NF service request processing method and device, computer equipment and storage medium

Abstract

The invention relates to an NF service request processing method and device, computer equipment and a computer readable storage medium. The method comprises the following steps: in response to a token acquisition request initiated by a pre-registered NF consumption end and used for acquiring an access token of a target NF providing end, a network storage network element NRF acquires a first consumption end credibility level corresponding to the pre-stored NF consumption end, and acquires a second consumption end credibility level required by the target NF providing end; under the condition that the credibility level of the first consumption end meets the credibility level of the second consumption end, returning the access token to the NF consumption end; and the NF consumption end is used for initiating an NF service request to the target NF providing end by using the access token, so that the target NF providing end returns a response result corresponding to the NF service request to the NF consumption end. By adopting the method, the NF consumption end can be ensured to meet the access requirement of the NF providing end, so that the network security risk can be avoided, and the security of the service request processing process is further improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for processing a NF service request. Background Art

[0002] With the development of communication technology, a technology that uses NF service requests for service communication has emerged. After the NF consumer and the NF provider complete the registration, the NF consumer can initiate a service request to the NF provider, and the NF provider can respond to the service request and return the response result of the service request to the NF consumer to process the service request initiated by the NF consumer.

[0003] In traditional technology, after the NF consumer initiates a service request to the NF provider, the NF provider completes the service request processing initiated by the NF consumer. However, this processing method may cause security issues. For example, if the NF consumer accesses a situation that does not meet the access requirements of the NF provider, it may cause network security risks. Therefore, in the existing NF service request processing method, the security of the service request processing process is relatively low. Summary of the invention

[0004] Based on this, it is necessary to provide a NF service request processing method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the security of the service request processing process in response to the above technical problems.

[0005] In a first aspect, the present application provides a NF service request processing method, which is applied to a network storage network element NRF, including:

[0006] In response to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquiring a pre-stored first consumer trust level corresponding to the NF consumer, and acquiring a second consumer trust level required by the target NF provider;

[0007] When the trust level of the first consumer meets the trust level of the second consumer, the access token is returned to the NF consumer; the NF consumer uses the access token to initiate a NF service request to the target NF provider, so that the target NF provider returns a response result corresponding to the NF service request to the NF consumer.

[0008] In one of the embodiments, after obtaining the second consumer-end trust level required by the NF provider, it also includes: when the first consumer-end trust level does not meet the second consumer-end trust level, obtaining a candidate NF provider according to the first consumer-end trust level, and the pre-stored provider trust level of each candidate NF provider; the candidate NF provider is an NF provider accessible to the NF consumer; a NF provider list is constructed according to each candidate NF provider and the provider trust level of each candidate NF provider, and the NF provider list is returned to the NF consumer.

[0009] In one of the embodiments, the constructing of the NF provider list according to each of the candidate NF providers and the provider trust level of each of the candidate NF providers includes: obtaining the arrangement order of each of the candidate NF providers in the NF provider list according to the provider trust level of each of the provider; wherein the arrangement order of the candidate NF providers with a higher provider trust level is before the arrangement order of the candidate NF providers with a lower provider trust level; and constructing the NF provider list including each of the candidate NF providers and the provider trust level of each of the candidate NF providers according to the arrangement order.

[0010] In one of the embodiments, the access token carries the first consumer trust level; after returning the access token of the target NF provider to the NF consumer, it also includes: upon receiving an access token verification request initiated by the target NF provider for the access token, obtaining a trust level verification result according to the first consumer trust level carried in the access token; the access token verification request is triggered by the target NF provider upon receiving the NF service request; the trust level verification result is returned to the target NF provider; the target NF provider is used to obtain a token verification result of the access token based on the trust level verification result, and when the token verification result indicates that the verification is passed, the response result corresponding to the NF service request is returned to the NF consumer.

[0011] In one of the embodiments, before responding to the token acquisition request initiated by the pre-registered NF consumer for acquiring the access token of the target NF provider, it also includes: responding to the NF registration request initiated by the NF to be registered, acquiring a configuration file corresponding to the NF to be registered; the NF to be registered is one of the NF consumer and the NF provider; according to the configuration file, acquiring the trust level of the NF to be registered, registering the NF to be registered, and storing the trust level of the NF to be registered.

[0012] In one of the embodiments, obtaining the trust level of the NF to be registered according to the configuration file includes: in a case where the configuration file carries a data field for storing the trust level of the NF to be registered, verifying the trust level of the NF to be registered recorded in the configuration file; in a case where the trust level verification passes, using the trust level of the NF to be registered recorded in the configuration file as the trust level of the NF to be registered; in a case where the trust level verification fails, setting the trust level of the NF to be registered to a default trust level; the default trust level represents a low trust level.

[0013] In one of the embodiments, obtaining the trust level of the NF to be registered according to the configuration file further includes: when the configuration file does not carry the data field, setting the trust level of the NF to be registered to the default trust level.

[0014] In one of the embodiments, in response to a token acquisition request initiated by a pre-registered NF consumer for obtaining an access token of a target NF provider, obtaining a pre-stored first consumer trust level corresponding to the NF consumer, and obtaining a second consumer trust level required by the target NF provider, includes: obtaining the identity authentication result and the business logic authorization verification result of the NF consumer in response to the token acquisition request; when both the identity authentication result and the business logic authorization verification result indicate that the verification is passed, obtaining the first consumer trust level and the second consumer trust level.

[0015] In a second aspect, the present application further provides a NF service request processing method, which is applied to a pre-registered NF consumer end, comprising:

[0016] Sending a token acquisition request for acquiring an access token of a target NF provider to a network storage network element NRF; the NRF is used to return the access token to the NF consumer end when the first consumer end trust level pre-stored at the NF consumer end meets the second consumer end trust level required by the target NF provider end;

[0017] Receive the access token, and use the access token to initiate a NF service request to the target NF provider; the target NF provider is used to return a response result corresponding to the NF service request to the NF consumer.

[0018] In one of the embodiments, after sending a token acquisition request for obtaining an access token of a target NF provider to a network storage network element NRF, it also includes: receiving a NF provider list returned by the NRF; the NF provider list includes candidate NF providers and a provider trust level of each candidate NF provider; the candidate NF provider is an NF provider accessible to the NF consumer; the NF provider list is generated by the NRF when the trust level of the first consumer does not meet the trust level of the second consumer; in response to a trigger operation for any candidate NF provider in the NF provider list, sending a token acquisition request for obtaining an access token of the candidate NF provider to the NRF.

[0019] In a third aspect, the present application further provides a NF service request processing method, which is applied to a target NF provider, comprising:

[0020] In response to a NF service request initiated by a pre-registered NF consumer through an access token, a response result corresponding to the NF service request is obtained; the access token is sent to the NF consumer by the network storage network element NRF when the first consumer trust level corresponding to the NF consumer meets the second consumer trust level required by the target NF provider;

[0021] The response result is returned to the NF consumer.

[0022] In one of the embodiments, in response to a NF service request initiated by a pre-registered NF consumer through an access token, obtaining a response result corresponding to the NF service request includes: obtaining a token verification result of the access token in response to the NF service request; and obtaining a response result corresponding to the NF service request when the token verification result indicates that the verification is passed.

[0023] In one of the embodiments, the access token carries the first consumer-end trust level; the obtaining of the token verification result of the access token in response to the NF service request includes: sending an access token verification request for the access token to the NRF in response to the NF service request; the access token verification request is used to request the NRF to obtain and return a trust level verification result based on the first consumer-end trust level carried in the access token; and obtaining the token verification result of the access token based on the trust level verification result.

[0024] In a fourth aspect, the present application further provides a NF service request processing device, which is applied to a network storage network element NRF, including:

[0025] A trust level acquisition module, configured to respond to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquire a pre-stored first consumer trust level corresponding to the NF consumer, and acquire a second consumer trust level required by the target NF provider;

[0026] The access token sending module is used to return the access token to the NF consumer end when the trust level of the first consumer end meets the trust level of the second consumer end; the NF consumer end is used to use the access token to initiate a NF service request to the target NF provider end, so that the target NF provider end returns the response result corresponding to the NF service request to the NF consumer end.

[0027] In a fifth aspect, the present application further provides a NF service request processing device, which is applied to a pre-registered NF consumer terminal, including:

[0028] A token acquisition request module is used to send a token acquisition request for acquiring an access token of a target NF provider to a network storage network element NRF; the NRF is used to return the access token to the NF consumer end when the first consumer end trust level pre-stored at the NF consumer end meets the second consumer end trust level required by the target NF provider end;

[0029] The NF service request module is used to receive the access token and use the access token to initiate a NF service request to the target NF provider; the target NF provider is used to return a response result corresponding to the NF service request to the NF consumer.

[0030] In a sixth aspect, the present application further provides a NF service request processing device, which is applied to a target NF provider, including:

[0031] A response result acquisition module is used to obtain a response result corresponding to the NF service request initiated by a pre-registered NF consumer through an access token; the access token is sent to the NF consumer by the network storage network element NRF when the first consumer trust level corresponding to the NF consumer meets the second consumer trust level required by the target NF provider;

[0032] The response result sending module is used to return the response result to the NF consumer end.

[0033] In the seventh aspect, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in any one of the embodiments of the first aspect, the second aspect, or the third aspect are implemented.

[0034] In an eighth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in any one of the embodiments of the first aspect, the second aspect or the third aspect are implemented.

[0035] In a ninth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in any one of the embodiments of the first aspect, the second aspect, or the third aspect.

[0036] The above-mentioned NF service request processing method, apparatus, computer equipment, computer-readable storage medium and computer program product, through the network storage network element NRF, responds to the token acquisition request initiated by the pre-registered NF consumer end for obtaining the access token of the target NF provider end, obtains the first consumer end trust level corresponding to the pre-stored NF consumer end, and obtains the second consumer end trust level required by the target NF provider end; when the first consumer end trust level meets the second consumer end trust level, returns the access token to the NF consumer end; the NF consumer end is used to use the access token to initiate a NF service request to the target NF provider end, so that the target NF provider end returns the response result corresponding to the NF service request to the NF consumer end. In this application, a token acquisition request for obtaining an access token of a target NF provider is sent to a network storage network element NRF through a pre-registered NF consumer. The NRF can respond to the request to obtain the first consumer trust level corresponding to the NF consumer stored in advance, and the second consumer trust level required by the target NF provider. Only when the first consumer trust level meets the second consumer trust level, the NRF returns the access token to the NF consumer. After that, the NF consumer can initiate an NF service request to the target NF provider through the access token to request a response result of the service request. In this way, it can be ensured that an NF service request is initiated to the target NF provider only when the trust level corresponding to the NF consumer is met, thereby ensuring that the NF consumer can meet the access requirements of the NF provider, thereby avoiding network security risks and improving the security of the service request processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1An application environment diagram of a method for processing an NF service request in an embodiment;

[0039] Figure 2 A flowchart of a method for processing a NF service request in an embodiment;

[0040] Figure 3 A schematic diagram of a process of returning a NF provider list to a NF consumer in one embodiment;

[0041] Figure 4 A schematic diagram of a NF registration process in an embodiment;

[0042] Figure 5 A schematic diagram of a process of obtaining a trust level of a NF to be registered in one embodiment;

[0043] Figure 6 A flowchart of a method for processing a NF service request in another embodiment;

[0044] Figure 7 FIG. 1 is a flow chart of a method for processing a NF service request in another embodiment;

[0045] Figure 8 A schematic diagram of a flow chart of a network function registration service operation in one embodiment;

[0046] Fig. 9 A flowchart of obtaining an access token service operation in one embodiment;

[0047] Fig.10 A schematic diagram of a flow chart of a network function service request service operation in one embodiment;

[0048] Fig.11 is a structural block diagram of an NF service request processing device in one embodiment;

[0049] Fig.12 It is a structural block diagram of a NF service request processing device in another embodiment;

[0050] Fig.13 is a structural block diagram of a NF service request processing device in another embodiment;

[0051] Fig.14 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The NF service request processing method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the network storage network element NRF103 communicates with the NF consumer end 101 and the target NF provider end 102 through the network, and the NF consumer end 101 and the target NF provider end 102 can also communicate through the network. Specifically, the pre-registered NF consumer end 101 can first initiate a token acquisition request to the network storage network element NRF103 for obtaining the access token of the target NF provider end 102, and NRF103 can respond to the request, thereby obtaining the first consumer end trust level of the NF consumer end 101 and the second consumer end trust level required by the target NF provider end 102. If the first consumer end trust level meets the second consumer end trust level, NRF103 returns the access token to the NF consumer end 101. After that, the NF consumer end 101 can initiate a NF service request to the target NF provider end 102 through the access token, so that the target NF provider end 102 returns the response result corresponding to the NF service request to the NF consumer end 101. Among them, the NF consumer end 101, the target NF provider end 102 and the NRF 103 can all be independent network element devices.

[0054] In one embodiment, Figure 2 As shown, a NF service request processing method is provided, and the method is applied to Figure 1 The network storage network element NRF103 in the example is used to illustrate, including the following steps:

[0055] Step S201, the network storage network element NRF103 responds to the token acquisition request initiated by the pre-registered NF consumer 101 for obtaining the access token of the target NF provider 102, obtains the pre-stored first consumer trust level corresponding to the NF consumer 101, and obtains the second consumer trust level required by the target NF provider 102.

[0056] NF consumer 101 refers to a service request end that needs to request NF service, target NF provider 102 is a service request provider for responding to the service request initiated by NF consumer 101, and network storage network element NRF103 is a network storage function network element responsible for managing NF registration, discovery and status information, and token acquisition request is a request for obtaining an access token, which can be used by NF consumer 101 to initiate a service request to target NF provider 102. The first consumer trust level is used to characterize the consumer trust level corresponding to the NF consumer, and the first consumer trust level can be stored in NRF103 when NF consumer 101 registers with NRF103, and the second consumer trust level is the consumer trust level required by the target NF provider, and only when the consumer trust level meets the second consumer trust level, the NF consumer is allowed to access the target NF provider 102.

[0057] Specifically, before the pre-registered NF consumer 101 initiates a NF service request for the target NF provider 102, it is also necessary to initiate a token acquisition request to NRF 103 for requesting an access token for the target NF provider 102. At this time, NRF103 can first obtain the consumer trust level corresponding to the NF consumer 101 from the stored consumer trust level as the first consumer trust level, and then can also obtain the consumer trust level required by the target NF provider 102 requested to be accessed by the NF consumer 101 as the second consumer trust level.

[0058] Step S202, when the trust level of the first consumer end meets the trust level of the second consumer end, the access token is returned to the NF consumer end 101; the NF consumer end 101 is used to use the access token to initiate a NF service request to the target NF provider end 102, so that the target NF provider end 102 returns the response result corresponding to the NF service request to the NF consumer end 101.

[0059] NF service request refers to the request initiated by NF consumer 101 to the target NF provider 102 for requesting NF service response. The initiation of this request depends on the access token of the target NF provider 102. The access token can be provided to NF consumer 101 by NRF103 when the consumer trust level corresponding to NF consumer 101 meets the consumer trust level required by the target NF provider.

[0060] Specifically, if the trust level of the first consumer meets the trust level of the second consumer, then NRF 103 can return the access token of the target NF provider 102 to the NF consumer 101, and the NF consumer 101 can initiate a NF service request to the target NF provider 102 through the access token to receive the response result of the NF service request returned by the target NF provider 102, thereby completing the processing of the NF service request.

[0061] In the above-mentioned NF service request processing method, the network storage network element NRF103 responds to the token acquisition request initiated by the pre-registered NF consumer 101 for obtaining the access token of the target NF provider 102, obtains the pre-stored first consumer trust level corresponding to the NF consumer 101, and obtains the second consumer trust level required by the target NF provider 102; when the first consumer trust level meets the second consumer trust level, returns the access token to the NF consumer 101; the NF consumer 101 is used to use the access token to initiate a NF service request to the target NF provider 102, so that the target NF provider 102 returns the response result corresponding to the NF service request to the NF consumer 101. In this application, a token acquisition request for obtaining an access token of a target NF provider 102 is sent to a network storage network element NRF103 through a pre-registered NF consumer. NRF103 can respond to the request to obtain the first consumer trust level corresponding to the NF consumer 101 stored in advance, and the second consumer trust level required by the target NF provider 102. Only when the first consumer trust level meets the second consumer trust level, NRF103 returns the access token to the NF consumer 101. After that, the NF consumer 101 can initiate a NF service request to the target NF provider 102 through the access token to request a response result of the service request. In this way, it can be ensured that a NF service request is initiated to the target NF provider 102 only when the trust level corresponding to the NF consumer 101 is met, thereby ensuring that the NF consumer can meet the access requirements of the NF provider, thereby avoiding network security risks and improving the security of the service request processing process.

[0062] In one embodiment, Figure 3 As shown, after step S201, the following steps may also be included:

[0063] Step S301, when the trust level of the first consumer end does not meet the trust level of the second consumer end, obtain a candidate NF provider end according to the trust level of the first consumer end, and the pre-stored trust level of each candidate NF provider end; the candidate NF provider end is an NF provider end accessible to the NF consumer end.

[0064] The candidate NF provider refers to the NF provider that the NF consumer 101 can access, for example, it can be a NF provider whose first consumer trust level can meet the requirements, or it can be a NF provider that does not require a consumer trust level. The provider trust level refers to the trust level corresponding to the candidate NF provider, and the provider trust level can be stored in NRF103 when each candidate NF provider registers with NRF103.

[0065] In this embodiment, if the trust level of the first consumer end does not meet the trust level of the second consumer end, the NF provider end accessible to the NF consumer end 101 can be used as a candidate NF provider end. For example, the NF provider end that can meet the required level can be screened out according to the trust level of the first consumer end as a candidate NF provider end, and the pre-stored trust level of the provider end corresponding to each candidate NF provider end can also be obtained.

[0066] For example, the trust level of the NF consumer 101 is a low trust level, and the trust level required by the target NF provider 102 requested for access is a high trust level. At this time, the NF consumer 101 does not meet the access conditions, so NRF103 can filter out the NF providers accessible to the NF consumer 101 as candidate NF providers. For example, the consumer trust level required by NF provider A is a low trust level, and NF provider B has no trust level requirement, then NF provider A and NF provider B can both be used as candidate NF providers, and then NRF103 can also obtain the provider trust levels of NF provider A and NF provider B.

[0067] Step S302, constructing a NF provider list according to each candidate NF provider and the provider trust level of each candidate NF provider, and returning the NF provider list to the NF consumer 101.

[0068] The NF provider list is a list composed of multiple candidate NF providers, which also records the provider trust level of each candidate NF provider. Specifically, after NRF103 obtains multiple candidate NF providers and the provider trust level of each NF provider, it can also use each candidate NF provider and the provider trust level of each candidate NF provider to construct a NF provider list, and then return the NF provider list to the NF consumer 101.

[0069] In this embodiment, if the trust level of the first consumer end does not meet the trust level of the second consumer end, NRF103 can also obtain the candidate NF provider end and the trust level of the provider end of each candidate NF provider end according to the trust level of the first consumer end, and thus build a NF provider end list based on each candidate NF provider end and the trust level of the provider end of each candidate NF provider end and return it for the NF consumer end 101 to select an accessible NF provider end. In this way, the intelligence level of the NF consumer end 101 in selecting the NF provider end can be improved.

[0070] Furthermore, step S302 may further include: obtaining the arrangement order of each candidate NF provider in the NF provider list according to the trust level of each provider; wherein the arrangement order of the candidate NF provider with a high provider trust level is before the arrangement order of the candidate NF provider with a low provider trust level; and constructing a NF provider list including each candidate NF provider and the provider trust level of each candidate NF provider according to the arrangement order.

[0071] The arrangement order refers to the ranking of each candidate NF provider in the NF provider list. In this embodiment, the ranking of each candidate NF provider in the NF provider list can be associated with the provider trust level of the candidate NF provider, and the candidate NF provider with a high provider trust level can be prioritized, that is, the ranking of the candidate NF provider with a high provider trust level in the NF provider list is before the ranking of the candidate NF provider with a low trust level in the NF provider list.

[0072] Specifically, NRF103 can obtain the arrangement order of each candidate NF provider in the NF provider list according to the provider trust level of each candidate NF provider, and thus construct a NF provider list including each candidate NF provider and the provider trust level of each candidate NF provider according to the above arrangement order.

[0073] In this embodiment, the arrangement order of each candidate NF provider in the NF provider list can be obtained according to the trust level of each provider, and the candidate NF provider with a high trust level can be ranked before the candidate NF provider with a low trust level, so that the NF provider with a high trust level can be recommended to the NF consumer 101 first. In this way, the intelligence level of the recommendation of the candidate NF provider can be improved.

[0074] In one embodiment, the access token carries a first consumer-end trust level; after step S102, it may also include: when receiving an access token verification request initiated by the target NF provider 102 for the access token, obtaining a trust level verification result according to the first consumer-end trust level carried in the access token; the access token verification request is triggered by the target NF provider 102 when receiving a NF service request; the trust level verification result is returned to the target NF provider 102; the target NF provider 102 is used to obtain a token verification result of the access token based on the trust level verification result, and when the token verification result indicates that the verification is passed, the response result corresponding to the NF service request is returned to the NF consumer 101.

[0075] In this embodiment, after the target NF provider 102 receives the NF service request initiated by the NF consumer 101 through the access token, it is also necessary to perform token verification on the access token. Only when the token verification result of the access token indicates that the verification is passed, the response result corresponding to the NF service request is returned to the NF consumer 101. The token verification process of the access token may include performing a trust level verification on the first consumer trust level stored in the access token. If the target NF provider 102 cannot perform the trust level verification alone, it may initiate an access token verification request to NRF103 to obtain the trust level verification result for the access token through NRF103.

[0076] Specifically, after the target NF provider 102 receives the NF service request initiated by the NF consumer 101, it can also perform token verification on the access token, that is, initiate an access token verification request to NRF103, and then NRF103 can respond to the access token verification request, thereby obtaining a trust level verification result according to the first consumer trust level carried in the access token, and return it to the target NF provider 102. The target NF provider 102 can obtain the token verification result of the access token according to the trust level verification result, and only return the response result corresponding to the NF service request to the NF consumer 101 when the token verification result indicates that the verification is passed.

[0077] In this embodiment, NRF103 can also perform trust level verification according to the first consumer trust level carried in the access token when receiving an access token verification request initiated by the target NF provider 102 for the access token, and return the trust level verification result, so that the target NF provider 102 can obtain the token verification result of the access token based on the trust level verification result, and return the response result when the token verification result indicates that the verification is passed. In this way, the security of network access can be further improved.

[0078] In one embodiment, Figure 4 As shown, before step S201, the following steps may also be included:

[0079] Step S401, in response to a NF registration request initiated by the NF to be registered, obtaining a configuration file corresponding to the NF to be registered; the NF to be registered is one of an NF consumer end or an NF provider end.

[0080] Among them, the NF to be registered refers to the NF network element that needs to complete registration in NRF103. In this embodiment, both the NF consumer end and the NF provider end need to complete registration in NRF103 before providing NF services. Specifically, when NRF103 receives the NF registration request initiated by the NF to be registered, it can first obtain the configuration file corresponding to the NF to be registered.

[0081] Step S402: According to the configuration file, the trust level of the NF to be registered is obtained, the NF to be registered is registered, and the trust level of the NF to be registered is stored.

[0082] In this embodiment, the trust level of the NF to be registered may be pre-stored in the configuration file. When registering the NF to be registered, the trust level of the NF to be registered may be obtained from the configuration file first, and the NF to be registered may be registered and stored.

[0083] In this embodiment, when the NF to be registered initiates a NF registration request, the trust level of the NF to be registered can be extracted from the configuration file corresponding to the NF to be registered, and when the NF to be registered is registered, the trust level of the NF to be registered can be stored. In this way, the trust level of each NF consumer and NF provider can be stored in NRF103, thereby ensuring the security of NF service request processing.

[0084] Furthermore, if Figure 5 As shown, step S402 may further include:

[0085] Step S501: When the configuration file carries a data field for storing the trust level of the NF to be registered, the trust level of the NF to be registered recorded in the configuration file is verified.

[0086] In this embodiment, a data field for storing the trust level of the NF to be registered, namely, the trustLevel field, may be newly added to the configuration file of the NF to be registered. If the configuration file carries a data field for storing the trust level of the NF to be registered, then NRF103 needs to verify the trust level of the NF to be registered recorded in the data field in the configuration file to ensure the authenticity of the trust level of the NF to be registered recorded in the configuration file.

[0087] Step S502: When the trust level verification is passed, the trust level of the NF to be registered recorded in the configuration file is used as the trust level of the NF to be registered.

[0088] If the trust level verification is passed, that is, the trust level of the NF to be registered recorded in the configuration file is true, NRF103 can use the trust level of the NF to be registered recorded in the configuration file as the trust level of the NF to be registered. For example, if the trust level of the NF to be registered recorded in the configuration file is characterized as a high trust level, if the trust level verification is passed, then NRF103 can store the trust level of the NF to be registered as a high trust level.

[0089] Step S503, when the trust level verification fails, the trust level of the NF to be registered is set to a default trust level; the default trust level represents a low trust level.

[0090] If the trust level verification fails, that is, the trust level of the NF to be registered recorded in the configuration file is not true, NRF103 can set the trust level of the NF to be registered to a default trust level representing a low trust level.

[0091] In this embodiment, if the configuration file carries a data field for storing the trust level of the NF to be registered, NRF103 can also verify the trust level recorded in the configuration file. If the verification passes, the trust level of the NF to be registered recorded in the configuration file can be used as the trust level of the NF to be registered. If the verification fails, the default trust level representing a low trust level can be used as the trust level of the NF to be registered. In this way, the accuracy of the trust level of the NF to be registered stored in NRF103 can be ensured.

[0092] In addition, step S402 may also include: in the case where the configuration file does not carry a data field, setting the trust level of the NF to be registered to a default trust level.

[0093] If the configuration file does not carry a data field for storing the trust level, in order to ensure that the NF to be registered can also be successfully registered, NRF103 can set the trust level of the NF to be registered to a default trust level representing a low trust level to complete the registration operation of the NF to be registered.

[0094] In this embodiment, if the configuration file does not carry a data field for storing the trust level, NRF103 can set the trust level of the NF to be registered to a default trust level representing a low trust level to complete the registration operation of the NF to be registered. In this way, it can be ensured that the NF to be registered can be successfully registered.

[0095] In one embodiment, step S201 may further include: in response to a token acquisition request, obtaining the identity authentication result of the NF consumer end 101 and the business logic authorization verification result; when the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, obtaining the first consumer end trust level and the second consumer end trust level.

[0096] In this embodiment, before verifying whether the trust level of the NF consumer end 101 meets the requirements, the identity and business logic authorization of the NF consumer end 101 can also be verified first, wherein the business logic authorization verification is mainly used to check whether the NF consumer end 101 has the authority to request the target service, and can be verified based on pre-configured policy rules. If the authority is insufficient, access is prohibited. Even if the trust level of the requester meets the requirements, if the business logic authorization fails, for example, the authority policy prohibits access to a certain type of service, then further trust level verification will be redundant. Therefore, in this embodiment, after receiving the token acquisition request, NRF103 also needs to obtain the identity authentication result of the NF consumer end 101 and the business logic authorization verification result. Only when the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, the first consumer end trust level corresponding to the NF consumer end 101 and the second consumer end trust level required by the target NF provider end 102 are obtained.

[0097] Specifically, after NRF103 receives the token acquisition request for obtaining the access token of the target NF provider 102, it can also first perform identity authentication and business logic authorization verification on the NF consumer 101 to obtain the identity authentication result of the NF consumer 101 and the business logic authorization verification result. Only when the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, the first consumer trust level corresponding to the NF consumer 101 and the second consumer trust level required by the target NF provider 102 are further obtained.

[0098] In this embodiment, after initiating a token acquisition request, NRF103 can first obtain the identity authentication result and the business logic authorization verification result of the NF consumer end 101, and only when the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, it further obtains the first consumer end trust level corresponding to the NF consumer end 101 and the second consumer end trust level required by the target NF provider end 102. In this way, invalid trust level checks can be avoided, thereby reducing the overhead of trust level checks.

[0099] In one embodiment, Figure 6 As shown, a NF service request processing method is provided, and the method is applied to Figure 1Taking the pre-registered NF consumer terminal 101 in the example as an example, the following steps are included:

[0100] Step S601, sending a token acquisition request for obtaining an access token of the target NF provider 102 to the network storage network element NRF103; NRF103 is used to return the access token to the NF consumer 101 when the first consumer trust level pre-stored in the NF consumer 101 meets the second consumer trust level required by the target NF provider 102.

[0101] Specifically, before the pre-registered NF consumer 101 initiates a NF service request to the target NF provider 102, it also needs to send a token acquisition request to NRF103 for obtaining the access token of the target NF provider 102. After that, NRF103 can determine whether the first consumer trust level of the NF consumer 101 stored in advance meets the second consumer trust level required by the target NF provider 102. If so, the access token will be returned to the NF consumer 101.

[0102] Step S602, receiving the access token, and using the access token to initiate a NF service request to the target NF provider 102; the target NF provider 102 is used to return a response result corresponding to the NF service request to the NF consumer 101.

[0103] After the NF consumer 101 obtains the access token, it can use the access token to initiate a NF service request to the target NF provider 102. After the target NF provider 102 receives the NF service request, it can return the response result of the NF service request to the NF consumer 101.

[0104] In the above-mentioned NF service request processing method, a token acquisition request for obtaining an access token of a target NF provider 102 is sent to the network storage network element NRF103 through the pre-registered NF consumer 101; NRF103 is used to return the access token to the NF consumer 101 when the first consumer trust level pre-stored in the NF consumer 101 meets the second consumer trust level required by the target NF provider 102; a token acquisition request for obtaining an access token of a target NF provider 102 is sent to the network storage network element NRF103; NRF103 is used to return the access token to the NF consumer 101 when the first consumer trust level pre-stored in the NF consumer 101 meets the second consumer trust level required by the target NF provider 102. In this application, a token acquisition request for obtaining an access token of a target NF provider 102 is sent to a network storage network element NRF103 through a pre-registered NF consumer. NRF103 can respond to the request to obtain the first consumer trust level corresponding to the NF consumer 101 stored in advance, and the second consumer trust level required by the target NF provider 102. Only when the first consumer trust level meets the second consumer trust level, NRF103 returns the access token to the NF consumer 101. After that, the NF consumer 101 can initiate a NF service request to the target NF provider 102 through the access token to request a response result of the service request. In this way, it can be ensured that a NF service request is initiated to the target NF provider 102 only when the trust level corresponding to the NF consumer 101 is met, thereby ensuring that the NF consumer can meet the access requirements of the NF provider, thereby avoiding network security risks and improving the security of the service request processing process.

[0105] In one embodiment, after step S601, it may also include: receiving the NF provider list returned by NRF103; the NF provider list includes candidate NF providers and the provider trust level of each candidate NF provider; the candidate NF provider is the NF provider accessible to the NF consumer 101; the NF provider list is generated by NRF103 when the trust level of the first consumer does not meet the trust level of the second consumer; in response to a trigger operation for any candidate NF provider in the NF provider list, sending a token acquisition request to NRF103 for obtaining an access token of the candidate NF provider.

[0106] If NRF103 determines that the trust level of the first consumer does not meet the trust level of the second consumer, NRF103 can filter out NF providers that meet the required level through the trust level of the first consumer as candidate NF providers, and construct a NF provider list including candidate NF providers and the provider trust level of each candidate NF provider, and return it to the NF consumer 101. After receiving the NF provider list, the NF consumer 101 can also display the NF provider list, and the user selects one of the candidate NF providers to trigger the operation, so as to send a token acquisition request to NRF103 for acquiring the access token of the candidate NF provider.

[0107] For example, the NF provider list includes NF provider A and NF provider B. When the user selects and triggers NF provider A, NF consumer 101 can again initiate a token acquisition request to NRF 103 to obtain an access token for NF provider A.

[0108] In this embodiment, if the trust level of the first consumer end does not meet the trust level of the second consumer end, NRF103 can also obtain the candidate NF provider end and the trust level of the provider end of each candidate NF provider end according to the trust level of the first consumer end, and thus build a NF provider end list based on each candidate NF provider end and the trust level of the provider end of each candidate NF provider end and return it, so that the NF consumer end 101 can select an accessible NF provider end to initiate the token acquisition request again. In this way, the intelligence level of the NF consumer end 101 in selecting the NF provider end can be improved.

[0109] In one embodiment, Figure 7 As shown, a NF service request processing method is provided, and the method is applied to Figure 1 The target NF provider 102 in the example is used as an example to illustrate, including the following steps:

[0110] Step S701, in response to the NF service request initiated by the pre-registered NF consumer 101 through the access token, obtain the response result corresponding to the NF service request; the access token is sent to the NF consumer 101 by the network storage network element NRF103 when the first consumer trust level corresponding to the NF consumer 101 meets the second consumer trust level required by the target NF provider 102.

[0111] Specifically, before the pre-registered NF consumer 101 initiates a NF service request to the target NF provider 102, it needs to first send a token acquisition request to NRF103 for acquiring the access token of the target NF provider 102. Then, NRF103 can determine whether the first consumer trust level of the NF consumer 101 stored in advance meets the second consumer trust level required by the target NF provider 102. If it meets, the access token is returned to the NF consumer 101. After the NF consumer 101 obtains the access token, it can use the access token to initiate a NF service request to the target NF provider 102.

[0112] Step S702, returning the response result to the NF consumer end 101.

[0113] After the target NF provider 102 receives the NF service request initiated by the NF consumer 101, it can obtain the response result corresponding to the NF service request and return the response result to the NF consumer 101, thereby completing the processing of the NF service request.

[0114] In the above-mentioned NF service request processing method, the target NF provider 102 responds to the NF service request initiated by the pre-registered NF consumer 101 through the access token to obtain the response result corresponding to the NF service request; the access token is sent to the NF consumer 101 by the network storage network element NRF103 when the first consumer trust level corresponding to the NF consumer 101 meets the second consumer trust level required by the target NF provider 102; and the response result is returned to the NF consumer 101. In this application, a token acquisition request for obtaining an access token of a target NF provider 102 is sent to a network storage network element NRF103 through a pre-registered NF consumer. NRF103 can respond to the request to obtain the first consumer trust level corresponding to the NF consumer 101 stored in advance, and the second consumer trust level required by the target NF provider 102. Only when the first consumer trust level meets the second consumer trust level, NRF103 returns the access token to the NF consumer 101. After that, the NF consumer 101 can initiate a NF service request to the target NF provider 102 through the access token to request a response result of the service request. In this way, it can be ensured that a NF service request is initiated to the target NF provider 102 only when the trust level corresponding to the NF consumer 101 is met, thereby ensuring that the NF consumer can meet the access requirements of the NF provider, thereby avoiding network security risks and improving the security of the service request processing process.

[0115] In one embodiment, step S701 may further include: in response to the NF service request, obtaining a token verification result of the access token; and when the token verification result indicates that the verification is successful, obtaining a response result corresponding to the NF service request.

[0116] Token verification may include verification of the validity and integrity of the token, and may also include verification of the token's validity period, scope of authority, and the consumer's trustworthiness level.

[0117] Specifically, after the target NF provider 102 receives the NF service request initiated by the NF consumer 101 through the access token, it can also perform token verification on the access token. Only when the token verification result of the access token indicates that the verification is successful, it obtains the response result corresponding to the NF service request and returns the response result corresponding to the NF service request to the NF consumer 101.

[0118] In this embodiment, after the target NF provider 102 receives the NF service request initiated by the NF consumer 101 through the access token, it can also perform token verification on the access token. Only when the token verification result of the access token indicates that the verification is successful, the response result corresponding to the NF service request is obtained. In this way, the security of network access can be further improved.

[0119] Furthermore, the access token carries a first consumer-end trust level; in response to the NF service request, a token verification result of the access token is obtained, including: in response to the NF service request, an access token verification request for the access token is sent to the NRF; the access token verification request is used to request the NRF to obtain and return a trust level verification result based on the first consumer-end trust level carried in the access token; and the token verification result of the access token is obtained based on the trust level verification result.

[0120] In this embodiment, the access token may carry the first consumer-end trust level of the NF consumer 101, and the access token verification process may include a process for verifying the consumer-end trust level of the NF consumer 101. If the target NF provider 102 is unable to perform the trust level verification alone, an access token verification request may be initiated to NRF103 to obtain the trust level verification result for the access token through NRF103.

[0121] Specifically, after the target NF provider 102 receives the NF service request initiated by the NF consumer 101, it can also perform token verification on the access token, that is, initiate an access token verification request to NRF103, and then NRF103 can respond to the access token verification request, thereby obtaining a trust level verification result according to the first consumer trust level carried in the access token, and returning it to the target NF provider 102. After the target NF provider 102 obtains the trust level verification result, it can obtain the token verification result of the access token according to the trust level verification result.

[0122] In this embodiment, the target NF provider 102 can also initiate an access token verification request for the access token to NRF103 to obtain the trust level verification result of the first consumer trust level carried in the access token, and then obtain the token verification result of the access token. In this way, the integrity and security of the access token verification can be improved.

[0123] In one embodiment, a network function instance management and service discovery method based on trust level is also provided, which can be used to select network function (NF) instances in 5G networks, thereby preventing unauthorized access, that is, preventing NF consumers with low trust levels from accessing NF services that they should not access, thereby reducing network security risks. Dynamic selection can also be achieved, that is, allowing the network to dynamically select the most appropriate NF instance based on real-time security status and business needs, thereby improving the flexibility and adaptability of the network. User data can also be protected, that is, for sensitive data such as user identity information and communication data, ensure that these data can only be processed by NFs with high trust levels, thereby enhancing user privacy protection. This can be achieved specifically through the following process:

[0124] 1. Define the NF trust level of the network function service instance:

[0125] Based on the business and network function service instance requirements, the trust levels of network function service consumers and network function service providers are divided into "high" and "low".

[0126] Trust level "high": the network function service instance has trust capabilities and supports remote attestation;

[0127] Trust level "low": The network function service instance has trust capabilities but does not support remote attestation.

[0128] The relationship between remote attestation and trust can be shown as follows:

[0129] Remote attestation is one of the important means of trust. Through remote attestation, it is possible to verify whether the operating status of a device or system meets expectations and whether there are security vulnerabilities or malicious attacks. Therefore, devices or systems that support remote attestation are more easily evaluated for their trustworthiness.

[0130] Not supporting remote attestation does not necessarily mean that they are untrustworthy. Some devices or systems may not be able to support remote attestation due to cost, performance or functional limitations. But this does not mean that they are untrustworthy. For example, some traditional physical devices may not have remote attestation capabilities, but other security measures can still be used to ensure their trustworthiness.

[0131] 2. Network function service instance enhancement:

[0132] Assume that within the same public land mobile network (PLMN), the network storage element (NRF) can store network function service instances (NF) with different trust states. In order to enable NRF to identify and manage network function service instances NF with different trust levels, NRF needs to be enhanced and optimized. At the same time, the network function service discovery and request phase also needs to be enhanced. On the basis of the existing NRF, the trust level identification and management capabilities are introduced to enable it to classify and prioritize network function service instances with different trust levels. This enhancement requires:

[0133] (1) Add a new “trust level” field to the NRF database.

[0134] (2) Extend the service discovery and selection logic to enable network function consumers to filter based on trust levels.

[0135] (3) NRF supports dynamic adjustment of the trust level of network function instances.

[0136] Enhanced optimization details:

[0137] 1. Data storage enhancement:

[0138] New fields need to be added to the NRF database to store the trusted state of network function service instances.

[0139] Field name: trustLevel.

[0140] Possible values:

[0141] High: High confidence level, with remote certification capabilities.

[0142] Low: Low trust level, with basic trust capabilities but no support for remote attestation.

[0143] Table 1 Schematic diagram of data storage in NRF database

[0144]

[0145] 2. Service registration enhancement:

[0146] When a network function (NF) instance registers with NRF, it needs to carry its trust level information:

[0147] Registration interface enhancement: Enhance the registration interface provided by NRF (such as Nnrf_NFManagement_NFRegister) and add the trustLevel field.

[0148] 3. Service discovery enhancement:

[0149] Enhance NRF's service discovery logic (Nnrf_NFDiscovery):

[0150] A new query parameter trustLevel is added to allow network function consumers to filter target instances by trust level.

[0151] The returned results only include instances that meet the trust level.

[0152] 4. Service selection optimization:

[0153] When returning a list of available instances, NRF can be optimized according to the following logic:

[0154] Prioritize by trust level: When other conditions (such as load, geographic location, etc.) are the same, instances with a high trust level are returned first.

[0155] Dynamic adjustment mechanism: supports dynamically raising or lowering the trust level of an instance based on the context.

[0156] 5. Backward compatibility of interfaces:

[0157] Ensure that the addition of the trust level field remains transparent to networks that do not support enhanced capabilities;

[0158] If the trustLevel field is not provided for an instance, NRF considers it to be of low trust level by default.

[0159] The specific implementation steps may include the following processes:

[0160] Profile definition: Network function consumers and network function service providers register with NRF through profiles to complete the description of functions. In addition to the NF type, NF instance ID, NF service description, PLMN ID and addressing information, the NF profile (NF Profile) also includes the trust level of the NF instance. The trust level field includes the value of "high" or "low" to describe the trust capability of the instance.

[0161] NRF processes the configuration file: When NRF receives a registration request from a network function service instance, it parses and stores the configuration file data in the request. If the configuration file contains the trusteLevel field, NRF will perform further verification. Depending on the requirements of the network design, this verification can be:

[0162] Checks whether the trusteLevel matches a predefined trust level value (such as "High" or "Low").

[0163] Verify that the trusteLevel is consistent with other information (such as network function certificates, authentication mechanisms, hardware security modules, etc.). If the trust level mentioned in the configuration file is inconsistent with the actual situation, NRF can choose to reject the configuration file or issue a warning.

[0164] When a NF is successfully registered with NRF through the Nnrf_NFManagement_NFRegister service operation, NRF marks the NF as available, marks its trust level, and notifies all other NFs that have subscribed to this information. Figure 8 As shown, the specific implementation may include the following processes:

[0165] In the process of network function (NF) registering with network storage network element (NRF), the trust level management of NRF needs to be judged and recorded according to the specific registration scenario. The following lists four registration implementation examples and their optimization suggestions.

[0166] Case 1: The NF configuration file does not contain the trustLevel field.

[0167] Description: When a NF does not provide the trustLevel field in the configuration file during registration, the NRF cannot obtain its declared trust level.

[0168] Processing method:

[0169] Default level processing: NRF marks such network function instances as low trust level by default.

[0170] Recording method: In the NRF database, trustLevel=Low is recorded for the instance, and the reason why the trust level was not declared during registration is noted (such as field missing).

[0171] The second case: NF registration is based on the TLS security protocol, and the trusted verification situation is different.

[0172] Description: When a NF instance is registered:

[0173] Only the TLS secure channel is established, and no trusted verification is performed (for example, remote attestation is not supported).

[0174] Complete the TLS secure channel establishment and complete the trusted verification.

[0175] Processing method:

[0176] Instances of TLS-only registration:

[0177] NRF is marked as Low Trust Level by default.

[0178] Record trustLevel=Low in the database, and note "No trusted verification, only TLS completed" in the remarks field.

[0179] In service discovery, such instances have a low priority by default unless the consumer has no trust level requirements.

[0180] Complete TLS and trusted authentication example:

[0181] NRF is marked as High Trust Level by default.

[0182] The database records trustLevel=High.

[0183] Such instances have a high priority and can be used as recommended instances during the service discovery phase.

[0184] The third case: Bidirectional authentication and trust verification are completed, but NRF does not record the trust level.

[0185] Description: The NF instance has completed mutual authentication and trust verification during registration, but NRF has not recorded the trustLevel in its database.

[0186] Processing method:

[0187] Current processing: NRF performs standard service function logging for such registration requests, but ignores trustLevel related information. Such instances cannot be filtered and prioritized based on trust level during service discovery.

[0188] The fourth case: complete two-way authentication and trust verification, and record the high / low trust level.

[0189] Description: After the NF instance completes the mutual authentication and trust verification, NRF records the trust level as high or low.

[0190] Processing method:

[0191] Registration and Recording Process:

[0192] After receiving the configuration file from NF, NRF verifies its trusted verification result and authentication method.

[0193] According to the verification result, the trust level of the NF is recorded as trustLevel=High or trustLevel=Low.

[0194] At the same time, the verification information is recorded in the database, including the verification method (such as TPM-based remote attestation), authentication method (such as TLS two-way authentication) and timestamp.

[0195] Service discovery optimization:

[0196] During the service discovery phase, NF consumers are allowed to filter and prioritize service instances based on trustLevel.

[0197] Provide high priority for instances with high trust levels to ensure that sensitive scenarios (such as finance and medical care) give priority to network functions with stronger trust capabilities.

[0198] Dynamic adjustment and update:

[0199] When the trusted capabilities of an NF instance change, the NRF can be notified by re-registering or updating the interface.

[0200] NRF supports real-time updating of trust level information in the database to ensure the accuracy of service discovery.

[0201] 3. Access token acquisition:

[0202] When a network function service consumer requests a service, it first needs to apply for an access token from the Network Function Repository (NRF). This process is implemented through the Nnrf_AccessToken_Get service operation, where the NF consumer submits a request to the NRF to obtain authorization and the corresponding access token. Fig. 9 As shown, the specific implementation may include the following processes:

[0203] The network function consumer submits an access token request to the NRF:

[0204] Input:

[0205] When a network function consumer submits a request, it needs to provide identity credentials (such as certificates, keys) for authentication.

[0206] The request includes the target service type (Service Type) to be accessed and the identifier of the target network function instance (such as NF ID, etc.).

[0207] 3. The request may also include the declared trustLevel for subsequent querying.

[0208] (1) NRF certifies consumers:

[0209] Processing logic:

[0210] NRF authenticates NF Consumer using the identity credentials in the request.

[0211] A two-way TLS authentication mechanism can be used to verify the identities of both parties.

[0212] Optionally, if the credentials are based on a hardware-based trusted module (such as a TPM), they can be further remotely attested to ensure authenticity.

[0213] After successful authentication, the authentication status and timestamp are recorded; if failed, the request is directly rejected and an error response is returned.

[0214] (2) NRF performs business-based logical authorization:

[0215] Processing logic:

[0216] Checks whether the network function consumer has the authority to request the target service (based on pre-configured policy rules).

[0217] If the permissions are insufficient, a denial is returned with detailed reasons for the denial.

[0218] This process mainly ensures that the requester has the permission to access the target service. This is a basic permission verification based on policy rules and has nothing to do with the trust level.

[0219] Even if the requester's trust level meets the requirements, if the business logic authorization fails (for example, the permission policy prohibits access to a certain type of service), then further trust level verification will be redundant. That is, it is only necessary to perform a trust level check after the business logic authorization is successful, otherwise the cost of checking the trust level is unnecessary.

[0220] (3) Check the network function provider's requirements for the consumer's trust level:

[0221] Processing logic:

[0222] Retrieve the configuration file of the target service provider instance and check whether there is any requirement for the trustLevel of the consumer.

[0223] If the target service has no trust level requirement, skip this step.

[0224] If required, verify that the consumer's trust level matches that of the provider.

[0225] For example, if the service provider declares trustLevel = High, but the consumer is only Low, then the service cannot be accessed. If the service provider declares trustLevel = Low, but the consumer is High, then the service can be accessed.

[0226] Token issuance logic:

[0227] 1. Qualified conditions:

[0228] If the consumer's trust level meets the requirements of the target service, NRF will issue an access token, which is used to directly authorize the consumer to access the target service.

[0229] The token contains:

[0230] Consumer identification (NF ID);

[0231] The scope of access rights of the target service (Scope, such as Service Type);

[0232] Token validity period (Expiration Time).

[0233] Consumer trust level declaration, used for verification of subsequent service calls.

[0234] 2. Situations that do not meet the requirements:

[0235] When the consumer trust level does not meet the target service requirements, the NRF retrieves other service instances in the database that meet the consumer trust level.

[0236] The list of instances with the highest trust level is returned first according to the trust level, and the trust level of each instance is marked.

[0237] The returned results are recommended to include:

[0238] The instance identifier of the network function service provider (NF ID);

[0239] the types of services that are accessible;

[0240] The current load status (such as availability, response time) of the network function provider instance.

[0241] The return result is returned through a response message.

[0242] After receiving the response, the network function consumer can select a recommended service instance to re-initiate a new access token request.

[0243] 3. Dynamic adjustment and subsequent processing:

[0244] Processing logic:

[0245] 1. During the validity period of the access token, NRF can dynamically adjust the attributes of the token (such as shortening the validity period and increasing the access scope).

[0246] 2. If the trust level of the service provider or consumer changes (such as service instance update or consumer re-registration), NRF can issue a notification or revoke the token.

[0247] 4. NF consumers use access tokens to initiate service requests:

[0248] After obtaining the access token, the NF consumer initiates a service request to the NF service provider. Fig.10 As shown, this can be achieved through the following process:

[0249] (1) Service request initiation:

[0250] Request content:

[0251] The NF consumer initiates a service request to the NF provider, and the request includes an access token to prove the authorization of the NF consumer.

[0252] (2) Access token verification process:

[0253] When the NF provider receives the request, it verifies the access token.

[0254] Remote verification (relying on third-party verification services):

[0255] Applicable scenarios:

[0256] NF providers cannot independently verify tokens or need to dynamically check the real-time status of tokens.

[0257] Verification process:

[0258] 1. The NF provider first verifies the validity and integrity of the token.

[0259] 2. The NF provider initiates a trust level verification request to the NRF or other authorized server.

[0260] 3. The NRF or authorization server verifies the token’s validity period, scope of authority, and the consumer’s trust level, etc.

[0261] 4. NRF returns the verification result (valid / invalid) and related information to the NF provider.

[0262] (3) Verification result processing:

[0263] Depending on the validation results, the NF provider takes different next steps:

[0264] 1. Verification successful:

[0265] operate:

[0266] The NF provider accepts the service request and processes it.

[0267] Return a response to the NF consumer, providing the requested service or data.

[0268] 2. Verification failed:

[0269] Failure reason:

[0270] The token is invalid or expired.

[0271] Signature verification failed (possible tampering).

[0272] Insufficient permissions (scope does not match).

[0273] The consumer's trust level does not meet the provider's service requirements.

[0274] operate:

[0275] The NF provider denies the service request.

[0276] Return an error response to the NF consumer, indicating the reason for the failure (such as unauthorized, token expired, etc.).

[0277] In this embodiment, through the introduction of trust levels, dynamic adjustment and classification management of the trust status of NF instances are supported, which effectively improves network security and flexibility, that is, enhances the trust management capabilities of network function services. Consumers can quickly locate service instances that meet their trust level requirements through NRF to avoid unnecessary waste of resources, thereby optimizing service discovery and selection efficiency. In addition, the introduced trust level verification mechanism effectively prevents unauthorized access, so the security and scalability of token management can be achieved. At the same time, the matching mechanism of consumer trust levels and service provider requirements can reduce potential security risks, while the dynamic retrieval matching mechanism improves the availability and stability of services, thereby improving the robustness of the overall network. In addition, it can support high-value scenarios in 5G and 6G networks (such as Internet of Vehicles, Industrial Internet, XR services, etc.), meet the differentiated needs of different scenarios for trust and security, and therefore can adapt to diversified business scenarios.

[0278] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0279] Based on the same inventive concept, the embodiment of the present application also provides a NF service request processing device for implementing the NF service request processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more NF service request processing device embodiments provided below can refer to the limitations of the NF service request processing method above, and will not be repeated here.

[0280] In one embodiment, Fig.11 As shown, a NF service request processing device is provided, which is applied to a network storage network element NRF, including: a trust level acquisition module 1101 and an access token sending module 1102, wherein:

[0281] The trust level acquisition module 1101 is used to respond to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquire a first consumer trust level corresponding to a pre-stored NF consumer, and acquire a second consumer trust level required by the target NF provider;

[0282] The access token sending module 1102 is used to return the access token to the NF consumer end when the trust level of the first consumer end meets the trust level of the second consumer end; the NF consumer end is used to use the access token to initiate a NF service request to the target NF provider end, so that the target NF provider end returns the response result corresponding to the NF service request to the NF consumer end.

[0283] In one embodiment, the NF service request processing device also includes: an NF list sending module, which is used to obtain a candidate NF provider according to the first consumer end trust level and a pre-stored provider trust level of each candidate NF provider when the first consumer end trust level does not meet the second consumer end trust level; the candidate NF provider is an NF provider accessible to the NF consumer; a NF provider list is constructed according to each candidate NF provider and the provider trust level of each candidate NF provider, and the NF provider list is returned to the NF consumer.

[0284] In one embodiment, the NF list sending module is further used to obtain the arrangement order of each candidate NF provider in the NF provider list according to the trust level of each provider; wherein the arrangement order of the candidate NF provider with a high provider trust level is before the arrangement order of the candidate NF provider with a low provider trust level; according to the arrangement order, construct a NF provider list including each candidate NF provider and the provider trust level of each candidate NF provider.

[0285] In one embodiment, the access token carries a first consumer-end trust level; the NF service request processing device also includes: a trust level verification module, which is used to obtain a trust level verification result according to the first consumer-end trust level carried in the access token when receiving an access token verification request initiated by the target NF provider for the access token; the access token verification request is triggered by the target NF provider when receiving the NF service request; the trust level verification result is returned to the target NF provider; the target NF provider is used to obtain a token verification result of the access token based on the trust level verification result, and when the token verification result indicates that the verification is passed, the response result corresponding to the NF service request is returned to the NF consumer.

[0286] In one embodiment, the NF service request processing device further includes: an NF registration module, which is used to respond to the NF registration request initiated by the NF to be registered, and obtain a configuration file corresponding to the NF to be registered; the NF to be registered is one of the NF consumer end and the NF provider end; according to the configuration file, the trust level of the NF to be registered is obtained, and the NF to be registered is registered, and the trust level of the NF to be registered is stored.

[0287] In one embodiment, the NF registration module is further used to verify the trust level of the NF to be registered recorded in the configuration file when the configuration file carries a data field for storing the trust level of the NF to be registered; when the trust level verification passes, the trust level of the NF to be registered recorded in the configuration file is used as the trust level of the NF to be registered; when the trust level verification fails, the trust level of the NF to be registered is set to a default trust level; the default trust level represents a low trust level.

[0288] In one embodiment, the NF registration module is further configured to set the trust level of the NF to be registered to a default trust level when the configuration file does not carry a data field.

[0289] In one embodiment, the trust level acquisition module 1101 is further used to obtain the identity authentication result and the business logic authorization verification result of the NF consumer end in response to the token acquisition request; when the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, the first consumer end trust level and the second consumer end trust level are obtained.

[0290] In one embodiment, Fig.12 As shown, a NF service request processing device is provided, which is applied to a pre-registered NF consumer end, including: a token acquisition request module 1201 and a NF service request module 1202, wherein:

[0291] The token acquisition request module 1201 is used to send a token acquisition request for acquiring an access token of a target NF provider to a network storage network element NRF; the NRF is used to return the access token to the NF consumer end when the first consumer end trust level pre-stored at the NF consumer end meets the second consumer end trust level required by the target NF provider end;

[0292] The NF service request module 1202 is used to receive the access token and use the access token to initiate a NF service request to the target NF provider; the target NF provider is used to return the response result corresponding to the NF service request to the NF consumer.

[0293] In one embodiment, the token acquisition request module 1201 is also used to receive the NF provider list returned by the NRF; the NF provider list includes candidate NF providers and the provider trust level of each candidate NF provider; the candidate NF provider is the NF provider accessible to the NF consumer; the NF provider list is generated by the NRF when the trust level of the first consumer does not meet the trust level of the second consumer; in response to a trigger operation for any candidate NF provider in the NF provider list, a token acquisition request for obtaining an access token of the candidate NF provider is sent to the NRF.

[0294] In one embodiment, Fig.13 As shown, a NF service request processing device is provided, which is applied to a target NF provider, including: a response result acquisition module 1301 and a response result sending module 1302, wherein:

[0295] The response result acquisition module 1301 is used to respond to the NF service request initiated by the pre-registered NF consumer through the access token and obtain the response result corresponding to the NF service request; the access token is sent to the NF consumer by the network storage network element NRF when the first consumer trust level corresponding to the NF consumer meets the second consumer trust level required by the target NF provider;

[0296] The response result sending module 1302 is used to return the response result to the NF consumer end.

[0297] In one embodiment, the response result acquisition module 1301 is further used to obtain a token verification result of the access token in response to the NF service request; when the token verification result indicates that the verification is passed, obtain a response result corresponding to the NF service request.

[0298] In one embodiment, the access token carries a first consumer-end trust level; the response result acquisition module 1301 is further used to send an access token verification request for the access token to the NRF in response to the NF service request; the access token verification request is used to request the NRF to obtain and return a trust level verification result based on the first consumer-end trust level carried in the access token; and a token verification result of the access token is obtained based on the trust level verification result.

[0299] Each module in the above-mentioned NF service request processing device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0300] In an exemplary embodiment, a computer device is provided. The computer device may be a network storage element NRF, or a NF consumer or NF provider. The internal structure diagram thereof may be as follows: Fig.14As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store trust level data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a NF service request processing method is implemented.

[0301] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0302] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0303] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0304] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0305] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0306] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0307] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0308] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for processing a NF service request, characterized in that: Applied to a network storage network element NRF, the method comprises: In response to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquiring a pre-stored first consumer trust level corresponding to the NF consumer, and acquiring a second consumer trust level required by the target NF provider; When the trust level of the first consumer meets the trust level of the second consumer, the access token is returned to the NF consumer; the NF consumer uses the access token to initiate a NF service request to the target NF provider, so that the target NF provider returns a response result corresponding to the NF service request to the NF consumer.

2. The method according to claim 1, characterized in that: After obtaining the second consumer end trust level required by the NF provider end, the method further includes: In the case where the trust level of the first consumer end does not meet the trust level of the second consumer end, obtaining a candidate NF provider end according to the trust level of the first consumer end, and the pre-stored provider end trust level of each of the candidate NF providers; the candidate NF provider end is an NF provider end accessible to the NF consumer end; A NF provider list is constructed according to each of the candidate NF providers and the provider trust level of each of the candidate NF providers, and the NF provider list is returned to the NF consumer.

3. The method according to claim 2, characterized in that The step of constructing a NF provider list according to each of the candidate NF providers and the provider trust level of each of the candidate NF providers includes: According to the trust level of each provider, the arrangement order of each candidate NF provider in the NF provider list is obtained; wherein the arrangement order of the candidate NF provider with a higher trust level is located before the arrangement order of the candidate NF provider with a lower trust level; According to the arrangement order, a NF provider list is constructed including each of the candidate NF providers and the provider trust level of each of the candidate NF providers.

4. The method according to claim 1, characterized in that The access token carries the trust level of the first consumer end; after returning the access token of the target NF provider end to the NF consumer end, the method further includes: Upon receiving an access token verification request initiated by the target NF provider for the access token, obtaining a trust level verification result according to the trust level of the first consumer carried in the access token; the access token verification request is triggered by the target NF provider upon receiving the NF service request; The trust level verification result is returned to the target NF provider; the target NF provider is used to obtain the token verification result of the access token based on the trust level verification result, and when the token verification result indicates that the verification is passed, the response result corresponding to the NF service request is returned to the NF consumer.

5. The method according to any one of claims 1 to 4, characterized in that: Before responding to the token acquisition request initiated by the pre-registered NF consumer for acquiring the access token of the target NF provider, the method further includes: In response to an NF registration request initiated by a to-be-registered NF, a configuration file corresponding to the to-be-registered NF is obtained; the to-be-registered NF is one of an NF consumer end and an NF provider end; According to the configuration file, the trust level of the NF to be registered is obtained, the NF to be registered is registered, and the trust level of the NF to be registered is stored.

6. The method according to claim 5, characterized in that The obtaining, according to the configuration file, the trust level of the NF to be registered includes: In a case where the configuration file carries a data field for storing the trust level of the NF to be registered, verifying the trust level of the NF to be registered recorded in the configuration file; In the case where the trust level verification passes, the trust level of the NF to be registered recorded in the configuration file is used as the trust level of the NF to be registered; In the case where the trust level verification fails, the trust level of the NF to be registered is set to a default trust level; the default trust level represents a low trust level.

7. The method according to claim 6, characterized in that The step of obtaining the trust level of the NF to be registered according to the configuration file further includes: In the case that the data field is not carried in the configuration file, the trust level of the NF to be registered is set to the default trust level.

8. The method according to claim 1, characterized in that The step of responding to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquiring a pre-stored first consumer trust level corresponding to the NF consumer, and acquiring a second consumer trust level required by the target NF provider, comprises: In response to the token acquisition request, obtaining the identity authentication result of the NF consumer end and the business logic authorization verification result; When the identity authentication result and the business logic authorization verification result both indicate that the verification is passed, the first consumer end trust level and the second consumer end trust level are obtained.

9. A method for processing a NF service request, characterized in that: Applicable to pre-registered NF consumers, including: Sending a token acquisition request for acquiring an access token of a target NF provider to a network storage network element NRF; the NRF is used to return the access token to the NF consumer end when the first consumer end trust level pre-stored at the NF consumer end meets the second consumer end trust level required by the target NF provider end; Receive the access token, and use the access token to initiate a NF service request to the target NF provider; the target NF provider is used to return a response result corresponding to the NF service request to the NF consumer.

10. The method according to claim 9, characterized in that After sending a token acquisition request for acquiring an access token of a target NF provider to the network storage network element NRF, the method further includes: Receive the NF provider list returned by the NRF; the NF provider list includes candidate NF providers and the provider trust level of each candidate NF provider; the candidate NF provider is an NF provider accessible to the NF consumer; the NF provider list is generated by the NRF when the trust level of the first consumer does not meet the trust level of the second consumer; In response to a trigger operation on any candidate NF provider in the NF provider list, a token acquisition request for acquiring an access token of the candidate NF provider is sent to the NRF.

11. A method for processing a NF service request, characterized in that: Applied to the target NF provider, including: In response to a NF service request initiated by a pre-registered NF consumer through an access token, a response result corresponding to the NF service request is obtained; the access token is sent to the NF consumer by the network storage network element NRF when the first consumer trust level corresponding to the NF consumer meets the second consumer trust level required by the target NF provider; The response result is returned to the NF consumer.

12. The method according to claim 11, characterized in that The step of responding to the NF service request initiated by the pre-registered NF consumer through the access token, obtaining a response result corresponding to the NF service request, comprises: In response to the NF service request, obtaining a token verification result of the access token; When the token verification result indicates that the verification is successful, a response result corresponding to the NF service request is obtained.

13. The method according to claim 12, characterized in that The access token carries the first consumer end trust level; The obtaining, in response to the NF service request, a token verification result of the access token, comprises: In response to the NF service request, sending an access token verification request for the access token to the NRF; the access token verification request is used to request the NRF to obtain and return a trust level verification result based on the first consumer end trust level carried in the access token; A token verification result of the access token is obtained based on the trust level verification result.

14. A NF service request processing device, characterized in that: Applied to a network storage network element NRF, the device comprises: A trust level acquisition module, configured to respond to a token acquisition request initiated by a pre-registered NF consumer for acquiring an access token of a target NF provider, acquire a pre-stored first consumer trust level corresponding to the NF consumer, and acquire a second consumer trust level required by the target NF provider; The access token sending module is used to return the access token to the NF consumer end when the trust level of the first consumer end meets the trust level of the second consumer end; the NF consumer end is used to use the access token to initiate a NF service request to the target NF provider end, so that the target NF provider end returns the response result corresponding to the NF service request to the NF consumer end.

15. A NF service request processing device, characterized in that: Applied to a pre-registered NF consumer, the device comprises: A token acquisition request module is used to send a token acquisition request for acquiring an access token of a target NF provider to a network storage network element NRF; the NRF is used to return the access token to the NF consumer end when the first consumer end trust level pre-stored at the NF consumer end meets the second consumer end trust level required by the target NF provider end; The NF service request module is used to receive the access token and use the access token to initiate a NF service request to the target NF provider; the target NF provider is used to return a response result corresponding to the NF service request to the NF consumer.

16. A NF service request processing device, characterized in that: Applied to a target NF provider, the device comprises: A response result acquisition module is used to obtain a response result corresponding to the NF service request initiated by a pre-registered NF consumer through an access token; the access token is sent to the NF consumer by the network storage network element NRF when the first consumer trust level corresponding to the NF consumer meets the second consumer trust level required by the target NF provider; The response result sending module is used to return the response result to the NF consumer end.

17. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images