmitted to the entire target environment to form a security system that combines software and hardware. Secondly, according to the level defined by the trusted metric value, such as distinguishing between system boot programs, important configuration parameters and programs, key execution links of applications, all applications and execution links, intrusion identification, etc., the matching of authentication and mapping to the corresponding level is verified.

[0047] For the CA offline audit method, for example, CA can check the chips used by the NF's physical host, such as which manufacturers' and which models of CPU chips meet the requirements of the corresponding level of trusted computing environment. It can also be similar to the commercial password authentication method, first perform authentication tests on the corresponding physical entity, and then after passing the corresponding trust level, the CA center will issue a certificate.

[0048] For the CA online audit method, for example, a third-party certification agency can first conduct an offline audit of the NF's trust level, and then give a thing similar to a U-shield to the physical machine manufacturer. When the NF uses the physical machine, it uses the private key in the U-shield to sign the trust level in the certificate. If the CA center verifies it with the public key, it is considered that the trust verification has passed.

[0049] In the embodiment of the present application, the CA can perform offline certification assessment based on its own capabilities, or it can use the assessment report of the authoritative three-party assessment structure as the basis for certification. The embodiment of the present application does not limit the CA's audit method for the trust metric value, but it is necessary to ensure that the trust metric value that has passed the audit is authentic and reliable; in addition, the embodiment of the present application does not limit the granularity of the definition and division of the trust metric value, and the trustworthiness of the trust chain can be divided according to the specific application security requirements of the network.

[0050] S203: CA issues a certification certificate, including the certificate signature and certificate plain text information.

[0051] CA issues an authentication certificate, which can return the certificate plain text information and signed information to NF.

[0052] S102: Upon receiving the authentication certificate sent by the authentication center indicating that the authentication request file has been authenticated, carry the trust metric value to perform a registration application operation to the network repository function.

[0053] In an embodiment of the present application, after the first network function requests authentication from the authentication center and passes the authentication, the first network function further performs a registration process in the network repository function.

[0054] In an optional implementation manner of the present application, the first network function performs a registration application operation to the network repository function through the following steps 1-1) to 1-3):

[0055] Step 1-1): Carrying the trust metric value to perform a secure transport layer protocol TLS two-way authentication with a network repository function; wherein, after the network repository function completes the TLS authentication of the first network function, the trust metric value of the first network function is stored in a local storage area of ​​the network repository function;

[0056] Step 1-2): When the TLS two-way authentication with the network repository function is completed, a registration request is sent to the network repository function; the registration request includes at least one of the following information of the first network function: type information, identification information, and registration additional information; wherein the registration additional information includes at least one of the following information: type information, identification information, and a trusted metric value of the network function corresponding to the first network function; the registration request is used by the network repository function to store various information included in the registration request into a local storage area of ​​the network repository function, and to generate a local policy corresponding to the first network function according to various information included in the registration request information; the local policy includes at least one of the following: limited information on the trusted metric value of the network function corresponding to the first network function, limited information on the trusted metric value of the network function corresponding to the first network function according to the type and / or identification of the first network function, and limited information on the trusted metric value of the network function corresponding to the first network function generated according to a preset access type;

[0057] Step 1-3): Receive notification information sent by the network storage repository function indicating successful registration of the first network function.

[0058] Below, Figure 3 Take the following as an example to introduce the registration process of network functions. Figure 3 As shown, the registration process of the network function includes the following steps:

[0059] S301: NF and NRF perform mutual TLS authentication, including authentication of trusted metrics.

[0060] When NF makes a registration request to NRF, it needs to first perform a two-way TLS authentication with NRF. During the two-way authentication process, one end uses the certificate public key to verify the hash value of the certificate, and then hashes the plain text information of the other end's certificate. If the hash value of the certificate obtained by the signature verification is the same as the value of the local hash calculation of the plain text information, the authentication of the other end is successful. After NRF authenticates NF, it stores the authenticated trust metric value of NF locally.

[0061] S302: NF submits a registration request to NRF with registration information, registration additional information, etc.

[0062] NF submits a registration request to NRF, and the registration request carries registration information such as NF type and ID to NRF for registration. Optionally, if the NF to be registered is PNF, PNF registers additional information to NRF, and the additional information can be the type, ID, and trust metric value of the CNF that PNF requires it to provide service access.

[0063] S303: NRF stores the trust measurement value, registration information and additional information locally and generates local policies.

[0064] NRF registers NF, and NRF locally stores the authenticated trust values, registration information, and registration additional information of NF and generates local policies. Local policies include the trust values ​​of CNF requiring the corresponding PNF, the trust values ​​of PNF requiring the corresponding CNF, the trust values ​​of the other end limited by the registered NF type / ID, and the trust value requirements of CNF and PNF generated according to the core network service access type.

[0065] S304: NRF returns registration success information to NF.

[0066] After NF is successfully registered, NRF returns registration success information to NF.

[0067] In the embodiment of the present application, the authentication center is first used to authenticate the trusted computing environment of the NF based on the trusted metric value of the NF. After the authentication center authenticates the trusted metric value of the NF, the NF applies for registration to the NRF with the trusted metric value authenticated by the authentication center. This can ensure that the process of NF registering with the NRF is carried out in a trusted environment, avoiding the risk of the core network being attacked during the process of NF registering with the NRF.

[0068] S103: Upon receiving notification information of successful registration of the first network function sent by the network repository function, perform a service access operation with the second network function using the trust metric value.

[0069] In an embodiment of the present application, the first network function is a consumer network function (i.e., CNF), and the second network function is a service provider network function (i.e., PNF); or, the first network function is a service provider network function (i.e., PNF), and the second network function is a consumer network function (i.e., CNF).

[0070] In one implementation, when the first network function is a consumer network function and the second network function is a service provider network function, the step S103 includes the following steps:

[0071] Step 2-1): carrying the trust metric value to the network repository function to apply for a service access token;

[0072] Step 2-2): upon receiving the service access token sent by the network repository function, perform a service access request operation for the second network function by carrying the service access token.

[0073] In the embodiment of the present application, the authentication center is first used to authenticate the trusted computing environment of the NF based on the trusted metric value of the NF. After the authentication center authenticates the trusted metric value of the NF, the NF applies for registration with the NRF with the trusted metric value authenticated by the authentication center. After completing the registration with the NRF, the authenticated trusted metric value is continued to be used to execute the process of applying for a service access token from the NRF and the process of accessing the service to the peer network function. This can ensure that the process of applying for a service access token from the NRF and the process of accessing the service to the peer network function are carried out in a trusted environment, avoiding the risk of the core network being attacked.

[0074] In the embodiment of the present application, when the first network function is a CNF, after successfully registering with the network repository function, the first network function further applies to the network repository function for a service access token.

[0075] In an optional implementation manner of the present application, the first network function applies for a service access token from the network repository function through the following steps 3-1) to 3-2):

[0076] Step 3-1): Send a service access token request message to the network repository; wherein the service access token request message includes at least one of the following information of the first network function: identification information, type information, service name of the corresponding second network function, instance information of the corresponding second network function, and limitation information of the trust metric value of the corresponding second network function; the service access token request message is used by the network repository function to check whether the various information contained in the service access token request message complies with the local policy, and if the various information contained in the service access token request message complies with the local policy, generate a service access token and send the service access token to the first network function; wherein the service access token includes declaration information, and the declaration information includes the identification information of the instance of the network repository function service, the identification information of the instance of the first network function, the type information of the second network function, the service name information of the second network function, and the time limitation information;

[0077] Step 3-2): Receive the service access token sent by the network repository function.

[0078] Below, Figure 4 Taking this as an example, the process of applying for a service access token for a network function is introduced.

[0079] like Figure 4 As shown in the figure, the application process of the service access token of the network function includes the following steps:

[0080] S401: NF initiates a service access token request to NRF, optionally carrying expected NF trust metric value requirement information.

[0081] Taking the NF as CNF as an example, CNF initiates a service access token request to NRF, carrying information such as CNF's NF instance ID, CNF's NF type, expected NF service name and expected PNF instance to NRF for access token application. Optionally, it can carry the primary service PLMN ID, expected PNF trust metric value requirements, etc.

[0082] S402: Perform local policy check for legal authorization, token generation and digital signature on the service access token request.

[0083] NRF performs a local policy check on the legal authorization of CNF's service access token request, including checking the CNF and PNF instances of the service, checking the trusted metric value requirements of the CNF and PNF of the service, etc. The trusted metric value requirement check includes whether the CNF applying for access meets the trusted metric requirements of the PNF to be accessed, whether it meets the trusted metric requirements of the type / ID, and whether it meets the trusted metric requirements of the service access type, whether the PNF to be accessed meets the trusted metric requirements of the CNF applying for access, whether it meets the trusted metric requirements of the type / ID, and whether it meets the trusted metric requirements of the service access type, etc.; then generates an access token containing appropriate declarations, and the declarations in the token should include the instance ID of NRF, the instance ID of CNF, the NF type of PNF, the expected service name and expiration time; NRF digitally signs the generated access token based on a shared key or a private key.

[0084] S403: NRF returns the authorized service access token to NF.

[0085] After NRF legally authorizes the service access token request, it returns the authorized service access token to CNF.

[0086] In an embodiment of the present application, using a trusted measurement value authenticated by an authentication center to execute the process of applying for a service access token from NRF can ensure that the process of applying for a service access token from NRF is performed in a trusted environment, thereby avoiding the risk of the core network being attacked.

[0087] S104: Upon receiving the service access token sent by the network repository function, perform a service access request operation for the second network function by carrying the service access token.

[0088] In the embodiment of the present application, when the first network function is a CNF, after applying for a service access token from the network repository function, the first network function further initiates an access request to the second network function.

[0089] In an optional implementation manner of the present application, the first network function initiates an access request to the second network function through the following steps 4-1) to 4-3).

[0090] Step 4-1): Carrying the trust metric value to perform TLS mutual authentication with the second network function;

[0091] Step 4-2): When the TLS two-way authentication between the second network function and the second network function is completed, a first access service request is sent to the second network function; the first access service request includes the service access access token, and the first access service request is used by the second network function to verify the legitimacy of various information contained in the service access access token, and when the legitimacy of various information contained in the service access access token is verified, service access success information is sent to the first network function, and the service requested by the first network function is executed and responded to;

[0092] Step 4-3): Receive the service access success information sent by the second network function and the service data sent by the second network function.

[0093] Below, Figure 5 Taking the example of FIG. 1 as an example, the process of applying for service access request of the first network function is introduced.

[0094] like Figure 5 As shown, the first network function applies for service access from the second network function including the following steps:

[0095] S501: CNF and PNF perform mutual TLS authentication.

[0096] Before CNF requests PNF for access service, the request message includes TLS two-way authentication information, and CNF and PNF perform two-way TLS authentication. For the specific authentication process, see S301.

[0097] Here, CNF is the first network function and PNF is the second network function.

[0098] S502: The CNF carries the service access token and requests the PNF to access the service.

[0099] The CNF carries the service access token to request access service from the PNF and sends a first access service request message;

[0100] S503: The PNF performs a validity verification and a local policy check on the service access token.

[0101] PNF verifies the legitimacy of the service access token, uses the token public key or shared key of NRF to verify the hash value of the access token, and then hashes the plaintext information of the CNF access token. If the hash value of the token obtained by verification is the same as the value after the local hash calculation of the plaintext information, the legitimacy of the token is authenticated. Based on the legal token declaration information and local policy, PNF checks whether the identity of the token issuer NRF matches the subject in the NRF certificate, whether the token subject declaration matches the subject in the CNF certificate, whether the token audience declaration matches its own PNF identity type, whether the requested service operation matches, whether the trusted measurement value of the CNF certificate and the trusted measurement value requirements for its own PNF in the token match the service, and verifies the expiration time in the access token based on the current data / time to check whether the access token has expired.

[0102] S504: After the PNF is successfully verified, it executes the requested service and responds to the CNF.

[0103] After successful verification by the PNF, the requested service is executed and the CNF is responded to, returning service access success information.

[0104] In an embodiment of the present application, using a trusted metric value authenticated by an authentication center to execute a process of applying for service access to a second network function can ensure that the process of applying for service access to a second network function is performed in a trusted environment, thereby avoiding the risk of the core network being attacked.

[0105] In one implementation, when the first network function is a service provider network function and the second network function is a consumer network function, the step S103 includes the following steps:

[0106] Step 5-1): upon receiving a TLS mutual authentication request sent by a second network function, carrying the trust metric value to perform TLS mutual authentication with the second network function;

[0107] Step 5-2): When the TLS two-way authentication with the second network function is completed, if a second access service request sent by the second network function is received, verify the legitimacy of each piece of information in the service access token of the second network function contained in the second access service request;

[0108] Step 5-3): After verifying that all information in the service access token of the second network function contained in the second access service request is legal, send service access success information to the second network function, and execute and respond to the service requested by the second network function.

[0109] In an embodiment of the present application, when the first network function is a PNF, after successfully registering with the network repository function, the first network function can receive a TLS two-way authentication request from a second network function, and after completing the TLS two-way authentication request with the second network function, if an access service request from the second network function is received, the service access request of the second network function is further verified and the service data is responded to, etc.

[0110] In an embodiment of the present application, when the first network function is a PNF and the second network function is a CNF, when the first network function receives an access service request from the second network function, it can verify the reliability of the second network function based on the trust metric value of the first network function, thereby ensuring that service access with the second network function is carried out in a trusted environment, avoiding the risk of the core network being attacked, and ensuring the data security of the core network.

[0111] The technical solution of the embodiment of the present application introduces a trusted metric as a part of the legitimacy authorization of the access message during the legitimacy authentication process of both NF parties. First, the trusted computing environment of the NF is authenticated by the authentication center based on the trusted metric value of the NF. After the authentication is passed, the message legitimacy authorization process (including the registration process with NRF, the process of applying for a service access token from NRF, and the process of accessing the service to the peer network function) is carried out. The trusted metric values ​​used in the message legitimacy authorization process are all authenticated. The authenticated trusted metric values ​​meet the requirements of the corresponding security level and can ensure that the message access is carried out in a trusted environment, thereby avoiding the security risk of the core network being attacked.

[0112] The embodiment of the present application introduces the authenticated trust metric value as the trust root of all levels of trusted policies, protecting the inherent security, active immunity and active defense capabilities of any level based on the trusted computing environment after the authenticated trust metric; the core network network function service introduces the trust metric value as a policy check at any level including but not limited to the authentication, registration, access and other processes; the embodiment of the present application introduces trusted computing locally in the network function that stores or generates sensitive data to ensure that it is always in a trusted environment when generating and transmitting relevant data. Adopting the underlying hardware trusted computing, measuring step by step, trusting one level at a time, until the local system is safely started, the security of the entire platform and operating system is guaranteed, and a trusted operating environment is provided for the application.

[0113] Figure 6 Schematic diagram of the process of the service access method of the network function provided in the embodiment of the present application Figure 2 . Figure 6 The solution involves the process of service access of network functions in roaming scenarios. Figure 6 As shown, the service access of the network function in the roaming scenario includes the following steps:

[0114] S601: The first network function of the access domain sends an authentication request file to the authentication center.

[0115] Here, the first network function of the access domain sends an authentication request file to the authentication center, the authentication center authenticates the information included in the authentication request file, and the process of the authentication center sending the authentication certificate to the first network function of the access domain is the same as the above step S201, which will not be repeated here.

[0116] S602: Upon receiving the authentication certificate sent by the authentication center indicating that the authentication request file has been authenticated, the first network function of the access domain carries the trust metric value and performs a registration application operation to the network repository function of the access domain.

[0117] When the first network function is a network function of a visited domain, the second network function is a network function of a home domain, and the visited domain and the home domain are networks in different areas, the first network function of the visited domain carries the trusted metric value to perform a registration application operation to a network repository function of the visited domain.

[0118] In an embodiment of the present application, after the first network function of the access domain requests authentication from the authentication center and passes, it further performs a registration process in the network storage repository function of the access domain.

[0119] In an optional implementation manner of the present application, the first network function of the visited domain performs a registration application operation to the network storage repository function of the visited domain through the following steps 6-1) to 6-3):

[0120] 6-1): Carrying the trust metric value to perform TLS mutual authentication with the network repository function of the access domain; wherein, after the network repository function of the access domain completes the TLS authentication of the first network function of the access domain, the trust metric value of the first network function of the access domain is stored in the local storage area of ​​the network repository function of the access domain;

[0121] 6-2): When the TLS mutual authentication between the access domain and the network repository function is completed, a registration request is sent to the network repository function of the access domain; the registration request is used for the network repository function of the access domain to store various information included in the registration request into the local storage area of ​​the network repository function of the access domain, and to generate a local policy corresponding to the first network function of the access domain according to various information included in the registration request information;

[0122] 6-3): Receive notification information sent by the network storage repository function of the visited domain indicating that the first network function of the visited domain has been successfully registered.

[0123] In an embodiment of the present application, after completing the registration of the first network function of the visited domain, the network repository function of the visited domain performs TLS two-way authentication with the network repository function of the belonging domain, and after completing the TLS two-way authentication with the network repository function of the belonging domain, sends the various information stored in the local storage area of ​​the network repository function of the visited domain according to the registration request and the generated local policy to the network repository function of the belonging domain.

[0124] Figure 7 Steps S701 to S702 in FIG. 7 are steps for vCNF to apply for registration with vNRF in a roaming scenario.

[0125] S701: vCNF accesses PLMN to register.

[0126] That is, vCNF registers with vNRF.

[0127] S702: NRFs of the visited PLMN and the home PLMN perform mutual TLS authentication.

[0128] That is, mutual TLS authentication is performed between vNRF and hNRF.

[0129] In the roaming scenario, before vCNF accesses the service of hPNF, it needs to apply for a service access token in hNRF. Before applying for a service access token, vCNF needs to complete registration with vNRF, and vNRF and hNRF need to complete mutual authentication.

[0130] In the embodiment of the present application, in a roaming scenario, the trusted computing environment of the NF of the access domain is first authenticated by the authentication center based on the trusted metric value of the NF of the access domain. After the authentication center authenticates the trusted metric value of the NF of the access domain, the NF of the access domain applies for registration to the NRF of the access domain with the trusted metric value authenticated by the authentication center. This ensures that the process of the NF of the access domain registering with the NRF of the access domain is carried out in a trusted environment, avoiding the risk of the core network being attacked during the process of the NF of the access domain registering with the NRF of the access domain.

[0131] S603: Upon receiving the notification information of successful registration of the first network function of the visited domain from the network repository function of the visited domain, the first network function of the visited domain carries the trust metric value to apply for a service access token from the network repository function of the home domain.

[0132] In the embodiment of the present application, after the first network function of the visited domain is registered in the network repository function of the visited domain, it further applies to the network repository function of the home domain for a service access token.

[0133] In an optional implementation manner of the present application, the first network function of the visited domain applies for a service access token from the network repository function of the home domain through the following steps 7-1) to 7-2):

[0134] Step 7-1): Send service access token request information to the network repository of the visited domain; the service access token request information is used by the network repository of the visited domain to send the service access token request information to the network repository function of the home domain when checking that each piece of information included in the service access token request information complies with the local policy of the network repository of the visited domain; the network repository function of the home domain is used to generate a service access token and send the service access token to the first network function of the visited domain via the network repository function of the visited domain when checking that each piece of information included in the service access token request information complies with the local policy of the network repository of the home domain;

[0135] Step 7-2): Receive the service access token sent by the network repository function of the access domain.

[0136] Figure 7 Steps S703 to S706 in FIG. 7 are the process of vCNF applying for a service access token from hNRF in a roaming scenario.

[0137] S703: vCNF makes a service access token request to vNRF.

[0138] S704: vNRF submits a token request to hNRF for a service access token.

[0139] S705: Token generation and digital signature.

[0140] S706: hNRF returns the authorized service access token to vNRF.

[0141] S707: vNRF returns the authorized service access token to vCNF.

[0142] The embodiment of the present application is based on the CNF application process for service access token in a roaming scenario in a trusted environment, which is similar to the non-roaming scenario, and adds vNRF to check authorization and bridge.

[0143] In an embodiment of the present application, in a roaming scenario, the first network function of the visited domain uses the trusted metric value authenticated by the authentication center to execute the process of applying for a service access token from the NRF of the home domain, which can ensure that the process of applying for a service access token from the NRF of the home domain is carried out in a trusted environment, avoiding the risk of the core network being attacked.

[0144] S604: When receiving the service access token sent by the network storage repository function of the home domain, the first network function of the visited domain carries the service access token to perform a service access request operation for the second network function of the home domain.

[0145] In the embodiment of the present application, after the first network function of the visited domain applies for a service access token from the network storage repository function of the home domain, the first network function of the visited domain applies for service access from the second network function of the home domain.

[0146] In an optional implementation manner of the present application, the first network function of the visited domain applies for service access to the second network function of the home domain through the following steps 8-1) to 8-2):

[0147] Step 8-1): Sending a first access service request to the second network function of the home domain via the visited domain security edge protection proxy SEPP and the home domain SEPP; the first access service request includes the service access access token, and the first access service request is used by the second network function of the home domain to verify the legitimacy of various information contained in the service access access token, and when the various information contained in the service access access token is verified to be legal, sending service access success information to the first network function of the visited domain via the visited domain SEPP and the home domain SEPP, and executing and responding to the service requested by the first network function of the visited domain;

[0148] Step 8-2): Receive the service access success information sent by the home domain second network function via the visited domain SEPP and the home domain SEPP and the service data returned by the home domain second network function.

[0149] In the roaming scenario, after the vCNF completes the application process for the service access token, the vCNF carries the service access token to request access to the home domain PNF. The vCNF request for access to the service in the roaming scenario based on the trusted environment is similar to that in the non-roaming scenario, with the optional addition of a secure edge protection proxy SEPP as the border gateway between the PLMN core network control plane to provide application layer control plane security.

[0150] Below, Figure 8 Taking the vCNF service access request process as an example, this paper introduces the vCNF service access request process. Figure 8 As shown, the vCNF applies for service access from the hPNF, including the following steps:

[0151] S801: The vCNF carries the service access token and requests the hPNF to access the service.

[0152] S802: hPNF performs legitimacy verification and local policy check on the service access token.

[0153] S803: After the hPNF is successfully verified, it executes the requested service and responds to the vCNF.

[0154] In the embodiment of the present application, vCNF needs to access the home domain, so it needs to meet the authorization and policy requirements of the home domain. The application for access token needs to be applied to the hNRF of the home domain, and the hPNF that needs to access the home domain needs to be accessed. Based on the trusted environment, the CNF in the roaming scenario requests access to the service, which is similar to the process in the non-roaming scenario, ensuring the trustworthiness of the CNF and PNF accessed in the roaming scenario, and improving the security level in the roaming scenario.

[0155] In the embodiment of the present application, CNF always includes the measurement and verification of the trusted environment (i.e., the measurement and verification of the trusted measurement value) in the service access process. This method can ensure that CNF, NRF and PNF are in the interaction process, such as when it involves sensitive and secure data interaction and process interaction in the service, to ensure that the core network system operates in a trusted state.

[0156] In the embodiment of the present application, the NF used to store or generate sensitive data uses a trusted measurement value as a prerequisite for the generation and transmission of relevant sensitive data, ensuring that the NF access service is performed in a trusted environment, avoiding the situation where only the identity and access information of the NF is authenticated and authorized, but the security risk assessment and authentication of the environment in which the NF runs during the entire authorization process is not performed, resulting in the security risk of the core network being attacked after the NF is maliciously infected under certain circumstances.

[0157] The embodiment of the present application monitors all execution links of the trusted process in real time, and issues an alarm when it detects that the trustworthiness verification fails or is damaged. It can also generate audit records based on the trusted verification results and send them to a dedicated security management center, thereby achieving real-time dynamic correlation perception of the trusted environment.

[0158] Fig. 9 A schematic diagram of the structure of a service access device 900 for a network function provided in an embodiment of the present application, wherein the service access device 900 is applied to a first network function, and the service access device 900 includes:

[0159] A sending unit 901 is used to send an authentication request file to an authentication center; the authentication request file carries at least a trust metric value of the first network function; the authentication request file is used by the authentication center to perform an authentication operation on the authentication request file;

[0160] A registration application unit 902 is used to carry the trust metric value to perform a registration application operation to a network repository function when receiving an authentication certificate sent by the authentication center that authenticates the authentication request file;

[0161] The service access unit 903 is configured to perform a service access operation with the second network function by using the trust metric value.

[0162] The first network function is a consumer network function, and the second network function is a service provider network function; or, the first network function is a service provider network function, and the second network function is a consumer network function.

[0163] In one embodiment, when the first network function is a consumer network function and the second network function is a service provider network function, the service access unit 903 is used to carry the trust metric value to apply for a service access token to the network repository function; and when receiving the service access token sent by the network repository function, carry the service access token to perform a service access request operation for the second network function.

[0164] In one embodiment, the service access unit 903 is used to send a service access token request message to the network repository; wherein the service access token request message includes at least one of the following information of the first network function: identification information, type information, a service name of a corresponding second network function, instance information of a corresponding second network function, and limitation information of a trust metric value of a corresponding second network function; the service access token request message is used by the network repository function to check whether each information contained in the service access token request message complies with the local policy, and if the information contained in the service access token request message complies with the local policy, generate a service access token and send the service access token to the first network function; wherein the service access token includes declaration information, and the declaration information includes identification information of an instance of the network repository function service, identification information of an instance of the first network function, type information of the second network function, service name information of the second network function, and time limitation information; and receive the service access token sent by the network repository function.

[0165] In one embodiment, the service access unit 903 is used to carry the trusted metric value to perform TLS two-way authentication with the second network function; when the TLS two-way authentication with the second network function is completed, a first access service request is sent to the second network function; the first access service request includes the service access access token, and the first access service request is used by the second network function to verify the legitimacy of each information contained in the service access access token, and when the legitimacy of each information contained in the service access access token is verified, service access success information is sent to the first network function, and the service requested by the first network function is executed and responded; and the service access success information sent by the second network function and the service data sent by the second network function are received.

[0166] In one embodiment, when the first network function is a service provider network function and the second network function is a consumer network function, the service access unit 903 is used to carry the trust metric value to perform TLS two-way authentication with the second network function when receiving a TLS two-way authentication request sent by the second network function; when completing the TLS two-way authentication with the second network function, if a second access service request sent by the second network function is received, verify the legitimacy of each item of information in the service access access token of the second network function contained in the second access service request; when verifying that each item of information in the service access access token of the second network function contained in the second access service request is legal, send service access success information to the second network function, and execute and respond to the service requested by the second network function.

[0167] In one embodiment, the registration application unit 902 is used to carry the trusted metric value to perform a secure transport layer protocol TLS two-way authentication with a network repository function; wherein, after the network repository function completes the TLS authentication of the first network function, the trusted metric value of the first network function is stored in a local storage area of ​​the network repository function; when the TLS two-way authentication with the network repository function is completed, a registration request is sent to the network repository function; the registration request includes at least one of the following information of the first network function: type information, identification information, and registration additional information; wherein the registration additional information includes at least one of the following information: type information of the network function corresponding to the first network function, identification information, a trustworthy metric value; the registration request is used by the network repository function to store various information included in the registration request into a local storage area of ​​the network repository function, and to generate a local policy corresponding to the first network function according to various information included in the registration request information; the local policy includes at least one of the following: limiting information on the trustworthy metric value of the network function corresponding to the first network function, limiting information on the trustworthy metric value of the network function corresponding to the first network function according to the type and / or identification of the first network function, and limiting information on the trustworthy metric value of the network function corresponding to the first network function generated according to a preset access type; receiving notification information of successful registration of the first network function sent by the network repository function.

[0168] In one embodiment, when the first network function is a consumer network function of a visited domain, the second network function is a service provider network function of a home domain, and the visited domain and the home domain are networks in different regions, the registration application unit 902 is used to carry the trust metric value to perform TLS mutual authentication with the network repository function of the visited domain; wherein, after the network repository function of the visited domain completes the TLS authentication of the first network function of the visited domain, the trust metric value of the first network function of the visited domain is stored in a local storage area of ​​the network repository function of the visited domain; when the TLS mutual authentication with the network repository function of the visited domain is completed, a registration request is sent to the network repository function of the visited domain; the registration request is used for the network repository function of the visited domain to store various information included in the registration request in the local storage area of ​​the network repository function of the visited domain, and to generate a local policy corresponding to the first network function of the visited domain according to various information included in the registration request information; and receive notification information sent by the network repository function of the visited domain that the first network function of the visited domain is successfully registered.

[0169] In one embodiment, after completing the registration of the first network function of the access domain, the network repository function of the access domain performs TLS mutual authentication with the network repository function of the home domain, and after completing the TLS mutual authentication with the network repository function of the home domain, sends the various information stored in the local storage area of ​​the network repository function of the access domain according to the registration request and the generated local policy to the network repository function of the home domain; the service access unit 903 is used to send service access access token request information to the network repository of the access domain; the service access access token request information is used for the network repository of the access domain to send the service access access token request information to the network repository function of the home domain when checking that the various information contained in the service access access token request information complies with the local policy of the network repository of the access domain, and the network repository function of the home domain is used to generate a service access access token and send the service access access token to the first network function of the access domain via the network repository function of the access domain when checking that the various information contained in the service access access token request information complies with the local policy of the network repository of the home domain; and receive the service access access token sent by the network repository function of the access domain.

[0170] In one embodiment, the service access unit 903 is used to send a first service access service request to the second network function of the home domain via the access domain security edge protection proxy SEPP and the home domain SEPP; the first access service request includes the service access access token, and the first access service request is used by the second network function of the home domain to verify the legitimacy of each information contained in the service access access token, and when verifying that the each information contained in the service access access token is legitimate, send service access success information to the first network function of the access domain via the access domain SEPP and the home domain SEPP, and execute and respond to the service requested by the first network function of the access domain; receive the service access success information sent by the second network function of the home domain via the access domain SEPP and the home domain SEPP and the service data returned by the second network function of the home domain.

[0171] Those skilled in the art should understand that Fig. 9 The implementation functions of each unit in the service access device for the network function shown can be understood by referring to the relevant description of the aforementioned service access method for the network function. Fig. 9 The functions of each unit in the service access device for network functions shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0172] An embodiment of the present application also provides an electronic device. Fig.10 Schematic diagram of the hardware structure of the electronic device of the embodiment of the present application, such as Fig.10 As shown, the electronic device includes: a communication component 1003 for data transmission, at least one processor 1001, and a memory 1002 for storing a computer program that can be run on the processor 1001. The various components in the terminal are coupled together through a bus system 1004. It can be understood that the bus system 1004 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0173] When the processor 1001 executes the computer program, at least Figure 1 or Figure 6 The steps of the service access method of the network function shown.

[0174] It can be understood that the memory 1002 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 1002 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0175] The method disclosed in the above embodiment of the present application can be applied to the processor 1001, or implemented by the processor 1001. The processor 1001 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 1001 or an instruction in the form of software. The above processor 1001 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1001 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 1002, and the processor 1001 reads the information in the memory 1002, and completes the steps of the service access method of the aforementioned network function in combination with its hardware.

[0176] In an exemplary embodiment, the electronic device can be implemented by one or more application-specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general-purpose processor, controller, MCU, microprocessor, or other electronic components to perform the service access method of the aforementioned network function.

[0177] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the program is at least used to execute when executed by a processor Figure 1 or Figure 6 The computer readable storage medium may be a memory. The memory may be Fig.10 Memory 1002 is shown.

[0178] The technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0179] In the several embodiments provided in the present application, it should be understood that the disclosed methods and intelligent devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0180] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0181] In addition, all functional units in the embodiments of the present application may be integrated into a second processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0182] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A service access method for a network function, characterized in that: The method is applied to a first network function, and the service access method includes: Sending an authentication request file to an authentication center; the authentication request file carries at least a trust metric value of the first network function; Upon receiving the authentication certificate sent by the authentication center that authenticates the authentication request file, carrying the trust metric value to perform a registration application operation to the network repository function; Upon receiving notification information of successful registration of the first network function sent by the network repository function, performing a service access operation with the second network function using the trust metric value; The first network function is a consumer network function, and the second network function is a service provider network function; or, the first network function is a service provider network function, and the second network function is a consumer network function.

2. The method according to claim 1, characterized in that In a case where the first network function is a consumer network function and the second network function is a service provider network function, performing a service access operation with the second network function by using the trusted metric value includes: Carrying the trust metric value, applying for a service access token to the network repository function; In case of receiving the service access token sent by the network repository function, a service access request operation for a second network function is performed by carrying the service access token.

3. The method according to claim 2, characterized in that The operation of carrying the trust metric value to apply for a service access token from the network repository function includes: Sending a service access token request message to the network repository; wherein the service access token request message includes at least one of the following information of the first network function: identification information, type information, service name of the corresponding second network function, instance information of the corresponding second network function, and limitation information of the trust metric value of the corresponding second network function; the service access token request message is used by the network repository function to check whether each information contained in the service access token request message complies with the local policy, and if the information contained in the service access token request message complies with the local policy, generate a service access token and send the service access token to the first network function; wherein the service access token includes declaration information, and the declaration information includes identification information of the instance of the network repository function service, identification information of the instance of the first network function, type information of the second network function, service name information of the second network function, and time limitation information; The service access token sent by the network repository function is received.

4. The method according to claim 2, characterized in that: The carrying the service access access token to perform a service access request operation for a second network function includes: Carrying the trust metric value to perform TLS mutual authentication with the second network function; When the TLS two-way authentication with the second network function is completed, a first access service request is sent to the second network function; the first access service request includes the service access access token, and the first access service request is used by the second network function to verify the legitimacy of various information contained in the service access access token, and when the legitimacy of various information contained in the service access access token is verified, service access success information is sent to the first network function, and the service requested by the first network function is executed and responded to; Receive service access success information sent by the second network function and service data sent by the second network function.

5. The method according to claim 1, characterized in that In a case where the first network function is a service provider network function and the second network function is a consumer network function, the using the trusted metric value to perform a service access operation with the second network function includes: When receiving a TLS mutual authentication request sent by a second network function, carrying the trust metric value to perform TLS mutual authentication with the second network function; In the case of completing the TLS two-way authentication with the second network function, if a second access service request sent by the second network function is received, verifying the legitimacy of various information in the service access access token of the second network function contained in the second access service request; After verifying that each piece of information in the service access token of the second network function included in the second access service request is legal, a service access success message is sent to the second network function, and the service requested by the second network function is executed and responded to.

6. The method according to any one of claims 1 to 5, characterized in that The step of carrying the trustworthy metric value to the network repository function to perform a registration application operation includes: Carrying the trust metric value to perform a secure transport layer protocol TLS two-way authentication with a network repository function; wherein, after the network repository function completes the TLS authentication of the first network function, the trust metric value of the first network function is stored in a local storage area of ​​the network repository function; In the case of completing the TLS two-way authentication with the network repository function, sending a registration request to the network repository function; the registration request includes at least one of the following information of the first network function: type information, identification information, and registration additional information; wherein the registration additional information includes at least one of the following information: type information, identification information, and a trusted metric value of the network function corresponding to the first network function; the registration request is used by the network repository function to store various information included in the registration request into a local storage area of ​​the network repository function, and to generate a local policy corresponding to the first network function according to various information included in the registration request information; the local policy includes at least one of the following: limiting information on the trusted metric value of the network function corresponding to the first network function, limiting information on the trusted metric value of the network function corresponding to the first network function limited according to the type and / or identification of the first network function, and limiting information on the trusted metric value of the network function corresponding to the first network function generated according to a preset access type; Receive notification information sent by the network storage repository function indicating successful registration of the first network function.

7. The method according to claim 2, characterized in that In the case where the first network function is a consumer network function of a visited domain, the second network function is a service provider network function of a home domain, and the visited domain and the home domain are networks in different regions, performing a registration application operation to a network repository function by carrying the trust metric value includes: Carrying the trust metric value to perform TLS two-way authentication with the network repository function of the visited domain; wherein, after the network repository function of the visited domain completes the TLS authentication of the first network function of the visited domain, the trust metric value of the first network function of the visited domain is stored in the local storage area of ​​the network repository function of the visited domain; In the case of completing the TLS two-way authentication with the network repository function of the access domain, sending a registration request to the network repository function of the access domain; the registration request is used for the network repository function of the access domain to store various information included in the registration request into a local storage area of ​​the network repository function of the access domain, and to generate a local policy corresponding to the first network function of the access domain according to various information included in the registration request information; Receive notification information sent by the network storage repository function of the visited domain that the first network function of the visited domain is successfully registered.

8. The method according to claim 7, characterized in that The network repository function of the visited domain performs TLS mutual authentication with the network repository function of the home domain after completing the registration of the first network function of the visited domain, and after completing the TLS mutual authentication with the network repository function of the home domain, sends the various information stored in the local storage area of ​​the network repository function of the visited domain according to the registration request and the generated local policy to the network repository function of the home domain; The operation of carrying the trust metric value to apply for a service access token from the network repository function includes: Sending a service access token request message to the network repository of the visited domain; the service access token request message is used by the network repository of the visited domain to send the service access token request message to the network repository function of the home domain when checking that each piece of information contained in the service access token request message complies with the local policy of the network repository of the visited domain; the network repository function of the home domain is used to generate a service access token and send the service access token to the first network function of the visited domain via the network repository function of the visited domain when checking that each piece of information contained in the service access token request message complies with the local policy of the network repository of the home domain; The service access token sent by the network repository function of the access domain is received.

9. The method according to any one of claims 7 or 8, characterized in that The carrying the service access access token to perform a service access request operation for a second network function includes: Sending a third access service request to the second network function of the home domain via the visited domain security edge protection proxy SEPP and the home domain SEPP; the third access service request includes the service access access token, and the third access service request is used by the second network function of the home domain to verify the legitimacy of various information contained in the service access access token, and when verifying that various information contained in the service access access token is legal, sending service access success information to the first network function of the visited domain via the visited domain SEPP and the home domain SEPP, and executing and responding to the service requested by the first network function of the visited domain; Receive service access success information sent by the home domain second network function via the visited domain SEPP and the home domain SEPP and service data returned by the home domain second network function.

10. A service access device for a network function, characterized in that: The service access device is applied to the first network function, and the service access device includes: A sending unit, configured to send an authentication request file to an authentication center; the authentication request file carries at least a trust metric value of the first network function; A registration application unit, configured to carry the trust metric value and perform a registration application operation to a network repository function upon receiving an authentication certificate sent by the authentication center indicating that the authentication request file has been authenticated; a service access unit, configured to, upon receiving notification information of successful registration of the first network function sent by the network repository function, perform a service access operation with the second network function using the trust metric value; The first network function is a consumer network function, and the second network function is a service provider network function; or, the first network function is a service provider network function, and the second network function is a consumer network function.

11. An electronic device, characterized in that: The electronic device comprises: a memory and a processor, wherein the memory stores computer executable instructions, and the processor can implement any one of claims 1 to 9 when executing the computer executable instructions on the memory.

12. A computer storage medium, characterized in that: The storage medium stores executable instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 9.

Images