Authorization method, terminal, node, communication device, communication system and storage medium

Abstract

The embodiment of the invention provides an authorization method, a terminal, a node, communication equipment, a communication system and a storage medium. The method is executed by a first node, and the method comprises the following steps: sending first information to a terminal, the first information being used for requesting authorization for processing first data, and the first data being related to the terminal. According to the technical scheme provided by the embodiment of the invention, the first node directly sends the first information to the terminal to request the terminal to authorize the processing behavior of the first data related to the terminal; on one hand, the terminal can participate in the authorization process of the first data of the terminal, so that the terminal can adjust the authorization result of the processing behavior of the first data in real time according to the privacy protection strategy. And on the other hand, compared with centralized management and control by the network function of the core network, the terminal performs authority management and control on processing related to the first data of the terminal, so that the authorization efficiency can be effectively improved.

Description

Authorization methods, terminals, nodes, communication equipment, communication systems, and storage media Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to authorized methods, terminals, nodes, communication devices, communication systems and storage media. Background Technology

[0002] In current communication systems, network functions typically need to obtain relevant authorization from the relevant network functions in the core network before processing data related to terminals or users using those terminals.

[0003] Summary of the Invention

[0004] This disclosure provides an authorized method, apparatus, node, communication device, and storage medium.

[0005] According to a first aspect of the present disclosure, an authorization method is provided, wherein the method is executed by a first node, the method comprising: sending first information to a terminal, the first information being used to request authorization to process first data, the first data being associated with the terminal.

[0006] According to a second aspect of the present disclosure, an authorization method is provided, wherein the method is executed by a terminal, the method comprising: receiving first information sent by a first node, the first information being used to request authorization to process first data, the first data being associated with the terminal.

[0007] According to a third aspect of the present disclosure, an authorization method is provided, wherein the method is executed by a second node, the method comprising: receiving fifth information sent by a first node, the fifth information being used to request obtaining a token; the fifth information including an authorization code, the authorization code being related to the authorization of processing behavior of first data, the first data being related to a terminal.

[0008] According to a fourth aspect of the present disclosure, an authorization method is provided, wherein the method is performed by a third node, the method comprising: receiving seventh information sent by a first node, the seventh information being used to request a service related to first data, the first data being related to a terminal; the seventh information including a token.

[0009] According to a fifth aspect of the present disclosure, an authorization method is provided, wherein the method is executed by a communication system, the method comprising: a first node sending first information to a terminal, the first information being used to request authorization to process first data, the first data being associated with the terminal; the terminal sending ninth information to a second node, the ninth information being used to indicate authorization information related to the processing of the first data; the second node sending tenth information to the terminal, the tenth information including the authorization code; the terminal sending fourth information to the first node, the fourth information including the authorization code; the first node sending fifth information to the second node, the fifth information being used to request obtaining a token; the fifth information including the authorization code; the second node sending sixth information to the first node, the sixth information including the token; and the first node sending seventh information to a third node, the seventh information being used to request services related to the first data, the seventh information including the token.

[0010] According to a sixth aspect of the present disclosure, a first node is provided, wherein the first node includes: a sending module configured to send first information to a terminal, the first information being used to request authorization to process first data, the first data being associated with the terminal.

[0011] According to a seventh aspect of the present disclosure, a terminal is provided, wherein the terminal includes: a first receiving module configured to receive first information sent by a first node, the first information being used to request authorization to process first data, the first data being related to the terminal.

[0012] According to an eighth aspect of the present disclosure, a second node is provided, wherein the second node includes: a second receiving module configured to receive fifth information sent by a first node, the fifth information being used to request obtaining a token; the fifth information includes an authorization code, the authorization code being related to the authorization of processing behavior of first data, the first data being related to a terminal.

[0013] According to a ninth aspect of the present disclosure, a third node is provided, wherein the third node includes: a third receiving module configured to receive seventh information sent by a first node, the seventh information being used to request a service related to first data, the first data being related to a terminal; the seventh information including a token.

[0014] According to a tenth aspect of the present disclosure, a communication system is provided, wherein the communication system includes a terminal, a first node, a second node, and a third node, the first node being configured to implement an authorization method provided by a first aspect, the terminal being configured to implement an authorization method provided by a second aspect, the second node being configured to implement an authorization method provided by a third aspect, and the third node being configured to implement an authorization method provided by a fourth aspect.

[0015] According to an eleventh aspect of the present disclosure, a communication device is provided, wherein the communication device includes: one or more processors; wherein the processors are configured to invoke instructions to cause the communication device to perform the authorized method provided in the first aspect, the second aspect, the third aspect, or the fourth aspect.

[0016] According to a twelfth aspect of the present disclosure, a storage medium is provided, wherein the storage medium stores instructions that, when executed on a communication device, cause the communication device to perform the authorized method provided in the first aspect, the second aspect, the third aspect, or the fourth aspect.

[0017] The technical solution provided in this disclosure sends first information directly to the terminal through a first node to request the terminal to authorize its processing of its own related first data. On the one hand, this allows the terminal to participate in the authorization process of its own first data, so that the terminal can adjust the authorization result of the processing of the first data in real time according to the privacy protection strategy. On the other hand, compared with centralized management by the network functions of the core network, the terminal's access control for its own processing of its own first data can effectively improve the authorization efficiency.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments of the invention.

[0020] Figure 1A is a schematic diagram of the architecture of a communication system according to an exemplary embodiment;

[0021] Figure 1B is a schematic diagram of the architecture of a communication system according to an exemplary embodiment;

[0022] Figure 2A is an interactive schematic diagram of an authorization method according to an exemplary embodiment;

[0023] Figure 2B is an interactive schematic diagram of an authorization method according to an exemplary embodiment;

[0024] Figure 2C is an interactive schematic diagram of an authorization method according to an exemplary embodiment;

[0025] Figure 3A is a flowchart illustrating an authorization method according to an exemplary embodiment;

[0026] Figure 3B is a schematic flowchart of an authorization method according to an exemplary embodiment;

[0027] Figure 4A is a schematic flowchart of an authorization method according to an exemplary embodiment;

[0028] Figure 4B is a flowchart illustrating an authorization method according to an exemplary embodiment;

[0029] Figure 5A is a flowchart illustrating an authorization method according to an exemplary embodiment;

[0030] Figure 5B is a flowchart illustrating an authorization method according to an exemplary embodiment.

[0031] Figure 6A is a schematic flowchart illustrating an authorization method according to an exemplary embodiment;

[0032] Figure 6B is a flowchart illustrating an authorization method according to an exemplary embodiment;

[0033] Figure 7 is an interactive schematic diagram of an authorization method according to an exemplary embodiment;

[0034] Figure 8A is a flowchart illustrating an authorization method according to an exemplary embodiment.

[0035] Figure 8B is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment;

[0036] Figure 8C is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment;

[0037] Figure 8D is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment;

[0038] Figure 8E is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment;

[0039] Figure 8F is a schematic diagram illustrating an authorization method according to an exemplary embodiment;

[0040] Figure 9A is a schematic diagram of the structure of a first node according to an exemplary embodiment;

[0041] Figure 9B is a schematic diagram of the structure of a terminal according to an exemplary embodiment;

[0042] Figure 9C is a schematic diagram of the structure of a second node according to an exemplary embodiment;

[0043] Figure 9D is a schematic diagram of the structure of a third node according to an exemplary embodiment;

[0044] Figure 10A is a schematic diagram of the structure of a communication device according to an exemplary embodiment;

[0045] Figure 10B is a schematic diagram of the structure of a chip according to an exemplary embodiment. Detailed Implementation

[0046] This disclosure provides an authorization method, as well as a terminal, node, communication device, communication system, and storage medium.

[0047] In a first aspect, embodiments of this disclosure provide an authorization method, wherein the method is executed by a first node, and the method includes: sending first information to a terminal, the first information being used to request authorization to process first data, the first data being related to the terminal.

[0048] In the above embodiments, before processing the terminal-related first data, the first node directly sends first information to the terminal to request authorization from the terminal for processing its own first data. This allows the terminal to participate in the authorization process for its own first data, enabling it to adjust the authorization result for processing the first data in real time according to privacy protection policies. Furthermore, compared to centralized management by the core network's network functions, allowing the terminal to manage its own first data processing permissions effectively improves authorization efficiency.

[0049] In conjunction with some embodiments of the first aspect, in some embodiments, the first node includes at least one of the following: core network functions; access network functions.

[0050] In the above embodiments, both the core network function and the access network function can request authorization to process the first data related to the terminal by sending the first information to the terminal, so that the access network function can also have the ability to process the first data. In this way, the processing of the first data of the terminal within the coverage area of ​​the access network function can be performed by the access network function.

[0051] In conjunction with some embodiments of the first aspect, in some embodiments, sending the first information to the terminal includes at least one of the following:

[0052] When the first node is a core network function, the first information is sent to the terminal through the access network function, and the first information is carried in the non-access stratum (NAS) message.

[0053] When the first node is an access network function and the first node supports the first access method, the first information is sent to the terminal, and the first information is carried in the message of the first access method adaptation.

[0054] When the first node is an access network function and the first node supports the second access method, the first information is sent to the terminal, and the first information is carried in the message of the second access method adaptation;

[0055] The message adapted to the first access method is at least one of the access layer AS message and the radio resource control RRC message; the message adapted to the second access method is different from the message adapted to the first access method.

[0056] In the above embodiments, when the first node is a device of different types and / or different access capabilities, the messages exchanged between the device and the terminal of different types and / or different access capabilities are reused to carry the first information, thereby reducing information overhead.

[0057] In conjunction with some embodiments of the first aspect, in some embodiments, the first information includes at least one of the following: second information for indicating the requested scope of authorization related to the first data; and first identification information for indicating a first application function AF for obtaining the first data.

[0058] In the above embodiments, the first information may include second information and / or first identification information, so that when the first node requests authorization related to the first data, the scope of the requested authorization related to the first data can be limited by the second information and / or the first identification information, so that the authorization for the processing behavior of the first data can be more refined.

[0059] In conjunction with some embodiments of the first aspect, in some embodiments, the second information includes at least one of the following: data type information, used to indicate the type of the first data; purpose information, used to indicate the purpose of processing the first data; and the first identification information.

[0060] In the above embodiments, by carrying at least one of data type information, purpose information and first identification information in the second information, a request is made to the terminal to process a specific type of data related to the terminal for a specific purpose. Thus, the authorization obtained by the first node can not only meet its processing needs for the first data, but also effectively prevent the abuse of authorization for the first data related to the terminal, thereby effectively protecting the privacy of the terminal.

[0061] In conjunction with some embodiments of the first aspect, in some embodiments, the data type information includes at least one of the following: terminal location information; terminal sensing information; terminal user identification information; and terminal identification information.

[0062] In the above embodiments, the first data requested by the first node may be the terminal's location information, sensing information, user identification information, and / or the terminal's identification information, thereby enabling the first node to request authorization for processing actions on terminal data and / or data of users using the terminal, improving the flexibility of authorization.

[0063] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: determining the second information based on third information; wherein the third information is used to indicate a service related to the first data requested by the first node.

[0064] In the above embodiments, the first node can determine the scope of authorization related to the requested first data based on the requested service related to the first data. In this way, the first node can request the scope of authorization corresponding to its processing needs based on its own processing needs for the first data.

[0065] In some embodiments, in conjunction with the first aspect, the method further includes: receiving fourth information sent by the terminal, the fourth information including an authorization code configured for the first node.

[0066] In the above embodiment, the first node obtains an authorization code by receiving the fourth information sent by the terminal; this enables the first node to use the authorization code as an authorization credential to request a corresponding token from the second node.

[0067] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending fifth information to a second node, the fifth information being used to request obtaining a token, the fifth information including the authorization code, the authorization code being related to the authorization of the processing behavior of the first data.

[0068] In the above embodiment, the first node sends fifth information carrying an authorization code to the second node to request a token. Since the authorization code is related to the authorization of the processing behavior of the first data, the second node can generate a corresponding token for the first node based on the authorization code in the fifth information; so that the first node can use the token to request services related to the processing of the first data for a specific purpose.

[0069] In conjunction with some embodiments of the first aspect, in some embodiments, the fifth information further includes at least one of the following: first identification information; second identification information for indicating a terminal and / or a user using the terminal; data type information for indicating the type of the first data; purpose information for indicating the purpose of processing the first data; service operation information for indicating at least one of the following: a service operation associated with the acquired first data; the data type of the first data; and the purpose of processing the first data.

[0070] In the above embodiments, by carrying at least one of the first identification information, the second identification information, the data type information, and the purpose information in the fifth information, the second node can verify the authorization code, the requested data type, and the purpose of data processing based on the above information in the fifth information and the authorization information related to the processing of the first data sent by the terminal, thereby ensuring that the behavior of processing a specific type of first data for a specific purpose can be authorized, and improving the precision of the authorization.

[0071] In conjunction with some embodiments of the first aspect, in some embodiments, the token includes at least one of the following: second identification information; third identification information for indicating a second AF authorized to obtain the first data; authorized data processing purpose.

[0072] In the above embodiments, by carrying at least one of the second identification information, the third identification information, and the authorized data processing purpose in the token, the second node can verify whether the purpose of the service request by the first node is authorized based on the above information in the token during the subsequent process of the first node initiating a service request. This enables the second node to provide the terminal with a service that processes the first data for the authorized specific purpose, and refuses to provide a service that processes the first data for other purposes.

[0073] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: receiving sixth information sent by the second node, the sixth information including the token.

[0074] In the above embodiment, the first node obtains a token generated by the second node for the first node by receiving the sixth information sent by the second node. This token is related to the authorization of the processing behavior of the first data requested by the first node; thereby enabling the first node to use the token to request services related to the first data.

[0075] In conjunction with some embodiments of the first aspect, in some embodiments, sending the fifth information to the second node includes at least one of the following:

[0076] If the first node is an access network function and supports Service-Based Architecture (SBA), the fifth information is sent to the second node.

[0077] If the first node is an access network function and does not support the SBA, the fifth information is sent to the second node through the core network function.

[0078] In the above embodiments, by sending the fifth information directly to the second node or by sending the fifth information to the second node via the core network function, the first node with different capabilities can request to obtain a token from the second node, thereby using the token to request services related to the first data.

[0079] In conjunction with some embodiments of the first aspect, in some embodiments, the core network function is used to perform at least one of the following: access management function; mobility management function.

[0080] In the above embodiments, since the core network function is used to perform access management functions and / or mobility management functions, it has the ability to communicate with various network functions; thus, in the case that the first node does not support SBA, the core network function is used as an information transmission intermediary so that the first node that does not support SBA can send the fifth information to the second node.

[0081] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: sending seventh information to a third node, the seventh information being used to request services related to the first data; the seventh information including the token.

[0082] In the above embodiment, the first node sends a seventh message carrying a token to the third node to request a service that processes the first data for the authorized data processing purpose indicated by the token.

[0083] In conjunction with some embodiments of the first aspect, in some embodiments, the seventh information further includes at least one of the following: the first identification information; the second identification information; data type information for indicating the type of the first data; and purpose information for indicating the purpose of processing the first data.

[0084] In the above embodiments, by carrying at least one of the first identification information, the second identification information, the data type information, and the purpose information in the seventh information, the third node can verify the purpose of the first node's request for service based on the token and the aforementioned information in the seventh information, thereby ensuring that the service of processing the first data for the authorized data processing purpose can be provided to the first node.

[0085] Secondly, embodiments of this disclosure provide an authorization method, wherein the method is executed by a terminal, and the method includes: receiving first information sent by a first node, the first information being used to request authorization to process first data, the first data being related to the terminal.

[0086] In the above embodiments, the terminal authorizes its own processing of first data by receiving first information sent by the first node. On the one hand, this allows the terminal to participate in the authorization process of its own first data, so that the terminal can adjust the authorization result of the processing of the first data in real time according to the privacy protection policy. On the other hand, compared with centralized management by the network functions of the core network, the terminal's access control over its own processing of first data can effectively improve authorization efficiency.

[0087] In conjunction with some embodiments of the second aspect, in some embodiments, the first node includes at least one of the following: core network functions; access network functions.

[0088] The first information received from the first node includes at least one of the following:

[0089] In conjunction with some embodiments of the second aspect, in some embodiments, when the first node is a core network function, the first information sent by the first node through the access network function is received, and the first information is carried in the NAS message;

[0090] When the first node is the access network function and the first node supports the first access method, the first information sent by the first node is received, and the first information is carried in the message of the first access method adaptation.

[0091] When the first node is the access network function and the first node supports the second access method, the first information sent by the first node is received, and the first information is carried in the message of the second access method adaptation;

[0092] The message adapted to the first access method is at least one of the access layer AS message and the radio resource control RRC message; the message adapted to the second access method is different from the message adapted to the first access method.

[0093] In conjunction with some embodiments of the second aspect, in some embodiments, the first information includes at least one of the following: second information for the requested scope of authorization related to the first data; and first identification information for indicating a first AF for obtaining the first data.

[0094] In conjunction with some embodiments of the second aspect, in some embodiments, the second information includes at least one of the following: data type information, used to indicate the type of the first data; and purpose information, used to indicate the purpose of processing the first data.

[0095] In conjunction with some embodiments of the second aspect, in some embodiments, the data type information includes at least one of the following: terminal location information; terminal sensing information; terminal user identification information; terminal identification information.

[0096] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: determining ninth information based on the first information, the ninth information being used to indicate authorization information related to the processing of the first data; and sending the ninth information to the second node.

[0097] In the above embodiment, after receiving the first information, the terminal decides whether to authorize the processing of the first data requested by the first node, and sends the ninth information indicating the authorization information related to the processing of the first data to the second node, so that the second node can subsequently configure the corresponding authorization code for the second node based on the ninth information sent by the terminal.

[0098] In conjunction with some embodiments of the second aspect, in some embodiments, the ninth information includes at least one of the following: the data type that is allowed or denied authorization; and the data processing purpose that is allowed or denied authorization.

[0099] In the above embodiments, the terminal performs authorization based on data type and / or data processing purpose during the authorization process, thereby improving the accuracy of authorization.

[0100] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: receiving tenth information sent by the second node, the tenth information including: an authorization code configured for the first node.

[0101] In the above embodiment, the terminal obtains the authorization code by receiving the tenth information sent by the second node; thereby enabling the authorization code to be used by the first node as an authorization credential to request the acquisition of the corresponding token.

[0102] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes: sending fourth information to the first node, the fourth information including the authorization code.

[0103] Thirdly, this disclosure provides an authorization method, wherein the method is executed by a second node, and the method includes: receiving fifth information sent by a first node, the fifth information being used to request obtaining a token; the fifth information includes an authorization code, the authorization code being related to the authorization of processing behavior of first data, and the first data being related to a terminal.

[0104] In the above embodiment, by receiving the fifth information carrying the authorization code sent by the first node, since the authorization code is related to the authorization of the processing behavior of the first data, the second node can generate a corresponding token for the first node according to the authorization code in the fifth information; so that the first node can use the token to request services related to the processing of the first data for a specific purpose.

[0105] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes: the fifth information, which further includes at least one of the following: first identification information for indicating the first AF that acquired the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; purpose information for indicating the purpose of processing the first data; service operation information for indicating at least one of the following: the service operation associated with the acquired first data; the data type of the first data; and the purpose of processing the first data.

[0106] In some embodiments, in conjunction with the third aspect, the method further includes: performing a first verification on the fifth information based on the eleventh information.

[0107] In the above embodiment, before the second node configures a token for the first node, the second node performs a first verification on the fifth information based on the pre-stored eleventh information, thereby determining whether the processing behavior of the first data requested by the first node is authorized by the terminal.

[0108] In conjunction with some embodiments of the third aspect, in some embodiments, the eleventh information includes at least one of the following: the second identification information; the authorization code associated with the second identification information; the authorization scope associated with the second identification information; the third identification information associated with the second identification information, the third identification information being used to indicate the second AF authorized to obtain the first data; the authorization code; the second identification information associated with the authorization code; the authorization scope associated with the authorization code; and the third identification information associated with the authorization code.

[0109] In the above embodiments, the eleventh information includes the relationship between the authorization code, the second identification information, the authorization scope, and the third identification information, so that the second node can perform the first verification of the fifth information from multiple perspectives based on the relationship between the above information.

[0110] In conjunction with some embodiments of the third aspect, in some embodiments, the first verification of the fifth information based on the eleventh information includes at least one of the following:

[0111] The fifth information includes the second identification information, and the authorization code in the fifth information is verified based on the authorization code associated with the second identification information in the eleventh information;

[0112] The fifth information includes the authorization code and the second identification information. Based on the second identification information associated with the authorization code contained in the eleventh information, the second identification information in the fifth information is verified.

[0113] The fifth information includes the second identification information, the data type information, and the purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type information and the purpose information in the fifth information are verified.

[0114] The fifth piece of information includes the authorization code, the data type information, and the purpose information. Based on the authorization scope associated with the authorization code in the eleventh piece of information, the data type information and the purpose information in the fifth piece of information are verified.

[0115] The fifth information includes the second identification information and the first identification information. Based on the third identification information associated with the second identification information in the eleventh information, the first identification information in the fifth information is verified.

[0116] The fifth information includes the second identification information and the first identification information. Based on the authorization scope associated with the second identification information in the eleventh information, the first identification information within the fifth information is verified.

[0117] The fifth information includes the authorization code and the first identification information. Based on the third identification information associated with the authorization code in the eleventh information, the first identification information in the fifth information is verified.

[0118] The fifth information includes the authorization code and the first identification information. Based on the authorization scope associated with the authorization code in the eleventh information, the first identification information within the fifth information is verified.

[0119] The fifth information includes the authorization code and the service operation information, but does not include the purpose information. Based on the authorization scope associated with the authorization code in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified.

[0120] The fifth information includes the second identification information and the service operation information, but does not include the purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified.

[0121] In the above embodiments, the second node can verify the authorization code, the requested data type, and the data processing purpose based on the information in the fifth information and the authorization information related to the processing of the first data sent by the terminal, thereby ensuring that the behavior of processing a specific type of first data for a specific purpose can be authorized, and improving the precision of the authorization.

[0122] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes: if the first verification is successful, sending sixth information to the first node, the sixth information including the token.

[0123] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes: receiving a ninth message sent by a terminal, the ninth message being used to indicate authorization information related to the processing of the first data.

[0124] In conjunction with some embodiments of the third aspect, in some embodiments, the ninth information includes at least one of the following: the data type that is allowed or denied authorization; and the data processing purpose that is allowed or denied authorization.

[0125] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes: configuring an authorization code for the first node according to the ninth information; and sending tenth information to the terminal, the tenth information including the authorization code.

[0126] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes: determining the eleventh information based on the ninth information and the tenth information.

[0127] In the above embodiment, the second node determines the eleventh information based on the authorization information and authorization code related to the processing of the first data sent by the terminal, so that the fifth information sent by the first node can be verified based on the eleventh information, thereby realizing the verification of authorization information, authorization code, etc.

[0128] Fourthly, this disclosure provides an authorization method, which is executed by a third node. The method includes: receiving seventh information sent by a first node, the seventh information being used to request services related to first data, the first data being related to a terminal; the seventh information including a token.

[0129] In the above embodiment, by receiving the seventh information carrying a token sent by the first node, it is possible to determine, based on the token, whether to provide the first node with the service of processing the first data for the data processing purpose requested by the seventh information.

[0130] In conjunction with some embodiments of the fourth aspect, in some embodiments, the seventh information further includes at least one of the following: first identification information for indicating the first AF that acquires the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; and purpose information for indicating the purpose of processing the first data.

[0131] In conjunction with some embodiments of the fourth aspect, in some embodiments, the token includes at least one of the following: second identification information; third identification information for indicating a second AF authorized to obtain the first data; and authorized data processing purpose.

[0132] In conjunction with some embodiments of the fourth aspect, in some embodiments, the method further includes: performing a second verification on the seventh information based on the token.

[0133] In the above embodiment, the third node performs a second verification on the service requested by the seventh information based on the authorization scope related to the authorized first data indicated by the token, thereby determining whether the service requested by the first node and the purpose of requesting the service are authorized.

[0134] In conjunction with some embodiments of the fourth aspect, in some embodiments, the second verification of the seventh information based on the token includes at least one of the following:

[0135] The seventh information includes the second identification information and the token. The second identification information in the seventh information is verified based on the second identification information in the token.

[0136] The seventh information includes the purpose information and the token. Based on the authorized data processing purpose within the token, the data processing purpose requested by the purpose information in the seventh information is verified.

[0137] The seventh information includes the first identification information and the token. Based on the authorized second AF indicated by the third identification information in the token, the first AF indicated by the first identification information in the seventh information is verified.

[0138] In the above embodiments, the third node can verify the identity of the requester and the purpose of the requested service based on the token and the information in the seventh information, thereby ensuring that it can provide the first node with the service of processing the first data for the authorized data processing purpose.

[0139] Fifthly, embodiments of this disclosure provide an authorization method, executed by a communication system, the method comprising: a first node sending first information to a terminal, the first information being used to request authorization to process first data, the first data being related to the terminal; the terminal sending ninth information to a second node, the ninth information being used to indicate authorization information related to the processing of the first data; the second node sending tenth information to the terminal, the tenth information including the authorization code; the terminal sending fourth information to the first node, the fourth information including the authorization code; the first node sending fifth information to the second node, the fifth information being used to request obtaining a token; the fifth information including the authorization code; the second node sending sixth information to the first node, the sixth information including the token; and the first node sending seventh information to a third node, the seventh information being used to request services related to the first data, the seventh information including the token.

[0140] In a sixth aspect, embodiments of this disclosure provide a first node, wherein the first node includes: a sending module configured to send first information to a terminal, the first information being used to request authorization to process first data, the first data being related to the terminal.

[0141] In a seventh aspect, embodiments of this disclosure provide a terminal, wherein the terminal includes: a first receiving module configured to receive first information sent by a first node, the first information being used to request authorization to process first data, the first data being related to the terminal.

[0142] Eighthly, this disclosure provides a second node, wherein the second node includes: a second receiving module configured to receive fifth information sent by a first node, the fifth information being used to request a token; the fifth information includes an authorization code, the authorization code being related to the authorization of processing behavior of first data, the first data being related to a terminal.

[0143] In a ninth aspect, embodiments of this disclosure provide a third node, wherein the third node includes: a third receiving module configured to receive seventh information sent by a first node, the seventh information being used to request services related to first data, the first data being related to a terminal; the seventh information includes a token.

[0144] In a tenth aspect, embodiments of this disclosure provide a communication system, wherein the communication system includes a terminal, a first node, a second node, and a third node, the first node being configured to implement the authorization method described in the optional implementation of the first aspect, the terminal being configured to implement the authorization method described in the optional implementation of the second aspect, the second node being configured to implement the authorization method described in the optional implementation of the third aspect, and the third node being configured to implement the authorization method described in the optional implementation of the fourth aspect.

[0145] Eleventhly, embodiments of this disclosure provide a communication device, the communication device comprising: one or more processors; wherein the processors are configured to invoke instructions to cause the communication device to perform the authorized method described in the optional implementations of the first aspect, the second aspect, the third aspect, or the fourth aspect.

[0146] In a twelfth aspect, embodiments of this disclosure provide a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform the authorized method described in the optional implementations of the first, second, third, or fourth aspects.

[0147] In a thirteenth aspect, embodiments of this disclosure provide a program product that, when executed by a communication device, causes the communication device to perform the licensing method described in the optional implementations of the first, second, third, or fourth aspects.

[0148] In a fourteenth aspect, embodiments of this disclosure provide a computer program that, when run on a computer, causes the computer to perform the authorized method described in optional implementations of the first, second, third, or fourth aspects.

[0149] Understandably, the aforementioned terminal, first node, second node, third node, communication equipment, communication system, storage medium, program product, and computer program are all used to execute the methods provided in the embodiments of this disclosure. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0150] This disclosure provides an authorization method, a terminal, a node, a communication device, a communication system, and a storage medium. In some embodiments, the terms "authorization method" and "information processing method" can be used interchangeably, as can the terms "information indicating device" and "information processing device" and "information transmission device," and the terms "communication system" and "information processing system" can be used interchangeably.

[0151] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0152] In each of the disclosed embodiments, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0153] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0154] In this embodiment of the disclosure, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the," "the," "the," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression.

[0155] In the embodiments disclosed herein, "multiple" refers to two or more.

[0156] In some embodiments, the terms “at least one of”, “one or more”, “a plurality of”, “multiple”, etc., may be used interchangeably.

[0157] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "A in one case, B in another", etc., may include the following technical solutions depending on the situation: in some embodiments, A (A is executed regardless of B); in some embodiments, B (B is executed regardless of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, A and B (both A and B are executed). The same applies when there are more branches such as A, B, C, etc.

[0158] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execution of A regardless of B); in some embodiments, B (execution of B regardless of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, C, etc.

[0159] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. Similarly, if the object being described is "information", then "first information" and "second information" can be the same information or different information, and their content can be the same or different.

[0160] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0161] In some embodiments, terms such as “…”, “determine…”, “in the case of…”, “when…”, “when…”, “if…”, etc. can be used interchangeably.

[0162] In some embodiments, the terms “greater than,” “greater than or equal to,” “not less than,” “more than,” “more than or equal to,” “not less than,” “higher than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably, as can the terms “less than,” “less than or equal to,” “not greater than,” “less than,” “less than or equal to,” “not more than,” “lower than,” “lower than or equal to,” “not higher than,” and “below”.

[0163] In some embodiments, devices, etc., can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as “device”, “equipment”, “circuit”, “network element”, “node”, “function”, “unit”, “section”, “system”, “network”, “chip”, “chip system”, “entity”, and “subject” can be used interchangeably.

[0164] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0165] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0166] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", and "client" can be used interchangeably.

[0167] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0168] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0169] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0170] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0171] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0172] Figure 1A is a schematic diagram of the architecture of a communication system according to an exemplary embodiment. Figure 1B is a schematic diagram of the architecture of a communication system according to an exemplary embodiment.

[0173] As shown in Figures 1A and 1B, the communication system 100 includes a terminal 101, an access network function 102, and a core network function 103.

[0174] In some embodiments, access network function 102 may include a first node. Core network function 103 may include a second node and a third node, as shown in Figure 1A.

[0175] In some embodiments, core network function 103 may include a first node, a second node, and a third node, as shown in Figure 1B.

[0176] In some embodiments, terminal 101 includes, but is not limited to, at least one of the following: mobile phone, wearable device, Internet of Things device, car with communication function, smart car, tablet computer, computer with wireless transceiver function, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal device in industrial control, wireless terminal device in self-driving, wireless terminal device in remote medical surgery, wireless terminal device in smart grid, wireless terminal device in transportation safety, wireless terminal device in smart city, and wireless terminal device in smart home.

[0177] In some embodiments, access network function 102 may be, for example, a node or device that connects a terminal to a wireless network. Access network function may include, but is not limited to, at least one of the following in a 5G communication system: evolved Node B (eNB), next-generation eNB (ng-eNB), next-generation Node B (gNB), node B (NB), home node B (HNB), home evolved node B (HeNB), radio backhaul device, radio network controller (RNC), base station controller (BSC), base transceiver station (BTS), base band unit (BBU), mobile switching center, base station in a 6G communication system, open RAN, cloud RAN, base station in other communication systems, and access node in a Wi-Fi system.

[0178] In some embodiments, the technical solutions of this disclosure can be applied to the Open RAN architecture. In this case, the interfaces between or within access network functions involved in the embodiments of this disclosure can be transformed into internal interfaces of Open RAN. The processes and information interactions between these internal interfaces can be implemented by software or programs.

[0179] In some embodiments, the access network function can be composed of a central unit (CU) and a distributed unit (DU). The CU can also be called a control unit. By adopting the CU-DU structure, the protocol layer of the access network function can be separated. Some of the protocol layer functions are centrally controlled by the CU, while the remaining part or all of the protocol layer functions are distributed in the DU, which is centrally controlled by the CU. However, this is not the only possibility.

[0180] In some embodiments, core network function 103 may be a single device including one or more network functions, or it may be multiple devices or a group of devices, each including one or more network functions. Network elements may be virtual or physical. The core network may include, for example, at least one of an Evolved Packet Core (EPC), a 5G Core Network (5GCN), and a Next Generation Core (NGC).

[0181] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions provided in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in this disclosure are also applicable to similar technical problems.

[0182] The following embodiments of this disclosure can be applied to the communication system 100 or some of the main bodies shown in FIG1A or FIG1B, but are not limited thereto. The main bodies shown in FIG1A or FIG1B are illustrative. The communication system may include all or some of the main bodies in FIG1A or FIG1B, or may include other main bodies other than those in FIG1A or FIG1B. The number and form of each main body are arbitrary. The connection relationship between the main bodies is illustrative. The main bodies may not be connected or may be connected. The connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0183] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G new radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other communication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0184] Figure 2A is an interactive schematic diagram illustrating an authorization method according to an exemplary embodiment. As shown in Figure 2A, this disclosure relates to an authorization method for a communication system 100, the method comprising:

[0185] Step S2101: The first node sends the first information to the terminal.

[0186] In some embodiments, the first node may be a core network function.

[0187] In some embodiments, when the first node functions as a core network, the first node sends first information to the terminal through the access network function.

[0188] In some embodiments, the terminal receives first information sent by the first node.

[0189] In some embodiments, when the first node functions as a core network, the terminal receives first information sent by the first node through an access network function.

[0190] In some embodiments, the first information is carried in a Non-Access Stratum (NAS) message.

[0191] In some embodiments, the first node includes one of the following: a first core network function; a second core network function; wherein the second core network function is an access management function and / or a mobility management function; the first core network function is different from the second core network function.

[0192] In some embodiments, the second core network function includes access management functions and mobility management functions.

[0193] In some embodiments, the second core network function may be an Access and Mobility Management Function (AMF) or a Mobile Management Entity (MME).

[0194] In some embodiments, the first node sending first information to the terminal via access network functionality includes at least one of the following:

[0195] When the first node is a first core network function, the first information is sent to the terminal through the second core network function and the access network function.

[0196] When the first node functions as the second core network, it sends the first information to the terminal through the access network function.

[0197] In some embodiments, when the first node is a first core network function, the first node can discover the second core network function based on the second identification information.

[0198] In some embodiments, the second identification information is used to indicate the terminal and / or the user using the terminal.

[0199] In some embodiments, the second identification information may include at least one of the following: terminal identifier; Subscription Concealed Identifier (SUCI); Generic Public Subscription Identifier (GPSI); Subscription Permanent Identifier (SUPI).

[0200] It is understandable that the first node can discover the core network functions related to mobility management (i.e., the second core network functions) based on the second identification information, so as to send the first information to the terminal via the second core network functions.

[0201] In some embodiments, the first node sends first information to the terminal before processing the first data.

[0202] In some embodiments, the first information is used to request authorization to process the first data; wherein the first data is associated with a terminal.

[0203] It should be noted that before processing the first data related to the terminal, the first node needs to obtain authorization related to the processing of the first data from the terminal. Therefore, before processing the first data related to the terminal, the first node needs to send the first information to the terminal.

[0204] In some embodiments, the first data may be data related to terminal and / or user privacy.

[0205] In some embodiments, the first data includes at least one of the following: terminal data; user data of the user using the terminal.

[0206] It should be noted that terminal data can be sensor data, fault analysis data, etc.

[0207] User data for users of a terminal can be data generated during the user's use of the terminal, such as browsing history data and purchase history data.

[0208] It is important to note that user data is user-related. User data can be data obtained from multiple devices used by the user.

[0209] In some embodiments, the first information includes at least one of the following: second information, used to indicate the requested scope of authorization related to the first data; and first identification information, used to indicate the first application function (AF) for obtaining the first data.

[0210] It should be noted that the scope of authorization requested by the first node related to the first data can be understood as the scope of processing of the first data requested by the first node from the terminal; the scope of authorization related to the first data may include, but is not limited to: requesting the processing time for processing the first data, requesting the processing method for processing the first data, etc.

[0211] The first AF can be understood as a third-party AF that requests the exposure of the first data or the processing result of the first data. That is, the first node requests to expose or open the first data to the third-party AF indicated by the first identification information.

[0212] In some embodiments, the second information includes at least one of the following: data type information, used to indicate the type of the first data; purpose information, used to indicate the purpose of processing the first data; and first identification information.

[0213] It should be noted that data type information is used to indicate the type of the first data, that is, the type of first data related to the terminal that the first node requests to process. In other words, the first node can use data type information to inform the terminal what type of data it is requesting to process.

[0214] Purpose information indicates the purpose of processing the first data, that is, the purpose for which the first node processes the first data. For example, the first node requests the first data for the purpose of collecting data. Or, the first node requests the first data for the purpose of training an AI model.

[0215] In some embodiments, the purpose information includes at least one of the following: collection; openness; marketing; advertising; user profiling; training AI / ML models.

[0216] It is worth noting that the second information may include the first identification information, that is, the identification information of the first AF that obtains the first data is included within the authorization scope requested by the first node related to the first data. Alternatively, the first identification information may also be carried within the first information, that is, the first information includes at least two information fields, with the first identification information and the second information located in different information fields of the first information.

[0217] In some embodiments, the data type information includes at least one of the following: terminal location information; terminal sensing information; terminal user identification information; and terminal identification information.

[0218] In some embodiments, the terminal's identification information may include at least one of the following: Subscription Concealed Identifier (SUCI); Generic Public Subscription Identifier (GPSI); Subscription Permanent Identifier (SUPI); Mobile Station Integrated Services Digital Network (MSISDN); Terminal's IP address; Terminal's Fully Qualified Domain Name (FQDN); and Terminal's International Mobile Subscriber Identity (IMSI).

[0219] In some embodiments, the first node determines the second information based on the third information; wherein the third information is used to indicate the service related to the first data requested by the first node.

[0220] In some embodiments, the third information is used to indicate the services that the first node expects related to the first data.

[0221] Here, the first node can generate second information based on the services related to the first data that the first node expects. For example, the service related to the first data that the first node expects is a service operation (Namf_Location_ProvidePositioningInfo) for obtaining the terminal's location information. Based on this service operation, the data type information can be determined to be the terminal's location information, and the purpose information is data collection.

[0222] It is understandable that the first node can determine the scope of authorization related to the first data based on the services related to the first data. In this way, the first node can request the scope of authorization corresponding to its processing needs based on its own processing needs for the first data.

[0223] In step S2102, the terminal determines the ninth information based on the first information.

[0224] It is worth noting that the authorizing entity can be either the terminal itself or the user using the terminal.

[0225] In some embodiments, the ninth information is used to indicate authorization information related to the processing of the first data.

[0226] In some embodiments, the ninth information is used to indicate the scope of authorization associated with the first data that is permitted to be authorized.

[0227] In some embodiments, the ninth information is used to indicate the scope of authorization related to the first data that is denied.

[0228] In some embodiments, the ninth information is used to indicate a processing purpose related to the first data that is denied authorization. It should be noted that the scope of authorization indicated by the ninth information may be the entire scope of authorization requested by the first information, or it may be a partial scope of authorization requested by the first information.

[0229] In some embodiments, the ninth information is used to indicate whether to allow or deny the processing related to the first data requested by the first information.

[0230] It should be noted that the authorization information related to the processing of the first data can be understood as the authorization result of the terminal or user's processing behavior of the first data requested by the first information.

[0231] The terminal can determine the ninth information based on the first information.

[0232] In some embodiments, the ninth information includes at least one of the following: the data type that is allowed or denied authorization; and the data processing purpose that is allowed or denied authorization.

[0233] In some embodiments, the terminal determines the ninth information based on the first information, including: determining the data type and / or data processing purpose requested by the first node based on the first information; and determining the ninth information based on the data type and / or data processing purpose requested by the first node.

[0234] For example, the terminal can determine the privacy protection policy corresponding to the first data based on the data type of the first data requested for authorization by the first node; and determine the ninth information based on the privacy protection policy corresponding to the first data.

[0235] For example, after receiving the first information, the terminal can determine the data type and / or data processing purpose requested by the first node based on the first information; and the terminal can output the data type and / or data processing purpose requested by the first node to the user; in response to the user's authorization operation on the data type and / or data processing purpose requested by the first node, the terminal can determine the allowed data type and / or data processing purpose indicated by the authorization operation. Based on the allowed data type and / or data processing purpose indicated by the authorization operation, the ninth information is determined.

[0236] In some embodiments, the data types that can be authorized in the ninth information may be at least a portion of the data types for which the first node requested authorization.

[0237] In some embodiments, the data processing purpose permitted for authorization in the ninth information may be at least a portion of the data processing purpose for which authorization was requested by the first node.

[0238] It should be noted that after receiving the first information, the terminal can determine the data type and / or data processing purpose requested by the first node based on the first information; and the terminal can determine the allowed data type and / or data processing purpose indicated by the authorization operation by outputting the data type and / or data processing purpose requested by the first node in response to the user's authorization operation on the data type and / or data processing purpose requested by the first node.

[0239] Step S2103: The terminal sends the ninth message to the second node.

[0240] In some embodiments, the second node receives the ninth information sent by the terminal.

[0241] In some embodiments, the second node can be a core network function. It is worth noting that the second node can be a core network function used for authorization and authentication.

[0242] In some embodiments, the terminal can be configured with the address information of the second node.

[0243] In some embodiments, the first node configures the address information of the second node for the terminal.

[0244] It is understandable that by configuring the address information of the second node for the terminal, the terminal can determine the second node based on the address information and send the ninth information to the second node.

[0245] In some embodiments, the address information of the second node may be a fully qualified domain name (FQDN). Here, the FQDN is used to uniquely identify and locate a host or service on the network.

[0246] In some embodiments, the address information of the second node may be an IP address.

[0247] In some embodiments, the terminal interacts with the second node via a user plane connection.

[0248] In some embodiments, if the ninth message indicates that the processing related to the first data requested by the first message is rejected, the terminal sends a twelfth message to the first node, the twelfth message indicating: rejection of authorization for processing related to the first data; and / or, the reason for rejection of authorization.

[0249] It should be noted that if the terminal refuses to authorize the processing related to the first data in the first information request, the terminal may send the twelfth information to the first node in order to inform the first node of the result of the refusal of authorization and / or the reason for the refusal of authorization.

[0250] It is worth noting that if the terminal refuses to authorize the processing related to the first data in the first information request, the terminal may not send the ninth information to the second node in order to reduce information transmission overhead.

[0251] In some embodiments, the ninth information may further include second identification information.

[0252] It is understood that by carrying the second identification information within the ninth information, the second node can determine the terminal and / or user associated with the first data indicated by the ninth information based on the second identification information.

[0253] Step S2104: The second node sends the tenth information to the terminal.

[0254] In some embodiments, the terminal receives the tenth information sent by the second node.

[0255] In some embodiments, the tenth information includes: an authorization code configured for the first node.

[0256] In some embodiments, the authorization code is associated with the authorization of the processing of the first data.

[0257] In some embodiments, the authorization method further includes: the second node configuring an authorization code for the first node based on the ninth information.

[0258] In some embodiments, the authorization method further includes: the second node sets the allowed data types and allowed data processing purposes in the ninth information to the scope in the token associated with the first node, so as to restrict the first node to only request the allowed data types and allowed data processing purposes.

[0259] It should be noted that after receiving the ninth message from the terminal, the second node generates an authorization code based on the allowed data types and data processing purposes in the ninth message.

[0260] It is worth noting that if the ninth message indicates that the authorization request covers the entire or partial scope of authorization related to the first data, the second node generates an authorization code based on the data type and data processing purpose of the authorization. If the ninth message indicates that the authorization request is denied for the entire scope of authorization related to the first data, the second node may not generate an authorization code. Based on this, the second node may not send the tenth message to the terminal.

[0261] In some embodiments, the authorization method further includes: the second node determining the eleventh information based on the ninth and tenth information.

[0262] In some embodiments, the eleventh information is used to indicate the association between the ninth and tenth information.

[0263] It should be noted that the eleventh piece of information can be understood as a mapping table stored by the second node. This mapping table includes the relationship between the ninth and tenth pieces of information; that is, it includes the relationship between authorization information and authorization codes related to the processing of the first data. This allows the second node to perform subsequent authorization verification based on the eleventh piece of information.

[0264] In some embodiments, the association of the eleventh information indication may be an association between authorization information related to the processing of the first data and the second identification information; or, it may be an association between authorization information related to the processing of the first data and the authorization code; or, it may be an association between the second identification information and the authorization code; or, it may be an association between authorization information related to the processing of the first data and the authorization code and the second identification information.

[0265] In some embodiments, the eleventh information includes at least one of the following: second identification information; an authorization code associated with the second identification information; an authorization scope associated with the second identification information; third identification information associated with the second identification information; an authorization code; second identification information associated with the authorization code; an authorization scope associated with the authorization code; and third identification information associated with the authorization code.

[0266] In some embodiments, the third identification information is used to indicate the second AF that is authorized to obtain the first data.

[0267] It should be noted that the second AF can be understood as a third-party AF that is authorized to expose or open, that is, the second node allows the authorized third-party AF to expose or open the first data to the second identification information.

[0268] It is worth noting that the second AF is a third-party AF that the terminal allows to be authorized and opened; while the first AF is a third-party AF that the first node requests to be opened. If the terminal allows authorization for all third-party AFs requested by the first node, the second AF and the first AF are the same. If the terminal allows authorization for only some third-party AFs requested by the first node, the second AF can be a part of the first AF.

[0269] In some embodiments, the scope of authorization associated with the second identification information includes at least one of the following: data type information; purpose information; third identification information.

[0270] In some embodiments, the scope of authorization associated with the authorization code includes at least one of the following: data type information; purpose information; third identification information.

[0271] It should be noted that the authorization scope associated with the second identification information and / or authorization code stored by the second node may include the third identification information. Alternatively, the authorization scope associated with the second identification information and / or authorization code stored by the second node may not include the third identification information, and the third identification information associated with the second identification information and / or authorization code needs to be stored separately.

[0272] Step S2105: The terminal sends the fourth information to the first node.

[0273] In some embodiments, the first node receives fourth information sent by the terminal.

[0274] In some embodiments, the fourth information is carried in a Non-Access Stratum (NAS) message.

[0275] In some embodiments, the terminal determines the fourth information based on the tenth information.

[0276] It should be noted that the fourth piece of information may include only the entire content of the tenth piece of information. Understandably, the terminal can directly forward the tenth piece of information to the first node.

[0277] Alternatively, the fourth information may include the tenth information and other information; here, the other information may be information content added by the terminal. For example, the fourth information may include the tenth information and the ninth information.

[0278] In some embodiments, the fourth information includes an authorization code configured for the first node.

[0279] Understandably, after receiving the authorization code from the second node, the terminal sends the authorization code to the first node so that the first node can use the authorization code to obtain a token.

[0280] In some embodiments, the authorization method further includes: if the authorization scope of the first information request is different from the permitted authorization scope, the terminal sends a ninth information to the first node.

[0281] It should be noted that when the terminal authorizes the entire scope of the first information request, the terminal can directly send the authorization code to the first node. When the terminal authorizes only a portion of the scope of the first information request, the terminal can send the authorization code and the ninth information to the first node to inform the first node of the portion of the authorization scope allowed by the terminal.

[0282] Step S2106: The first node sends the fifth message to the second node.

[0283] In some embodiments, the second node receives the fifth information sent by the first node.

[0284] In some embodiments, the fifth piece of information is used to request a token.

[0285] It should be noted that the fifth piece of information can be a token request.

[0286] In some embodiments, the first node sends the fifth information to the second node based on the fourth information.

[0287] In some embodiments, the fifth piece of information includes an authorization code.

[0288] It should be noted that for services that require terminal or user authorization, the first node needs to receive the fourth message sent by the terminal and obtain the authorization code from the fourth message before sending the fifth message carrying the authorization code to the second node, so as to request a token from the second node through the authorization code.

[0289] It is worth noting that, since the authorization code is related to the authorization of the processing behavior of the first data, the token obtained by the fifth information request carrying the authorization code is used to indicate the authorization information of the processing behavior of the first data associated with the authorization code.

[0290] For services requiring terminal or user authorization, if the first node does not obtain the fourth information from the terminal, even if the first node sends the fifth information to the second node, the second node will not send a token to the first node because the fifth information does not carry an authorization code. Therefore, if the first node does not obtain the fourth information from the terminal, it can choose not to send the fifth information to the second node to reduce unnecessary information transmission.

[0291] In some embodiments, the fifth information further includes at least one of the following: first identification information for indicating the first AF that acquires the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; purpose information for indicating the purpose of processing the first data; and service operation information for indicating at least one of the following: the service operation associated with the acquired first data; the data type of the first data; and the purpose of processing the first data.

[0292] It should be noted that the service operation information in the fifth message is used to indicate the service operation associated with the requested first data. The token requested in the fifth message is related to the requested service operation.

[0293] It is worth noting that if the purpose of the first node requesting the processing of the first data cannot be explicitly indicated through the service operation, the first node needs to explicitly indicate the purpose of data processing by including the purpose information in the fifth information.

[0294] In some embodiments, the fifth information includes: a first information field, which includes service operation information; and a second information field, which includes at least one of an authorization code, a first identification information, a second identification information, data type information, and purpose information.

[0295] It should be noted that, compared to existing token requests, this embodiment adds an information field to the fifth information to carry at least one of the following: authorization code, first identification information, second identification information, data type information, and purpose information; thereby enabling the second node to verify the authorization of the first node based on the authorization code, first identification information, second identification information, data type information, and / or purpose information in the fifth information.

[0296] Step S2107: The second node performs the first verification on the fifth information.

[0297] In some embodiments, the second node performs a first verification on the fifth information based on the eleventh information.

[0298] Understandably, the second node can verify the scope of authorization for the fifth information request based on the authorization information and authorization code sent by the terminal related to the processing of the first data.

[0299] In some embodiments, the first verification of the fifth information based on the eleventh information includes at least one of the following:

[0300] The fifth information includes the second identification information. Based on the authorization code associated with the second identification information in the eleventh information, the authorization code in the fifth information is verified.

[0301] The fifth information includes the authorization code and the second identification information. Based on the second identification information associated with the authorization code contained in the eleventh information, the second identification information in the fifth information is verified.

[0302] The fifth information includes the second identification information, data type information, and purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type information and purpose information in the fifth information are verified.

[0303] The fifth piece of information includes the authorization code, data type information, and purpose information. Based on the authorization scope associated with the authorization code in the eleventh piece of information, the data type information and purpose information in the fifth piece of information are verified.

[0304] The fifth information includes the second identification information and the first identification information. Based on the third identification information associated with the second identification information in the eleventh information, the first identification information in the fifth information is verified.

[0305] The fifth information includes the second identification information and the first identification information. Based on the authorization scope associated with the second identification information in the eleventh information, the first identification information in the fifth information is verified.

[0306] The fifth piece of information includes an authorization code and a first identification information. Based on the third identification information associated with the authorization code in the eleventh piece of information, the first identification information in the fifth piece of information is verified.

[0307] The fifth piece of information includes an authorization code and a first identification information. Based on the authorization scope associated with the authorization code in the eleventh piece of information, the first identification information within the fifth piece of information is verified.

[0308] The fifth information includes the authorization code and service operation information, but does not include the purpose information. Based on the authorization scope associated with the authorization code in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified.

[0309] The fifth information includes the second identification information and service operation information, but does not include the purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified.

[0310] It should be noted that the first verification process in this embodiment includes three aspects of verification: verification of the authorization code, verification of data type information and purpose information, and verification of the first identification information.

[0311] If the fifth information includes the second identification information, the second node verifies whether the authorization code associated with the second identification information in the stored eleventh information matches the authorization code in the fifth information; or, if the fifth information includes the authorization code and the second identification information, the second node verifies whether the second identification information associated with the authorization code in the stored eleventh information matches the second identification information in the fifth information. This completes the verification of the authorization code in the fifth information.

[0312] If the authorization code verification for the fifth piece of information fails, the second node refuses to send a token to the first node. If the authorization code verification for the fifth piece of information succeeds, the second node can continue to verify the fifth piece of information.

[0313] If the fifth information includes second identification information, data type information, and destination information, the second node verifies the data type information and destination information within the fifth information based on the authorization scope associated with the second identification information in the stored eleventh information; or, if the fifth information includes an authorization code, data type information, and destination information, the second node verifies the destination information of the data type information within the fifth information based on the authorization scope associated with the authorization code in the stored eleventh information. This completes the verification of the data type information and destination information in the fifth information.

[0314] If the data type and / or destination information of the fifth message fails to be verified, the second node refuses to send a token to the first node. If the data type and destination information of the fifth message are successfully verified, the second node may continue to verify the fifth message.

[0315] If the fifth information includes the second identification information and the first identification information, the second node verifies the first identification information in the fifth information based on the authorization scope associated with the second identification information in the stored eleventh information; or, if the fifth information includes the authorization code and the first identification information, the second node verifies the first identification information in the fifth information based on the authorization scope associated with the authorization code in the stored eleventh information.

[0316] It is worth noting that when the authorization scope associated with the second identification information and / or the authorization code includes the third identification information, the first node can verify the first identification information in the fifth information based on the authorization scope associated with the second identification information and / or the authorization code in the stored eleventh information.

[0317] If the fifth information includes the second identification information and the first identification information, the second node verifies the first identification information in the fifth information based on the third identification information associated with the second identification information in the stored eleventh information; or, if the fifth information includes the authorization code and the first identification information, the second node verifies the first identification information in the fifth information based on the third identification information associated with the authorization code in the stored eleventh information.

[0318] It is worth noting that if the authorization scope associated with the second identification information and / or the authorization code does not include the third identification information, the first node verifies the first identification information in the fifth information based on the third identification information associated with the second identification information and / or the authorization code in the stored eleventh information.

[0319] This completes the verification of the third identifier information in the fifth message. If the verification of the third identifier information in the fifth message fails, the second node refuses to send a token to the first node. If the verification of the third identifier information in the fifth message succeeds, the second node can continue to verify the fifth message.

[0320] If the fifth information includes an authorization code and service operation information but does not include destination information, the second node verifies the data type and data processing purpose corresponding to the service operation indicated by the service operation information based on the authorization scope associated with the authorization code in the stored eleventh information. Alternatively, if the fifth information includes second identification information and service operation information but does not include destination information, the second node verifies the data type and data processing purpose corresponding to the service operation indicated by the service operation information based on the authorization scope associated with the second identification information in the stored eleventh information.

[0321] It is worth noting that when the fifth information includes service operation information but does not include destination information, it indicates that the purpose of the first node's request to process the first data can be explicitly indicated by the service operation indicated by the service operation information. Based on this, the second node can verify the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information according to the authorization scope associated with the second identifier information and / or authorization code in the stored eleventh information. This completes the verification of the data type and destination information corresponding to the service operation indicated by the service operation information in the fifth information.

[0322] If the verification of the data type and destination information corresponding to the service operation indicated in the fifth message fails, the second node refuses to send a token to the first node. If the verification of the data type and destination information corresponding to the service operation indicated in the fifth message is successful, the second node may continue to verify the fifth message.

[0323] Step S2108: The second node sends the sixth message to the first node.

[0324] In some embodiments, the first node receives the sixth information sent by the second node.

[0325] In some embodiments, if the first verification is successful, the second node sends a sixth message to the first node.

[0326] In some embodiments, the sixth piece of information includes a token.

[0327] In some embodiments, the token includes service information indicating the authorized service.

[0328] Understandably, when the first node initiates a service request, the network function service provider can verify whether the service requested by the first node is authorized based on the token information within the service request.

[0329] In some embodiments, the sixth information includes at least one of the following: an access token; a refresh token.

[0330] It should be noted that an access token is required when the first node requests a service. The network function service provider can verify the access token to determine whether to provide services to the first node.

[0331] When generating an access token, the second node typically configures an expiration date for it. Within the token's validity period, the first node can use it to request services associated with that token. Once the token expires, the first node can no longer use it to request services.

[0332] A refresh token is used to renew the validity period of an access token that has been authorized.

[0333] In some embodiments, if the access token is nearing its expiration date or has expired, the first node sends a token update request to the second node, the token update request including refreshing the token.

[0334] Understandably, if the access token has expired or is about to expire, the first node can use a refresh token to obtain a new access token.

[0335] It should be noted that the refresh token also has an expiration date. When both the access token and the refresh token have expired, the first node sends a fifth message to the second node to reacquire the access token and refresh token.

[0336] In some embodiments, the token includes at least one of the following: second identification information; third identification information; authorized data processing purpose; authorized data type.

[0337] It should be noted that, compared to existing tokens, this embodiment of the present disclosure carries at least one of the following in the token: second identification information, third identification information, authorized data processing purpose, and authorized data type. This enables the verification of a service request initiated by the first node to not only verify whether the service requested by the first node is authorized based on the token, but also to verify whether the purpose of the service requested by the first node is authorized based on the token.

[0338] In some embodiments, if the first verification fails, the second node sends a thirteenth message to the first node, the thirteenth message indicating the reason for the failure of the first verification.

[0339] Understandably, in the event of a first verification failure, the second node sends a thirteenth message to the first node to inform it of the reason for the first verification failure, so that the first node can determine whether to adjust the scope of the requested authorization based on the reason for the failure.

[0340] Step S2109: The first node sends the seventh message to the third node.

[0341] In some embodiments, the third node receives the seventh information sent by the first node.

[0342] In some embodiments, the seventh information is used to request services related to the first data.

[0343] In some embodiments, the seventh piece of information may be a service request.

[0344] It is understandable that the first node can be a consumer of network function services, and the third node can be a producer of network function services.

[0345] In some embodiments, the seventh piece of information includes a token.

[0346] It is understandable that by carrying a token in the seventh message, the third node can verify the seventh message based on the token.

[0347] In some embodiments, the token is used to verify whether the service requested by the first node and the purpose of requesting the service are authorized.

[0348] In some embodiments, the seventh information further includes at least one of the following: first identification information for indicating the first AF that acquires the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; and purpose information for indicating the purpose of processing the first data.

[0349] It should be noted that if the seventh information includes destination information, it indicates that the purpose of the first node's request to process the first data cannot be explicitly indicated by the service requested by the seventh information; in this case, the first node needs to explicitly indicate the purpose of data processing by including destination information in the seventh information.

[0350] Step S2110: The third node performs a second verification on the seventh information.

[0351] In some embodiments, the third node performs a second verification on the seventh information based on the token.

[0352] In some embodiments, the seventh information is second-verified based on the token, including at least one of the following:

[0353] The seventh information includes the second identification information and the token. The second identification information in the seventh information is verified based on the second identification information in the token.

[0354] The seventh information includes purpose information and a token. Based on the authorized data processing purpose within the token, the data processing purpose requested by the purpose information in the seventh information is verified.

[0355] The seventh information includes first identification information and a token. Based on the authorized second AF indicated by the third identification information within the token, the first AF indicated by the first identification information in the seventh information is verified.

[0356] It is worth noting that the second verification of the seventh information in this embodiment is based on the token information in the seventh information, and the corresponding information carried outside the token in the seventh information is verified.

[0357] For example, if the seventh information includes the second identification information and the token, the second identification information carried outside the token in the seventh information is verified based on the second identification information within the token.

[0358] In cases where the seventh information includes purpose information and a token, the data processing purpose requested by the purpose information carried outside the token in the seventh information is verified according to the data processing purpose authorized within the token.

[0359] In cases where the seventh information includes the first identification information and the token, the first AF indicated by the first identification information carried outside the token is verified according to the authorized second AF indicated by the third identification information within the token.

[0360] The second identification information carried outside the token in the seventh information can be understood as the second identification information associated with the first data requested by the seventh information. The second identification information within the token can be understood as the second identification information associated with the first data authorized by the token.

[0361] It should be noted that the second verification process in this embodiment includes three aspects of verification: verification of the second identification information, verification of the target information, and verification of the first identification information.

[0362] If the seventh information includes the second identification information, the third node can verify whether the second identification information within the token is the same as the second identification information carried outside the token in the seventh information. If the verification of the second identification information in the seventh information fails, the third node refuses to provide the service requested by the seventh information to the first node. If the verification of the second identification information in the seventh information is successful, the third node can continue to verify the seventh information.

[0363] If the seventh message includes destination information, the third node can verify the destination information within the seventh message based on the data processing purpose within the token. If the verification of the destination information in the seventh message fails, the third node refuses to provide the service requested by the seventh message to the first node. If the verification of the destination information in the seventh message succeeds, the third node can continue to verify the seventh message.

[0364] If the seventh information includes the first identification information, the third node verifies the first identification information within the seventh information based on the third identification information within the token. If the verification of the first identification information in the seventh information fails, the third node refuses to provide the service requested by the seventh information to the first node. If the verification of the destination information in the seventh information is successful, the third node can continue to verify it.

[0365] It is worth noting that if the second verification is successful, the third node needs to continue to verify the token and / or the seventh information based on the existing verification mechanism.

[0366] If the existing verification mechanism is successful, the third node processes the first data and sends the fourteenth message to the first node to provide services related to the first data.

[0367] In some embodiments, the fourteenth information includes: the processing result of the first data.

[0368] In some embodiments, the fourteenth information may be a service response.

[0369] In some embodiments, the authorization method further includes: performing a third verification on the token in the seventh information, the third verification being used to verify the validity of the token; if the third verification is successful and the second verification is successful, the third node sends an eleventh information to the first node, the first information including: the processing result of the first data.

[0370] Understandably, the third node not only needs to perform a second verification on the seventh information based on the token, but also needs to verify the validity of the token; if the second verification is successful and the third verification is successful, the first data is processed and the fourteenth information is sent to the first node to provide the first node with services related to the first data.

[0371] In some embodiments, the third node processes the first data in at least one of the following ways:

[0372] If the token includes a data processing purpose, the third node processes the first data according to the data processing purpose in the token;

[0373] If the token does not include a data processing purpose, the third node processes the first data according to the service information in the token.

[0374] Understandably, if the token contains a data processing purpose, it means that the purpose for the first node to request the processing of the first data cannot be implicitly indicated by the service information in the token. The token explicitly indicates the purpose for the first node to request the processing of the first data through the data processing purpose. In this case, the third node can process the first data according to the data processing purpose in the token.

[0375] For example, if the service information in the token indicates a service for obtaining the terminal's location information, and the purpose of data processing in the token is to expose the location information to the second AF indicated by the third identification information, then the third node will expose the terminal's location information to the second AF.

[0376] If the token does not contain a data processing purpose, it means that the service information in the token implicitly indicates the purpose of the first node requesting the processing of the first data; in this case, the third node can process the first data according to the service information in the token.

[0377] For example, if the service information in the token indicates a service for obtaining the terminal's location information, and the token does not include a data processing purpose, then the third node obtains the terminal's location information and sends the location information to the first node.

[0378] In some embodiments, the authorization method further includes: in the event of a second verification failure and / or a third verification failure, the third node sends a fifteenth message to the first node, the fifteenth message indicating the reason for refusing to provide services to the first node.

[0379] In some embodiments, the term "information" may be used interchangeably with terms such as "message," "signal," "signaling," "report," "configuration," "indication," "instruction," "command," "channel," "parameter," "field," and "data."

[0380] In some embodiments, the term "send" may be used interchangeably with terms such as "transmit," "report," or "transmit."

[0381] The authorized method involved in the embodiments of this disclosure may include at least one of steps S2101 to S2110. For example, steps S2101 and S2102 may be implemented as independent embodiments, steps S2101 to S2103 may be implemented as independent embodiments, and steps S2101 to S2107 may be implemented as independent embodiments, but are not limited thereto.

[0382] In some embodiments, steps S2103, S2104, S2105, S2106, S2107, S2108, S2109, and S2110 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the terminal refuses to grant the full scope of authorization requested by the first node, the terminal may not send the ninth information to the second node.

[0383] In some embodiments, steps S2104, S2105, S2106, S2107, S2108, S2109, and S2110 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the ninth message indicates a denied data type and data processing purpose, the second node will not configure an authorization code for the first node, and therefore will not send the tenth message to the terminal. Based on this, the first node, without receiving an authorization code, will not send the fifth message to the second node to request a token, nor will it send the seventh message to the third node to request services related to the first data.

[0384] In some embodiments, steps S2108, S2109, and S2110 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that in the event of a first verification failure, the second node will not generate a token, nor will it send the sixth message to the first node. Based on this, the first node, without obtaining a token, will not send the seventh message to the third node to request services related to the first data.

[0385] Figure 2B is a schematic diagram of an authorization method according to an exemplary embodiment. As shown in Figure 2B, this disclosure relates to an authorization method for a communication system 100, the method comprising:

[0386] Step S2201: The first node sends the first information to the terminal.

[0387] In some embodiments, the terminal receives first information sent by the first node.

[0388] In some embodiments, the first node may be an access network function, and the first node supports a service-based architecture (SBA).

[0389] It is understandable that the first node could be an access network function that supports SBA.

[0390] In some embodiments, the first node sending the first information to the terminal includes at least one of the following:

[0391] When the first node is an access network function and supports the first access method, the first information is sent to the terminal, and the first information is carried in the message adapted to the first access method.

[0392] When the first node is an access network function and supports the second access method, the first information is sent to the terminal, and the first information is carried in the message adapted to the second access method.

[0393] The message for the first access method adaptation is at least one of the Access Stratum (AS) message and the Radio Resource Control (RRC) message; the message for the second access method adaptation is different from the message for the first access method adaptation.

[0394] It should be noted that the first access method can be the third-generation cooperation plan (3 rd The first access method is an access method supported by the Generation Partnership Project (3GPP) protocol. The second access method can be an access method not supported by the 3GPP protocol. It is understood that when the first node functions as an access network and is deployed in a 3GPP-compliant access network, the first information sent by the first node to the terminal is carried in the AS message and / or RRC message. When the first node functions as an access network and is deployed in a non-3GPP-compliant access network, the first information sent by the first node to the terminal is carried in a non-3GPP-compliant message.

[0395] In some embodiments, the first node may be a Trusted Non-3GPP Gateway Function (TNGF), a Non-3GPP Interworking Function (N3IWF), and / or a base station in a future network.

[0396] In some embodiments, the first node sends first information to the terminal before processing the first data.

[0397] In some embodiments, the first information is used to request authorization to process the first data; wherein the first data is associated with a terminal.

[0398] It should be noted that before processing the first data related to the terminal, the first node needs to obtain authorization related to the processing of the first data from the terminal. Therefore, before processing the first data related to the terminal, the first node needs to send the first information to the terminal.

[0399] In some embodiments, the first data may be data related to terminal and / or user privacy.

[0400] In some embodiments, the first data includes at least one of the following: terminal data; user data of the user using the terminal. It should be noted that the terminal data may be sensor data, fault analysis data, etc.

[0401] User data for users of a terminal can be data generated during the user's use of the terminal, such as browsing history data and purchase history data.

[0402] It is important to note that user data is user-related. User data can be data obtained from multiple devices used by the user.

[0403] In some embodiments, the first information includes at least one of the following: second information, used to indicate the requested scope of authorization related to the first data; and first identification information, used to indicate the first application function (AF) for obtaining the first data.

[0404] It should be noted that the scope of authorization requested by the first node related to the first data can be understood as the scope of processing of the first data requested by the first node from the terminal; the scope of authorization related to the first data may include, but is not limited to: requesting the processing time for processing the first data, requesting the processing method for processing the first data, etc.

[0405] The first AF can be understood as a third-party AF that requests the exposure of the first data or the processing result of the first data. That is, the first node requests to expose the first data to the third-party AF indicated by the first identification information.

[0406] In some embodiments, the second information includes at least one of the following: data type information, used to indicate the type of the first data; purpose information, used to indicate the purpose of processing the first data; and first identification information.

[0407] It should be noted that data type information is used to indicate the type of the first data, that is, the type of first data related to the terminal that the first node requests to process. In other words, the first node can use data type information to inform the terminal what type of data it is requesting to process.

[0408] Purpose information indicates the purpose of processing the first data, that is, the purpose for which the first node processes the first data. For example, the first node requests the first data for the purpose of collecting data. Or, the first node requests the first data for the purpose of training an AI model.

[0409] It is worth noting that the second information may include the first identification information, that is, the identification information of the first AF that obtains the first data is included within the authorization scope requested by the first node related to the first data. Alternatively, the first identification information may also be carried within the first information, that is, the first information includes at least two information fields, with the first identification information and the second information located in different information fields of the first information.

[0410] In some embodiments, the purpose information includes at least one of the following: collection; openness; marketing; advertising; user profiling; training AI / ML models.

[0411] In some embodiments, the data type information includes at least one of the following: terminal location information; terminal sensing information; terminal user identification information; and terminal identification information.

[0412] In some embodiments, the terminal's identification information may include at least one of the following: Subscription Concealed Identifier (SUCI); Generic Public Subscription Identifier (GPSI); Subscription Permanent Identifier (SUPI); Mobile Station Integrated Services Digital Network (MSISDN); Terminal's IP address; Terminal's Fully Qualified Domain Name (FQDN); and Terminal's International Mobile Subscriber Identity (IMSI).

[0413] In some embodiments, the first node determines the second information based on the third information; wherein the third information is used to indicate the service related to the first data requested by the first node.

[0414] In some embodiments, the third information is used to indicate the services that the first node expects related to the first data.

[0415] Here, the first node can generate second information based on the services related to the first data that the first node expects. For example, the service related to the first data that the first node expects is a service operation (Namf_Location_ProvidePositioningInfo) for obtaining the terminal's location information. Based on this service operation, the data type information can be determined to be the terminal's location information, and the purpose information is data collection.

[0416] It is understandable that the first node can determine the scope of authorization related to the first data based on the services related to the first data. In this way, the first node can request the scope of authorization corresponding to its processing needs based on its own processing needs for the first data.

[0417] In step S2202, the terminal determines the ninth information based on the first information.

[0418] In some embodiments, optional implementations of step S2202 can be found in optional implementations of step S2102 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0419] Step S2203: The terminal sends the ninth message to the second node.

[0420] In some embodiments, optional implementations of step S2203 can be found in optional implementations of step S2103 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0421] Step S2204: The second node sends the tenth information to the terminal.

[0422] In some embodiments, optional implementations of step S2204 can be found in optional implementations of step S2104 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0423] In step S2205, the terminal sends the fourth information to the first node.

[0424] In some embodiments, the first node receives fourth information sent by the terminal.

[0425] In some embodiments, the terminal sending fourth information to the first node includes at least one of the following:

[0426] When the first node is an access network function and supports the first access method, the terminal sends the fourth information to the first node, and the fourth information is carried in the message adapted to the first access method.

[0427] When the first node is an access network function and supports the second access method, the terminal sends the fourth information to the first node, and the fourth information is carried in the message for adapting the second access method.

[0428] The message adapted to the first access method is at least one of the AS message and the RRC message; the message adapted to the second access method is different from the message adapted to the first access method.

[0429] In some embodiments, the terminal determines the fourth information based on the tenth information.

[0430] It should be noted that the fourth piece of information may include only the entire content of the tenth piece of information. Understandably, the terminal can directly forward the tenth piece of information to the first node.

[0431] Alternatively, the fourth information may include the tenth information and other information; here, the other information may be information content added by the terminal. For example, the fourth information may include the tenth information and the ninth information.

[0432] In some embodiments, the fourth information includes an authorization code configured for the first node.

[0433] Understandably, after receiving the authorization code from the second node, the terminal sends the authorization code to the first node so that the first node can use the authorization code to obtain a token.

[0434] In some embodiments, the authorization method further includes: if the authorization scope of the first information request is different from the permitted authorization scope, the terminal sends a ninth information to the first node.

[0435] It should be noted that when the terminal authorizes the entire scope of the first information request, the terminal can directly send the authorization code to the first node. When the terminal authorizes only a portion of the scope of the first information request, the terminal can send the authorization code and the ninth information to the first node to inform the first node of the portion of the authorization scope allowed by the terminal.

[0436] Step S2206: The first node sends the fifth message to the second node.

[0437] In some embodiments, optional implementations of step S2206 can be found in optional implementations of step S2106 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0438] Step S2207: The second node performs the first verification on the fifth piece of information.

[0439] In some embodiments, optional implementations of step S2207 can be found in optional implementations of step S2107 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0440] Step S2208: The second node sends the sixth message to the first node.

[0441] In some embodiments, optional implementations of step S2208 can be found in optional implementations of step S2108 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0442] Step S2209: The first node sends the seventh message to the third node.

[0443] In some embodiments, optional implementations of step S2209 can be found in optional implementations of step S2109 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0444] Step S2210: The third node performs a second verification on the service requested by the first node.

[0445] In some embodiments, optional implementations of step S2210 can be found in optional implementations of step S2110 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0446] In some embodiments, the term "information" may be used interchangeably with terms such as "message," "signal," "signaling," "report," "configuration," "indication," "instruction," "command," "channel," "parameter," "field," and "data."

[0447] In some embodiments, the term "send" may be used interchangeably with terms such as "transmit," "report," or "transmit."

[0448] The authorized method involved in the embodiments of this disclosure may include at least one of steps S2201 to S2210. For example, steps S2201 and S2202 may be implemented as independent embodiments, steps S2201 to S2203 may be implemented as independent embodiments, and steps S2201 to S2207 may be implemented as independent embodiments, but are not limited thereto.

[0449] In some embodiments, steps S2203, S2204, S2205, S2206, S2207, S2208, S2209, and S2210 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the terminal refuses to grant the full scope of authorization requested by the first node, the terminal may not send the ninth information to the second node.

[0450] In some embodiments, steps S2204, S2205, S2206, S2207, S2208, S2209, and S2210 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the ninth message indicates a denied data type and data processing purpose, the second node will not configure an authorization code for the first node, and therefore will not send the tenth message to the terminal. Based on this, the first node, without receiving an authorization code, will not send the fifth message to the second node to request a token, nor will it send the seventh message to the third node to request services related to the first data.

[0451] In some embodiments, steps S2208, S2209, and S2210 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that in the event of a first verification failure, the second node will not generate a token, nor will it send the sixth message to the first node. Based on this, the first node, without obtaining a token, will not send the seventh message to the third node to request services related to the first data.

[0452] Figure 2C is an interactive schematic diagram of an authorization method according to an exemplary embodiment. As shown in Figure 2C, this disclosure relates to an authorization method for a communication system 100, the method comprising:

[0453] Step S2301: The first node sends the first information to the terminal.

[0454] In some embodiments, the terminal receives first information sent by the first node.

[0455] In some embodiments, the first node may be an access network function, and the first node does not support SBA.

[0456] It is understandable that the first node may be an access network function that does not support SBA.

[0457] In some embodiments, the first node sending the first information to the terminal includes at least one of the following:

[0458] The first node sends an AS message to the terminal, and the AS message includes the first information;

[0459] The first node sends an RRC message to the terminal, and the RRC message includes the first information.

[0460] In some embodiments, the first node sends first information to the terminal before processing the first data.

[0461] In some embodiments, the first information is used to request authorization to process the first data; wherein the first data is associated with a terminal.

[0462] It should be noted that before processing the first data related to the terminal, the first node needs to obtain authorization related to the processing of the first data from the terminal. Therefore, before processing the first data related to the terminal, the first node needs to send the first information to the terminal.

[0463] In some embodiments, the first data may be data related to terminal and / or user privacy.

[0464] In some embodiments, the first data includes at least one of the following: terminal data; user data of the user using the terminal.

[0465] It should be noted that terminal data can be sensor data, fault analysis data, etc.

[0466] User data for users of a terminal can be data generated during the user's use of the terminal, such as browsing history data and purchase history data.

[0467] It is important to note that user data is user-related. User data can be data obtained from multiple devices used by the user.

[0468] In some embodiments, the first information includes at least one of the following: second information, used to indicate the requested scope of authorization related to the first data; and first identification information, used to indicate the first application function (AF) for obtaining the first data.

[0469] It should be noted that the scope of authorization requested by the first node related to the first data can be understood as the scope of processing of the first data requested by the first node from the terminal; the scope of authorization related to the first data may include, but is not limited to: requesting the processing time for processing the first data, requesting the processing method for processing the first data, etc.

[0470] The first AF can be understood as a third-party AF that requests the exposure of the first data or the processing result of the first data. That is, the first node requests to expose the first data to the third-party AF indicated by the first identification information.

[0471] In some embodiments, the second information includes at least one of the following: data type information, used to indicate the type of the first data; purpose information, used to indicate the purpose of processing the first data; and first identification information.

[0472] It should be noted that data type information is used to indicate the type of the first data, that is, the type of first data related to the terminal that the first node requests to process. In other words, the first node can use data type information to inform the terminal what type of data it is requesting to process.

[0473] Purpose information indicates the purpose of processing the first data, that is, the purpose for which the first node processes the first data. For example, the first node requests the first data for the purpose of collecting data. Or, the first node requests the first data for the purpose of training an AI model.

[0474] It is worth noting that the second information may include the first identification information, that is, the identification information of the first AF that obtains the first data is included within the authorization scope requested by the first node related to the first data. Alternatively, the first identification information may also be carried within the first information, that is, the first information includes at least two information fields, with the first identification information and the second information located in different information fields of the first information.

[0475] In some embodiments, the purpose information includes at least one of the following: collection; openness; marketing; advertising; user profiling; training AI / ML models.

[0476] In some embodiments, the data type information includes at least one of the following: terminal location information; terminal sensing information; terminal user identification information; and terminal identification information.

[0477] In some embodiments, the terminal's identification information may include at least one of the following: Subscription Concealed Identifier (SUCI); Generic Public Subscription Identifier (GPSI); Subscription Permanent Identifier (SUPI); Mobile Station Integrated Services Digital Network (MSISDN); Terminal's IP address; Terminal's Fully Qualified Domain Name (FQDN); and Terminal's International Mobile Subscriber Identity (IMSI).

[0478] In some embodiments, the first node determines the second information based on the third information; wherein the third information is used to indicate the service related to the first data requested by the first node.

[0479] In some embodiments, the third information is used to indicate the services that the first node expects related to the first data.

[0480] Here, the first node can generate second information based on the services related to the first data that the first node expects. For example, the service related to the first data that the first node expects is a service operation (Namf_Location_ProvidePositioningInfo) for obtaining the terminal's location information. Based on this service operation, the data type information can be determined to be the terminal's location information, and the purpose information is data collection.

[0481] It is understandable that the first node can determine the scope of authorization related to the first data based on the services related to the first data. In this way, the first node can request the scope of authorization corresponding to its processing needs based on its own processing needs for the first data.

[0482] In step S2302, the terminal determines the ninth information based on the first information.

[0483] In some embodiments, optional implementations of step S2302 can be found in optional implementations of step S2102 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0484] Step S2303: The terminal sends the ninth message to the second node.

[0485] In some embodiments, optional implementations of step S2303 can be found in optional implementations of step S2103 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0486] Step S2304: The second node sends the tenth information to the terminal.

[0487] In some embodiments, optional implementations of step S2304 can be found in optional implementations of step S2104 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0488] Step S2305: The terminal sends the fourth information to the first node.

[0489] In some embodiments, the first node receives fourth information sent by the terminal.

[0490] In some embodiments, the terminal sending fourth information to the first node includes at least one of the following:

[0491] The terminal sends an AS message to the first node. The AS message includes the fourth information.

[0492] The terminal sends an RRC message to the first node, and the RRC message includes the fourth information.

[0493] In some embodiments, the terminal determines the fourth information based on the tenth information.

[0494] It should be noted that the fourth piece of information may include only the entire content of the tenth piece of information. Understandably, the terminal can directly forward the tenth piece of information to the first node.

[0495] Alternatively, the fourth information may include the tenth information and other information; here, the other information may be information content added by the terminal. For example, the fourth information may include the tenth information and the ninth information.

[0496] In some embodiments, the fourth information includes an authorization code configured for the first node.

[0497] Understandably, after receiving the authorization code from the second node, the terminal sends the authorization code to the first node so that the first node can use the authorization code to obtain a token.

[0498] In some embodiments, the authorization method further includes: if the authorization scope of the first information request is different from the permitted authorization scope, the terminal sends a ninth information to the first node.

[0499] It should be noted that when the terminal authorizes the entire scope of the first information request, the terminal can directly send the authorization code to the first node. When the terminal authorizes only a portion of the scope of the first information request, the terminal can send the authorization code and the ninth information to the first node to inform the first node of the portion of the authorization scope allowed by the terminal.

[0500] Step S2306: The first node sends the fifth message to the second node.

[0501] In some embodiments, when the first node is an access network function and does not support SBA, the first node sends the fifth information to the second node through a core network function. In some embodiments, the core network function is used to perform at least one of the following: access management function; mobility management function.

[0502] In some embodiments, the core network function may be AMF. It is understood that, when the first node is an access network function and does not support SBA, the first node sends the fifth information to the second node via AMF.

[0503] In some embodiments, the fifth piece of information is used to request a token.

[0504] It should be noted that the fifth piece of information can be a token request.

[0505] In some embodiments, the first node sends the fifth information to the second node based on the fourth information.

[0506] In some embodiments, the fifth piece of information includes an authorization code.

[0507] It should be noted that for services that require terminal or user authorization, the first node needs to receive the fourth message sent by the terminal and obtain the authorization code from the fourth message before sending the fifth message carrying the authorization code to the second node, so as to request a token from the second node through the authorization code.

[0508] It is worth noting that, since the authorization code is related to the authorization of the processing behavior of the first data, the token obtained by the fifth information request carrying the authorization code is used to indicate the authorization information of the processing behavior of the first data associated with the authorization code.

[0509] For services requiring terminal or user authorization, if the first node does not obtain the fourth information from the terminal, even if the first node sends the fifth information to the second node, the second node will not send a token to the first node because the fifth information does not carry an authorization code. Therefore, if the first node does not obtain the fourth information from the terminal, it can choose not to send the fifth information to the second node to reduce unnecessary information transmission.

[0510] In some embodiments, the fifth information further includes at least one of the following: first identification information for indicating the first AF that acquires the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; purpose information for indicating the purpose of processing the first data; and service operation information for indicating at least one of the following: the service operation associated with the acquired first data; the data type of the first data; and the purpose of processing the first data.

[0511] It should be noted that the service operation information in the fifth message is used to indicate the service operation associated with the requested first data. The token requested in the fifth message is related to the requested service operation.

[0512] It is worth noting that if the purpose of the first node requesting the processing of the first data cannot be explicitly indicated through the service operation, the first node needs to explicitly indicate the purpose of data processing by including the purpose information in the fifth information.

[0513] In some embodiments, the second identification information may include at least one of the following: terminal identifier; SUCI; GPSI; SUPI.

[0514] In some embodiments, the fifth information includes: a first information field, including service operation information;

[0515] The second information field includes at least one of the following: authorization code, first identification information, second identification information, data type information, and destination information.

[0516] It should be noted that, compared to existing token requests, this embodiment adds an information field to the fifth information to carry at least one of the following: authorization code, first identification information, second identification information, data type information, and purpose information; thereby enabling the second node to verify the authorization of the first node based on the authorization code, first identification information, second identification information, data type information, and / or purpose information in the fifth information.

[0517] Step S2307: The second node performs the first verification on the fifth piece of information.

[0518] In some embodiments, optional implementations of step S2307 can be found in optional implementations of step S2107 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0519] Step S2308: The second node sends the sixth message to the first node.

[0520] In some embodiments, the first node receives the sixth information sent by the second node.

[0521] In some embodiments, if the first verification is successful, the second node sends a sixth message to the first node.

[0522] In some embodiments, the second node sending the sixth information to the first node includes:

[0523] When the first node is an access network function and does not support SBA, the second node sends the sixth information to the first node through the core network function.

[0524] For example, if the first node is an access network function and does not support SBA, the second node sends the sixth information to the first node through AMF.

[0525] In some embodiments, the sixth piece of information includes a token.

[0526] In some embodiments, the token includes service information indicating the authorized service.

[0527] Understandably, when the first node initiates a service request, the network function service provider can verify whether the service requested by the first node is authorized based on the token information within the service request.

[0528] In some embodiments, the sixth information includes at least one of the following: an access token; a refresh token.

[0529] It should be noted that an access token is required when the first node requests a service. The network function service provider can verify the access token to determine whether to provide services to the first node.

[0530] When generating an access token, the second node typically configures an expiration date for it. Within the token's validity period, the first node can use it to request services associated with that token. Once the token expires, the first node can no longer use it to request services.

[0531] A refresh token is used to renew the validity period of an access token that has been authorized.

[0532] In some embodiments, if the access token is nearing its expiration date or has expired, the first node sends a token update request to the second node, the token update request including refreshing the token.

[0533] Understandably, if the access token has expired or is about to expire, the first node can use a refresh token to obtain a new access token.

[0534] It should be noted that the refresh token also has an expiration date. When both the access token and the refresh token have expired, the first node sends a fifth message to the second node to reacquire the access token and refresh token.

[0535] In some embodiments, the token includes at least one of the following: second identification information; third identification information; authorized data processing purpose; authorized data type.

[0536] It should be noted that, compared to existing tokens, this embodiment of the present disclosure carries at least one of the following in the token: second identification information, third identification information, authorized data processing purpose, and authorized data type. This enables the verification of a service request initiated by the first node to not only verify whether the service requested by the first node is authorized based on the token, but also to verify whether the purpose of the service requested by the first node is authorized based on the token.

[0537] In some embodiments, if the first verification fails, the second node sends a thirteenth message to the first node through core network functions. The thirteenth message is used to indicate the reason for the failure of the first verification.

[0538] Understandably, in the event of a first verification failure, the second node sends a thirteenth message to the first node through the core network function to inform the first node of the reason for the first verification failure, so that the first node can determine whether to adjust the scope of the requested authorization based on the reason for the failure.

[0539] Step S2309: The first node sends the seventh message to the third node.

[0540] In some embodiments, the third node receives the seventh information sent by the first node.

[0541] In some embodiments, the first node sends a seventh message to the third node, including:

[0542] When the first node is an access network function and does not support SBA, the first node sends the seventh information to the third node through the core network function.

[0543] For example, if the first node is an access network function and does not support SBA, the first node sends the seventh information to the third node through AMF.

[0544] In some embodiments, the seventh information is used to request services related to the first data.

[0545] In some embodiments, the seventh piece of information may be a service request.

[0546] It is understandable that the first node can be a consumer of network function services, and the third node can be a producer of network function services.

[0547] In some embodiments, the seventh piece of information includes a token.

[0548] It is understandable that by carrying a token in the seventh message, the third node can verify the seventh message based on the token.

[0549] In some embodiments, the token is used to verify whether the service requested by the first node and the purpose of requesting the service are authorized.

[0550] In some embodiments, the seventh information further includes at least one of the following: first identification information for indicating the first AF that acquires the first data; second identification information for indicating the terminal and / or the user using the terminal; data type information for indicating the type of the first data; and purpose information for indicating the purpose of processing the first data.

[0551] It should be noted that if the seventh information includes destination information, it indicates that the purpose of the first node's request to process the first data cannot be explicitly indicated by the service requested by the seventh information; in this case, the first node needs to explicitly indicate the purpose of data processing by including destination information in the seventh information.

[0552] Step S2310: The third node performs a second verification on the service requested by the first node.

[0553] In some embodiments, optional implementations of step S2310 can be found in optional implementations of step S2110 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0554] In some embodiments, the term "information" may be used interchangeably with terms such as "message," "signal," "signaling," "report," "configuration," "indication," "instruction," "command," "channel," "parameter," "field," and "data."

[0555] In some embodiments, the term "send" may be used interchangeably with terms such as "transmit," "report," or "transmit."

[0556] The authorized method involved in the embodiments of this disclosure may include at least one of steps S2301 to S2310. For example, steps S2301 and S2302 may be implemented as independent embodiments, steps S2301 to S2303 may be implemented as independent embodiments, and steps S2301 to S2307 may be implemented as independent embodiments, but are not limited thereto.

[0557] In some embodiments, steps S2303, S2304, S2305, S2306, S2307, S2308, S2309, and S2310 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the terminal refuses to grant the full scope of authorization requested by the first node, the terminal may not send the ninth information to the second node.

[0558] In some embodiments, steps S2304, S2305, S2306, S2307, S2308, S2309, and S2310 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the ninth message indicates a denied data type and data processing purpose, the second node will not configure an authorization code for the first node, and therefore will not send the tenth message to the terminal. Based on this, the first node, without receiving an authorization code, will not send the fifth message to the second node to request a token, nor will it send the seventh message to the third node to request services related to the first data.

[0559] In some embodiments, steps S2308, S2309, and S2310 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that in the event of a first verification failure, the second node will not generate a token, nor will it send the sixth message to the first node. Based on this, the first node, without obtaining a token, will not send the seventh message to the third node to request services related to the first data.

[0560] Figure 3A is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 3A, this disclosure relates to an authorization method, executed by a first node, the method including:

[0561] Step S3101: Send the first message.

[0562] In some embodiments, when the first node is a core network function, the optional implementation of step S3101 can be found in the optional implementation of step S2101 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0563] In some embodiments, when the first node is an access network function and the first node supports SBA, the optional implementation of step S3101 can be found in the optional implementation of step S2201 in FIG2B and other related parts in the embodiments involved in FIG2B, which will not be repeated here.

[0564] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S3101 can be found in the optional implementation of step S2301 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0565] Step S3102: Receive the fourth information.

[0566] In some embodiments, when the first node is a core network function, the optional implementation of step S3102 can be found in the optional implementation of step S2105 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0567] In some embodiments, when the first node is an access network function and the first node supports SBA, the optional implementation of step S3102 can be found in the optional implementation of step S2205 in FIG2B and other related parts in the embodiments involved in FIG2B, which will not be repeated here.

[0568] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S3102 can be found in the optional implementation of step S2305 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0569] Step S3103: Send the fifth message.

[0570] In some embodiments, when the first node is a core network function, or the first node is an access network function and the first node supports SBA, the optional implementation of step S3103 can be found in the optional implementation of step S2106 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0571] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S3103 can be found in the optional implementation of step S2306 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0572] Step S3104: Receive the sixth message.

[0573] In some embodiments, when the first node is a core network function, or the first node is an access network function and the first node supports SBA, the optional implementation of step S3104 can be found in the optional implementation of step S2108 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0574] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S3104 can be found in the optional implementation of step S2308 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0575] Step S3105: Send the seventh message.

[0576] In some embodiments, when the first node is a core network function, or the first node is an access network function and the first node supports SBA, the optional implementation of step S3105 can be found in the optional implementation of step S2109 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0577] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S3105 can be found in the optional implementation of step S2309 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0578] The authorized method involved in the embodiments of this disclosure may include at least one of steps S3101 to S3105. For example, step S3101 may be implemented as a standalone embodiment, steps S3101 to S3103 may be implemented as standalone embodiments, and steps S3101 to S3104 may be implemented as standalone embodiments, but are not limited thereto.

[0579] In some embodiments, steps S3102, S3103, S3104, and S3105 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the terminal refuses to authorize the full scope of authorization requested by the first node, the terminal may not send the fourth information to the first node; if the terminal does not obtain an authorization code, the terminal does not need to send the fifth information to the second node to request a token; nor does it need to send the seventh information to the third node to request services related to the first data.

[0580] In some embodiments, steps S3104 and S3105 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the first verification of the fifth information fails, the second node may not send the sixth information to the terminal. If the terminal does not obtain a token, the terminal does not need to send the seventh information to the third node to request services related to the first data.

[0581] In some embodiments, step S3105 is optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that even if the terminal obtains a token, it may not send the seventh message to the third node to request the service related to the first data if the terminal has not obtained the service related to the first data.

[0582] Figure 3B is a schematic flowchart of an authorization method according to an exemplary embodiment. As shown in Figure 3B, this disclosure embodiment relates to an authorization method, executed by a first node, the method including:

[0583] Step S3201: Send the first message.

[0584] In some embodiments, the first information is used to request authorization to process first data, which is associated with a terminal.

[0585] The optional implementations of step S3201 can be found in the optional implementations of step S2101 in Figure 2A, step S2201 in Figure 2B, step S2301 in Figure 2C, other related parts in the embodiments involved in Figure 2A, other related parts in the embodiments involved in Figure 2B, and other related parts in the embodiments involved in Figure 2C, which will not be repeated here.

[0586] Figure 4A is a schematic flowchart of an authorization method according to an exemplary embodiment. As shown in Figure 4A, this disclosure relates to an authorization method executed by a terminal, the method including:

[0587] Step S4101: Receive the first information.

[0588] In some embodiments, when the first node is a core network function, the optional implementation of step S4101 can be found in the optional implementation of step S2101 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0589] In some embodiments, when the first node is an access network function and the first node supports SBA, the optional implementation of step S4101 can be found in the optional implementation of step S2201 in FIG2B and other related parts in the embodiments involved in FIG2B, which will not be repeated here.

[0590] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S4101 can be found in the optional implementation of step S2301 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0591] Step S4102: Determine the ninth information based on the first information.

[0592] In some embodiments, optional implementations of step S4102 can be found in optional implementations of step S2102 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0593] Step S4103: Send the ninth message.

[0594] In some embodiments, optional implementations of step S4103 can be found in optional implementations of step S2103 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0595] Step S4104: Receive the tenth message.

[0596] In some embodiments, optional implementations of step S4104 can be found in optional implementations of step S2104 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0597] Step S4105: Send the fourth message.

[0598] In some embodiments, when the first node is a core network function, the optional implementation of step S4105 can be found in the optional implementation of step S2105 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0599] In some embodiments, when the first node is an access network function and the first node supports SBA, the optional implementation of step S4105 can be found in the optional implementation of step S2205 in FIG2B and other related parts in the embodiments involved in FIG2B, which will not be repeated here.

[0600] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S4105 can be found in the optional implementation of step S2305 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0601] The authorized method involved in the embodiments of this disclosure may include at least one of steps S4101 to S4105. For example, steps S4101 and S4102 may be implemented as independent embodiments, and steps S4101 to S4103 may be implemented as independent embodiments, but are not limited thereto.

[0602] In some embodiments, steps S4103, S4104, and S4105 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the terminal refuses to grant the full scope of authorization requested by the first node, the terminal may not send the ninth information to the second node.

[0603] In some embodiments, steps S4104 and S4105 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the ninth message indicates a denied data type and data processing purpose, the second node will not configure an authorization code for the first node, and therefore will not send the tenth message to the terminal; the terminal will also not send the fourth message to the first node.

[0604] Figure 4B is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 4B, this disclosure relates to an authorization method executed by a terminal, the method including:

[0605] Step S4201: Receive the first information.

[0606] In some embodiments, the first information is used to request authorization to process first data, which is associated with a terminal.

[0607] The optional implementations of step S4201 can be found in the optional implementations of step S2101 in Figure 2A, step S2201 in Figure 2B, step S2301 in Figure 2C, other related parts in the embodiments involved in Figure 2A, other related parts in the embodiments involved in Figure 2B, and other related parts in the embodiments involved in Figure 2C, which will not be repeated here.

[0608] Figure 5A is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 5A, this disclosure embodiment relates to an authorization method, executed by a second node, the method including:

[0609] Step S5101: Receive the ninth message.

[0610] In some embodiments, optional implementations of step S5101 can be found in optional implementations of step S2103 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0611] Step S5102: Send the tenth message.

[0612] In some embodiments, optional implementations of step S5102 can be found in optional implementations of step S2104 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0613] Step S5103: Receive the fifth message.

[0614] In some embodiments, when the first node is a core network function or an access network function and the first node supports SBA, the optional implementation of step S5103 can be found in the optional implementation of step S2106 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0615] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S5103 can be found in the optional implementation of step S2306 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0616] Step S5104: Perform the first verification on the fifth piece of information.

[0617] In some embodiments, optional implementations of step S5104 can refer to optional implementations of step S2107 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0618] Step S5105: Send the sixth message.

[0619] In some embodiments, when the first node is a core network function or an access network function and the first node supports SBA, the optional implementation of step S5105 can be found in the optional implementation of step S2108 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0620] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S5105 can be found in the optional implementation of step S2308 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0621] The authorized method involved in the embodiments of this disclosure may include at least one of steps S5101 to S5105. For example, step S5101 may be implemented as a standalone embodiment, and steps S5101 to S5104 may be implemented as standalone embodiments, but are not limited thereto.

[0622] In some embodiments, steps S5102, S5103, S5104, and S5105 are optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that if the ninth message indicates a denied data type and data processing purpose, the second node will not configure an authorization code for the first node, and therefore will not send the tenth message to the terminal.

[0623] In some embodiments, step S5105 is optional, and one or more of these steps may be omitted or substituted in different embodiments. It is understood that in the event of a first verification failure, the second node will not configure an authorization code for the first node, nor will it send the sixth message to the first node.

[0624] Figure 5B is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 5B, this disclosure relates to an authorization method executed by a second node, the method comprising:

[0625] Step S5201: Receive the fifth message.

[0626] In some embodiments, the fifth information is used to request a token. The fifth information includes an authorization code, which is related to the authorization of the processing behavior of the first data, and the first data is related to the terminal.

[0627] The optional implementations of step S5201 can be found in the optional implementations of step S2106 in Figure 2A, step S2206 in Figure 2B, step S2306 in Figure 2C, other related parts in the embodiments involved in Figure 2A, other related parts in the embodiments involved in Figure 2B, and other related parts in the embodiments involved in Figure 2C, which will not be repeated here.

[0628] Figure 6A is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 6A, this disclosure relates to an authorization method executed by a third node, the method comprising:

[0629] Step S6101: Receive the seventh message.

[0630] In some embodiments, when the first node is a core network function or an access network function and the first node supports SBA, the optional implementation of step S6101 can be found in the optional implementation of step S2109 in FIG2A and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0631] In some embodiments, when the first node is an access network function and the first node does not support SBA, the optional implementation of step S6101 can be found in the optional implementation of step S2309 in FIG2C and other related parts in the embodiments involved in FIG2C, which will not be repeated here.

[0632] Step S6102: Perform a second verification on the seventh information.

[0633] In some embodiments, optional implementations of step S6102 can be found in optional implementations of step S2110 in FIG2A, and other related parts in the embodiments involved in FIG2A, which will not be repeated here.

[0634] Figure 6B is a flowchart illustrating an authorization method according to an exemplary embodiment. As shown in Figure 6B, this disclosure embodiment relates to an authorization method, executed by a third node, the method including:

[0635] Step S6201: Receive the seventh message.

[0636] The seventh information is used to request services related to the first data, which is related to the terminal; the seventh information includes a token.

[0637] The optional implementations of step S6201 can be found in the optional implementations of step S2109 in Figure 2A, step S2209 in Figure 2B, step S2309 in Figure 2C, other related parts in the embodiments involved in Figure 2A, other related parts in the embodiments involved in Figure 2B, and other related parts in the embodiments involved in Figure 2C, which will not be repeated here.

[0638] Figure 7 is an interactive schematic diagram illustrating an authorization method according to an exemplary embodiment. As shown in Figure 7, this disclosure relates to an authorization method for a communication system 100, the method including one of the following steps:

[0639] Step S7101: The first node sends the first information to the terminal.

[0640] In some embodiments, the first information is used to request authorization to process first data, which is associated with a terminal.

[0641] In step S7102, the terminal sends the ninth message to the second node.

[0642] In some embodiments, the ninth information is used to indicate authorization information related to the processing of the first data.

[0643] Step S7103: The second node sends the tenth information to the terminal.

[0644] In some embodiments, the tenth information includes an authorization code.

[0645] Step S7104: The terminal sends the fourth information to the first node.

[0646] In some embodiments, the fourth information includes an authorization code.

[0647] Step S7105: The first node sends the fifth message to the second node.

[0648] In some embodiments, the fifth information is used to request a token; the fifth information includes an authorization code;

[0649] Step S7106: The second node sends the sixth message to the first node.

[0650] In some embodiments, the sixth piece of information includes a token;

[0651] Step S7107: The first node sends the seventh message to the third node.

[0652] In some embodiments, the seventh information is used to request services related to the first data, and the seventh information includes a token.

[0653] In some embodiments, the above methods may include the methods of the above-described communication system side, terminal side, first node side, second node side, third node side, etc., which will not be described again here.

[0654] In communication systems, before processing data related to a specific terminal or user, an access network (NF) may need to obtain user consent information or privacy configuration information from Unified Data Management (UDM) or Unified Data Repository (UDR). This authorization is rule-based, making it inflexible. Furthermore, for future network systems, access network devices may also need to collect or process data from specific terminals or users. However, current authorization mechanisms are limited to network functions.

[0655] In order to enable communication systems to use real-time policies to authorize NF or access network devices to process data related to specific terminals or users, a new authorization mechanism needs to be developed for communication systems.

[0656] Figure 8A is a schematic diagram illustrating the flow interaction of an authorization method according to an exemplary embodiment. As shown in Figure 8A, this disclosure relates to an authorization method, which includes:

[0657] In step S8101, NF1 sends authorization-related information to the terminal through access network functions and / or NF2.

[0658] It should be noted that before processing data related to a specific terminal / user, NF1 sends authorization-related information to the terminal via access network functions and / or NF2. It is worth noting that NF2 is optional in step S8101. For example, if NF1 is a network function related to mobility management, such as AMF, NF1 can directly send authorization-related information to the terminal via access network functions. In Figure 8A, NF2 is drawn with a dashed line to indicate that NF2 is optional.

[0659] Here, NF1 and NF2 are core network functions; NF1 is the core network function in the first network function of this disclosure. NF2 is the second network function of this disclosure; for example, NF2 is a network function related to mobility management, such as AMF.

[0660] The authorization-related information is the first information in this disclosure embodiment.

[0661] It is worth noting that NF1 is a consumer of network function services.

[0662] In some embodiments, the authorization-related information includes: second information indicating the scope of authorization for the requested terminal / user-related data and / or second identification information indicating the AF ID to be exposed.

[0663] Here, the requested scope of authorization indicates at least one of the following:

[0664] Data type information, used to indicate the data type requested from the terminal (e.g., location information, sensing results, and / or MSISDN);

[0665] Purpose information, used to indicate the data processing purpose of the requested data (e.g., exposing the data to a third-party AF indicated by the AF ID, or collecting data).

[0666] In some embodiments, NF1 generates the scope of authorization based on the expected service operations that need to be performed on data related to a particular terminal / user (e.g., the terminal's Subscription Permanent Identity (SUPI)).

[0667] For example, Namf_Location_ProvidePositioningInfo is a service operation used to obtain the terminal's location information. Based on the service operation Namf_Location_ProvidePositioningInfo, it can be determined that the data type requested by NF1 from the terminal is location information, and the purpose of data processing is to collect data.

[0668] In some embodiments, if there is a more specific data processing purpose that cannot be implicitly indicated by the service operation (e.g., the purpose of collecting location information is for a sensing service, or for an AI model training service, etc.), NF1 may explicitly indicate the data processing purpose outside of the service operation.

[0669] In some embodiments, authorization-related information can be transmitted to the terminal via NAS messages.

[0670] It should be noted that NF1 can send authorization-related information to the terminal via NF2, which is related to mobility management.

[0671] In some embodiments, NF1 can use terminal / user ID to discover network functions related to mobility management.

[0672] In step S8102, the terminal sends authorization information related to NF1 to NF3.

[0673] In some embodiments, after receiving authorization-related information from NF1, the terminal sends authorization information related to NF1 to NF3.

[0674] Here, NF3 is the third network function of this disclosure; the licensing information related to NF1 is the ninth information of this disclosure.

[0675] It should be noted that the terminal can be configured with NF3 address information (such as the NF3 Fully Qualified Domain Name (FQDN)); and the terminal can interact with NF3 through the user plane.

[0676] In some embodiments, the authorization information is used to indicate at least one of the following: the data type of the data granted or denied; and the data processing purpose of the data granted or denied.

[0677] In step S8103, NF3 sends an authorization code to the terminal.

[0678] If the authorization information associated with NF1 indicates that the data type and data processing purpose requested by NF1 are permitted to be authorized, NF3 sends an authorization code to the terminal.

[0679] In some embodiments, NF3 needs to maintain eleventh information. The eleventh information includes the association between at least two of the following: first identification information, authorization information provided by the terminal, and authorization code.

[0680] It is understandable that the eleventh piece of information can be mapping table information. This mapping table information can be a ternary mapping table, meaning it includes the relationship between the first identifier information, the authorization information provided by the terminal, and the authorization code. Alternatively, it can be a binary mapping table, meaning it can include the relationship between the first identifier information and the authorization information provided by the terminal; or the relationship between the authorization code and the authorization information provided by the terminal; or the relationship between the first identifier information and the authorization code.

[0681] In some embodiments, the eleventh information includes at least one of the following: second identification information; an authorization code associated with the second identification information; an authorization scope associated with the second identification information; third identification information associated with the second identification information, the third identification information being used to indicate the authorized AF ID; an authorization code; second identification information associated with the authorization code; an authorization scope associated with the authorization code; and third identification information associated with the authorization code.

[0682] Step S8104: The terminal sends an authorization code to NF1.

[0683] In step S8105, NF1 sends a token request to NF3.

[0684] Here, the token request is the fifth piece of information in this disclosure embodiment.

[0685] In some embodiments, the token request includes an authorization code.

[0686] For service operations that require terminal or user authorization, NF1 is only allowed to request a token by sending a token request carrying the authorization code to NF3 when it receives an authorization code sent by the terminal.

[0687] In some embodiments, the token request may further include at least one of the following: second identification information, including terminal / user ID; service operation information, for indicating the requested service operation; first identification information, for indicating the requested AF ID; data type information; and destination information.

[0688] It should be noted that the token request may include an additional scope, which contains second identification information, service operation information, and first identification information. After receiving the token request, NF3 verifies the token request based on the second identification information, service operation information, and first identification information carried within the token request.

[0689] In some embodiments, NF3 can verify the token request based on the authorization information sent by the terminal.

[0690] If the token request includes second identification information, the authorization code in the token request is verified based on the authorization code associated with the second identification information in the eleventh information stored in NF3.

[0691] If the token request includes an authorization code and second identification information, the second identification information in the token request is verified based on the second identification information associated with the authorization code in the eleventh information stored in NF3.

[0692] If the token request includes second identification information, data type information, and destination information, the data type information and destination information in the token request are verified based on the authorization scope associated with the second identification information in the eleventh information stored in NF3.

[0693] If the token request includes an authorization code, data type information, and destination information, the data type information and destination information within the token request are verified based on the authorization scope associated with the authorization code in the eleventh information stored in NF3.

[0694] If the token request includes both second and first identification information, the first identification information within the token request is verified based on the third identification information associated with the second identification information in the eleventh information stored in NF3.

[0695] If the token request includes both second identification information and first identification information, the first identification information within the token request is verified based on the authorization scope associated with the second identification information in the eleventh information stored in NF3.

[0696] If the token request includes an authorization code and first identification information, the first identification information in the token request is verified based on the third identification information associated with the authorization code in the eleventh information stored in NF3.

[0697] If the token request includes an authorization code and first identification information, the first identification information within the token request is verified based on the authorization scope associated with the authorization code in the eleventh information stored in NF3.

[0698] If the token request includes an authorization code and service operation information but does not include destination information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the token request are verified based on the authorization scope associated with the authorization code in the eleventh information stored in NF3.

[0699] If the token request includes second identification information and service operation information but does not include destination information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the token request are verified based on the authorization scope associated with the second identification information in the eleventh information stored in NF3.

[0700] In step S8106, NF3 sends a token response to NF1.

[0701] In some embodiments, upon successful verification, NF3 sends a token response to NF1; wherein the token response includes a token.

[0702] In some embodiments, NF3 terminates the authorization process if verification fails.

[0703] In some embodiments, NF3 may send an authorization failure message to NF1, which indicates the reason for the failure.

[0704] For example, if the data type and data processing purpose of the service operation requested by the token request are different from the data type and data processing purpose in the authorization information sent by the terminal, NF3 terminates the authorization process; and NF3 sends an authorization failure message to NF1, indicating that the authorization scope requested by the token request does not match the authorization information provided by the terminal.

[0705] In some embodiments, sending tokens from NF3 to NF1 includes sending an access token and a refresh token from NF3 to NF1.

[0706] In some embodiments, the token may include at least one of the following: second identification information, including terminal / user ID; authorized service operation; authorized data processing purpose; and third identification information, including authorized AF ID.

[0707] It should be noted that the terminal / user ID may be included in the resource portion of the token. Furthermore, if the token includes authorized service operations, and these service operations do not indicate the purpose of data processing, the token may additionally include the authorized data processing purpose.

[0708] Figure 8B is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment. As shown in Figure 8B, this disclosure relates to an authorization method, which includes:

[0709] Step S8201: The first access network function sends authorization request information to the terminal.

[0710] Here, the first access network function is the access network function that supports SBA.

[0711] In some embodiments, the first access network function may be equipment related to non-3GPP interworking functions (N3IWF), trusted non-3GPP gateway functions (TNGF), and base stations in the future network.

[0712] It is worth noting that the first access network function is a consumer of network function services.

[0713] In step S8202, the terminal sends authorization information related to the first access network function to NF3.

[0714] In some embodiments, after receiving authorization-related information from the first access network function, the terminal sends authorization information related to the first access network function to NF3.

[0715] Here, NF3 is the third network function of this disclosure; the authorization information related to the first access network function is the ninth information of this disclosure.

[0716] In step S8203, NF3 sends an authorization code to the terminal.

[0717] If the authorization information related to the first access network function indicates that the data type and data processing purpose requested by the first access network function are authorized, NF3 sends an authorization code to the terminal.

[0718] Step S8204: The terminal sends an authorization code to the first access network function.

[0719] Step S8205: The first access network function sends a token request to NF3.

[0720] Step S8206: NF3 sends a token to the first access network function.

[0721] It should be noted that, compared to the method shown in Figure 8A, the first access network function in this embodiment can directly send authorization-related information to the terminal before processing data related to a specific terminal / user, without needing to go through the access network function or NF2. The authorization-related information can be transmitted via RRC messages.

[0722] Figure 8C is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment. As shown in Figure 8C, this disclosure relates to an authorization method, which includes:

[0723] Step S8301: The second access network function sends authorization-related information to the terminal.

[0724] Here, the second access network function differs from the first access network function. The second access network function is an access network function that does not support SBA.

[0725] It is worth noting that the second access network function is a consumer of network function services.

[0726] In step S8302, the terminal sends authorization information related to the second access network function to NF3.

[0727] In step S8303, NF3 sends an authorization code to the terminal.

[0728] Step S8304: The terminal sends an authorization code to the second access network function.

[0729] In step S8305, the second access network function sends a token request to NF3 via NF2.

[0730] In step S8306, NF3 sends a token to the second access network function via NF2.

[0731] It should be noted that, compared to the method shown in Figure 8B, the second access network function in this embodiment of the present disclosure needs to send or receive token-related information through NF2, which is related to mobility management.

[0732] Figure 8D is a schematic diagram illustrating the flow interaction of an authorization method according to an exemplary embodiment. As shown in Figure 8D, this disclosure relates to an authorization method, which includes:

[0733] In step S8401, NF1 sends a service request carrying a token to NF4.

[0734] Here, NF4 is the fourth network function disclosed in this publication.

[0735] It is worth noting that NF4 is a producer of network function services.

[0736] NF1 sends a service request to NF4, requesting NF4 to process resources related to a specific terminal / user according to the requested data processing purpose.

[0737] In some embodiments, a service request may include at least one of the following: second identification information, including terminal / user ID; requested service operation; purpose information; data type information; first identification information, including requested AF ID; and token.

[0738] In step S8402, NF4 verifies the token.

[0739] It should be noted that if the service request contains second identification information, NF4 can verify the second identification information within the service request based on the token. If the second identification information in the token is the same as the second identification information carried outside the token in the service request, NF4 further verifies the token; otherwise, token verification fails.

[0740] If the service request contains destination information, NF4 can verify the destination information within the service request based on the token. If the data processing purpose authorized in the token is the same as the data processing purpose indicated by the destination information in the service request, NF4 further verifies the token; otherwise, token verification fails.

[0741] If the service request contains first identification information, NF4 can verify the first identification information within the service request based on the token. If the authorized AF ID of the third identification information in the token is the same as the requested AF ID of the first identification information in the service request, NF4 further verifies the token; otherwise, token verification fails.

[0742] It is understood that in this embodiment of the disclosure, NF4 can perform the above verifications to enhance the verification while verifying the validity of the token.

[0743] In step S8403, NF4 processes data according to the service request.

[0744] In some embodiments, if token verification is successful, NF4 can process the data according to the service operation in the token.

[0745] It should be noted that if the token verification is successful, and the service operation can implicitly indicate the data processing purpose (i.e., the token does not contain the data processing purpose), NF4 will process the data based on the service operation in the token.

[0746] In some embodiments, if the token is successfully verified, the NF4 may process the data according to the data processing purpose stated in the token.

[0747] It should be noted that if the token is successfully verified, and if the token includes a data processing purpose, NF4 will process the data based on the data processing purpose in the token.

[0748] In step S8404, NF4 sends a service response to NF1.

[0749] In some embodiments, the service response may include the requested service result.

[0750] For example, a service response may be used to indicate that the requested terminal / user-related data has been successfully exposed to the AF indicated by the AF ID. Alternatively, a service response may include processed sensor data.

[0751] Figure 8E is a schematic diagram of the flow interaction of an authorization method according to an exemplary embodiment. As shown in Figure 8E, this disclosure relates to an authorization method, which includes:

[0752] Step S8501: The access network function sends a service request carrying a token to NF4.

[0753] Here, access network functions may include: first access network functions and / or second access network functions.

[0754] In some embodiments, the access network function sends a service request carrying a token to NF4, including:

[0755] The access network function includes a first access network function, which sends a service request carrying a token to NF4;

[0756] The access network function includes a second access network function, which sends a service request carrying a token to NF4 via NF2.

[0757] In step S8502, NF4 verifies the token.

[0758] In step S8503, NF4 processes data according to the service request.

[0759] In step S8504, NF4 sends a service response to the access network function.

[0760] It should be noted that, compared to the first access network function, the second access network function needs to send or receive token-related information through NF2, which is related to mobility management.

[0761] As shown in Figure 8F, which is a schematic diagram illustrating an authorization method according to an exemplary embodiment, the authorization method can be applied to core network functions, a first access network function supporting SBA, and a second access network function that does not support SBA, so that after obtaining authorization, the aforementioned devices can request the network function producer to provide services for processing first data for authorized data processing purposes.

[0762] This disclosure also provides apparatus for implementing any of the above methods. For example, an apparatus is provided that includes units or modules for implementing the steps performed by the terminal in any of the above methods. Alternatively, another apparatus is provided that includes units or modules for implementing the steps performed by a network device (e.g., an access network device, or a core network device) in any of the above methods.

[0763] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0764] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a Central Processing Unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a type of microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a Neural Network Processing Unit (NPU), a Tensor Processing Unit (TPU), a Deep Learning Processing Unit (DPU), etc.

[0765] Figure 9A is a schematic diagram illustrating the structure of a first node according to an exemplary embodiment. As shown in Figure 9A, the first node includes: a sending module 9101, configured to send first information to a terminal, the first information being used to request authorization to process first data, the first data being related to the terminal. Optionally, the sending module 9101 is used to perform the steps related to information sending executed by the first node in any of the above authorization methods, which will not be described in detail here. Optionally, the first node also includes a receiving module used to perform the steps related to information receiving executed by the first node in any of the above authorization methods, which will not be described in detail here.

[0766] Figure 9B is a schematic diagram of a terminal structure according to an exemplary embodiment. As shown in Figure 9B, the terminal includes: a first receiving module 9201, configured to receive first information sent by a first node, the first information being used to request authorization to process first data, the first data being related to the terminal. Optionally, the first receiving module 9201 is used to perform the steps related to information reception performed by the terminal in any of the above authorization methods, which will not be described in detail here. Optionally, the terminal also includes a sending module used to perform the steps related to information sending performed by the terminal in any of the above authorization methods, which will not be described in detail here. Optionally, the terminal also includes a processing module used to perform the steps related to information processing performed by the terminal in any of the above authorization methods, which will not be described in detail here.

[0767] Figure 9C is a schematic diagram of a second node according to an exemplary embodiment. As shown in Figure 9C, the second node includes: a second receiving module 9301, configured to receive fifth information sent by the first node, the fifth information being used to request a token; the fifth information includes an authorization code, the authorization code being related to the authorization of processing behavior of first data, and the first data being related to a terminal. Optionally, the second receiving module 9301 is used to perform the steps related to information reception performed by the second node in any of the above authorization methods, which will not be described in detail here. Optionally, the second node also includes a sending module used to perform the steps related to information sending performed by the second node in any of the above authorization methods, which will not be described in detail here. Optionally, the second node also includes a processing module used to perform the steps related to information processing performed by the second node in any of the above authorization methods, which will not be described in detail here.

[0768] Figure 9D is a schematic diagram illustrating the structure of a third node according to an exemplary embodiment. As shown in Figure 9D, the third node includes: a third receiving module 9401, configured to receive seventh information sent by a first node, the seventh information being used to request services related to first data, the first data being related to a terminal; the seventh information includes a token. Optionally, the third receiving module 9401 is used to perform the steps related to information reception performed by the third node in any of the above authorization methods, which will not be described in detail here. Optionally, the third node also includes a sending module used to perform the steps related to information sending performed by the third node in any of the above authorization methods, which will not be described in detail here. Optionally, the third node also includes a processing module used to perform the steps related to information processing performed by the third node in any of the above authorization methods, which will not be described in detail here.

[0769] Figure 10A is a schematic diagram of a communication device according to an exemplary embodiment. The communication device 1100 can be a first node, a second node, a terminal (e.g., a user equipment), a chip, chip system, or processor that supports network devices in implementing any of the above methods, or a chip, chip system, or processor that supports terminals in implementing any of the above-described licensing methods. The communication device 1100 can be used to implement the licensing methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0770] As shown in Figure 10A, the communication device 1100 includes one or more processors 1101. The processor 1101 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control communication devices (e.g., base stations, baseband chips, terminal devices, terminal device chips, DUs or CUs, etc.), execute programs, and process program data. The processor 1101 is used to invoke instructions to cause the communication device 1100 to execute any of the above communication methods.

[0771] In some embodiments, the communication device 1100 further includes one or more memories 1102 for storing instructions. Optionally, all or part of the memories 1102 may also be located outside the communication device 1100.

[0772] In some embodiments, the communication device 1100 further includes one or more transceivers 1103. When the communication device 1100 includes one or more transceivers 1103, the communication steps such as sending and receiving in the above method are performed by the transceivers 1103, and other steps are performed by the processor 1101.

[0773] In some embodiments, a transceiver may include a receiver and a transmitter, which may be separate or integrated. Optionally, the terms transceiver, transceiver unit, transceiver, transceiver circuit, etc., may be used interchangeably; the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc., may be used interchangeably; and the terms receiver, receiving unit, receiver, receiving circuit, etc., may be used interchangeably.

[0774] Optionally, the communication device 1100 further includes one or more interface circuits 1104, which are connected to the memory 1102. The interface circuits 1104 can be used to receive signals from the memory 1102 or other devices, and can be used to send signals to the memory 1102 or other devices. For example, the interface circuits 1104 can read instructions stored in the memory 1102 and send the instructions to the processor 1101.

[0775] The communication device 1100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 1100 described in this disclosure is not limited thereto, and the structure of the communication device 1100 may not be limited by FIG10A. The communication device may be a standalone device or a part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally, the IC collection may also include storage components for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0776] Figure 10B is a schematic diagram of a chip structure according to an exemplary embodiment. For cases where the communication device 1100 can be a chip or a chip system, please refer to the schematic diagram of the chip 1200 shown in Figure 10B, but it is not limited thereto.

[0777] Chip 1200 includes one or more processors 1201, which are used to invoke instructions to cause chip 1200 to execute any of the above communication methods.

[0778] In some embodiments, chip 1200 further includes one or more interface circuits 1202 connected to memory 1203. Interface circuits 1202 can be used to receive signals from memory 1203 or other devices, and can also be used to send signals to memory 1203 or other devices. For example, interface circuit 1202 can read instructions stored in memory 1203 and send those instructions to processor 1201. Optionally, terms such as interface circuit, interface, transceiver pin, and transceiver can be used interchangeably.

[0779] In some embodiments, chip 1200 further includes one or more memories 1203 for storing instructions. Optionally, all or part of the memories 1203 may be located outside of chip 1200.

[0780] This disclosure also provides a storage medium storing instructions that, when executed on a communication device 1100, cause the communication device 1100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but it can also be a storage medium readable by other devices. Optionally, the storage medium can be a non-transitory storage medium, but it can also be a temporary storage medium.

[0781] This disclosure also provides a program product, which, when executed by the communication device 1100, causes the communication device 1100 to perform any of the above communication methods. Optionally, the program product is a computer program product.

[0782] This disclosure also provides a computer program that, when run on a computer, causes the computer to perform any of the above communication methods.

[0783] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0784] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. An authorization method, wherein, Executed by the first node, the method includes: Send a first message to the terminal, the first message being used to request authorization to process first data, the first data being related to the terminal.

2. The method according to claim 1, wherein, The first node includes at least one of the following: Core network functions; Access network function.

3. The method according to claim 2, wherein, Sending the first information to the terminal includes at least one of the following: When the first node is a core network function, the first information is sent to the terminal through the access network function, and the first information is carried in the non-access stratum (NAS) message. When the first node is an access network function and the first node supports the first access method, the first information is sent to the terminal, and the first information is carried in the message of the first access method adaptation. When the first node is an access network function and the first node supports the second access method, the first information is sent to the terminal, and the first information is carried in the message of the second access method adaptation; The message adapted to the first access method is at least one of the access layer AS message and the radio resource control RRC message; the message adapted to the second access method is different from the message adapted to the first access method.

4. The method according to claim 2 or 3, wherein, The first information includes at least one of the following: The second piece of information is used to indicate the scope of authorization requested in relation to the first data; The first identification information is used to indicate the first application function AF that acquires the first data.

5. The method according to claim 4, wherein, The second information includes at least one of the following: Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data; The first identification information.

6. The method according to claim 5, wherein, The data type information includes at least one of the following: Terminal location information; The terminal's sensor information; Terminal user identification information; Terminal identification information.

7. The method according to any one of claims 4 to 6, wherein, The method further includes: The second information is determined based on the third information; wherein the third information is used to indicate the service related to the first data requested by the first node.

8. The method according to any one of claims 4 to 7, wherein, The method further includes: The terminal sends a fourth message, which includes an authorization code configured for the first node.

9. The method according to claim 8, wherein, The method further includes: A fifth message is sent to the second node. The fifth message is used to request a token. The fifth message includes the authorization code, which is related to the authorization of the processing behavior of the first data.

10. The method according to claim 9, wherein, The fifth piece of information also includes at least one of the following: The first identification information; The second identification information is used to indicate the terminal and / or the user using the terminal; Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data; Service operation information is used to indicate at least one of the following: the service operation associated with the first data being acquired; the data type of the first data; and the purpose of processing the first data.

11. The method according to claim 10, wherein, The token includes at least one of the following: The second identification information; The third identification information is used to indicate the second AF that is authorized to obtain the first data; Authorized data processing purpose.

12. The method according to claim 10 or 11, wherein, The method further includes: Receive the sixth message sent by the second node, the sixth message including the token.

13. The method according to any one of claims 10 to 12, wherein, The sending of the fifth message to the second node includes at least one of the following: If the first node is an access network function and supports Service-Based Architecture (SBA), the fifth information is sent to the second node. If the first node is an access network function and does not support the SBA, the fifth information is sent to the second node through the core network function.

14. The method according to claim 13, wherein, The core network function is used to perform at least one of the following: Access management functions; Mobility management features.

15. The method according to claim 12 or 13, wherein, The method further includes: A seventh message is sent to the third node, the seventh message being used to request services related to the first data; the seventh message includes the token.

16. The method according to claim 15, wherein, The seventh information also includes at least one of the following: The first identification information; The second identification information; Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data.

17. An authorization method, wherein, The method, executed by a terminal, includes: The terminal receives first information sent by a first node, the first information being used to request authorization to process first data, the first data being related to the terminal.

18. The method according to claim 17, wherein, The first node includes at least one of the following: Core network functions; Access network function.

19. The method according to claim 18, wherein, The first information received from the first node includes at least one of the following: When the first node functions as a core network, it receives first information sent by the first node through the access network function, and the first information is carried in the NAS message. When the first node is the access network function and the first node supports the first access method, the first information sent by the first node is received, and the first information is carried in the message of the first access method adaptation. When the first node is the access network function and the first node supports the second access method, the first information sent by the first node is received, and the first information is carried in the message of the second access method adaptation; The message adapted to the first access method is at least one of the access layer AS message and the radio resource control RRC message; the message adapted to the second access method is different from the message adapted to the first access method.

20. The method according to any one of claims 17 to 19, wherein, The first information includes at least one of the following: The second information is used for the requested scope of authorization related to the first data; First identification information is used to indicate the first AF that acquires the first data.

21. The method according to claim 20, wherein, The second information includes at least one of the following: Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data.

22. The method according to claim 21, wherein, The data type information includes at least one of the following: Terminal location information; The terminal's sensor information; Terminal user identification information; Terminal identification information.

23. The method according to any one of claims 17 to 22, wherein, The method further includes: Based on the first information, a ninth piece of information is determined, which is used to indicate authorization information related to the processing of the first data; Send the ninth message to the second node.

24. The method according to claim 23, wherein, The ninth piece of information includes at least one of the following: Data types that allow or deny authorization; Allow or deny authorized data processing purposes.

25. The method according to claim 23 or 24, wherein, The method further includes: The system receives a tenth message sent by the second node, the tenth message including an authorization code configured for the first node.

26. The method of claim 25, wherein, The method further includes: Send a fourth message to the first node, the fourth message including the authorization code.

27. An authorization method, wherein, Executed by the second node, the method includes: The system receives a fifth message sent by the first node, which is used to request a token. The fifth message includes an authorization code, which is related to the authorization of the processing behavior of the first data, and the first data is related to the terminal.

28. The method according to claim 27, wherein, The fifth piece of information also includes at least one of the following: First identification information is used to indicate the first AF that acquires the first data; The second identification information is used to indicate the terminal and / or the user using the terminal; Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data; Service operation information is used to indicate at least one of the following: the service operation associated with the first data being acquired; the data type of the first data; and the purpose of processing the first data.

29. The method according to claim 28, wherein, The method further includes: Based on the eleventh piece of information, the fifth piece of information is verified for the first time.

30. The method according to claim 29, wherein, The eleventh piece of information includes at least one of the following: The second identification information; The authorization code associated with the second identification information; The scope of authorization associated with the second identification information; The third identification information associated with the second identification information is used to indicate the second AF authorized to obtain the first data; The authorization code; The second identification information associated with the authorization code; The scope of authorization associated with the authorization code; The third identification information associated with the authorization code.

31. The method according to claim 30, wherein, The first verification of the fifth information based on the eleventh information includes at least one of the following: The fifth information includes the second identification information, and the authorization code in the fifth information is verified based on the authorization code associated with the second identification information in the eleventh information; The fifth information includes the authorization code and the second identification information. Based on the second identification information associated with the authorization code contained in the eleventh information, the second identification information in the fifth information is verified. The fifth information includes the second identification information, the data type information, and the purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type information and the purpose information in the fifth information are verified. The fifth piece of information includes the authorization code, the data type information, and the purpose information. Based on the authorization scope associated with the authorization code in the eleventh piece of information, the data type information and the purpose information in the fifth piece of information are verified. The fifth information includes the second identification information and the first identification information. Based on the third identification information associated with the second identification information in the eleventh information, the first identification information in the fifth information is verified. The fifth information includes the second identification information and the first identification information. Based on the authorization scope associated with the second identification information in the eleventh information, the first identification information within the fifth information is verified. The fifth information includes the authorization code and the first identification information. Based on the third identification information associated with the authorization code in the eleventh information, the first identification information in the fifth information is verified. The fifth information includes the authorization code and the first identification information. Based on the authorization scope associated with the authorization code in the eleventh information, the first identification information within the fifth information is verified. The fifth information includes the authorization code and the service operation information, but does not include the purpose information. Based on the authorization scope associated with the authorization code in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified. The fifth information includes the second identification information and the service operation information, but does not include the purpose information. Based on the authorization scope associated with the second identification information in the eleventh information, the data type and data processing purpose corresponding to the service operation indicated by the service operation information in the fifth information are verified.

32. The method according to any one of claims 29 to 31, wherein, The method further includes: If the first verification is successful, a sixth message is sent to the first node, the sixth message including the token.

33. The method according to any one of claims 29 to 32, wherein, The method further includes: The receiving terminal sends a ninth message, which is used to indicate authorization information related to the processing of the first data.

34. The method according to claim 33, wherein, The ninth piece of information includes at least one of the following: Data types that allow or deny authorization; Allow or deny authorized data processing purposes.

35. The method according to claim 33 or 34, wherein, The method further includes: Based on the ninth piece of information, an authorization code is configured for the first node; Send the tenth message to the terminal, the tenth message including the authorization code.

36. The method according to claim 35, wherein, The method further includes: Based on the ninth and tenth information, the eleventh information is determined.

37. An authorization method, wherein, Executed by a third node, the method includes: The system receives a seventh message sent by the first node, the seventh message being used to request services related to the first data, the first data being related to the terminal; the seventh message includes a token.

38. The method according to claim 37, wherein, The seventh information also includes at least one of the following: First identification information is used to indicate the first AF that acquires the first data; The second identification information is used to indicate the terminal and / or the user using the terminal; Data type information, used to indicate the type of the first data; Purpose information, used to indicate the purpose of processing the first data.

39. The method according to claim 38, wherein, The token includes at least one of the following: The second identification information; The third identification information is used to indicate the second AF that is authorized to obtain the first data; Authorized data processing purpose.

40. The method according to claim 39, wherein, The method further includes: The seventh information is then verified a second time based on the token.

41. The method according to claim 40, wherein, The second verification of the seventh information based on the token includes at least one of the following: The seventh information includes the second identification information and the token. The second identification information in the seventh information is verified based on the second identification information in the token. The seventh information includes the purpose information and the token. Based on the authorized data processing purpose within the token, the data processing purpose requested by the purpose information in the seventh information is verified. The seventh information includes the first identification information and the token. Based on the authorized second AF indicated by the third identification information in the token, the first AF indicated by the first identification information in the seventh information is verified.

42. An authorization method, wherein, Performed by a communication system, the method includes: The first node sends first information to the terminal, the first information being used to request authorization to process first data, the first data being related to the terminal; The terminal sends a ninth message to the second node, the ninth message being used to indicate authorization information related to the processing of the first data; The second node sends tenth information to the terminal, the tenth information including the authorization code; The terminal sends fourth information to the first node, the fourth information including the authorization code; The first node sends a fifth message to the second node, the fifth message being used to request a token; the fifth message includes an authorization code. The second node sends a sixth message to the first node, the sixth message including the token; The first node sends a seventh message to the third node, the seventh message being used to request services related to the first data, the seventh message including a token.

43. A first node, wherein, The first node includes: The sending module is configured to send first information to the terminal, the first information being used to request authorization to process first data, the first data being related to the terminal.

44. A terminal, wherein, The terminal includes: The first receiving module is configured to receive first information sent by the first node, the first information being used to request authorization to process first data, the first data being related to the terminal.

45. A second node, wherein, The second node includes: The second receiving module is configured to receive a fifth message sent by the first node, the fifth message being used to request a token; The fifth piece of information includes an authorization code, which is related to the authorization of the processing behavior of the first data, and the first data is related to the terminal.

46. ​​A third node, wherein, The third node includes: The third receiving module is configured to receive a seventh message sent by the first node. The seventh message is used to request services related to the first data, which is related to the terminal. The seventh message includes a token.

47. A communication system, wherein, The communication system includes a terminal, a first node, a second node, and a third node; the first node is configured to implement the authorization method of any one of claims 1 to 16, the terminal is configured to implement the authorization method of any one of claims 17 to 26, the second node is configured to implement the authorization method of any one of claims 27 to 36, and the third node is configured to implement the authorization method of any one of claims 37 to 41.

48. A communication device, wherein, The communication device includes: One or more processors; The processor is configured to invoke instructions to cause the communication device to execute the authorized method according to any one of claims 1 to 16, 17 to 26, 27 to 36, and 37 to 41.

49. A storage medium, wherein, The storage medium stores instructions that, when executed on a communication device, cause the communication device to perform the authorized method as described in any one of claims 1 to 16, 17 to 26, 27 to 36, and 37 to 41.

Images