Identity verification method and device

Abstract

The invention discloses an identity verification method and device, which can improve the automation degree of certificate issuing. The method comprises the following steps: a client obtains address information of a first network element and an identifier of the first network element and sends a certificate reservation request to a first server, and the certificate reservation request comprises the address information of the first network element; the first server sends challenge information (which can be understood as a response to the certificate reservation request) to the client, including a token for performing an authentication challenge for the first network element. And the client determines first information (response information of challenge information) according to the first key authorization and the identifier of the first network element, wherein the first information is used for proving that the client has the control right of address information of the first network element. Wherein the first key authorization is determined according to the token and an account key of the client. And the first server obtains the first information from the second server, and issues a certificate including the identifier of the first network element to the first network element when determining that the client has the control right of the address information of the first network element according to the first information.

Description

[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on September 8, 2023, with application number 202311160171.6 and application name “A Method and Device for Identity Verification”, all contents of which are incorporated by reference in this application. Technical Field

[0002] The embodiments of the present application relate to the field of communications, and in particular to an identity verification method and device. Background Art

[0003] In the service-based architecture (SBA) under the 3rd generation partnership project (3GPP) scenario, in order to realize the automated management of network function (NF) certificates, an initial trust needs to be established between the NF and the operator's certification authority (CA) so that the operator CA can verify the identity of the NF.

[0004] At present, in order to establish the initial trust between NF and the operator CA, it is necessary to pre-deploy a private CA (i.e., Private CA) in the security domain of NF and pre-set the root certificate of the private CA in the operator CA. Alternatively, it is necessary to issue an initial credential (such as a one-time random number) to the NF through an offline method. In other words, the current solution requires more preparation work, resulting in a low degree of automation in certificate management. Summary of the invention

[0005] The embodiments of the present application provide an identity verification method and device, which can improve the degree of automation of certificate issuance and reduce the complexity of certificate issuance.

[0006] In the first aspect, an identity verification method is provided, which can be executed by a client, or by a component of the client, such as a processor, chip, or chip system of the client, or by a logic module or software that can implement all or part of the client functions. The method includes: obtaining the address information of the first network element and the identifier of the first network element, the address information includes a domain name or an Internet Protocol IP address; sending a certificate reservation request to a first server, the certificate reservation request includes the address information of the first network element; receiving challenge information from the first server, the challenge information includes a token, and the token is used to perform an identity authentication challenge for the first network element; determining response information to the challenge information based on the first key authorization and the identifier of the first network element, the response information is used to prove that the client has control over the address information of the first network element, and the first key authorization is determined based on the token and the client's account key.

[0007] Based on this solution, the client determines the information used to prove that the client has the control right of the address information (such as domain name or IP address) of the network element according to the key authorization and the identification of the network element, so that the first server can verify whether the client has the control right of the domain name or IP address of the network element. If the verification is successful, the first server can believe that the client can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believes that the identification of the network element is also legal, and thus believes that the identity verification of the certificate subject has passed, and then issues a certificate to the network element.

[0008] In addition, the address information is the identifier of the network element at the IP layer, which is carried at the IP layer, not at the application layer. If the application layer wants to obtain the address information, it needs to interact with the IP layer to obtain the address information from the IP layer, but this involves the interaction between the upper and lower layer protocol stacks, and the network element may not support this function. If the network element is to support this function, the implementation complexity of the network element is increased. In the present application, the identifier of the network element can be the application layer identifier of the network element. Using the identifier of the network element as the identity identifier of the certificate subject can enable the network element to be recognized by other network elements at the application layer, compared to using the address information as the identity identifier of the network element, thereby facilitating the application layer data interaction between network elements. Compared with enabling the network element to support the interaction between the upper and lower layer protocol stacks, the implementation complexity of the network element is reduced.

[0009] Furthermore, in the process of verifying whether the client has control over the address information of the network element, since the information used to verify the control right (i.e., the response information of the challenge information) is determined based on the key authorization and the identification of the network element, and the key authorization is determined based on the token provided by the first server, there is no need to pre-establish initial trust between the client and the first server, and no need to perform related deployment work in advance, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0010] In one possible design, the response information of the challenge information includes a first string, which is a value constructed based on the first key authorization and the identifier of the first network element. The method also includes: using the first string as a resource under a first path of the address information, and the first path is determined based on the token.

[0011] In one possible design, the response information of the challenge information includes a first string, which is a value constructed based on the first key authorization and the identifier of the first network element. The method also includes: using the first string as a text record of a verification address, where the verification address is determined based on the address information of the first network element.

[0012] In one possible design, the response information of the challenge information includes a self-signed certificate of the client, and the self-signed certificate includes a first field and a second field. The first field carries the address information of the first network element, and the second field carries the first string, which is a value constructed according to the first key authorization and the identifier of the first network element; or, the first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

[0013] In one possible design, the first field is a subject alias field, and the second field is a protocol identification field.

[0014] In one possible design, the method also includes: obtaining a certificate issued by the first server to the first network element, the certificate including an identifier of the first network element.

[0015] In one possible design, obtaining the address information of the first network element and the identifier of the first network element includes: obtaining the address information of the first network element and the identifier of the first network element from a second network element. The second network element is at least one of the following: a certificate management function CMF network element, a certificate management network function CMNF network element, a network storage function NRF network element, an operation management and maintenance OAM network element, a network function virtualization management and orchestration NFV MANO network element, a first network element, or a client.

[0016] In the second aspect, an identity verification method is provided, which can be executed by a first server, or by a component of the first server, such as a processor, chip, or chip system of the first server, or by a logic module or software that can implement all or part of the functions of the first server. The method includes: sending a request message to a second server, the request message is used to request first information corresponding to a first network element, the first information is used to prove that the client has control over the address information of the first network element; receiving first information from the second server, the first information includes an identifier of the first network element corresponding to the address information of the first network element, the identifier of the first network element is a unique identity identifier of the first network element; when it is determined according to the first information that the client has control over the address information of the first network element, a certificate is issued to the first network element, the certificate includes the identifier of the first network element.

[0017] Based on this solution, the first server can verify whether the client has control over the domain name or IP address of the network element. If the verification is successful, the first server can believe that the client can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believes that the identifier of the network element is also legal, and thus believes that the identity verification of the certificate subject has passed, and then issues a certificate to the network element. In the process of verifying whether the client has control over the address information of the network element, it is usually not necessary to pre-establish initial trust between the client and the first server, and there is no need to perform related deployment work in advance, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0018] In addition, the second server is used to store information for verifying the control right of the address information, so the second server can be a server related to the address information, such as a common HTTP server or DNS server. In other words, the second server can be an ordinary common network element in the network, and there is no need to deploy a dedicated network element (such as a private CA) for certificate issuance, thereby further improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0019] In one possible design, the first information further includes a third string. The client has control over the address information of the first network element, including: the third string is the same as the second string, the second string is determined based on a second key authorization, the second key authorization is determined based on a token and an account key of the client, and the token is used to perform an identity authentication challenge of the first network element.

[0020] Based on this possible design, since the information (second character string) used to verify the control right is determined based on the second key authorization, and the second key authorization is determined based on the identification of the token and the network element, the token can be provided by the first server. Therefore, there is no need to pre-establish initial trust between the client and the first server, and no need to perform related deployment work in advance, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0021] In one possible design, the first information includes an identifier of the first network element corresponding to the address information of the first network element, including: the first information includes a self-signed certificate of the client, and the self-signed certificate includes a first field and a second field. The first field carries the address information of the first network element, and the second field carries a first string, which is a value constructed based on the first key authorization and the identifier of the first network element; or, the first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

[0022] In a possible design, when the first field carries the address information of the first network element and the second field carries the first string, the client has control over the address information of the first network element, including: the third string is the same as the second string. The third string is determined based on the first string, the second string is determined based on the second key authorization, the second key authorization is determined based on the token and the client's account key, and the token is used to perform an identity authentication challenge for the first network element.

[0023] In a possible design, when the first field carries the identifier of the first network element and the second field carries the first key authorization or the summary of the first key authorization, the client has control over the address information of the first network element, including: the first key authorization and the second key authorization are the same, or the summary of the first key authorization and the summary of the second key authorization are the same. The second key authorization is determined based on the token and the account key of the client, and the token is used to perform the identity authentication challenge of the first network element.

[0024] In one possible design, the method further includes: receiving an account key of the client from the client.

[0025] In one possible design, before sending a request message to the second server, the method also includes: receiving a certificate reservation request from the client, the certificate reservation request including address information of the first network element; sending challenge information to the client, the challenge information including a token, the token is used to perform an identity authentication challenge for the first network element, and the first information is response information to the challenge information.

[0026] In one possible design, issuing a certificate to a first network element includes: receiving a certificate issuance request from a client, the certificate issuance request including an identifier of the first network element and / or address information of the first network element; and issuing a certificate to the first network element in response to the certificate issuance request.

[0027] In the third aspect, an identity verification method is provided, which can be executed by a second server, or by a component of the second server, such as a processor, chip, or chip system of the second server, or by a logic module or software that can implement all or part of the functions of the second server. The method includes: obtaining the address information of the first network element and the identifier of the first network element, the address information includes a domain name or an Internet Protocol IP address; receiving information from the client for determining the authorization of the first key; determining a text record of the verification address based on the first key authorization and the identifier of the first network element, the verification address is determined based on the address information of the first network element, and the text record of the verification address is used to prove that the client has control over the address information of the first network element.

[0028] Based on this solution, the second server determines the information used to prove that the client has the control right of the address information (such as domain name or IP address) of the network element according to the key authorization and the identification of the network element, so that the first server can verify whether the client has the control right of the domain name or IP address of the network element. If the verification is successful, the first server can believe that the client can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believes that the identification of the network element is also legal, and thus believes that the identity verification of the certificate subject has passed, and then issues a certificate to the network element.

[0029] In the process of verifying whether the client has the control right of the address information of the network element, since the text record of the verification address is determined based on the key authorization and the identification of the network element, the key authorization can be determined based on the token provided by the first server. Therefore, there is no need to pre-establish initial trust between the client and the first server, and no need to pre-perform related deployment work, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance. In addition, the second server is used to store information for verifying the control right of address information, so the second server can be a server related to address information, such as a common or DNS server. In other words, the second server can be an ordinary and common network element in the network, and there is no need to deploy a dedicated network element (such as a private CA) for certificate issuance, thereby further improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0030] In one possible design, the method also includes: receiving a request message from the first server, the request message being used to request a text record of a verification address; and sending the text record of the verification address to the first server.

[0031] In a fourth aspect, an identity verification method is provided, which can be executed by a first server, or by a component of the first server, such as a processor, chip, or chip system of the first server, or by a logic module or software that can implement all or part of the functions of the first server. The method includes: obtaining address information of a first network element and a first identifier corresponding to the address information of the first network element, the address information being a domain name or an Internet Protocol IP address, and the first identifier being an identifier of the first network element; if the address information of the first network element is verified, issuing a certificate to the first network element, the certificate including the first identifier.

[0032] Based on this solution, the first server can verify the address information of the first network element. If the address information of the first network element is verified, the first server can believe that it can legally represent the subject (i.e., the network element) of the domain name or IP address, and therefore believe that the identifier of the network element is also legal, and thus believe that the identity verification of the certificate subject has passed, and then issue a certificate to the network element. Since it is usually not necessary to pre-establish initial trust between the client and the first server when verifying the address information, and it is not necessary to pre-deploy related work, the degree of automation of certificate issuance can be improved and the complexity of certificate issuance can be reduced.

[0033] In one possible design, obtaining address information and a first identifier of a first network element includes: receiving address information of the first network element from a client; sending first information to a second network element, where the first information is used to request an identifier corresponding to the address information of the first network element; and receiving the first identifier from the second network element.

[0034] In one possible design, the method also includes: receiving a second identifier from the client; issuing a certificate to the first network element when the address information of the first network element is verified, including: issuing a certificate to the first network element when the address information of the first network element is verified and the second identifier is the same as the first identifier.

[0035] In one possible design, the address information and the first identifier of the first network element are obtained, including: receiving the address information and the second identifier of the first network element from a client; sending second information to a second network element, the second information being used to confirm whether the second identifier is an identifier corresponding to the address information of the first network element; receiving third information from the second network element, and when the third information indicates that the second identifier is an identifier corresponding to the address information of the first network element, the second identifier is used as the first identifier.

[0036] In one possible design, obtaining the address information and the first identifier of the first network element includes: receiving the first identifier from the client; sending fourth information to the second network element, the fourth information being used to request the address information corresponding to the first identifier; and receiving the address information of the first network element from the second network element.

[0037] In one possible design, the second network element is at least one of the following: a certificate management function CMF network element, a certificate management network function CMNF network element, a network storage function NRF network element, an operation management and maintenance OAM network element, or a network function virtualization management and orchestration NFV MANO network element.

[0038] In one possible design, obtaining address information and a first identifier of a first network element includes: receiving address information of the first network element from a client; and determining the first identifier based on the address information of the first network element and a correspondence between the address information and the identifier.

[0039] In a fifth aspect, an identity verification method is provided, which can be executed by a first server, or by a component of the first server, such as a processor, a chip, or a chip system of the first server, or by a logic module or software that can implement all or part of the functions of the first server. The method includes: verifying the address information of the first network element. When the address information of the first network element is verified, the identifier of the first network element is determined according to the address information of the first network element, and a certificate is issued to the first network element, the certificate including the identifier of the first network element. The address information of the first network element is a domain name or an Internet Protocol IP address.

[0040] In a sixth aspect, an identity verification method is provided, which can be executed by a second network element, or by a component of the second network element, such as a processor, a chip, or a chip system of the second network element, or can be implemented by a logic module or software that can implement all or part of the functions of the second network element. The method includes: receiving an address information certificate of a first network element, the address information certificate including the address information of the first network element. Determine a first identifier based on the address information of the first network element, the first identifier being an identifier of the first network element. When the first identifier and the second identifier are the same, communicate with the first network element, and the second identifier is an identifier of the first network element used when the first network element and the second network element communicate. Among them, the address information is a domain name or an Internet Protocol IP address.

[0041] In one possible design, the method also includes: sending a uniform resource identifier URI to the first network element, where the URI includes a second identifier.

[0042] In one possible design, the method also includes: receiving a second identifier from a network storage function NRF network element in a service discovery process.

[0043] In one possible design, the method also includes: receiving a network function NF service request message from the first network element, the NF service request message including a second identifier.

[0044] In combination with the fifth aspect or the sixth aspect, in a possible design, when the address information of the first network element is a domain name, the address information of the first network element consists of an identifier of the first network element and at least one of the following: a mobile country code MCC, a mobile network code MNC, or a preset character string.

[0045] In combination with the fifth aspect or the sixth aspect, in a possible design, when the identifier of the first network element is an instance identifier of the first network element, the address information of the first network element satisfies the following form:

[0046] nfinanceid<NF instanceID> .mnc <mnc>.mcc <mcc>.Preset string

[0047] Among them, NF instanceID represents the identifier of the first network element.

[0048] In combination with the fifth aspect or the sixth aspect, in one possible design, the identifier of the first network element is determined by at least one of the following: the number of the first network element in the set to which the first network element belongs, the identifier of the set, the area identifier, or the type of the first network element.

[0049] In combination with the fifth aspect or the sixth aspect, in a possible design, when the address information of the first network element is an IP address, the identifier of the first network element is determined by the IP address of the first network element and at least one of the following: the number of the first network element in the set to which the first network element belongs, the identifier of the set, the area identifier, the type of the first network element, the MCC or the MNC.

[0050] In combination with the fifth aspect or the sixth aspect, in one possible design, the identifier of the first network element is the same as the address information of the first network element.

[0051] In combination with any one of the first to sixth aspects, in one possible design, the identifier of the first network element is carried in the subject alias field and / or the subject name field of the certificate.

[0052] In combination with any one of the first to sixth aspects, in a possible design, the identifier of the first network element is an instance identifier of the first network element.

[0053] In combination with any one of the first to sixth aspects, in one possible design, the client is an automatic certificate management environment (ACME) client, and the first server is an ACME server.

[0054] In a seventh aspect, a communication device is provided, which includes a unit or module, and the unit or module is used to execute any one of the methods described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, or the sixth aspect.

[0055] In an eighth aspect, a communication device is provided for implementing various methods. The communication device may be a client in the first aspect, or a device included in the client, such as a chip or a chip system; or, the communication device may be a server in the second aspect, the third aspect, the fourth aspect, or the fifth aspect, or a device included in the server, such as a chip or a chip system; or, the communication device may be a second network element in the sixth aspect, or a device included in the second network element, such as a chip or a chip system. The communication device includes a module, unit, or means corresponding to the implementation method, and the module, unit, or means may be implemented by hardware, software, or by hardware executing the corresponding software implementation. The hardware or software includes one or more modules or units corresponding to the functions.

[0056] In some possible designs, the communication device may include a processing module and a transceiver module. The processing module may be used to implement the processing function in any of the above aspects and any possible implementations thereof. The transceiver module may include a receiving module and a sending module, respectively used to implement the receiving function and the sending function in any of the above aspects and any possible implementations thereof.

[0057] In some possible designs, the transceiver module may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.

[0058] In a ninth aspect, a communication device is provided, comprising: a processor and a memory; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device executes the method described in any aspect. The communication device can be the client in the first aspect, or a device included in the client, such as a chip or a chip system; or, the communication device can be the server in the second aspect, the third aspect, the fourth aspect, or the fifth aspect, or a device included in the server, such as a chip or a chip system; or, the communication device can be the second network element in the sixth aspect, or a device included in the second network element, such as a chip or a chip system.

[0059] In a tenth aspect, a communication device is provided, comprising: a processor and a communication interface; the communication interface is used to communicate with a module outside the communication device; the processor is used to execute a computer program or instruction so that the communication device executes the method described in any aspect. The communication device can be the client in the first aspect, or a device included in the client, such as a chip or a chip system; or, the communication device can be the server in the second aspect, the third aspect, the fourth aspect, or the fifth aspect, or a device included in the server, such as a chip or a chip system; or, the communication device can be the second network element in the sixth aspect, or a device included in the second network element, such as a chip or a chip system.

[0060] In the eleventh aspect, a communication device is provided, comprising: at least one processor; the processor is used to execute a computer program or instruction stored in a memory so that the communication device performs the method described in any aspect. The memory may be coupled to the processor, or may be independent of the processor. The communication device may be the client in the first aspect, or a device included in the client, such as a chip or a chip system; or the communication device may be the server in the second aspect, the third aspect, the fourth aspect, or the fifth aspect, or a device included in the server, such as a chip or a chip system; or the communication device may be the second network element in the sixth aspect, or a device included in the second network element, such as a chip or a chip system.

[0061] In the twelfth aspect, a computer-readable storage medium is provided, in which a computer program or instruction is stored, and when the computer-readable storage medium is executed on a communication device, the communication device can execute the method described in any one of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, or the sixth aspect.

[0062] In the thirteenth aspect, a computer program product comprising instructions is provided, which, when executed on a communication device, enables the communication device to execute the method described in any one of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, or the sixth aspect.

[0063] In the fourteenth aspect, a communication device is provided (for example, the communication device may be a chip or a chip system), which includes a processor for implementing the functions involved in any one of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, or the sixth aspect.

[0064] In some possible designs, the communication device includes a memory for storing necessary program instructions and data.

[0065] In some possible designs, when the device is a chip system, it can be composed of a chip or include a chip and other discrete devices.

[0066] It can be understood that when the communication device provided in any one of the seventh to fourteenth aspects is a chip, the sending action / function of the communication device can be understood as output information, and the receiving action / function of the communication device can be understood as input information.

[0067] Among them, the technical effects brought about by any design method in the seventh to fourteenth aspects can refer to the technical effects brought about by different design methods in the first aspect or the second aspect or the third aspect or the fourth aspect or the fifth aspect or the sixth aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A schematic diagram of the system architecture for issuing a certificate provided for this application;

[0069] Figure 2 A schematic diagram of the system architecture for issuing another certificate provided for this application;

[0070] Figure 3 A schematic diagram of the process of issuing a certificate provided for this application;

[0071] Figure 4 A schematic diagram of the structure of a communication system provided for this application;

[0072] Figure 5-Figure 13 A flowchart of the identity verification method provided for this application;

[0073] Fig.14 A schematic diagram of the structure of a communication device provided by the present application;

[0074] Fig.15 A schematic diagram of the structure of another communication device provided by the present application;

[0075] Figure 16-Figure 21 A flowchart of the identity verification method provided for this application. DETAILED DESCRIPTION

[0076] In the description of this application, unless otherwise specified, " / " indicates that the objects associated with each other are in an "or" relationship. For example, A / B can represent A or B. The "and / or" in this application is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0077] In the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0078] In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

[0079] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0080] It is understood that the "embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It is understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0081] It can be understood that in this application, "when" and "if" both mean that corresponding processing will be carried out under certain objective circumstances, and do not limit the time, nor do they require any judgment action when implementing, nor do they mean the existence of other limitations.

[0082] It can be understood that some optional features in the embodiments of the present application may be implemented independently in certain scenarios without relying on other features, such as the solution on which they are currently based, to solve corresponding technical problems and achieve corresponding effects, or may be combined with other features according to needs in certain scenarios. Accordingly, the devices provided in the embodiments of the present application may also realize these features or functions accordingly, which will not be elaborated here.

[0083] In this application, unless otherwise specified, the same or similar parts between the various embodiments can refer to each other. In each implementation mode of this application, if there is no special description and logical conflict, the terms and / or descriptions between different implementation modes are consistent and can be referenced to each other, and the technical features in different implementation modes can be combined to form a new implementation mode according to their inherent logical relationships. The implementation modes of this application described below do not constitute a limitation on the scope of protection of this application.

[0084] In order to facilitate understanding of the technical solutions of the embodiments of the present application, a brief introduction to the related technologies of the present application is first given as follows.

[0085] 1. Public key infrastructure (PKI):

[0086] PKI is an infrastructure that provides security services using asymmetric cryptography theory and technology. The main function of PKI is to bind the identity of the certificate holder and the relevant key pair, provide users with convenient ways to apply for certificates, cancel certificates, obtain certificates, and query certificate status, and use digital certificates and related services (such as certificate issuance, blacklist issuance, timestamp services, etc.) to achieve identity authentication, integrity, non-repudiation and confidentiality of each entity in the communication.

[0087] In the PKI system, a digital certificate is issued by a certification authority (CA), binding the identity information and public key of a PKI user. A PKI relying party can verify the certificate chain of a PKI user with which it communicates based on the self-signed certificate of the root CA it trusts, thereby reliably obtaining the user's public key for use in various security services.

[0088] Generally, a complete PKI system should include digital certificates, CA, certificate database, certificate revocation list (CRL) / online certificate status protocol (OCSP) system, key backup and recovery system, PKI application programming interface (API) system, etc. The description of each part is shown in Table 1:

[0089] Table 1

[0090]

[0091] 2. X.509 certificate:

[0092] An X.509 certificate may refer to a digital certificate that complies with the X.509 standard. In a possible implementation, the information included in the X.509 certificate and the function of each information are shown in Table 2.

[0093] Table 2

[0094]

[0095] Among them, the subject name and subject alias can identify the identity information of the certificate holder. The subject name is a unique identifier used to identify the certificate holder in the certificate, usually including information such as the organization name, distinguished name, country / region (optional), or including host name, domain name, server (optional), etc. The subject name is the most important identifier in the certificate and is used to verify the authenticity and legitimacy of the certificate. The subject alias is an alternative identifier to the subject name, usually including information such as email address, Internet Protocol (IP) address, Domain Name System (DNS) name, etc. The purpose of the subject alias is to facilitate the use and management of certificates, and the identity information of the certificate holder can be quickly located through the subject alias.

[0096] 3. Network function (NF) instance identifier (ID):

[0097] NF can be understood as a network processing function used or defined in the service-based architecture (SBA) in the 3rd generation partnership project (3GPP) scenario. Within the SBA, the unique identity of NF is the NF instance ID. The format of NF instance ID is universal unique identifier (UUID).

[0098] In addition to the NF instance ID, the NF also has address information, which includes at least one of the following: a fully qualified domain name (FQDN), an Internet Protocol version 4 (IPv4) address, or an Internet Protocol version 6 (IPv6) address. The address information is used for mutual access between NFs.

[0099] The address information can be understood as the unique identifier of NF at the IP layer, which is carried at the IP layer but not at the application layer. The NF instance ID can be understood as the unique identifier of NF at the application layer. At the application layer, NF identifies other NFs through NF instance ID, and the identity of NF cannot be identified through address information.

[0100] For example, in actual applications, if the application layer wants to obtain address information, it needs to interact with the IP layer to obtain address information from the IP layer. However, this involves the interaction between the upper and lower layer protocol stacks, and the NF may not support this function. Therefore, the application layer allocates a unique identifier NF instance ID for the NF, and identifies the NF through the NF instance ID at the application layer.

[0101] In order to realize the automated management of NF certificates, initial trust needs to be established between NF and operator CA so that operator CA can verify the identity of NF, which is a prerequisite for the certificate registration procedure.

[0102] In one solution, Figure 1 As shown, the initial certificate can be issued by a private CA (i.e., Private CA) in the same security (trust) domain as the NF, and the NF requests the entity certificate from the operator CA based on the initial certificate. Among them, the root certificate of the private CA should be configured as the trust anchor of the operator CA, that is, the root certificate of the private CA needs to be pre-set in the operator CA.

[0103] Further, such as Figure 2 As shown, a certificate management NF can be deployed in the same security (trust) domain of the NF and the private CA. The certificate management NF can act as an agent for the NF to perform operations related to applying for certificates. The private CA can issue an initial certificate to the certificate management NF, and the certificate management NF then issues the initial certificate issued by the private CA to the NF.

[0104] For example, Figure 1 A specific certificate registration (or issuance) process under the solution shown is as follows Figure 3 shown. Figure 2 The process under the solution shown is the same as Figure 3 Similar, but different Figure 3 The actions of the NF in the process shown are implemented by the certificate management NF. Figure 3 , the process may include the following steps:

[0105] S301. The root certificate of the private CA is configured as a trust anchor in the operator CA.

[0106] S302: NF generates a public-private key pair and a certificate signing request (CSR) for the initial certificate. The CSR includes the public key in the public-private key pair.

[0107] S303, NF sends CSR to private CA. Correspondingly, private CA receives CSR from NF.

[0108] S304. The private CA signs the public key and issues an initial certificate to the NF.

[0109] S305. NF obtains an initial certificate from the private CA.

[0110] S306. NF generates a new public-private key pair for the entity certificate.

[0111] S307: NF sends a certificate enrolment request (CER) to the operator CA. Correspondingly, the operator CA receives the certificate enrolment request from NF.

[0112] The certificate registration request includes the public key generated in S306, the initial certificate obtained in S305, the ownership certificate, and the digital signature. Exemplarily, the digital signature can be obtained based on the private key generated in S302.

[0113] S308. The operator CA uses the initial certificate to verify the digital signature on the certificate registration request based on the private CA's root certificate (trust anchor), verify the consistency of the initial certificate and the identity of the requested entity certificate owner, and verify the private key ownership proof of the requested entity certificate.

[0114] S309: The operator CA sends a certificate registration response to the NF. Correspondingly, the NF receives the certificate registration response from the operator CA.

[0115] The certificate registration response includes the entity certificate and may also include the operator's public root CA certificate and a digital signature.

[0116] In another solution, an initial credential (such as a one-time random number) needs to be issued offline to the NF that applies for the entity certificate. Subsequently, the NF sends a certificate application request to the operator CA, which carries the initial credential. After receiving the certificate application request, the operator CA obtains the initial credential and verifies the identity of the NF using the correspondence between the initial credential and the NF identity that it has stored in advance. If the verification is successful, the entity certificate is issued to the NF.

[0117] However, in the first solution, it is necessary to pre-deploy a private CA in the security domain of the NF and pre-set the root certificate of the private CA in the operator CA. In the second solution, it is necessary to pre-issue an initial certificate for the NF and pre-set the correspondence between the initial certificate and the NF identity in the operator CA. In other words, the above two solutions require more preparation work, resulting in a low degree of automation in certificate management.

[0118] Based on this, the present application provides an identity verification method, which first verifies the address information (such as domain name, etc.) of the network element. If the address information verification is passed, it is considered that the identifier of the network element corresponding to the address information of the network element is also legal, so that the identity verification is considered to be passed, and then a certificate is issued to the network element. Since there is no need to establish initial trust in advance (such as pre-setting certificates, etc.) when verifying the address information of the network element, there is no need to perform related deployment work in advance, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0119] The technical solution provided in the present application can be used in various communication systems, which can be 3GPP communication systems, for example, 4th generation (4G) long term evolution (LTE) system, 5th generation (5G) new radio (NR) system, vehicle to everything (V2X) system, LTE and NR hybrid networking system, or device to device (D2D) system, machine to machine (M2M) communication system, Internet of Things (IoT), non-terrestrial network (NTN), and other next generation communication systems. The technical solution provided in the present application can be used in SBA of 3GPP communication system.

[0120] Among them, the above-mentioned communication system and architecture applicable to the present application are only examples, and the communication system applicable to the present application is not limited to this. They are uniformly described here and will not be repeated below.

[0121] See also Figure 4 , is an exemplary communication system provided by the present application. The communication system includes a client and a first server. Exemplarily, the client is used to apply for a certificate for a network element in 3GPP, and the first server is used to perform identity authentication, certificate issuance, etc. of the network element.

[0122] It should be noted that the certificate in the embodiments of the present application refers to a digital certificate. For the convenience of description, the digital certificate is referred to as a certificate in the embodiments of the present application.

[0123] In a possible implementation, a network element may also be referred to as a network function (NF). A network element may be understood as a network processing function used or defined by 3GPP. A network element may be an entity on dedicated hardware, a software instance running on dedicated hardware, or a virtualized function instantiated by a platform provider (e.g., a network function instantiated on a cloud infrastructure).

[0124] Optionally, the network element may be located in a core network or a radio access network (RAN). When the network element is located in the core network, it may be referred to as a core network network element; when it is located in the RAN, it may be referred to as an access network network element.

[0125] Exemplarily, the core network network elements may include, but are not limited to, access and mobility management function (AMF) network elements, session management function (SMF) network elements, user plane function network elements (UPF), policy control function (PCF) network elements, unified data management (UDM) network elements, unified data repository (UDR) network elements, etc.

[0126] Exemplarily, the access network element is used to provide wireless access services for terminal devices. The access network element can be an evolutionary Node B (eNB or eNodeB) in an LTE or evolved LTE system (LTE-Advanced, LTE-A), such as a traditional macro base station eNB and a micro base station eNB in ​​a heterogeneous network scenario; or it can be a next generation node B (gNodeB or gNB) in a 5G system; or it can be a transmission reception point (TRP); or it can be a base station in a future evolved public land mobile network (PLMN); or it can be a broadband network service gateway (BNG), an aggregation switch or a non-3GPP access device; or it can be a wireless controller in a cloud radio access network (CRAN); or it can be an access point (AP) in a WiFi system; or it can be a wireless relay node or a wireless backhaul node; or it can be a device that implements base station functions in IoT, V2X, D2D, or M2M.

[0127] Exemplarily, in the embodiments of the present application, the use of certificates to establish connections or communications between core network elements, between access network elements, and between core network elements and access network elements is used as an example for explanation. With the development of future technologies, the solution provided in the embodiments of the present application can also be extended to scenarios where certificates are used to establish connections or communications between access network elements and terminal devices, between terminal devices, and between terminal devices and core network elements.

[0128] Exemplarily, the terminal device has a wireless transceiver function. The terminal device can be a drone, an IoT device (e.g., a sensor, an electric meter, a water meter, etc.), a V2X device, a station (ST) in a wireless local area network (WLAN), a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA) device, a handheld device with a wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device (also referred to as a wearable smart device), a tablet computer or a computer with a wireless transceiver function, a virtual reality (VR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a smart home, a wireless terminal in a smart city, a wireless terminal in a smart home, a wireless terminal in a smart grid, a wireless terminal in a smart city, a wireless terminal in a smart home ... The invention relates to wireless terminals in the home, vehicle-mounted terminals, vehicles with vehicle-to-vehicle (V2V) communication capabilities, intelligent connected vehicles, drones with unmanned aerial vehicle (UAV) to unmanned aerial vehicle (UAV to UAV, U2U) communication capabilities, etc.

[0129] In a possible implementation, the first server can be understood as a certificate authority (CA). It can be responsible for managing the entire life cycle of the certificate, including issuing certificates, defining the validity period of certificates, revoking certificates, etc. Exemplarily, the CA can include a registration authority (RA), which is used to obtain and authenticate the user's identity and then submit a certificate issuance request to the CA. Among them, the RA can be a function integrated in the CA, or it can be deployed separately.

[0130] In a possible implementation, Figure 4 As shown, the communication system may further include a second server. The second server is used to assist the first server in verifying the user identity. Exemplarily, the second server may be a hypertext transfer protocol (HTTP) server, or the second server may be a domain name system (DNS) server, or the second server may be a transport layer security (TLS) server.

[0131] About the client deployment method:

[0132] As a first possible implementation, the client can be deployed independently. In this scenario, a secure channel can exist between the client and the authoritative network element. Exemplarily, the authoritative network element can be understood as a trusted network element or a network element with management and / or storage functions. The authoritative network element may include but is not limited to: certificate management function (CNF) network element, certificate management network function (CNMF) network element, network storage function (NRF) network element, operation administration and maintenance (OAM) network element, network functions virtualization management and orchestration (NFV MANO) network element.

[0133] As a second possible implementation, the client can be deployed in a common network element, or in other words, the client and the common network element can be co-located. Common network elements can be understood as network elements that need to apply for certificates, such as AMF network elements, SMF network elements, UPF network elements, etc. In this scenario, the actions / functions implemented by the client in the embodiment of the present application can also be understood as actions / functions implemented by common network elements.

[0134] As a third possible implementation, the client may be deployed in an authoritative network element, or in other words, the client and the authoritative network element may be co-located. In this scenario, the actions / functions implemented by the client in the embodiment of the present application may also be understood as the actions / functions implemented by the authoritative network element.

[0135] As a fourth possible implementation, the client may be deployed in the second server, or in other words, the client and the second server may be co-located. In this scenario, the interaction between the client and the second server in the embodiment of the present application may be understood as internal interaction of the device.

[0136] Exemplarily, the CNF / CNMF network element can be used to uniformly apply for, update, and revoke digital certificates for network elements within the SBA.

[0137] The NRF network element supports the service discovery function. For example, the NRF network element can receive an NF discovery request from an NF instance (denoted as NF instance 1) and provide the information of the discovered NF instance to NF instance 1; in addition, the NRF network element can maintain the available NF instances and their supported NF profiles.

[0138] OAM network elements are mainly used for network and service analysis, prediction, planning, configuration, etc. In addition, OAM network elements can also be used for network and service testing, fault management, etc.

[0139] NFV MANO network elements are mainly used to provide management and orchestration of network function virtualization. NFV MANO can be understood as a functional body composed of network functions virtualization orchestrator (NFVO), virtualized network function manager (VNFM) and virtualized infrastructure manager (VIM).

[0140] Among them, NFVO is mainly used to manage network services, network function lifecycles and resources, with the aim of optimizing the allocation of required resources. The main responsibility of VNFM is the lifecycle management of virtualized network function (VNF) instances. A VNFM can manage one or more VNF instances, and the types of the multiple VNF instances can be the same or different. The lifecycle may include going online, maintenance, and going offline. VIM is mainly used to control and manage the computing resources, storage resources, network resources, etc. of the network function virtualization infrastructure (NFVI). A VIM can control a specific type of NFVI resource or multiple types of NFVI resources.

[0141] About the deployment method of the first server:

[0142] The first server may be deployed inside the 3GPP network, for example, the first server may be a CA inside the PLMN; or, the first server may be deployed outside the 3GPP network, for example, the first server may be a public CA outside the PLMN.

[0143] About the deployment method of the second server:

[0144] As a first possible implementation, the second server can be deployed independently. Exemplarily, the second server can be a unified server deployed inside the SBA. At this time, it can be considered that the second server corresponds to multiple network elements, and the domain names of the multiple network elements can be subdomains of the domain name of the second server.

[0145] As a second possible implementation, the second server can be deployed on a common network element, or the second server and the common network element can be co-located. In this scenario, the actions / functions implemented by the second server in the embodiment of the present application can also be understood as actions / functions implemented by a common network element.

[0146] As a third possible implementation, the second server may be deployed in the authoritative network element, or the second server and the authoritative network element may be co-located. In this scenario, the actions / functions implemented by the second server in the embodiment of the present application may also be understood as the actions / functions implemented by the authoritative network element.

[0147] As a fourth possible implementation, the client and the second server may be co-located. Please refer to the above related descriptions, which will not be repeated here.

[0148] It should be noted that the names of the various network elements in the embodiments of the present application are only exemplary descriptions. With the development of mobile communication systems, the various network elements in the embodiments of the present application may have different names in future evolving PLMNs, such as the sixth generation (6th generation, 6G) mobile communication systems.

[0149] The following will be combined with the accompanying drawings and the above description to describe the method provided by the embodiment of the present application. In the embodiment of the present application, each subject can perform some or all of the steps in the embodiment of the present application, and these steps or operations are only examples. The embodiment of the present application can also perform other operations or variations of various operations. In addition, each step can be performed in a different order presented in the embodiment of the present application, and it is possible not to perform all the operations in the embodiment of the present application.

[0150] like Figure 5 FIG. 1 is a flow chart of an identity verification method provided by the present application, and the method comprises the following steps:

[0151] S501. A client obtains address information of a first network element and an identifier of the first network element.

[0152] In a possible implementation, the first network element can be understood as a certificate owner, or a network element to be issued a certificate. That is, in the embodiment of the present application, the first server needs to issue a certificate to the first network element.

[0153] In one possible implementation, the address information includes a domain name (such as an FQDN) or an Internet Protocol (IP) address, such as an IPv4 or IPv6 address. The identifier of the first network element can be a unique identifier of the first network element at the application layer, such as an instance identifier of the first network element, that is, the NF instance ID of the first network element.

[0154] In a possible implementation, the identifier of the first network element may be determined (or constructed) based on the address information of the first network element; or the address information of the first network element may be determined (or constructed) based on the identifier of the first network element. Exemplarily, there are the following three methods:

[0155] Method A: When the address information is a domain name, the domain name of the network element may be composed of the network element identifier and at least one of the following: a mobile country code (MCC), a mobile network code (MNC), or a preset string. That is, the domain name of the network element may be determined based on the following parameters:

[0156] Network element identification [MNC] [MCC] [preset string]

[0157] Among them, [] indicates optional. MCC consists of three digits and is used to identify a country. A country can be assigned multiple MCCs. For example, the MCCs of country 1 include MCC1, MCC2, and MCC3, and the MCC of country 2 is MCC4.

[0158] MNC consists of two to three digits. The combination of MNC and MCC can uniquely identify a mobile network provider. For example, China's MCC is 460, China Mobile's MNC is 00, China Unicom's MNC is 01, and China Satellite Global Star Network's MNC is 04. In this case, 460-00 uniquely identifies China Mobile.

[0159] The preset string is used to represent the 3GPP network, and it can be a fixed value. For example, the preset string can be: 3gppnetwork.org. Of course, the preset string can also have other values, which will not be repeated here.

[0160] For example, taking the network element identifier as NF instance ID as an example, the domain name of the network element can satisfy the following format:

[0161] nfinanceid<NF instanceID> .mnc <mnc>.mcc <mcc>.Preset string

[0162] or,

[0163] nfinanceid<NF instanceID> .Preset string

[0164] or,

[0165] nfinanceid<NF instanceID> .mcc <mcc>.Preset string

[0166] in,<NF instanceID> Indicates the specific value of NF instance ID. <mnc>Indicates the specific value of MNC. <mcc>Indicates the specific value of MCC. The preset string can be 3gppnetwork.org.

[0167] In addition, the identification of the network element (such as NF instance ID) can be determined based on at least one of the number of the network element in the set to which it belongs (Set), the identification of the set to which the network element belongs (Set ID), the region identification (Region ID) or the network element type (NF type). That is, the identification of the network element can be determined based on at least one of the following parameters:

[0168] The number of the network element in the set to which it belongs Set ID Region ID NF type

[0169] Exemplarily, the identifier of the network element may satisfy the following format:

[0170] pt<NF Pointer> .set<Set ID> .NFtype

[0171] or,

[0172] pt<NF Pointer> .set<Set ID> .region<Region ID> .NFtype

[0173] NF Pointer indicates the number of the network element in the set. NF type can be the NF name i.5gc.mnc. For example, when the NF is AMF, its NF type is expressed as amfi.5gc.mnc, and the AMF identifier can be expressed as pt<AMF Pointer> .set<Set Id> .amfi.5gc.mnc; when NF is SMF, its NF type is expressed as smfi.5gc.mnc, and the SMF identifier can be expressed as pt<SMF Pointer> .set<Set Id> .smfi.5gc.mnc.

[0174] Exemplarily, the network elements in the SBA architecture can be divided into multiple sets (Sets), each set can include at least one network element. The network elements in the set can be numbered separately. Different sets are distinguished by set identifiers. The regional identifier can be the identifier of the area served by the network element, and the regional division of the network element service can take into account factors such as the data network (DN) it serves and the network slice.

[0175] Mode B: When the address information is an IP address, the network element identification is determined by the network element's IP address and at least one of the following: the set identification (Set ID) to which the network element belongs, the region identification (Region ID) or the network element type (NF type), MCC, MNC. That is, the network element identification can be determined based on the following parameters:

[0176] IP address of the network element [Set ID] [Region ID] [NF type] [MCC] [MNC]

[0177] Among them, [] indicates optional.

[0178] Based on this method B, when the same IP address is used in different MNCs, MCCs, areas or collections, the network element identifier can uniquely identify the network element in multiple MNCs, MCCs, areas or collections, thereby avoiding the situation where different network elements use the same identifier.

[0179] Method C: The network element identifier is the same as the network element address information, or in other words, the network element address information is used as the network element identifier. For example, the network element domain name or IP address is the network element identifier.

[0180] In a possible implementation manner, when the client is independently deployed, the client obtaining the address information of the first network element and the identifier of the first network element may include: the client obtaining the address information of the first network element and the identifier of the first network element from a second network element. The second network element may be at least one of the following: a CMF network element, a CMNF network element, an OAM network element, an NFV MANO network element, a first network element, or a client.

[0181] The client obtains the address information of the first network element and the identifier of the first network element, which can also be understood as the client obtains the correspondence between the address information of the first network element and the identifier of the first network element. In the following embodiments, the client obtains the correspondence as an example for explanation, and it can be understood that the implementation of the client obtaining the correspondence can also be applied to the client obtaining the address information of the first network element and the identifier of the first network element.

[0182] As a possible implementation, when the second network element is not a client, the second network element may actively send the correspondence between the address information of the first network element and the identifier of the first network element to the client. For example, the second network element may send the correspondence to the client when it is necessary to request a certificate for the first network element. Alternatively, the client may request the correspondence between the address information of the first network element and the identifier of the first network element from the second network element, and in response to the request, the second network element may send the correspondence to the client. The client may request the correspondence from the second network element when it is necessary to request a certificate for the first network element.

[0183] As an example, the second network element may return the address information of the first network element and the identifier of the first network element in the form of a key-value pair, such as {address information of the first network element: identifier of the first network element}, which may represent the correspondence between the address information of the first network element and the identifier of the first network element. Alternatively, in the case where the address information is a domain name, the domain name of the first network element may include the identifier of the first network element. In this case, the second network element returns the domain name of the first network element, and it is assumed that there is a correspondence between the domain name of the first network element and the identifier included in the domain name, or it is assumed that the identifier corresponding to the domain name of the first network element is the identifier included in the domain name. Alternatively, the second network element may return the identifier of the first network element. In this case, the address information of the first network element is the address information determined based on the identifier of the first network element. Please refer to the relevant instructions in the aforementioned methods A-C, which will not be repeated here.

[0184] As another possible implementation, when the second network element is a client, the correspondence between the address information of the first network element and the identifier of the first network element may be preconfigured or stored in the client. The client obtaining the correspondence from the second network element may be understood as: the client reads the preconfigured or prestored correspondence between the address information of the first network element and the identifier of the first network element.

[0185] In another possible implementation, when the client is deployed in the first network element or the authoritative network element, the first network element or the authoritative network element may pre-configure or pre-store the correspondence between the address information of the first network element and the identifier of the first network element. In this scenario, the client obtains the correspondence between the address information of the first network element and the identifier of the first network element, which may include: the client reads the pre-configured or pre-stored correspondence between the address information of the first network element and the identifier of the first network element.

[0186] Optionally, the correspondence between the address information of the first network element preconfigured or prestored in the authoritative network element and the identifier of the first network element may be configured in an offline manner, or may be sent by the first network element to the authoritative network element. For example, when the authoritative network element is an NRF, the first network element may register an NF profile with the NRF network element, and the NF profile includes the correspondence between the address information of the first network element and the identifier of the first network element.

[0187] S502: The client sends a certificate reservation request to the first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0188] The certificate reservation request includes the address information of the first network element. Exemplarily, the address information of the first network element can be used as an identifier, that is, step S502 can also be understood as including the identifier in the certificate reservation request. The certificate reservation request is used to request an application for a certificate corresponding to the identifier (i.e., the address information of the first network element).

[0189] In a possible implementation manner, the certificate reservation request may also be understood as an order for the certificate.

[0190] In a possible implementation, before step S502, an account may be created for the client. Exemplarily, the client may generate an asymmetric key pair and send an account creation request to the first server. The account creation request may be signed using a private key generated by the client. The account creation request may provide the client's contact information, terms of service agreed (TOS), or information for associating the requested account with an existing account.

[0191] In addition, the client may also inform the first server of its account key. Exemplarily, the client's account key may be a public key and / or a private key in an asymmetric key pair generated by the client.

[0192] S503: The first server sends a challenge message to the client. Correspondingly, the client receives the challenge message from the first server.

[0193] The challenge information may be understood as a response to a certificate reservation request. The challenge information includes a token. Exemplarily, the token may be a random number, for example, a random number with at least 128 bits of entropy, so that the token has strong randomness.

[0194] Optionally, the challenge information may also include the address information of the first network element, or the corresponding relationship between the address information of the first network element and the token. The address information of the first network element may be understood as the challenge address information, and the challenge address information may be understood as the address information that needs to be proved that the client has control over it. After receiving the challenge information, the client may obtain the token corresponding to the address information of the first network element, and use the token to respond to the challenge corresponding to the first network element.

[0195] Optionally, the challenge information may further include type information. The type information is used to indicate the challenge type or the verification method or the type of the second server. Exemplarily, the type information may be "http-01", "dns-01", or "tls-alpn-01". Among them, "http-01" indicates an HTTP challenge or an HTTP verification method or the second server is an HTTP server; "dns-01" indicates a DNS challenge or a DNS verification method or the second server is a DNS server; "tls-alpn-01" indicates a TLS challenge or a TLS verification method or the second server is a TLS server.

[0196] In a possible implementation, the challenge information may be used to trigger or require the client to prove control over the address information of the first network element. The token may be used to respond to the challenge initiated by the first server, or may be used to perform an identity authentication challenge of the first network element.

[0197] In a possible implementation, after receiving the certificate reservation request, the first server may initiate a challenge to the client, such as sending a challenge message, so that the client can prove that it can control the identifier in the requested certificate, that is, the address information of the first network element.

[0198] S504: The client determines response information of the challenge information according to the first key authorization and the identifier of the first network element.

[0199] Among them, the response information of the challenge information can be used to prove that the client has the control right of the address information of the first network element. Exemplarily, the control right of the address information of the first network element can also be understood as: the control right of the address represented by the address information of the first network element, or the control right of the address of the first network element. For the convenience of description, the response information of the challenge information is referred to as the first information in the following embodiments of the present application.

[0200] The first key authorization is determined based on the token and the client's account key. Exemplarily, the client's account key can be a key generated by the client during the account creation process. The client's account key is used to identify the client. Only the client and the first server can generate the first key authorization. Other clients or attackers cannot forge the first key authorization. Therefore, it can be considered that the first key authorization is used to ensure the security of the certificate issuance process.

[0201] As a possible implementation, the first key authorization may be a concatenation of a token and an account key hash value. Exemplarily, the token, account key, and first key authorization may satisfy the following relationship:

[0202] keyAuthorization1=token1||.||base64url(thumbprint(accountkey))

[0203] Among them, keyAuthorization1 represents the first key authorization, token1 represents the token, and "||" represents the cascade of strings. base64url is an encoding method. "." represents a separator. thumbprint can be understood as a fingerprint algorithm, such as using the secure hash algorithm (SHA)-256 to calculate the hash value of accountKey.

[0204] Optionally, when the challenge information includes type information, the client can respond to the challenge according to the type information. For example, when the type information is "http-01", the client responds to the challenge using the first possible implementation method described below; when the type information is "dns-01", the client responds to the challenge using the second possible implementation method described below; when the type information is "tls-alpn-01", the client responds to the challenge using the third possible implementation method described below.

[0205] As a first possible implementation (for example, the challenge type is "http-01"), the client can prove control over the address information of the first network element by placing a specified value in a specific path of the second server (such as an HTTP server). Figure 6 As shown, step S504 can be expressed as S504-1, and the first information may include a first string, and the first string is determined according to the first key authorization and the identifier of the first network element, or in other words, the first string is a value constructed using the first key authorization and the identifier of the first network element. The first string can be used as a resource under the first path of the address information of the first network element. That is, after determining the first string, the method may also include: using the value constructed using the first key authorization and the identifier of the first network element (i.e., the first string) as a resource (or resource value) under the first path of the address information of the first network element. Among them, the first path is determined according to the token. That is, the client can use the first key authorization and the identifier of the first network element to construct the resources under the first path.

[0206] Exemplarily, the first character string is a value constructed using the first key authorization and the identifier of the first network element, which can also be understood as: the first character string is a value determined or generated using the first key authorization and the first network element.

[0207] Exemplarily, the client can determine the first string based on the first rule, and the first rule may include: the first string is a cascade of the first key authorization and the identifier of the first network element, such as "first key authorization||identifier of the first network element", or, it can be a cascade of the summary of the first key authorization and the identifier of the first network element, such as "summary of the first key authorization||identifier of the first network element", or, it can be a cascade of the value obtained by calculating the first key authorization using an algorithm and the identifier of the first network element.

[0208] Exemplarily, the digest of the first key authorization may be a SHA-256 digest of the first key authorization. The digest of the first key authorization may be concatenated with the identifier of the first network element using base64url encoding.

[0209] Optionally, the first path can be a cascade of the first prefix and the token. The first prefix can be pre-negotiated by the client, the first server, and the second server, or can be defined by the protocol. The first prefix can be a string. Exemplarily, the first prefix can be " / .well-known / challenge / " or " / .well-known / XXX-challenge / ", where XXX can be the name of some automated certificate management protocol, or can be any character or string. Taking the first prefix " / .well-known / XXX-challenge / " as an example, the first path can be expressed as: " / .well-known / XXX-challenge / {token1}".

[0210] Optionally, the first path of the address information of the first network element can be understood as the first path under the address represented by the address information of the first network element. For example, taking the address information of the first network element as a domain name, the domain name is "www.example.org", and the first path is represented as " / .well-known / XXX-challenge / {token1}", the first path of the address information of the first network element can be represented as "http: / / www.example.org / .well-known / XXX-challenge / {token1}".

[0211] Optionally, the first path may be a path on the second server. Exemplarily, the second server is an HTTP server. When the second server is deployed in the first network element, the address information of the second server is the same as the address information of the first network element. When the second server and the first network element are independently deployed, the address of the first network element may be a sub-address of the address of the second server, and the second server may control the domain corresponding to the domain name of the first network element.

[0212] Optionally, when the client and the second server are jointly installed, the client uses the first key authorization and the identifier of the first network element to construct resources under the first path. It can be understood that: the client stores (or puts or writes) the value (i.e., the first string) constructed using the first key authorization and the identifier of the first network element under the first path.

[0213] As a second possible implementation method (the challenge type is "dns-01"), the client can prove the control of the address information of the first network element by providing a specific value of a specific verification address to the second server (such as a DNS server). Figure 7 As shown, step S504 can be expressed as S504-2, and the first information can include a first string, and the first string can be used as a text record (TXT record) of the verification address. That is, after determining the first string, the method can also include: using the first string as a text record of the verification address, that is, the client can use the first key authorization and the identifier of the first network element to construct a text record of the verification address. Among them, the text record can also be called a text resource record (TXTresource record), and the two can be replaced with each other. The first string can refer to the relevant instructions in S504-1, which will not be repeated here.

[0214] Among them, the verification address is determined based on the address information of the first network element. Exemplarily, the verification address can be a cascade of the second prefix and the address information of the first network element. The second prefix can be pre-negotiated by the client, the first server, and the second server, or can be defined by the protocol. The second prefix can be a string. Exemplarily, the second prefix can be "challenge" or "_XXX-challenge", where XXX can be the name of some automated certificate management protocol, or can be any character or string. Taking the second prefix as "_XXX-challenge", the address information of the first network element is a domain name, and the domain name is "www.example.org" as an example, the verification address can be expressed as "_XXX-challenge.www.example.org".

[0215] Optionally, when the client and the second server are jointly installed, the client uses the first key authorization and the identifier of the first network element to construct a text record of the verification address, which can be understood as: the client stores the text record of the verification address, and the text record of the verification address includes a value constructed using the first key authorization and the identifier of the first network element (i.e., the first string).

[0216] As a third possible implementation method (the challenge type is "tls-alpn-01"), the client can provide a self-signed certificate to the second server (such as a TLS server) based on the transport layer security-application layer protocol negotiation (TLS-ALPN) verification method to prove the control of the address information of the first network element. Fig.16 As shown, step S504 may be expressed as S504-3, and the first information may include a self-signed certificate of the client, where the self-signed certificate is determined according to the first key authorization and the identifier of the first network element.

[0217] As a first possible implementation, the first field of the self-signed certificate carries the address information of the first network element, and the second field carries the first string, that is, the first field is used to carry the address information of the first network element, and the second field is used to carry the first string. The first string is determined according to the first key authorization and the identifier of the first network element, or in other words, the first string is a value constructed using the first key authorization and the identifier of the first network element. The first string can refer to the relevant description in S504-1, which will not be repeated here.

[0218] As a second possible implementation, the first field of the self-signed certificate carries the identification of the first network element, and the second field carries the first key authorization or a summary of the first key authorization. That is, the first field is used to carry the identification of the first network element, and the second field is used to carry the first key authorization or a summary of the first key authorization.

[0219] Exemplarily, in the above two possible implementations, the first field may be a subject alias field (SubjectAltName), and the second field may be a protocol identification field. The protocol may be an application layer protocol. Furthermore, the protocol is used for automatic certificate management. For example, the protocol is an automatic certificate management environment (ACME) protocol. In this case, the second field may be an acmeIdentifier field. The first field and the second field may be extension fields of a self-signed certificate.

[0220] In the above two possible implementations, the self-signed certificate may also include a public key generated by the client. Exemplarily, the client may generate a public-private key pair, and use the private key in the public-private key pair to sign the certificate content (such as including the public key, subject alias, acmeIdentifier) ​​constructed using the public key in the public-private key pair to obtain the self-signed certificate.

[0221] In a possible implementation, when the client and the second server are deployed separately, Figure 5 As shown, after step S504, the client may also send response information of the challenge information to the second server.

[0222] For example, in the first possible implementation, Figure 6 As shown, after the client uses the first key authorization and the identifier of the first network element to construct the resources under the first path, it can also send the first key authorization and the identifier of the first network element to the second server. After the second server receives the first key authorization and the identifier of the first network element, it can use the first key authorization and the identifier of the first network element to construct the resources under the first path and store (or put or write) them under the first path. Alternatively, the client can send the first string to the second server, and after the second server receives the first string, it stores (or puts or writes) it under the first path.

[0223] Optionally, after the second server stores the value constructed using the first key authorization and the identifier of the first network element (ie, the first string) under the first path, it can send a notification message to the client to notify the second server that the first string has been used as a resource under the first path.

[0224] In the second possible implementation method described above, Figure 7 As shown, after the client constructs the text record of the verification address using the first key authorization and the identifier of the first network element, it can also send the text record of the verification address to the second server. After the second server receives the text record of the verification address, it can store the text record of the verification address on the second server.

[0225] Exemplarily, the client may send information in the following format to the second server to represent the text record of the verification address: verification address.300IN TXT "text record". For example, taking the verification domain name "_XXX-challenge.www.example.org" as an example, the text record of the verification address sent by the client to the second server may be expressed in the following format: _XXX-challenge.www.example.org.300IN TXT "first string". Alternatively, the client may also send other forms of information to the second server to represent the text record of the verification address, such as sending the text record of the verification address in the form of "verification address." text record"" or "verification address||"text record"". Among them, "||" represents the cascade of character strings. This application does not limit the sending form of the text record of the verification address.

[0226] Alternatively, the client may send the first key authorization and the identifier of the first network element to the second server. After receiving the first key authorization and the identifier of the first network element, the second server may use the first key authorization and the identifier of the first network element to construct a text record of the verification address and store the text record.

[0227] Optionally, after storing the text record of the verification address, the second server may send notification information to the client to notify the second server that the text record of the verification address has been stored.

[0228] For example, in the third possible implementation, Fig.16 As shown, after the client uses the first key authorization and the identifier of the first network element to determine the self-signed certificate, it can also send the self-signed certificate to the second server (such as a TLS server). After the second server receives the self-signed certificate, it can store the self-signed certificate on the second server.

[0229] Optionally, after storing the self-signed certificate, the second server may send notification information to the client to notify the second server that the self-signed certificate has been stored.

[0230] S505: The first server sends a request message to the second server. Correspondingly, the second server receives the request message from the first server.

[0231] The request message is used to request first information corresponding to the first network element, and the first information is used to prove that the client has control over the address information of the first network element. In other words, the request message requests information used to verify the challenge initiated by the first server.

[0232] In one possible implementation, after step S504, the client may send a response to the first server, and the response may be used to confirm or indicate to the first server that the first server can verify the challenge it initiated. Exemplarily, the client may respond with an empty object ({}). For example, the client may send the response to the first server after receiving a notification message from the second server. After receiving the response, the first server may execute step S505 to send a request message to the second server. Alternatively, after S503, the first server may start a first timer. If the first server does not receive the response from the client before the first timer times out, the first server may execute step S505 to send a request message to the second server after the first timer times out.

[0233] As a first possible implementation, when the client proves control over the first network element address information by placing a specified value in a specific path of a second server (such as an HTTP server), Figure 6 As shown, step S505 can be expressed as S505-1. Before S505-1, the first server can construct the first path and the second string of the address information of the first network element. Among them, the second string can be determined according to the second key authorization, and the second key authorization is determined according to the token and the account key of the client. The second key authorization is determined in the same manner as the first key authorization. Please refer to the relevant description of the first key authorization in the above step S504. The first path can refer to the relevant description in the above step S504, which will not be repeated here.

[0234] Exemplarily, the first server may determine the second string according to the second rule and the second key authorization, and the second rule corresponds to the first rule. For example, when the first rule is that the first string is a concatenation of the first key authorization and the identifier of the first network element, the second rule may be: the second string is the second key authorization; or, when the first rule is a concatenation of the summary of the first key authorization and the identifier of the first network element, the second rule may be: the second string is a summary of the second key authorization.

[0235] After constructing the first path, the first server can send a request message. At this time, the request message can be understood as an access message of the first path. Exemplarily, the first server can use an HTTP GET request to send a request message to access the first path. Since the request message can be used to access the first path, and the first path is the path under the address indicated by the address information of the first network element, the address information of the first network element can be reflected in the request message, so that it can be considered that the request message is used to request the first information corresponding to the first network element. The request message can be sent to the transmission control protocol (TCP) port 80 of the second server. For example, the format of the request message can be "GEThttp: / / www.example.org / .well-known / XXX-challenge / {token1}:80".

[0236] As a second possible implementation, when the client proves the control right over the first network element address information by providing a specific value of a specific verification address to a second server (such as a DNS server), Figure 7 As shown, step S505 can be expressed as S505-2. Before S505-2, the first server can construct a verification address and a second string. The construction of the verification address can refer to the relevant description in the above step S504, and the construction of the second string can refer to the above relevant description in step S505, which will not be repeated here.

[0237] After constructing the verification address, the first server can send a request message. At this time, it can be considered that the request message is used to query the text record of the verification address. Exemplarily, the request message includes the verification address. Since the verification address is determined based on the address information of the first network element, it can be considered that the address information of the first network element can be reflected in the request message, and thus it can be considered that the request message is used to request the first information corresponding to the first network element.

[0238] As a third possible implementation, when the client proves the control of the first network element address information by providing a self-signed certificate to the second server (such as a TLS server), Fig.16 As shown, step S505 can be expressed as S505-3. Before S505-3, the first server can construct a second string or a second key authorization or a summary of the second key authorization. The second key authorization and the second string can refer to the relevant description in step S505-1, which will not be repeated here.

[0239] After constructing the second string or the second key authorization or the summary of the second key authorization, the first server can send a request message to the second server. Taking the second server as a TLS server as an example, the address information of the TLS server can be understood as the address information of the challenge. In the case where the TLS server and the first network element are co-installed, the address information of the TLS server is the same as the address information of the first network element. In the case where the TLS server and the first network element are deployed independently, the address of the first network element can be a sub-address of the TLS server address, and the TLS server can control the domain corresponding to the domain name of the first network element, or the TLS server address can be a sub-address of the address of the first network element, without restriction.

[0240] In addition, the request message can be understood as a TLS connection establishment message. Exemplarily, the request message can include address information of the first network element, and the address information of the first network element can be carried in the third field of the request message. Exemplarily, the third field is a service name indication (server name indication, SNI) extension field.

[0241] Furthermore, the request message may also include an ALPN extension field. Exemplarily, the SNI extension field and the ALPN extension field may be set to: ALPN extension = "acme-tls / 1", SNI extension = address information of the first network element.

[0242] S506: The second server sends the first information to the first server. Correspondingly, the first server receives the first information from the second server.

[0243] The first information includes an identifier of the first network element corresponding to the address information of the first network element. Exemplarily, the first information may include an identifier of the first network element, and the first server assumes that the identifier is the identifier corresponding to the address information of the first network element.

[0244] As a first possible implementation, when the client proves control over the first network element address information by placing a specified value in a specific path of a second server (such as an HTTP server), Figure 6 As shown, step S506 can be expressed as S506-1, and the first information also includes a third string, which is a string in the first string except the identifier of the first network element, that is, the third string and the identifier of the first network element constitute the first string. For example, when the first string is "first key authorization||identifier of the first network element", the third string can be the first key authorization; when the first string is "summary of the first key authorization||identifier of the first network element", the third string can be the summary of the first key authorization.

[0245] In addition, if Figure 6 As shown, the second server sending the first information to the first server in step S506-1 can be understood as: in response to the first server's access to the first path, the second server sends a response message to the first server, and the response message includes the resources under the first path.

[0246] As a second possible implementation, when the client proves the control right over the first network element address information by providing a specific value of a specific verification address to a second server (such as a DNS server), Figure 7 As shown, step S506 can be expressed as S506-2, and the first information also includes a third string, that is, the third string and the identifier of the first network element constitute the first string (the text record of the verification address). Please refer to the relevant description of the first possible implementation method in step S506, which will not be repeated here. Figure 7 As shown, the second server sending the first information to the first server in step S506-2 can be understood as: the second server sending a response message to the first server, and the response message includes a text record of the verification address.

[0247] As a third possible implementation, when the client proves the control of the first network element address information by providing a self-signed certificate to the second server (such as a TLS server), Fig.16 As shown, step S506 can be expressed as S506-3. The first information includes an identifier of the first network element corresponding to the address information of the first network element, and can include: the first information includes a self-signed certificate of the client, and the self-signed certificate includes the identifier of the first network element. The implementation of the self-signed certificate can refer to the relevant description in the above step S504-3, which will not be repeated here.

[0248] As a first possible implementation, when the first field of the self-signed certificate carries the address information of the first network element and the second field carries the first string, it can be considered that the self-signed certificate implicitly includes the identifier of the first network element. The first string can be divided into the identifier of the first network element and the third string, that is, the third string is the string in the first string except the identifier of the first network element, that is, the third string and the identifier of the first network element constitute the first string. For example, when the first string is "first key authorization||identifier of the first network element", the third string can be the first key authorization; when the first string is "summary of the first key authorization||identifier of the first network element", the third string can be the summary of the first key authorization.

[0249] As a second possible implementation, when the first field of the self-signed certificate carries the identification of the first network element and the second field carries the first key authorization or a digest of the first key authorization, it can be considered that the self-signed certificate explicitly includes the identification of the first network element.

[0250] In addition, if Fig.16 As shown, the second server sending the first information to the first server in step S506-3 can be understood as: the second server sending a response message to the first server, and the response message includes a self-signed certificate. Exemplarily, the response message can be a TLS response or a TLS connection establishment response message. Further, the response message can include an ALPN extension field, and the value of the field can be ALPN extension = "acme-tls / 1".

[0251] S507: When the first server determines that the client has control over the address information of the first network element according to the first information, the first server issues a certificate to the first network element. The certificate includes the identifier of the first network element. In other words, the first server issues a certificate corresponding to the identifier to the first network element.

[0252] As a first possible implementation, when the client proves control over the address information of the first network element by placing a specified value in a specific path of the second server (such as an HTTP server), after the first server receives the response message from the second server, it verifies whether the body of the response message conforms to the format of the first string, that is, whether it conforms to the format of "third string||network element identifier", for example, whether it conforms to the format of "key authorization||network element identifier" or "summary of key authorization||network element identifier". If it conforms to the format, the first server extracts the third string in the body, such as the key authorization or the summary of the key authorization. Among them, the extracted key authorization is the first key authorization, and the summary of the key authorization is the summary of the first key authorization. Afterwards, the first server verifies whether the client has control over the address information of the first network element. Exemplarily, when the third string and the second string are the same, it means that the client has control over the address information of the first network element.

[0253] For example, if the second character string is the second key authorization and the third character string is the first key authorization, if the second key authorization and the first key authorization are the same, it means that the client has the control right of the address information of the first network element. Or, if the second character string is the summary of the second key authorization and the third character string is the summary of the first key authorization, if the summary of the second key authorization and the summary of the first key authorization are the same, it means that the client has the control right of the address information of the first network element.

[0254] As a second possible implementation, when the client proves control over the address information of the first network element by providing a specific value of a specific verification address to a second server (such as a DNS server), the first server verifies whether the body of the response message conforms to the format of the first string after receiving the response message from the second server. If it conforms to the format, the first server extracts the third string in the body. Afterwards, the first server verifies whether the client has control over the address information of the first network element. Exemplarily, when the third string and the second string are the same, it indicates that the client has control over the address information of the first network element. Please refer to the relevant instructions in the above-mentioned first possible implementation in step S507, which will not be repeated here.

[0255] As a third possible implementation, when the client proves control over the first network element address information by providing a self-signed certificate to the second server (such as a TLS server), after the first server receives a response message from the second server:

[0256] In the case where the first field of the self-signed certificate carries the address information of the first network element and the second field carries the first string, the first server verifies whether the second field conforms to the format of the first string. If it conforms to the format, the first server extracts the third string in the second field, such as a key authorization or a summary of the key authorization. Among them, the extracted key authorization is the first key authorization, and the summary of the key authorization is the summary of the first key authorization. Afterwards, the first server verifies whether the client has control over the address information of the first network element. Exemplarily, when the third string and the second string are the same, it means that the client has control over the address information of the first network element. The second string can refer to the relevant description of the first possible implementation method in step S505. The implementation of the same second and third strings can refer to the relevant description of the first possible implementation method in step S507, which will not be repeated here.

[0257] When the first field of the self-signed certificate carries the identification of the first network element and the second field carries the first key authorization or the summary of the first key authorization, the first server extracts the first key authorization or the summary of the first key authorization in the second field. When the first key authorization and the second key authorization are the same, or the summary of the first key authorization and the summary of the second key authorization are the same, it indicates that the client has control over the address information of the first network element.

[0258] In the above three possible implementations, when the first server determines that the client has the right to control the address information of the first network element, the first server may extract the network element identifier in the body of the response message sent by the second server to the first server in step S506, and store the network element identifier or store the correspondence between the network element identifier and the address information, and the network element identifier is the identifier of the first network element. Alternatively, the first server may also extract the third string and the network element identifier in the body of the response message at the same time, and when it is determined that the client has the right to control the address information of the first network element, store the identifier of the first network element or the correspondence between the identifier of the first network element and the address information of the first network element. When it is determined that the client does not have the right to control the address information of the first network element, the first server may not extract the network element identifier in the body of the response message, or may discard the extracted network element identifier. Among them, the client does not have the right to control the address information of the first network element, including: the second string and the third string are different, that is, the address information verification of the first network element fails. In the above-mentioned third possible implementation, the body of the response message can be understood as a self-signed certificate, and the identifier of the first network element can be carried in the field of the self-signed certificate, for example, it can be carried in the above-mentioned second field (the case where the second field carries the first string) or the first field (the case where the first field carries the identifier of the first network element).

[0259] In a possible implementation, when the first server determines that the client has control over the address information of the first network element, the client may send a certificate issuance request to the first server, and after receiving the certificate issuance request from the client, the first server issues a certificate to the first network element in response to the certificate issuance request. The certificate issuance request may include an identifier of the first network element, and further, may include the address information of the first network element.

[0260] Exemplarily, when the certificate issuance request includes the address information of the first network element, the first server can determine whether the address information of the first network element has been verified, that is, whether the client has control over the address information of the first network element. When it is determined that the address information of the first network element has been verified, the first server searches for the identifier of the first network element corresponding to the address information of the first network element stored therein, and issues a certificate to the first network element, in which the identifier of the first network element is carried.

[0261] In the case where the certificate issuance request includes the identifier of the first network element, the first server can check whether it has stored the identifier. If the first server has stored the identifier of the first network element, it means that the address information of the first network element has passed the verification, and a certificate can be issued to the first network element, and the identifier of the first network element can be carried in the certificate.

[0262] In another possible implementation, the client may send a certificate issuance request to the first server in the above step S502, that is, the client carries the certificate issuance request when booking the certificate. In this scenario, after the address information of the first network element is verified, the first server may directly issue a certificate to the first network element, that is, issue a certificate corresponding to the first network element identifier.

[0263] Optionally, a certificate issuance request may also be referred to as a certificate signing request (CSR) or a certificate issuance request, and the three may be interchangeable.

[0264] In a possible implementation, the first server issuing a certificate to the first network element may include: the first server sending the certificate of the first network element to the client. Accordingly, the client obtains the certificate issued by the first server to the first network element. In the case where the client and the first network element are deployed separately, after the client obtains the certificate issued by the first server to the first network element, the client may send the certificate to the first network element.

[0265] In a possible implementation, the certificate may be an X.509 certificate, which is used for communication between the first network element and other network elements in the core network, that is, the first network element may use the certificate when communicating with other network elements.

[0266] In a possible implementation, the identifier of the first network element is carried in the subject alias (subjectAltName) field and / or the subject name (subjectName) field of the certificate, that is, the subject alias and / or the subject name of the certificate may include the identifier of the first network element.

[0267] Optionally, the subject alias and / or subject name may also include other information, such as the subject alias may also include an IP address, etc., and the subject name may also include an organization name, a distinguished name, etc. This application does not make specific limitations on this.

[0268] Based on the above scheme, the client determines the information used to prove that the client has the control right of the address information (such as domain name or IP address) of the network element according to the key authorization and the identification of the network element, so that the first server can verify whether the client has the control right of the domain name or IP address of the network element. If the verification is successful, the first server can believe that the client can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believes that the identification of the network element is also legal, and thus believes that the identity verification of the certificate subject has passed, and then issues a certificate to the network element.

[0269] In the process of verifying whether the client has control over the address information of the network element, since the information used to verify the control right (i.e., the first information) is determined based on the key authorization and the identification of the network element, and the key authorization is determined based on the token provided by the first server, there is no need to pre-establish initial trust between the client and the first server, and no need to perform related deployment work in advance, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0270] In addition, the second server is used to store information for verifying the control right of the address information, so the second server can be a server related to the address information, such as a common HTTP server or DNS server. In other words, the second server can be an ordinary common network element in the network, and there is no need to deploy a dedicated network element (such as a private CA) for certificate issuance, thereby further improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0271] Above Figure 7 In the method shown, the client determines the text record of the verification address and sends it to the second server, which saves it for subsequent verification of the address information control right. In addition, the present application also provides an identity verification method, in which the second server can generate the final text record of the verification address. The process of the method can be as follows: Figure 8 shown.

[0272] It should be noted that Figure 8 The solution shown is described by taking the second server deployed in the NRF network element and the client deployed in the CMNF network element as an example. In this solution, the functions implemented by the second server can also be understood as the functions implemented by the NRF network element, and the second server can be replaced by the NRF network element; the functions implemented by the client can also be understood as the functions implemented by the CMNF network element, and the client can be replaced by the CMNF network element. Figure 8 , the identity verification method may include the following steps:

[0273] S801. A second server obtains address information of a first network element and an identifier of the first network element.

[0274] In a possible implementation, the first network element may register (or send) an NF profile to the NRF network element, and the NF profile may include the address information of the first network element and the identifier of the first network element. After receiving the NF profile, the second server may obtain the address information of the first network element and the identifier of the first network element therefrom.

[0275] The second server obtains the address information of the first network element and the identifier of the first network element, which can also be understood as the second server obtaining the corresponding relationship between the address information of the first network element and the identifier of the first network element.

[0276] In a possible implementation, after the first network element registers the NF configuration file with the NRF network element, the NRF network element can subscribe to the correspondence between the address information of the first network element and the identifier of the first network element. If the address information of the first network element changes subsequently, the correspondence between the changed address information of the first network element and the identifier of the first network element can be sent to the NRF network element.

[0277] S802: The client sends a certificate reservation request to the first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0278] The certificate reservation request may include the address information of the first network element. Please refer to the relevant description in the above step S502, which will not be repeated here.

[0279] In a possible implementation, the address information of the first network element may be sent by the first network element to the client, or may be sent by other network elements (such as NRF network elements) to the client, or may be pre-stored or pre-configured by the client. This application does not make specific limitations on this.

[0280] In a possible implementation, before step S802, an account may be created for the client, and reference may be made to the relevant description in the above step S502.

[0281] In a possible implementation, before step S802, the first network element may send a request message to the client to request the client to apply for a certificate for the first network element. After receiving the request message, the client may send a certificate reservation request to the first server. Alternatively, the client may actively apply for a certificate for the first network element, that is, actively send a certificate reservation request to the first server.

[0282] S803, the first server sends a challenge message to the client. Correspondingly, the client receives the challenge message from the first server. The challenge message includes a token. Please refer to the relevant description in the above step S503, which will not be repeated here.

[0283] S804: The client sends information A to the second server. Correspondingly, the second server receives the information A from the client.

[0284] The information A is used to determine the first key authorization. The first key authorization can refer to the relevant description in the above step S504, which will not be repeated here.

[0285] In a possible implementation, the second information may be an initial text record of the verification address. The verification address is determined according to the address information of the first network element, and reference may be made to the relevant description in the above step S504-2, which will not be repeated here.

[0286] As a possible implementation, the initial text record may include a token and the client's account key. In this scenario, after the second server receives the initial text record of the verification address, it can determine the first key authorization based on the token and the client's account key.

[0287] As another possible implementation, the initial text record may include the first key authorization itself.

[0288] S805: The second server determines a text record of the verification address according to the first key authorization and the identifier of the first network element. The text record of the verification address is used to prove that the client has control over the address information of the first network element.

[0289] In a possible implementation, the text record of the verification address includes a value constructed using the first key authorization and the identifier of the first network element. For reference, the relevant description in the above step S504-2 is provided, which will not be repeated here. In the following embodiments of the present application, the text record of the verification address includes a summary of the first key authorization and the identifier of the first network element as an example for explanation.

[0290] As a possible implementation, when the second information is an initial text record of the domain name verification, after receiving the second information, the second server can determine that the initial text record is an initial text record corresponding to the address information of the first network element. Thus, the identifier of the first network element can be obtained based on the correspondence between the address information of the first network element and the identifier of the first network element. Then, the summary of the first key authorization and the identifier of the first network element are used as the text record of the verification address.

[0291] It is understandable that, since the second server can store the text record of the verification address, it can be considered that the second server has the text record function. Alternatively, since the authoritative domain name server has the DNS text record function, it can also be considered that the second server has the function of the authoritative domain name server.

[0292] In one possible implementation, after step S805, the second server sends a notification message to the client to notify the second server that it has stored (or determined) a text record of the verification address. After receiving the notification message, the client can send a response to the first server, which can be used to confirm or indicate to the first server that the first server can verify the challenge it initiated. After receiving the response, the first server can execute the following step S806. Alternatively, after S803, the first server can start a second timer. If the first server does not receive the response from the client before the second timer times out, the first server can execute step S506 to send a request message to the second server after the second timer times out.

[0293] S806: The first server sends a request message to the second server. Correspondingly, the second server receives the request message from the first server.

[0294] The request message is used to request or query the text record of the verification address, or in other words, the request message requests information used to verify the challenge initiated by the first server. Please refer to the relevant description in the above step S505-2, which will not be repeated here.

[0295] S807: The second server sends the text record of the verification address to the first server. Correspondingly, the first server receives the text record of the verification address from the second server. Please refer to the relevant description in the above step S506-2, which will not be repeated here.

[0296] In a possible implementation, if the first server is an external public CA, then in steps S806 and S807, the interaction between the first server and the second server can be performed through forwarding by the CMNF network element. In addition, when the address information is a domain name, if the NRF network element does not support the DNS service, the CMNF network element needs to convert the format of the information from the first server and convert the DNS service request sent by the first server into the HTTP request format within 3GPP.

[0297] S808: When the first server determines, based on the text record of the verification address, that the client has control over the address information of the first network element, the first server issues a certificate to the first network element.

[0298] The certificate includes the identifier of the first network element. Exemplarily, the identifier of the first network element may be carried in a subject alias (subjectAltName) field and / or a subject name (subjectName) field of the certificate.

[0299] The implementation of the first server determining that the client has the right to control the address information of the first network element according to the text record of the verification address can refer to the relevant description in the above step S507, which will not be repeated here.

[0300] In a possible implementation, when the first server determines that the client has control over the address information of the first network element, if a certificate issuance request is received from the client, the first server issues a certificate to the first network element in response to the certificate issuance request. For details, please refer to the relevant description in the above step S507, which will not be repeated here.

[0301] In another possible implementation, the client may send a certificate issuance request to the first server in the above step S802, that is, the client carries the certificate issuance request when booking the certificate. In this scenario, after the address information of the first network element is verified, the first server may directly issue a certificate to the first network element.

[0302] In a possible implementation, the first server issuing a certificate to the first network element may include: the first server sending the certificate of the first network element to the client. Accordingly, the client obtains the certificate issued by the first server to the first network element. In the case where the client and the first network element are deployed separately, after the client obtains the certificate issued by the first server to the first network element, the client may send the certificate to the first network element.

[0303] Based on the above scheme, the second server determines the information used to prove that the client has the control right of the address information (such as domain name or IP address) of the network element according to the key authorization and the identification of the network element, so that the first server can verify whether the client has the control right of the domain name or IP address of the network element. If the verification is successful, the first server can believe that the client can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believes that the identification of the network element is also legal, and thus believes that the identity verification of the certificate subject has passed, and then issues a certificate to the network element.

[0304] In the process of verifying whether the client has the control right of the address information of the network element, since the text record of the verification address is determined based on the key authorization and the identification of the network element, and the key authorization is determined based on the token provided by the first server, there is no need to pre-establish initial trust between the client and the first server, and no need to pre-perform related deployment work, thereby improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance. In addition, the second server is used to store information for verifying the control right of the address information, so the second server can be a server related to the address information, such as a common HTTP server or DNS server. In other words, the second server can be an ordinary and common network element in the network, and there is no need to deploy a dedicated network element (such as a private CA) for certificate issuance, thereby further improving the degree of automation of certificate issuance and reducing the complexity of certificate issuance.

[0305] In addition to the above Figures 5 to 8 In addition to the method shown in the figure, the embodiment of the present application also provides an identity authentication method, such as Fig. 9 As shown, the identity authentication method includes the following steps:

[0306] S901. A first server obtains address information of a first network element and a first identifier corresponding to the address information of the first network element, wherein the address information is a domain name or an IP address.

[0307] The first identifier may be understood as an identifier of the first network element. Further, the first identifier may be understood as a real (or legal) identifier of the first network element considered by the first server.

[0308] Optionally, if the first server obtains an identifier from the client, and the client claims that the identifier is the identifier of the first network element, then the first server doubts the authenticity or legality of the identifier. It can be determined later whether the identifier is a true (or legal) identifier of the first network element. For the convenience of description, in the embodiment of the present application, the identifier of the first network element that is true or legal confirmed by the first server is referred to as the first identifier, and the identifier of the first network element that the first server doubts is referred to as the second identifier.

[0309] S902: When the address information of the first network element is verified successfully, the first server issues a certificate to the first network element.

[0310] The certificate includes a first identifier, that is, an identifier of the first network element. Exemplarily, the identifier of the first network element may be carried in a subject alias (subjectAltName) field and / or a subject name (subjectName) field in the certificate.

[0311] In a possible implementation, the first server issuing a certificate to the first network element may include: the first server sending the certificate of the first network element to the client. Accordingly, the client obtains the certificate issued by the first server to the first network element. In the case where the client and the first network element are deployed separately, after the client obtains the certificate issued by the first server to the first network element, the client may send the certificate to the first network element.

[0312] Optionally, in step S901, the first server may obtain the address information of the first network element and the first identifier corresponding to the address information of the first network element in the following four ways:

[0313] Method 1: The client can send the address information of the first network element to the first server. After receiving the address information of the first network element, the first server sends the first information to the second network element, wherein the first information is used to request the identifier corresponding to the address information of the first network element. After receiving the first information, the second network element can send the first identifier to the first server. Accordingly, the first server receives the first identifier from the second network element and can obtain the first identifier corresponding to the address information of the first network element.

[0314] In a possible implementation, the client may actively send the address information of the first network element to the first server. For example, the client may send the address information of the first network element to the first server when applying for a certificate for the first network element.

[0315] Exemplarily, the second network element can be understood as an authoritative network element, or a network element trusted by the first server. Therefore, the first server can consider the identifier returned by the second network element to be the real or legal identifier of the first network element, that is, the identifier returned by the second network element is considered to be the first identifier. The second network element can be at least one of a CMF network element, a CMNF network element, an NRF network element, an OAM network element, or an NFVMANO network element.

[0316] In a possible implementation, the second network element may pre-store the correspondence between the address information of the first network element and the identifier of the first network element. For example, the first network element may send the correspondence between its address information and the identifier to the second network element during the network access or registration process. Alternatively, the second network element may pre-configure the correspondence between the address information of the first network element and the identifier of the first network element.

[0317] Optionally, the client, the first server, and the second network element may be Fig.10 The process shown is the information interaction in mode 1:

[0318] S1000. Create an account for the client. Please refer to the above Figure 5 The instructions for creating a client account in the method shown are not repeated here.

[0319] S1001: A client sends a certificate reservation request to a first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0320] The certificate reservation request includes the address information of the first network element. Please refer to the relevant description in the above step S502, which will not be repeated here.

[0321] S1002: Verify the address information of the first network element. Verifying the address information of the first network element may also be understood as: verifying whether the client has control over the address information of the first network element.

[0322] In a possible implementation, step S1002 may include the above steps S503-S506 and the implementation of the first server determining whether the client has the address information of the first network element in step S507. Please refer to the above related instructions and will not be repeated here.

[0323] In a possible implementation manner, the passing of the address information verification of the first network element may also be understood as: determining that the client has the control right over the address information of the first network element.

[0324] In a possible implementation manner, after the address information of the first network element is verified, the first server may record or store the address information of the first network element, indicating that the address information has been verified.

[0325] S1003: The client sends a certificate issuance request to the first server. Correspondingly, the first server receives the certificate issuance request from the client.

[0326] In a possible implementation, the certificate issuance request may include a second identifier. The second identifier may be understood as an identifier of the first network element provided by the client. The first server may have doubts about the authenticity or legality of the second identifier.

[0327] S1004: The first server sends first information to the second network element. Correspondingly, the second network element receives the first information from the first server.

[0328] The first information is used to request an identifier corresponding to the address information of the first network element. Exemplarily, the first information may include the address information of the first network element.

[0329] S1005: The second network element sends a first identifier to the first server. Correspondingly, the first server receives the first identifier from the second network element.

[0330] The first identifier may be understood as the identifier of the first network element returned by the second network element. Exemplarily, the first server may understand the first identifier returned by the second network element as the real (or legal) identifier of the first network element.

[0331] After step S1005, the first server can obtain the identifier of the first network element. If the address information of the first network element is verified in step S1002, the first server can execute step S902 to issue a certificate to the first network element. Alternatively, if the certificate issuance request carries a second identifier, the first server can determine whether the first identifier and the second identifier are the same. If the first identifier and the second identifier are the same and the address information of the first network element is verified in step S1002, the first server can issue a certificate to the first network element.

[0332] Method 2: The client may send the address information and the second identifier of the first network element to the first server. The first server may send the second information to the second network element to confirm whether the second identifier is the identifier corresponding to the address information of the first network element. If the second network element indicates that the second identifier is the identifier corresponding to the address information of the first network element, the first server uses the second identifier as the first identifier. The second network element may refer to the relevant instructions in the above method 1, which will not be repeated here.

[0333] In a possible implementation, the client may actively send the address information and the second identifier of the first network element to the first server. For example, the client may send the address information and the second identifier of the first network element to the first server when applying for a certificate for the first network element.

[0334] Optionally, the client, the first server, and the second network element may be Fig.11 The process shown is the information exchange in mode 2:

[0335] S1100, create an account for the client. Please refer to the above Figure 5 The instructions for creating a client account in the method shown are not repeated here.

[0336] S1101: A client sends a certificate reservation request to a first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0337] Optionally, the certificate reservation request includes the address information of the first network element. Alternatively, the certificate reservation request includes the address information of the first network element and the second identifier. Alternatively, the certificate reservation request includes the second identifier. The second identifier can be understood as the identifier of the first network element provided by the client, or the identity identifier of the first network element provided by the client. For the remaining implementation, please refer to the relevant description in the above step S502, which will not be repeated here.

[0338] S1102, verifying the address information of the first network element. Verifying the address information of the first network element can also be understood as: verifying whether the client has control over the address information of the first network element. Please refer to the relevant description in the above step S1002, which will not be repeated here.

[0339] S1103: The client sends a certificate issuance request to the first server. Correspondingly, the first server receives the certificate issuance request from the client.

[0340] Exemplarily, when the certificate reservation request includes the address information of the first network element and the second identifier, the certificate issuance request may include the second identifier or the address information of the first network element. When the certificate reservation request includes the address information of the first network element but does not include the second identifier, the certificate issuance request includes the second identifier.

[0341] S1104: The first server sends second information to the second network element. Correspondingly, the second network element receives the second information from the first server.

[0342] The second information is used to confirm whether the second identifier is an identifier corresponding to the address information of the first network element, or to confirm whether the second identifier and the address information of the first network element match or correspond. Exemplarily, the second information may include the address information of the first network element and the second identifier.

[0343] Optionally, when the certificate reservation request includes the address information of the first network element and the second identifier, there is no strict order between step S1104 and step S1102, and step S1102 may be executed first, and then step S1104; or, step S1104 may be executed first, and then step S1102; or, step S1102 and S1104 may be executed simultaneously.

[0344] In the case that the certificate reservation request includes the address information of the first network element but does not include the second identifier, the first server may execute step S1104 after acquiring the second identifier in step S1103.

[0345] When the certificate reservation request includes the second identifier (ie, the identity identifier of the first network element) but does not include the address information of the first network element, the first server may obtain the address information of the first network element in step S1103 and then execute S1104.

[0346] S1105: The second network element sends the third information to the first server. Correspondingly, the first server receives the third information from the second network element.

[0347] The third information indicates whether the second identifier is an identifier corresponding to the address information of the first network element, or indicates whether the second identifier and the address information of the first network element match or correspond.

[0348] S1106: When the third information indicates that the second identifier corresponds to the address information of the first network element, use the second identifier as the first identifier.

[0349] In a possible implementation, the above steps S1104-S1106 can be understood as the first server verifying the authenticity or legality of the second identifier. When the third information indicates that the second identifier corresponds to the address information of the first network element, it means that the second identifier is verified. Therefore, the first server can understand the second identifier as the real (or legal) identifier of the first network element, that is, the first server uses the second identifier as the first identifier.

[0350] After step S1106, the first server may learn the identification of the first network element. If the address information of the first network element is verified in step S1102, the first server may execute step S902 to issue a certificate to the first network element.

[0351] Method 3: The client can send the first identifier to the first server. After receiving the first identifier, the first server queries the second network element for the address information corresponding to the first identifier. Correspondingly, the second network element can return the address information of the first network element corresponding to the first identifier.

[0352] Optionally, the client, the first server, and the second network element may be Fig.12 The process shown is the information exchange in mode 2:

[0353] S1200. Create an account for the client. Please refer to the above Figure 5 The instructions for creating a client account in the method shown are not repeated here.

[0354] S1201: A client sends a certificate reservation request to a first server. Correspondingly, the first server receives the certificate reservation request from the client, wherein the certificate reservation request includes an identifier of a first network element.

[0355] In a possible implementation, after receiving the certificate reservation request, the first server may temporarily use the identifier of the first network element carried in the certificate reservation request as the first identifier. That is, the first server temporarily considers that the identifier carried in the certificate reservation request is the real (or legal) identifier of the first network element. Then, the following step S1202 is executed.

[0356] S1202: The first server sends fourth information to the second network element. Correspondingly, the second network element receives the fourth information from the first server.

[0357] The fourth information is used to request the address information corresponding to the first identifier. Exemplarily, the fourth information may include the first identifier. The address information corresponding to the first identifier is the address information of the first network element.

[0358] S1203: The second network element sends the address information of the first network element to the first server. Correspondingly, the first server receives the address information of the first network element.

[0359] In a possible implementation, after receiving the fourth information, the second network element may query the address information of the network element corresponding to it according to the first identifier. If the query is successful, the queried address information is returned to the first server. If the query fails, it means that the first identifier may not be a real or legal identifier of the first network element. The second network element may indicate to the first server that the first identifier is illegal or that the second network element does not store the address information corresponding to the first identifier, or does not send a response to the fourth information to the first server.

[0360] In a possible implementation, after the first server receives the address information of the first network element, it can be considered that the second network element stores the address information corresponding to the first identifier, and thus it can be considered that the first identifier is indeed a real (or legal) identifier of the first network element, and then the following step S1204 is executed. If the first server does not receive the address information of the first network element, it can be considered that the first identifier is an illegal identifier, and the subsequent solution is not executed.

[0361] S1204: Verify the address information of the first network element. Verifying the address information of the first network element can also be understood as: verifying whether the client has the control right over the address information of the first network element. Please refer to the relevant description in the above step S1002, which will not be repeated here.

[0362] In step S1204, when the address information of the first network element is verified, the first server may execute step S902 to issue a certificate to the first network element.

[0363] In a possible implementation, Fig.12 As shown, before the first server issues a certificate to the first network element, the client may send a certificate issuance request to the first server. Accordingly, the first server receives the certificate issuance request from the client. The certificate issuance request may include the address information and / or the first identifier of the first network element. The first server may issue a certificate to the first network element in response to the certificate issuance request.

[0364] In a possible implementation manner, in the above-mentioned methods 1 to 3, the client may be deployed in the first network element, or in other words, the client and the first network element may be co-located. Figures 10 to 12 In the embodiment, the functions implemented by the client can also be understood as the functions implemented by the first network element.

[0365] Method 4: The client can send the address information of the first network element to the first server. After receiving the address information of the first network element, the first server uses the address information of the first network element to query the first identifier corresponding to the address information of the first network element from the correspondence between the address information and the identifier.

[0366] In a possible implementation, the client may actively send the address information of the first network element to the first server. For example, the client may send the address information of the first network element to the first server when applying for a certificate for the first network element.

[0367] Optionally, the client and the first server can Fig.13 The process shown is the information exchange in mode 2:

[0368] S1300a, create an account for the client. Please refer to the above Figure 5 The instructions for creating a client account in the method shown are not repeated here.

[0369] S1300b. Preconfigure or prestore the correspondence between the address information and the identifier of the network element in the first server.

[0370] In a possible implementation manner, the corresponding relationship may be sent by the second network element to the first server. Alternatively, the corresponding relationship may be configured in an offline manner, which is not specifically limited in the present application.

[0371] It should be noted that there is no strict order between steps S1300a and S1300b. Step S1300a may be performed first, and then step S1300b; or step S1300b may be performed first, and then step S1300a; or step S1300a and step S1300b may be performed simultaneously. This application does not make any specific limitation on this.

[0372] S1301: The client sends a certificate reservation request to the first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0373] The certificate reservation request includes the address information of the first network element. Please refer to the relevant description in the above step S502, which will not be repeated here.

[0374] In a possible implementation manner, when the client and the first network element are deployed separately, before step S1301, the first network element may send a certificate application request to the client to request the client to apply for a certificate for the first network element.

[0375] S1302: Verify the address information of the first network element. Verifying the address information of the first network element can also be understood as: verifying whether the client has control over the address information of the first network element. Please refer to the relevant description in the above step S1002, which will not be repeated here.

[0376] After the address information of the first network element is verified, the first server can determine the first identifier based on the address information of the first network element and the correspondence between the address information and the identifier. For example, the first server can use the address information of the first network element to query the first identifier corresponding to the address information of the first network element from the correspondence between the address information and the identifier.

[0377] After the address information of the first network element is verified and the first server queries the first identifier, the first server may execute step S902 to issue a certificate to the first network element.

[0378] In a possible implementation, Fig.13 As shown, before the first server issues a certificate to the first network element, the client may send a certificate issuance request to the first server. Accordingly, the first server receives the certificate issuance request from the client. The certificate issuance request may include the address information and / or the first identifier of the first network element. The first server may issue a certificate to the first network element in response to the certificate issuance request.

[0379] As a possible implementation, after receiving the certificate issuance request, the first server can verify whether the address information of the first network element carried in the certificate issuance request has been verified, or verify whether the address information of the first network element corresponding to the first identifier has been verified. After confirming that the address information of the first network element has been verified, a certificate is issued to the first network element.

[0380] In a possible implementation manner, if the client is deployed in an NRF network element, after the client receives the certificate of the first network element, the following step S1303 may also be performed:

[0381] S1303. The NRF network element updates the NF profile of the first network element, and adds the certificate information of the first network element to the NF profile of the first network element.

[0382] In another possible implementation, if the client and the NRF network element are deployed separately, after receiving the certificate of the first network element, the client may also send the certificate of the first network element to the NRF network element. After receiving the certificate, the NRF network element may add the certificate information of the first network element to the NF configuration file of the first network element.

[0383] Based on the above scheme, the first server can verify the address information of the first network element. If the address information of the first network element is verified, the first server can believe that it can legally represent the subject (i.e., the network element) of the domain name or IP address, and therefore believe that the identifier of the network element is also legal, and thus believe that the identity verification of the certificate subject is passed, and then issue a certificate to the network element. Since it is usually not necessary to pre-establish initial trust between the client and the first server when verifying the address information, and it is not necessary to pre-deploy related work, the degree of automation of certificate issuance can be improved and the complexity of certificate issuance can be reduced.

[0384] In addition to the above method, the present application embodiment also provides an identity authentication method, such as Fig.17 As shown, the identity authentication method includes the following steps:

[0385] S1701. The first server verifies the address information of the first network element.

[0386] The address information of the first network element may include a domain name (such as FQDN) or an IP address, such as an IPv4 or IPv6 address. Please refer to the above description of the address information, which will not be repeated here.

[0387] In a possible implementation manner, verifying the address information of the first network element may also be understood as: verifying that the client has control over the address information of the first network element.

[0388] In a possible implementation, the first server may be an automatic certificate management environment (ACME) server. The first server may verify the address information of the first network element based on an HTTP verification method, a DNS verification method, or a TLS-ALPN verification method of ACME.

[0389] For example, when the first server is an ACME server, Fig.18 As shown, before step S1701, the method further includes the following steps S1700a-S1700c:

[0390] S1700a. The client and the first server are initialized and an ACME account is created.

[0391] S1700b. The client generates a certificate reservation request.

[0392] The certificate reservation request includes the address information of the first network element. Exemplarily, the address information of the first network element can be used as an identifier, that is, identifier = address information of the first network element. The certificate reservation request can also be understood as an order for the certificate.

[0393] S1700c: The client sends a certificate reservation request to the first server. Correspondingly, the first server receives the certificate reservation request from the client.

[0394] After step S1700c, the first server, the client, and the second server interact to verify the address information of the first network element. The verification method can refer to the HTTP verification method, DNS verification method, or TLS-ALPN verification method of ACME, which will not be described in detail here.

[0395] S1702: When the address information of the first network element is verified successfully, the first server determines an identifier of the first network element according to the address information of the first network element.

[0396] Among them, the relationship between the address information of the first network element and the identifier of the first network element can refer to the relevant descriptions in the above-mentioned method A to method C of step S501, which will not be repeated here.

[0397] S1703. The first server issues a certificate to the first network element, where the certificate includes an identifier of the first network element.

[0398] Optionally, when the address information of the first network element is verified, the client may send a certificate issuance request to the first server. After receiving the certificate issuance request from the client, the first server responds to the certificate issuance request and issues a certificate to the first network element.

[0399] Optionally, the certificate issuance request may include an identifier of the first network element. At this time, the first server may determine whether the identifier of the first network element carried in the certificate issuance request is the same as the identifier of the first network element determined according to the address information of the first network element in the above step S1702. If they are the same, step S1703 is executed to issue a certificate to the first network element.

[0400] Optionally, a certificate signing request may also be referred to as a CSR or a certificate issuance request, and the three may be interchangeable.

[0401] In a possible implementation, the first server issuing a certificate to the first network element may include: the first server sending the certificate of the first network element to the client. Accordingly, the client obtains the certificate issued by the first server to the first network element. In the case where the client and the first network element are deployed separately, after the client obtains the certificate issued by the first server to the first network element, the client may send the certificate to the first network element.

[0402] In a possible implementation, the certificate may be an X.509 certificate, which is used for communication between the first network element and other network elements in the core network, that is, the first network element may use the certificate when communicating with other network elements.

[0403] In a possible implementation, the identifier of the first network element is carried in the subject alias (subjectAltName) field and / or the subject name (subjectName) field of the certificate, that is, the subject alias and / or the subject name of the certificate may include the identifier of the first network element.

[0404] Optionally, the subject alias and / or subject name may also include other information, such as the subject alias may also include address information of the first network element, such as an IP address, a domain name, etc., and the subject name may also include an organization name, a distinguished name, etc. This application does not make specific limitations on this.

[0405] In a possible implementation, based on the structural relationship between the address information of the first network element and the identifier of the first network element shown in method A of step S501, in the above step S1702, the first server can also obtain the type, country, home domain name, and other information of the first network element that needs to be carried in the certificate according to the address information of the first network element. For example, the above NF type can indicate the type of the first network element, and MCC and MNC can indicate the country and home domain name. Based on this, the client does not need to carry the type, country, home domain name, and other information of the first network element in the certificate issuance request, thereby reducing signaling overhead.

[0406] Based on the construction relationship between the address information of the first network element and the identifier of the first network element shown in method B of the above step S501, the certificate issuance request sent by the above client needs to carry at least one of the identifier (Set ID) of the set to which the network element belongs, the region identifier (Region ID) or the network element type (NF type), MCC, and MNC, so that the first server can determine the identifier of the first network element.

[0407] Optional, in Fig.17 or Fig.18 In the method shown, the client may be co-located with the first network element, the second server may be co-located with the first network element, or the second server may be co-located with the NRF network element.

[0408] Based on the above scheme, the first server can verify the address information of the first network element. If the address information of the first network element is verified, the first server can believe that the identifier of the first network element constructed by the address information can legally represent the subject of the domain name or IP address (i.e., the network element), and therefore believe that the identifier of the network element is also legal, and thus believe that the identity verification of the certificate subject has passed, and then issue a certificate to the network element. Since it is usually not necessary to pre-establish initial trust between the client and the first server when verifying the address information, and it is not necessary to pre-perform related deployment work, the degree of automation of certificate issuance can be improved and the complexity of certificate issuance can be reduced.

[0409] In one implementation scenario, the embodiment of the present application further provides an identity authentication method, in which an address information certificate may be issued to a network element first, and then verified during subsequent interactions between network elements. Fig.19 As shown, the identity authentication method includes the following steps:

[0410] S1901. A first network element sends an address information certificate of the first network element to a second network element. Correspondingly, the second network element receives the address information certificate of the first network element.

[0411] The address information certificate of the first network element includes the address information of the first network element. Exemplarily, the address information may be a domain name (such as FQDN) or an IP address. The address information certificate may be referred to as a domain name certificate or an IP address certificate.

[0412] In a possible implementation, the first network element may serve as a NF consumer, and correspondingly, the second network element may serve as a NF producer; or, the first network element may serve as a NF producer, and correspondingly, the second network element may serve as a NF consumer.

[0413] In a possible implementation, the first network element may send the address information certificate of the first network element to the second network element in a TLS handshake message.

[0414] In a possible implementation, before step S1901, the ACME server may issue an address information certificate of the second network element to the second network element. Further, the ACME server may also issue an address certificate of the first network element to the first network element. The implementation of the ACME server issuing certificates to network elements can refer to the relevant description in the ACME protocol, which will not be repeated here.

[0415] S1902: The second network element determines a first identifier according to the address information of the first network element. The first identifier can be understood as an identifier of the first network element determined according to the address information of the first network element.

[0416] Exemplarily, the second network element may obtain the address information of the first network element from the address information certificate of the first network element, and then determine the first identifier based on the address information of the first network element. The relationship between the address information of the first network element and the first identifier may refer to the relevant description of the relationship between the address information of the network element and the network element identifier in the above-mentioned method A-method C of step S501, which will not be repeated here.

[0417] S1903: When the first identifier and the second identifier are the same, the second network element communicates with the first network element.

[0418] The second identifier is an identifier of the first network element used when the first network element and the second network element communicate. Exemplarily, the second identifier can be obtained through the following three implementations:

[0419] As a first possible implementation, the second network element sends a uniform resource identifier (URI) to the first network element, and correspondingly, the first network element receives the URI from the second network element. In this case, the second identifier is the network element identifier in the URI. The URI is used to uniquely identify a resource.

[0420] In the 5GC service-based interface (SBI) API, when the resource URI is an absolute URI, its structure is as follows: {apiRoot} / <apiname> / <apiversion> / <apispecificresourceuripart>. For example, <apispecificresourceuripart>It can be nf-instances / {nfInstanceID}. That is, the URI is composed of {apiRoot} / {apiName} / {apiVersion} / nf-instances / {nfInstanceID}. The URI and the network element identifier satisfy the following relationship: URI: {apiRoot} / {apiName} / {apiVersion} / nf-instances / {nfInstanceID}.

[0421] Where "apiRoot" is the concatenation of the following:

[0422] a) "http" or "https";

[0423] b) Fixed string ": / / ";

[0424] c) Internet Engineering Task Force (IETF) request for comments (RFC)

[0425] The authority (host and optional port) defined in 3986. The host should be represented by a carrier-specific FQDN;

[0426] d) An optional deployment-specific string (also known as an API prefix), starting with a " / " character.

[0427] "apiName" indicates the name of the API. For example, "nsmf-pdusession".

[0428] "apiVersion" indicates the major version of the API. For example, "v1".

[0429] nfInstanceID indicates the network element identifier.

[0430] Exemplarily, when the first network element acts as an NF producer and the second network element acts as an NF consumer, the network element identifier in the URI may be returned by the NRF network element to the second network element in the service discovery process. When the first network element acts as an NFconsumer and the second network element acts as an NF producer, the network element identifier in the URI may be carried in the service request sent by the first network element to the second network element.

[0431] As a second possible implementation, when the first network element acts as an NF producer and the second network element acts as an NF consumer, before step S1901, the second network element may trigger a service discovery process, in which the NRF network element may send a second identifier to the second network element. Accordingly, the second network element receives the second identifier from the NRF network element in the service discovery process. Subsequently, when the second network element requests a service from the first network element, it may carry the second identifier.

[0432] In the first and second possible implementations described above, the second network element communicating with the first network element may include: the second network element establishing a TLS channel with the first network element.

[0433] As a third possible implementation, when the first network element acts as an NF consumer and the second network element acts as an NF producer, the first network element may send an NF service request message to the second network element, and accordingly, the second network element receives the NF service request message from the first network element, wherein the NF service request message carries the second identifier. At this time, the second network element communicating with the first network element may include: the second network element sending an NF service response message to the first network element.

[0434] In a possible implementation manner, when the first identifier and the second identifier are the same, the second network element may store the address information certificate of the first network element.

[0435] For example, the first network element is used as the NF consumer and the second network element is used as the NF producer. Fig. 20 As shown, the above Fig.19 An application flow of the method shown. Fig. 20 , the process includes the following steps:

[0436] S2001. A first network element sends a TLS handshake message to a second network element. Correspondingly, the second network element receives the TLS handshake message from the first network element. Exemplarily, the TLS handshake message may be a Client Hello message.

[0437] S2002: The second network element sends a TLS handshake message to the first network element. Correspondingly, the first network element receives the TLS handshake message from the second network element.

[0438] The TLS handshake message includes the address information certificate of the second network element. Exemplarily, the TLS handshake message may be a Server Hello message. The implementation of step S2002 may refer to the description of step S1901 above, which will not be repeated here.

[0439] S2003. The first network element determines a third identifier according to the address information of the second network element, and verifies whether the third identifier is the same as the fourth identifier. The third identifier can be understood as the identifier of the second network element determined according to the address information of the second network element. The fourth identifier can be understood as the identifier of the second network element used when the second network element communicates with the first network element.

[0440] Among them, the first network element determines the implementation of the third identifier based on the address information of the second network element. You can refer to step S1902, where the second network element determines the implementation of the first identifier based on the address information certificate of the first network element. The fourth identifier can refer to the implementation of the second identifier, which will not be repeated here.

[0441] S2004: When the third identifier and the fourth identifier are the same, the first network element sends the address information certificate of the first network element to the second network element. Correspondingly, the second network element receives the address information certificate of the first network element. Please refer to the description of the above step S1901, which will not be repeated here.

[0442] Optionally, when the third identifier and the fourth identifier are the same, the first network element may also store the address information certificate of the second network element.

[0443] S2005. The second network element determines the first identifier according to the address information certificate of the first network element, and verifies whether the first identifier is the same as the second identifier.

[0444] Among them, the implementation of step S2005 can refer to the relevant instructions in the above steps S1902 and S1903, which will not be repeated here.

[0445] S2006: When the first identifier is the same as the second identifier, the second network element and the first network element establish a TLS channel.

[0446] Exemplarily, the second network element and the first network element may establish a TLS channel based on the address information certificate of the second network element and the address information certificate of the first network element.

[0447] Optionally, after step S2006, the method may further include the following steps S2007 and S2008:

[0448] S2007. The first network element sends an NF service request message to the second network element. Correspondingly, the second network element receives the NF service request message from the first network element.

[0449] S2008. The second network element sends an NF service response message to the first network element. Correspondingly, the first network element receives the NF service response message from the second network element.

[0450] In addition, if Fig.21 As shown, the above Fig.19 Another application process of the method shown. Fig.21 , the process includes the following steps:

[0451] S2101. A first network element sends a TLS handshake message to a second network element. Correspondingly, the second network element receives the TLS handshake message from the first network element. Exemplarily, the TLS handshake message may be a Client Hello message.

[0452] S2102: The second network element sends a TLS handshake message to the first network element. Correspondingly, the first network element receives the TLS handshake message from the second network element.

[0453] The TLS handshake message includes the address information certificate of the second network element. Exemplarily, the TLS handshake message may be a Server Hello message. The implementation of step S2002 may refer to the description of step S1901 above, which will not be repeated here. After the first network element receives the address information certificate of the second network element, it may save the address information certificate of the second network element.

[0454] S2103, the first network element sends the address information certificate of the first network element to the second network element. Correspondingly, the second network element receives and saves the address information certificate of the first network element. Please refer to the description of the above step S1901, which will not be repeated here.

[0455] S2104. The second network element and the first network element establish a TLS channel.

[0456] Exemplarily, the second network element and the first network element may establish a TLS channel based on the address information certificate of the second network element and the address information certificate of the first network element.

[0457] S2105. The first network element sends an NF service request message to the second network element. Correspondingly, the second network element receives the NF service request message from the first network element. The NF service request message includes a second identifier, and the second identifier represents the identity identifier of the sender of the service request message, that is, the identity identifier of the first network element.

[0458] S2106. The second network element determines the first identifier according to the address information certificate of the first network element, and verifies whether the first identifier is the same as the second identifier.

[0459] Among them, the implementation of step S2106 can refer to the relevant instructions in the above steps S1902 and S1903, which will not be repeated here.

[0460] S2107: When the first identifier and the second identifier are the same, the second network element sends an NF service response message to the first network element. Correspondingly, the first network element receives the NF service response message from the second network element.

[0461] Based on the above solution, the consistency of the certificate identity and the network element identifier can be verified based on the address information certificate of the network element. For example, the address information certificate of the network element is obtained, the identifier of the network element is obtained from the address information certificate, and then verified with the identifier of the requested service. If the verification is successful, communication is performed. This solution does not require modifying the current certificate issuance process, which can improve the applicability of the solution.

[0462] It is understandable that in each of the above embodiments, the methods and / or steps implemented by the client may also be implemented by components (such as processors, chips, chip systems, circuits, logic modules, or software) that can be used for the client; the methods and / or steps implemented by the server may also be implemented by components (such as processors, chips, chip systems, circuits, logic modules, or software) that can be used for the server. The chip system may be composed of chips, or the chip system may include chips and other discrete devices.

[0463] It is understandable that, in order to realize the above functions, the communication device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0464] The embodiment of the present application can divide the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0465] communication device Fig.14 The structure diagram of a communication device 140 is shown. The communication device 140 includes a processing module 1401 and a transceiver module 1402. The communication device 140 can be used to implement the functions of the above-mentioned client or server (including the first server and the second server) or the second network element.

[0466] In some embodiments, the communication device 140 may further include a storage module ( Fig.14 ), for storing program instructions and data.

[0467] In some embodiments, the transceiver module 1402 may also be referred to as a transceiver unit for implementing a sending and / or receiving function. The transceiver module 1402 may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface.

[0468] In some embodiments, the transceiver module 1402 may include a receiving module and a sending module, which are respectively used to execute the receiving and sending steps performed by the client or server in the above-mentioned method embodiments, and / or used to support other processes of the technology described herein; the processing module 1401 may be used to execute the processing steps (such as determination, etc.) performed by the client or server in the above-mentioned method embodiments, and / or used to support other processes of the technology described herein.

[0469] When the communication device 140 is used to implement the above-mentioned client functions:

[0470] The processing module 1401 is used to obtain the address information of the first network element and the identifier of the first network element, the address information includes a domain name or an Internet Protocol IP address; the transceiver module 1402 is used to send a certificate reservation request to the first server, the certificate reservation request includes the address information of the first network element; the transceiver module 1402 is also used to receive challenge information from the first server, the challenge information includes a token, and the token is used to perform an identity authentication challenge for the first network element; the processing module 1401 is also used to determine response information to the challenge information based on the first key authorization and the identifier of the first network element, the response information is used to prove that the client has control over the address information of the first network element, and the first key authorization is determined based on the token and the client's account key.

[0471] Optionally, the response information of the challenge information includes a first string, which is a value constructed according to the first key authorization and the identifier of the first network element. The processing module 1401 is further configured to use the first string as a resource under a first path of the address information, which is determined according to the token.

[0472] Optionally, the response information of the challenge information includes a first string, which is a value constructed according to the first key authorization and the identifier of the first network element. The processing module 1401 is further configured to use the first string as a text record of a verification address, which is determined according to the address information of the first network element.

[0473] Optionally, the response information of the challenge information includes a self-signed certificate of the client, and the self-signed certificate includes a first field and a second field. The first field carries the address information of the first network element, and the second field carries the first string, which is a value constructed according to the first key authorization and the identifier of the first network element; or, the first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

[0474] Optionally, the first field is a subject alias field, and the second field is a protocol identification field.

[0475] Optionally, the processing module 1401 is further configured to obtain a certificate issued by the first server to the first network element, where the certificate includes an identifier of the first network element.

[0476] Optionally, the processing module 1401 is used to obtain the address information of the first network element and the identifier of the first network element, including: the processing module 1401 is used to obtain the address information of the first network element and the identifier of the first network element from the second network element. The second network element is at least one of the following: a certificate management function CMF network element, a certificate management network function CMNF network element, a network storage function NRF network element, an operation management and maintenance OAM network element, a network function virtualization management and orchestration NFV MANO network element, a first network element or a client.

[0477] When the communication device 140 is used to implement the function of the first server, in a possible implementation manner:

[0478] The transceiver module 1402 is used to send a request message to the second server, where the request message is used to request first information corresponding to the first network element, and the first information is used to prove that the client has control over the address information of the first network element; the transceiver module 1402 is also used to receive first information from the second server, where the first information includes an identifier of the first network element corresponding to the address information of the first network element, and the identifier of the first network element is a unique identity identifier of the first network element; the processing module 1401 is used to issue a certificate to the first network element when it is determined that the client has control over the address information of the first network element based on the first information, and the certificate includes the identifier of the first network element.

[0479] Optionally, the first information further includes a third string. The client has control over the address information of the first network element, including: the third string is the same as the second string, the second string is determined based on a second key authorization, the second key authorization is determined based on a token and an account key of the client, and the token is used to perform an identity authentication challenge of the first network element.

[0480] Optionally, the first information includes an identifier of the first network element corresponding to the address information of the first network element, including: the first information includes a self-signed certificate of the client, and the self-signed certificate includes a first field and a second field. The first field carries the address information of the first network element, and the second field carries a first string, and the first string is a value constructed according to the first key authorization and the identifier of the first network element; or, the first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

[0481] Optionally, when the first field carries the address information of the first network element and the second field carries the first string, the client has control over the address information of the first network element, including: the third string is the same as the second string. The third string is determined based on the first string, the second string is determined based on the second key authorization, the second key authorization is determined based on the token and the client's account key, and the token is used to perform an identity authentication challenge for the first network element.

[0482] Optionally, when the first field carries the identifier of the first network element and the second field carries the first key authorization or the summary of the first key authorization, the client has control over the address information of the first network element, including: the first key authorization and the second key authorization are the same, or the summary of the first key authorization and the summary of the second key authorization are the same. The second key authorization is determined based on the token and the account key of the client, and the token is used to perform the identity authentication challenge of the first network element.

[0483] Optionally, the transceiver module 1402 is also used to receive a certificate reservation request from the client, the certificate reservation request includes address information of the first network element; the transceiver module 1402 is also used to send challenge information to the client, the challenge information includes a token, the token is used to perform an identity authentication challenge for the first network element, and the first information is response information to the challenge information.

[0484] Optionally, processing module 1401 is used to issue a certificate for the first network element, including: processing module 1401 is used to receive a certificate issuance request from the client through transceiver module 1402, the certificate issuance request including the identifier of the first network element and / or the address information of the first network element; in response to the certificate issuance request, processing module 1401 is also used to issue a certificate for the first network element.

[0485] When the communication device 140 is used to implement the function of the first server, in another possible implementation:

[0486] Processing module 1401 is used to obtain address information of the first network element and a first identifier corresponding to the address information of the first network element, where the address information is a domain name or an Internet Protocol IP address, and the first identifier is the identifier of the first network element; processing module 1401 is also used to issue a certificate to the first network element when the address information of the first network element is verified, and the certificate includes the first identifier.

[0487] Optionally, the processing module 1401 is used to obtain the address information of the first network element and the first identifier corresponding to the address information of the first network element, including: the processing module 1401 is used to receive the address information of the first network element from the client through the transceiver module 1402; it is also used to send first information to the second network element through the transceiver module 1402, and the first information is used to request the identifier corresponding to the address information of the first network element; it is also used to receive the first identifier from the second network element through the transceiver module 1402.

[0488] Optionally, the transceiver module 1402 is also used to receive a second identifier from the client; the processing module 1401 is used to issue a certificate to the first network element when the address information of the first network element is verified, including: the processing module 1401 is used to issue a certificate to the first network element when the address information of the first network element is verified and the second identifier is the same as the first identifier.

[0489] Optionally, the processing module 1401 is used to obtain the address information and the first identifier of the first network element, including: the processing module 1401 is used to receive the address information and the second identifier of the first network element from the client through the transceiver module 1402; it is also used to send second information to the second network element through the transceiver module 1402, and the second information is used to confirm whether the second identifier is the identifier corresponding to the address information of the first network element; it is also used to receive third information from the second network element through the transceiver module 1402; when the third information indicates that the second identifier is the identifier corresponding to the address information of the first network element, the processing module 1401 is used to use the second identifier as the first identifier.

[0490] Optionally, the processing module 1401 is used to obtain the address information and the first identifier of the first network element, including: the processing module 1401 is used to receive the first identifier from the client through the transceiver module 1402; it is also used to send fourth information to the second network element through the transceiver module 1402, and the fourth information is used to request the address information corresponding to the first identifier; it is also used to receive the address information of the first network element from the second network element through the transceiver module 1402.

[0491] Optionally, processing module 1401 is used to obtain address information and a first identifier of a first network element, including: processing module 1401 is used to receive address information of the first network element from a client via transceiver module 1402; processing module 1401 is also used to determine the first identifier based on the address information of the first network element and the correspondence between the address information and the identifier.

[0492] When the communication device 140 is used to implement the function of the first server, in another possible implementation:

[0493] Processing module 1401 is used to verify the address information of the first network element, where the address information is a domain name or an Internet Protocol IP address; processing module 1401 is also used to determine the identifier of the first network element based on the address information of the first network element when the address information of the first network element is verified; processing module 1401 is also used to issue a certificate to the first network element, where the certificate includes the identifier of the first network element.

[0494] When the communication device 140 is used to implement the function of the second network element:

[0495] The transceiver module 1402 is used to receive the address information certificate of the first network element, the address information certificate includes the address information of the first network element, the address information is a domain name or an Internet Protocol IP address; the processing module 1401 is used to determine the first identifier according to the address information of the first network element, the first identifier is the identifier of the first network element; when the first identifier and the second identifier are the same, the transceiver module 1402 is also used to communicate with the first network element, and the second identifier is the identifier of the first network element used when the first network element and the second network element communicate.

[0496] Optionally, the transceiver module 1402 is further configured to send a uniform resource identifier URI to the first network element, where the URI includes the second identifier.

[0497] Optionally, the transceiver module 1402 is further used to receive a second identifier from a network storage function NRF network element in the service discovery process.

[0498] Optionally, the transceiver module 1402 is further used to receive a network function NF service request message from the first network element, where the NF service request message includes a second identifier.

[0499] Optionally, when the address information of the first network element is a domain name, the address information of the first network element consists of an identifier of the first network element and at least one of the following: a mobile country code MCC, a mobile network code MNC, or a preset character string.

[0500] Optionally, when the identifier of the first network element is the instance identifier of the first network element, the address information of the first network element satisfies the following format:

[0501] nfinstanceid<NF instanceID>.mnc <mnc>.mcc <mcc>.Preset string

[0502] Among them, NF instanceID represents the identifier of the first network element.

[0503] Optionally, the identifier of the first network element is determined by at least one of the following: a number of the first network element in a set to which the first network element belongs, an identifier of the set, an area identifier, or a type of the first network element.

[0504] Optionally, when the address information of the first network element is an IP address, the identifier of the first network element is determined by the IP address of the first network element and at least one of the following: the number of the first network element in the set to which the first network element belongs, the identifier of the set, the area identifier, the type of the first network element, MCC or MNC.

[0505] Optionally, the identifier of the first network element is the same as the address information of the first network element.

[0506] When the communication device 140 is used to implement the function of the second server:

[0507] The processing module 1401 is used to obtain the address information of the first network element and the identifier of the first network element, the address information includes a domain name or an Internet Protocol IP address; the transceiver module 1402 is used to receive information from the client for determining the first key authorization; the processing module 1401 is also used to determine the text record of the verification address based on the first key authorization and the identifier of the first network element, the verification address is determined based on the address information of the first network element, and the text record of the verification address is used to prove that the client has control over the address information of the first network element.

[0508] Optionally, the transceiver module 1402 is further used to receive a request message from the first server, where the request message is used to request a text record of the verification address; and send the text record of the verification address to the first server.

[0509] Among them, all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0510] In the present application, the communication device 140 may be presented in the form of dividing various functional modules in an integrated manner. The "module" here may refer to a specific application-specific integrated circuit (ASIC), a circuit, a processor and a memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions.

[0511] In some embodiments, when Fig.14 When the communication device 140 is a chip or a chip system, the function / implementation process of the transceiver module 1402 can be implemented through the input and output interface (or communication interface) of the chip or the chip system, and the function / implementation process of the processing module 1401 can be implemented through the processor (or processing circuit) of the chip or the chip system.

[0512] Since the communication device 140 provided in this embodiment can execute the above method, the technical effects that can be obtained can refer to the above method embodiments and will not be repeated here.

[0513] As a possible product form, the server or client described in the embodiments of the present application can also be implemented using the following: one or more field programmable gate arrays (FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout the present application.

[0514] As another possible product form, the client or server or second network element in this application can adopt Fig.15 The structure shown, or including Fig.15 Parts shown. Fig.15 A schematic diagram of the composition of a communication device 1500 provided in the present application, wherein the communication device 1500 may be a server or a chip or a system on chip in a server; or, it may be a client or a module or a chip or a system on chip in a client; or, it may be a second network element or a module or a chip or a system on chip in a second network element.

[0515] like Fig.15 As shown, the communication device 1500 includes at least one processor 1501 and at least one communication interface ( Fig.15 The communication device 1500 is merely exemplary and is described by taking a communication interface 1504 and a processor 1501 as an example. Optionally, the communication device 1500 may further include a communication bus 1502 and a memory 1503.

[0516] The processor 1501 may be a general-purpose central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 1501 may also be other devices with processing functions, such as circuits, devices, or software modules, without limitation.

[0517] The communication bus 1502 is used to connect different components in the communication device 1500 so that the different components can communicate. The communication bus 1502 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.15 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0518] The communication interface 1504 is used to communicate with other devices or communication networks. Exemplarily, the communication interface 1504 can be a module, a circuit, a transceiver, or any device capable of implementing communication. Optionally, the communication interface 1504 can also be an input and output interface located in the processor 1501 to implement signal input and signal output of the processor.

[0519] The memory 1503 may be a device with a storage function, used to store instructions and / or data, wherein the instructions may be computer programs.

[0520] Exemplarily, the memory 1503 may be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

[0521] It should be noted that the memory 1503 may exist independently of the processor 1501 or may be integrated with the processor 1501. The memory 1503 may be located inside the communication device 1500 or outside the communication device 1500, without limitation. The processor 1501 may be used to execute instructions stored in the memory 1503 to implement the methods provided in the following embodiments of the present application.

[0522] As an optional implementation, the communication device 1500 may also include an output device 1505 and an input device 1506. The output device 1505 communicates with the processor 1501 and can display information in a variety of ways. For example, the output device 1505 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 1506 communicates with the processor 1501 and can receive user input in a variety of ways. For example, the input device 1506 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0523] In some embodiments, in terms of hardware implementation, those skilled in the art may think of the above Fig.14 The communication device 140 shown may be implemented using Fig.15 The form of the communication device 1500 is shown.

[0524] As an example, Fig.14 The function / implementation process of the processing module 1401 in Fig.15 The processor 1501 in the communication device 1500 shown calls the computer execution instructions stored in the memory 1503 to implement. Fig.14 The function / implementation process of the transceiver module 1402 can be Fig.15 The communication interface 1504 in the communication device 1500 is shown to be implemented.

[0525] It should be noted that Fig.15 The structure shown does not constitute a specific limitation on the client or server. For example, in other embodiments of the present application, the client or server may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0526] In some embodiments, an embodiment of the present application further provides a communication device, which includes a processor for implementing a method in any of the above method embodiments.

[0527] As a possible implementation, the communication device further includes a memory. The memory is used to store necessary computer programs and data. The computer program may include instructions, and the processor may call the instructions in the computer program stored in the memory to instruct the communication device to execute the method in any of the above method embodiments. Of course, the memory may not be in the communication device.

[0528] As another possible implementation, the communication device also includes an interface circuit, which is a code / data read / write interface circuit, which is used to receive computer execution instructions (computer execution instructions are stored in a memory, may be read directly from the memory, or may pass through other devices) and transmit them to the processor.

[0529] As another possible implementation manner, the communication device further includes a communication interface, and the communication interface is used to communicate with a module outside the communication device.

[0530] It can be understood that the communication device can be a chip or a chip system. When the communication device is a chip system, it can be composed of chips, or it can include chips and other discrete devices. The embodiments of the present application do not specifically limit this.

[0531] The present application also provides a computer-readable storage medium on which a computer program or instruction is stored. When the computer program or instruction is executed by a computer, the functions of any of the above method embodiments are implemented.

[0532] The present application also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0533] Those skilled in the art will appreciate that, for the sake of convenience and brevity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0534] It is understood that the systems, devices and methods described in the present application can also be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0535] The units described as separate components may or may not be physically separated, i.e., they may be located in one place, or they may be distributed over multiple network units. The components shown as units may or may not be physical units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0536] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0537] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or may contain one or more servers, data centers and other data storage devices that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state drive (SSD)), etc. In the embodiment of the present application, the computer may include the aforementioned device.

[0538] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in a claim. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0539] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / mcc> < / mnc> < / apispecificresourceuripart> < / apispecificresourceuripart> < / apiversion> < / apiname> < / mcc> < / mnc> < / mcc> < / mcc> < / mnc> < / mcc> < / mnc>

Claims

1. An identity verification method, characterized in that: The method comprises: Acquire address information of a first network element and an identifier of the first network element, the address information including a domain name or an Internet Protocol IP address; Sending a certificate reservation request to the first server, wherein the certificate reservation request includes address information of the first network element; receiving challenge information from the first server, the challenge information including a token, the token being used to perform an identity authentication challenge for the first network element; Response information to the challenge information is determined based on a first key authorization and an identifier of the first network element, the response information being used to prove that the client has control over the address information of the first network element, and the first key authorization is determined based on the token and the account key of the client.

2. The method according to claim 1, characterized in that The response information of the challenge information includes a first character string, where the first character string is a value constructed according to the first key authorization and the identifier of the first network element; the method further includes: The first character string is used as a resource under a first path of the address information, where the first path is determined according to the token.

3. The method according to claim 1, characterized in that The response information of the challenge information includes a first character string, where the first character string is a value constructed according to the first key authorization and the identifier of the first network element; the method further includes: The first character string is used as a text record of a verification address, where the verification address is determined according to the address information of the first network element.

4. The method according to claim 1, characterized in that The response information of the challenge information includes the self-signed certificate of the client, and the self-signed certificate includes a first field and a second field; The first field carries address information of the first network element, and the second field carries a first string, where the first string is a value constructed according to the first key authorization and an identifier of the first network element; or, The first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

5. The method according to claim 4, characterized in that The first field is a subject alias field, and the second field is a protocol identification field.

6. The method according to any one of claims 1 to 5, characterized in that: The method further includes: obtaining a certificate issued by the first server to the first network element, wherein the certificate includes an identifier of the first network element.

7. The method according to claim 6, characterized in that The identifier of the first network element is carried in the subject alias field and / or the subject name field of the certificate.

8. The method according to any one of claims 1 to 7, characterized in that: The acquiring the address information of the first network element and the identifier of the first network element comprises: acquiring the address information of the first network element and the identifier of the first network element from the second network element; The second network element is at least one of the following: a certificate management function CMF network element, a certificate management network function CMNF network element, a network storage function NRF network element, an operation management and maintenance OAM network element, a network function virtualization management and orchestration NFV MANO network element, the first network element or the client.

9. The method according to any one of claims 1 to 8, characterized in that: The identifier of the first network element is an instance identifier of the first network element.

10. An identity verification method, characterized in that: The method comprises: Sending a request message to the second server, where the request message is used to request first information corresponding to the first network element, where the first information is used to prove that the client has control over the address information of the first network element; receiving the first information from the second server, where the first information includes an identifier of the first network element corresponding to the address information of the first network element, where the identifier of the first network element is a unique identity identifier of the first network element; When it is determined according to the first information that the client has the control right over the address information of the first network element, a certificate is issued to the first network element, where the certificate includes an identifier of the first network element.

11. The method according to claim 10, characterized in that The first information also includes a third character string; The client has control over the address information of the first network element, including: the third string is the same as the second string, the second string is determined based on a second key authorization, the second key authorization is determined based on a token and an account key of the client, and the token is used to perform an identity authentication challenge for the first network element.

12. The method according to claim 10, characterized in that The first information includes an identifier of the first network element corresponding to the address information of the first network element, including: the first information includes a self-signed certificate of the client, and the self-signed certificate includes a first field and a second field; The first field carries address information of the first network element, and the second field carries a first string, where the first string is a value constructed according to the first key authorization and an identifier of the first network element; or, The first field carries the identifier of the first network element, and the second field carries the first key authorization or a summary of the first key authorization.

13. The method according to claim 12, characterized in that When the first field carries the address information of the first network element and the second field carries the first character string, the client has control over the address information of the first network element, including: The third string is the same as the second string; the third string is determined based on the first string, the second string is determined based on a second key authorization, the second key authorization is determined based on a token and an account key of the client, and the token is used to perform an identity authentication challenge for the first network element.

14. The method according to claim 12, characterized in that When the first field carries the identifier of the first network element and the second field carries the first key authorization or a summary of the first key authorization, the client has control over the address information of the first network element, including: The first key authorization is the same as the second key authorization, or the summary of the first key authorization is the same as the summary of the second key authorization; the second key authorization is determined based on a token and an account key of the client, and the token is used to perform an identity authentication challenge for the first network element.

15. The method according to any one of claims 10 to 14, characterized in that: The method also includes receiving an account key of the client from the client.

16. The method according to any one of claims 10 to 15, characterized in that: Before sending the request message to the second server, the method further includes: receiving a certificate reservation request from the client, wherein the certificate reservation request includes address information of the first network element; Sending challenge information to the client, the challenge information including a token, the token being used to perform an identity authentication challenge for the first network element, and the first information being response information to the challenge information.

17. The method according to any one of claims 10 to 16, characterized in that: Issuing a certificate for the first network element includes: receiving a certificate issuance request from the client, the certificate issuance request including an identifier of the first network element and / or address information of the first network element; In response to the certificate issuance request, issuing the certificate to the first network element.

18. The method according to any one of claims 10 to 17, characterized in that: The identifier of the first network element is carried in the subject alias field and / or the subject name field of the certificate.

19. The method according to any one of claims 10 to 13, characterized in that: The identifier of the first network element is an instance identifier of the first network element.

20. An identity verification method, characterized in that: The method comprises: Acquire address information of a first network element and an identifier of the first network element, the address information including a domain name or an Internet Protocol IP address; receiving information from a client for determining authorization of a first key; A text record of a verification address is determined based on the first key authorization and the identifier of the first network element, wherein the verification address is determined based on the address information of the first network element, and the text record of the verification address is used to prove that the client has control over the address information of the first network element.

21. The method according to claim 20, characterized in that The method further comprises: receiving a request message from a first server, the request message being used to request a text record of the verification address; A text record of the verification address is sent to the first server.

22. An identity verification method, characterized in that: The method comprises: Acquire address information of a first network element and a first identifier corresponding to the address information of the first network element, the address information being a domain name or an Internet Protocol IP address, and the first identifier being an identifier of the first network element; When the address information of the first network element is verified, a certificate is issued to the first network element, where the certificate includes the first identifier.

23. The method according to claim 22, characterized in that The acquiring the address information of the first network element and the first identifier includes: Receiving address information of the first network element from a client; Sending first information to a second network element, where the first information is used to request an identifier corresponding to the address information of the first network element; Receive the first identifier from the second network element.

24. The method according to claim 23, characterized in that The method further includes: receiving a second identifier from the client; The issuing of a certificate to the first network element when the address information of the first network element passes the verification includes: When the address information of the first network element is verified and the second identifier is the same as the first identifier, a certificate is issued to the first network element.

25. The method according to claim 22, characterized in that The acquiring the address information of the first network element and the first identifier includes: Receiving the address information and the second identifier of the first network element from the client; Sending second information to the second network element, where the second information is used to confirm whether the second identifier is an identifier corresponding to the address information of the first network element; When receiving third information from the second network element, and the third information indicates that the second identifier is an identifier corresponding to the address information of the first network element, the second identifier is used as the first identifier.

26. The method according to claim 22, characterized in that The acquiring the address information of the first network element and the first identifier includes: Receiving the first identifier from the client; Sending fourth information to the second network element, where the fourth information is used to request address information corresponding to the first identifier; Receive address information of the first network element from the second network element.

27. The method according to any one of claims 23 to 26, characterized in that: The second network element is at least one of the following: a certificate management function CMF network element, a certificate management network function CMNF network element, a network storage function NRF network element, an operation management and maintenance OAM network element, or a network function virtualization management and orchestration NFV MANO network element.

28. The method according to claim 22, characterized in that The acquiring the address information of the first network element and the first identifier includes: Receiving address information of the first network element from a client; The first identifier is determined according to the address information of the first network element and the correspondence between the address information and the identifier.

29. The method according to any one of claims 22 to 28, characterized in that: The first identifier is carried in the subject alias field and / or the subject name field of the certificate.

30. An identity verification method, characterized in that: The method comprises: Verifying address information of the first network element, where the address information is a domain name or an Internet Protocol IP address; If the address information of the first network element is verified, determining an identifier of the first network element according to the address information of the first network element; A certificate is issued to the first network element, where the certificate includes an identifier of the first network element.

31. The method according to claim 30, characterized in that When the address information of the first network element is a domain name, the address information of the first network element consists of an identifier of the first network element and at least one of the following: a mobile country code MCC, a mobile network code MNC or a preset character string.

32. The method according to claim 31, characterized in that When the identifier of the first network element is an instance identifier of the first network element, the address information of the first network element satisfies the following format: nfinstanceid<NF instanceID>.mnc <mnc>.mcc <mcc> .Preset string< / mcc> < / mnc> Among them, NF instanceID represents the identifier of the first network element.

33. The method according to claim 31 or 32, characterized in that The identifier of the first network element is determined by at least one of the following: a number of the first network element in the set to which the first network element belongs, an identifier of the set, an area identifier, or a type of the first network element.

34. The method according to claim 30, characterized in that When the address information of the first network element is an IP address, the identifier of the first network element is determined by the IP address of the first network element and at least one of the following: the number of the first network element in the set to which the first network element belongs, the identifier of the set, the area identifier, the type of the first network element, MCC or MNC.

35. The method according to claim 30, characterized in that The identifier of the first network element is the same as the address information of the first network element.

36. An identity verification method, characterized in that: The method comprises: Receiving an address information certificate of a first network element, wherein the address information certificate includes address information of the first network element, wherein the address information is a domain name or an Internet Protocol IP address; Determine a first identifier according to the address information of the first network element, where the first identifier is an identifier of the first network element; When the first identifier and the second identifier are the same, communication is performed with the first network element, and the second identifier is the identifier of the first network element used when the first network element communicates with the second network element.

37. The method according to claim 36, characterized in that When the address information of the first network element is a domain name, the address information of the first network element consists of an identifier of the first network element and at least one of the following: a mobile country code MCC, a mobile network code MNC or a preset character string.

38. The method according to claim 37, characterized in that When the identifier of the first network element is an instance identifier of the first network element, the address information of the first network element satisfies the following format: nfinstanceid<NF instanceID>.mnc <mnc>.mcc <mcc> .Preset string< / mcc> < / mnc> Among them, NF instanceID represents the identifier of the first network element.

39. The method according to claim 37 or 38, characterized in that The identifier of the first network element is determined by at least one of the following: a number of the first network element in the set to which the first network element belongs, an identifier of the set, an area identifier, or a type of the first network element.

40. The method according to claim 36, characterized in that When the address information of the first network element is an IP address, the identifier of the first network element is determined by the IP address of the first network element and at least one of the following: the number of the first network element in the set to which the first network element belongs, the identifier of the set, the area identifier, the type of the first network element, MCC or MNC.

41. The method according to claim 36, characterized in that The identifier of the first network element is the same as the address information of the first network element.

42. The method according to any one of claims 36 to 41, characterized in that: The method further includes: sending a uniform resource identifier URI to the first network element, where the URI includes the second identifier.

43. The method according to any one of claims 36 to 41, characterized in that: The method also includes: receiving the second identifier from a network storage function NRF network element in a service discovery process.

44. The method according to any one of claims 36 to 41, characterized in that: The method also includes: receiving a network function NF service request message from the first network element, and the NF service request message includes the second identifier.

45. A communication device, characterized in that: The communication device includes a processor; the processor is used to run a computer program or instructions so that the communication device performs the method as described in any one of claims 1 to 9, or so that the communication device performs the method as described in any one of claims 10 to 19, or so that the communication device performs the method as described in any one of claims 20 to 21, or so that the communication device performs the method as described in any one of claims 22 to 29, or so that the communication device performs the method as described in any one of claims 30 to 35, or so that the communication device performs the method as described in any one of claims 36 to 44.

46. ​​A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions or programs. When the computer instructions or programs are executed on a computer, the method described in any one of claims 1 to 9 is executed, or the method described in any one of claims 10 to 19 is executed, or the method described in any one of claims 20 to 21 is executed, or the method described in any one of claims 22 to 29 is executed, or the method described in any one of claims 30 to 35 is executed, or the method described in any one of claims 36 to 44 is executed.

47. A computer program product, characterized in that The computer program product includes computer instructions; when part or all of the computer instructions are executed on a computer, the method described in any one of claims 1 to 9 is executed, or the method described in any one of claims 10 to 19 is executed, or the method described in any one of claims 20 to 21 is executed, or the method described in any one of claims 22 to 29 is executed, or the method described in any one of claims 30 to 35 is executed, or the method described in any one of claims 36 to 44 is executed.

48. A chip system, characterized in that: include: a memory for storing computer program instructions; A processor, configured to execute the computer program instructions so that a communication device including the chip performs the method according to any one of claims 1 to 44.

Images