Communication method and communication device

Abstract

The embodiment of the invention provides a method and device for providing ID privacy protection of equipment. In the application, the real ID of the device is stored in the IDM function responsible for ID mapping. When the device requests a service in the network, the first information and the second information are used to replace the temporary ID of the device and for user identity recognition implemented by different network functions in order to decouple the linkability of the temporary ID. The fifth information is used by the service provider for service authority identification to ensure that the service is a service subscribed by the device from the service provider. These new features may provide anonymous service access, thereby providing ID privacy protection for the device.

Description

Cross-reference to related applications

[0001] This application relates to and claims priority to U.S. Provisional Patent Application Serial No. 63 / 541,525, filed September 29, 2023, entitled "System and Method on User Identification in Anonymous Communication Networks." The disclosure of the above application is incorporated herein by reference in its entirety. Technical Field

[0002] The present invention relates to the field of wireless technology, and more specifically, to a communication method and a communication device. Background Technology

[0003] A general-purpose data storage system can provide data storage services. To prevent user identifiers (IDs) from being tracked, temporary identifiers (IDs) are assigned to users to facilitate communication with different providers or network functions (NFs). For example, the system may include data service management functions, data service profile functions, and at least one data service provider (SP). In the data service management function, ID1 is assigned to the device for communication; in the data service profile management function, ID2 is assigned to the device for communication; in data SP1, ID3 is assigned to the device for communication; and in data SP2, ID5 is assigned to the device for communication.

[0004] However, the linkability of these temporary IDs may still leak the device's ID privacy. Summary of the Invention

[0005] This application provides a communication method and apparatus that can provide ID privacy protection for the device.

[0006] In a first aspect, a communication method is provided, which can be executed by a first device or a chip installed in the first device. A first network function is responsible for service management. The method includes: sending a first message to an IDM function, wherein the first message includes a second ID of a device, the first message being used to request ID mapping; receiving a second message from the IDM function, wherein the second message includes first information, an ID of a first algorithm for generating the first information, second information, and an ID of a second algorithm for generating the second information; wherein the first information is used for user identification implemented by a second network function responsible for managing service profiles, the first information being generated by the IDM function based on the first algorithm and a first ID of the device known only to the IDM function and the second network function, the first ID being obtained by the IDM function based on the second ID and the ID of the second network function; or the first information is generated based on information provided by the second network function known only to the IDM function and the second network function; the second information is used for user identification implemented by a third network function providing services to the device, the second information being generated by the IDM function based on the second algorithm and the ID of a device in at least one third network function; the first network function, the second network function, and the third network function are provided by different providers.

[0007] According to this application, first information and second information are introduced to replace the device's temporary ID for communication. Network functions or entities in the communication system can use different temporary IDs to identify users (i.e., devices), and the network functions or entities cannot link the temporary ID to a specific user, which provides ID privacy protection for the device. Details can be found in the specification and will not be repeated here.

[0008] In one implementation of the first aspect, the method further includes: sending a third message to the second network function, wherein the third message is used to request a service for the device, the third message including the first information, the ID of the first algorithm, and a service ID; receiving a fourth message from the second network function, wherein the fourth message indicates the device's service permission to access the service, the fourth message including fifth information determined by the third network function for service permission and the ID of a fifth algorithm used to generate the fifth information, the fifth information being generated based on public information between the second network function and the third network function.

[0009] By introducing a new feature called IDM (Internet Data Manager) functionality, the service ID and device ID are decoupled. The service configuration file is stored in the second network function, and the temporary ID is stored in the IDM function, so that the proposed technical solution can provide both service privacy protection and device ID privacy protection.

[0010] In one implementation of the first aspect, the fifth information includes a service configuration file ID or information derived from the service configuration file ID.

[0011] The fifth piece of information is used to enable the third network function to have the ability to verify service permissions.

[0012] In one implementation of the first aspect, the information provided by the second network function includes a random number generated by the second network function.

[0013] In one implementation of the first aspect, the method further includes: sending a fifth message to the third network function, wherein the fifth message is used to request the service, and the fifth message includes the second information, the fifth information, the service ID, the ID of the second algorithm, and the ID of the fifth algorithm.

[0014] The technical effects of any of the second to eighth aspects can be referenced from the technical effects of the first aspect, and will not be repeated below.

[0015] Secondly, a communication method is provided, which can be executed by an IDM or a chip installed in an IDM function. The method includes: receiving a first message from a first network function responsible for service management, wherein the first message includes a second identifier (ID) of the device known only to the first network function and the IDM function, the first message being used to request ID mapping; obtaining a first ID of the device based on the second ID and the ID of the second network function; obtaining first information and second information, wherein the first information is used for user identification implemented by a second network function responsible for managing service profiles, the first information being obtained based on a first algorithm and the first ID of the device known only to the IDM function and the second network function, or the first information being obtained based on information provided by the second network function, the second information being obtained based on a second algorithm and one or more IDs of the device in at least one third network function; and sending a second message to the first network function, wherein the second message includes the first information, the ID of the first algorithm, the second information, and the ID of the second algorithm.

[0016] In one implementation of the second aspect, the method further includes: sending a sixth message to the second network function, wherein the sixth message is used to request information for calculating the first information; and receiving the information provided by the second network function, wherein the information provided by the second network function includes a random number generated by the second network function.

[0017] Thirdly, a communication method is provided, which can be executed by a second network function or a chip installed in the second network function. The second network function is responsible for managing service profiles. The method includes: receiving a third message from a first network function, wherein the third message is used to request a service for a device, the third message including first information, an ID of a first algorithm for generating the first information, and a service ID, the first information being generated by an IDM function based on the first algorithm and a first ID of the device known only to the IDM function and the second network function, the first ID being obtained by the IDM function based on a second ID of the device and an ID of the second network function, or the first information being generated based on information provided by the second network function known only to the IDM function and the second network function; performing user authentication and verifying the device based on service credentials stored in the second network function. The device and the first service are configured such that user identification is performed by comparing a first value with the received first information included in the third message, the first value being calculated using the first algorithm and the first ID of the device or a random number generated by the second network function; after successful user identification and successful verification of the device and the service, a fourth message is sent to the first network function, wherein the fourth message indicates the device's service permission to access the service, the fourth message including fifth information used by the third network function for service permission determination and an ID of a fifth algorithm for generating the fifth information, the fifth information being generated based on public information between the second network function and the third network function.

[0018] In one implementation of the third aspect, the fifth information includes a service configuration file ID or information derived from the service configuration file ID.

[0019] In one implementation of the third aspect, before receiving the third message from the first network function, the method further includes: receiving a sixth message from the IDM function, wherein the sixth message is used to request information for calculating the first information; and providing information to the IDM function, wherein the information provided by the second network function includes a random number generated by the second network function.

[0020] Fourthly, a communication method is provided, which can be executed by a third network function or a chip installed in the third network function. The third network function is responsible for providing services to a device. The method includes: receiving a fifth message from a first network function, wherein the fifth message is for requesting a service, the fifth message including second information, a service ID, an ID of a second algorithm for generating the second information, and an ID of a fifth algorithm for generating the fifth information, the second information being used for user identification implemented by the third network, the second information being generated by an IDM function based on the second algorithm and one or more IDs of devices in at least one third network function; performing user identification and service permission determination, wherein the user identification is performed based on the second algorithm and the second information included in the fifth message and the ID of the device in the third network function; the service permission determination is performed by comparing the fifth information included in the fifth message with a second value, the second value being calculated based on the fifth algorithm included in the fifth message and information known only to the second network function and the third network function; and providing the service to the device after successful user identification and successful service permission determination, wherein the first network function, the second network function, and the third network function are provided by different providers.

[0021] In one implementation of the fourth aspect, the method further includes sending a successful indication to the first network function.

[0022] Fifthly, a communication method is provided, which can be executed by a first network function or a chip installed in the first network function. The first network function is responsible for service management. The method includes: sending a first message to a second network function, wherein the first message includes third information, an ID of a third algorithm, and a service ID, the third information being generated by the first network function using the third algorithm based on information known only to the first network function and an IDM function, the third information being used for user identification implemented by the IDM function; receiving a second message from the second network function, wherein the second message includes second information, an ID of a second algorithm, fifth information, and an ID of a fifth algorithm, the second information being used for user identification implemented by a third network function, the second information being generated by the IDM function based on the ID of a device in at least one third network function and the second algorithm, the fifth information being used for service permission determination implemented by the third network function, the fifth information being generated by the second network function using the fifth algorithm based on information known only to the second network function and the third network function; wherein the first network function, the second network function, and the third network function are provided by different providers.

[0023] In one implementation of the fifth aspect, the method further includes: sending a third message to the third network function, wherein the third message includes the second information, the ID of the second algorithm, the fifth information, the ID of the fifth algorithm, and the service ID.

[0024] In one implementation of the fifth aspect, the method further includes: receiving an indication from the third network function, wherein the indication is used to indicate that the service has been successfully provided.

[0025] A sixth aspect provides a communication method that can be executed by an IDM function. The method includes: receiving a fourth message from a second network function, wherein the fourth message includes third information and an ID of a third algorithm, the third information being generated by a first network function using the third algorithm based on information known only to the first network function and the IDM function; performing user identification based on the third information and information known only to the first network function and the IDM function, obtaining a second ID of a device using the third algorithm, and obtaining a first ID of the device based on the second ID; generating second information using a second algorithm and the ID of a device in at least one third network function, wherein the second information is used for user identification implemented by the third network function; and sending a fifth message to the second network function, wherein the fifth message includes the second information, the ID of the second algorithm, and the first ID of the device.

[0026] A seventh aspect provides a communication method. The method can be executed by a second network function or a chip installed in the second network function responsible for managing service profiles. The method includes: receiving a first message from a first network function, wherein the first message includes third information, an ID of a third algorithm, and a service ID, the third information being generated by the first network function using the third algorithm based on information known only to the first network function and an IDM function; sending a fourth message to the IDM function, wherein the fourth message includes the third information and the ID of the third algorithm; and receiving a fifth message from the IDM function, wherein the fifth message includes second information, an ID of a second algorithm, and a first ID of the device, the second information being used for user identification implemented by a third network function, the second information being generated by the IDM function using the second algorithm based on the ID of a device in at least one third network function, wherein the first network function, the second network function, and the third network function are provided by different providers.

[0027] In one implementation of the seventh aspect, the method further includes: performing service permission determination by checking a service configuration file based on the service ID; verifying the device and service based on service credentials stored in the service configuration file; and generating fifth information using a fifth algorithm based on information known only to the second network function and the third network function, wherein the fifth information is used for service permission determination implemented by the third network function.

[0028] In one implementation of the seventh aspect, the method further includes: sending a second message to the first network function, wherein the second message includes the second information, the fifth information, the ID of the second algorithm, and the ID of the fifth algorithm.

[0029] Eighthly, a communication method is provided. The method can be performed by a third network function responsible for providing services to a device. The method includes: receiving a third message from a first network function, the third message including second information, an ID of a second algorithm, fifth information, an ID of the fifth algorithm, and a service ID, wherein the second information is generated by an IDM function using the second algorithm based on the ID of a device in at least one third network function; the fifth information is generated by the second network function using the fifth algorithm based on information known only to the second network function and the third network function; and performing user identification and service permission determination, wherein the user identification is performed based on the second information and the second algorithm, and the service permission determination is performed based on the fifth information and the fifth algorithm.

[0030] In one implementation of the eighth aspect, the method further includes: if the user identification and the service permission determination are successful, sending an indication of successful service provision; or sending an indication of service rejection for the device to access the service.

[0031] A ninth aspect provides a communication device having functions or modules for performing a method in any one of the first to eighth aspects or any implementation thereof.

[0032] In a tenth aspect, a chip (or chip system) is provided. The chip includes at least one processor coupled to at least one memory. The at least one memory is used to store one or more instructions and / or executable computer code. The at least one processor is used to invoke the one or more instructions and / or executable computer code to cause a communication device on which the chip is mounted to perform a method according to any one of the first to eighth aspects or any possible implementation thereof. Optionally, the chip may further include the at least one memory. Optionally, the chip may further include a communication interface for inputting and / or outputting information or data.

[0033] Eleventhly, a communication device is provided. The communication device includes one or more circuits and one or more communication interfaces. The one or more communication interfaces may include a first interface for receiving (i.e., inputting) information and / or data to be processed by the one or more circuits and a second interface for transmitting (i.e., outputting) the information and / or data processed by the one or more circuits. The one or more circuits are used to process the information and / or data to be processed, causing the communication device to perform any one of the first to eighth aspects, or any implementation thereof.

[0034] In a twelfth aspect, a communication system is provided. The communication system may include the communication apparatus according to the ninth or eleventh aspect. For example, the communication system may include one or more of the following: an IDM function, a first network function, a second network function, or a second network function. The communication system may also include a device.

[0035] In a thirteenth aspect, a computer storage medium is provided storing executable computer code for executing one or more instructions for a method according to the first aspect or any possible implementation thereof, or the second aspect or any possible implementation thereof.

[0036] In a fourteenth aspect, a computer program product comprising one or more instructions is provided, wherein when the computer program product is run on a computer, the computer performs a method according to the first aspect or any possible implementation thereof, or the second aspect or any possible implementation thereof. Attached Figure Description

[0037] One or more embodiments are described by way of example with the accompanying drawings, which are not intended to limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings are not limited to scale, wherein: Figure 1 This is a schematic diagram illustrating an application scenario according to an embodiment of this application; Figure 2 An example of a communication system is shown; Figure 3 Another example of an electronic device (ED) and a base station is shown; Figure 4 An example of a channel model for a MIMO system; Figure 5 An example of the conceptual architecture of a 6G system; Figure 6 This is for a general data storage system scenario; Figure 7 Scenarios requiring user identification triggered by data service management functions; Figure 8 This is a schematic flowchart illustrating a communication method according to some embodiments of this application; Figure 9 Scenarios where user identification is triggered by the data service configuration file management function; Figure 10 This is a schematic flowchart illustrating a communication method according to some embodiments of this application; Figure 11 This is an example of the network topology for this application; Figure 12 Here are examples of a user identification process according to some embodiments of this application; Figure 13 Here are examples of a user identification process according to some embodiments of this application; Figure 14 Here are examples of a user identification process according to some embodiments of this application; Figure 15 Here are examples of a user identification process according to some embodiments of this application; Figure 16 This is a schematic block diagram of a communication device 10 according to an embodiment of this application; Figure 17 This is a schematic block diagram of a communication device 10 according to an embodiment of the present application. Detailed Implementation

[0038] To gain a more detailed understanding of the features and technical content of the embodiments of this application, the implementation methods of the embodiments of this application will be described in detail below with reference to the accompanying drawings. The drawings are for reference and illustration only and are not intended to limit the embodiments of this application. In the following technical description, many details will be set forth for ease of explanation, so as to provide a thorough understanding of the disclosed embodiments.

[0039] This application broadly relates to wireless communication. Many emerging trends will trigger considerations and designs for future wireless networks, such as sixth-generation (6G) wireless networks. The proposed 6G wireless communication can meet the following requirements: - New network infrastructure capabilities, such as widely deployed cloud-native / friendly infrastructure; - New (relatively) mature technologies, such as large-scale models of artificial intelligence (AI), data privacy, and blockchain, have made significant progress and have a major impact on society and human life. - New applications and services, such as AI services, data (sensing) services, digital world services, etc., are widely used in the industrial / commercial sector and by individual customers; - A more globalized / open / collaborative operating trend, namely, a more open and collaborative operating model is becoming a common practice in many fields.

[0040] New expectations and more stringent requirements for future networks are also driving a rethinking and development of next-generation wireless networks. These requirements may include: - Privacy and trustworthiness, etc.; -Simplification and standardization; - Rapid deployment; -etc.

[0041] All of the above factors are driving research into 6G network architecture. The proposed 6G network architecture (centered on X) is based on a service-based architecture (SBA) (XaaS service) and is cloud-native. Requirements for 6G system network architecture design may include: - The proposed 6G network architecture needs to support new 6G services that can be developed / deployed by third parties; - The proposed 6G network architecture needs to build a more open ecosystem, opening the door to third parties with technical capabilities; The proposed 6G network architecture requires more reliable trust management.

[0042] A technical solution is needed to achieve the above requirements.

[0043] Cloud-based storage services have become an outsourcing solution for individuals and organizations to share data digitally. Despite these advantages, users must rely on storage services to ensure data confidentiality, access control, user privacy, and data availability. While advanced encryption algorithms can protect data confidentiality, cloud-based servers can retrieve shared encryption keys and possess knowledge of the data. More importantly, services typically know the user's identity to verify their eligibility to access requested data according to access controls, thus ensuring user traceability within the data storage system. Crucially, the lack of anonymity can discourage users from using such services in sensitive contexts.

[0044] By introducing new features of IDM, service IDs and user IDs are decoupled. Service profiles are stored in data service profiles (Unified Data Management (UDM) functionality), while temporary IDs are stored in IDM. This protects both service and user privacy.

[0045] This application introduces user identification materials (e.g., info1, info2, etc., which will be described in detail in the following embodiments) to replace temporary IDs for communication, making them unlinkable from temporary IDs.

[0046] This application introduces service permission materials (e.g., info5, which will be described in detail in the following embodiments) to ensure that users subscribe to services from data SPs. Beneficial technical effects include: (1) Enhance privacy protection: Decoupling service subscription from ID configuration file protects both service privacy and ID privacy. Temporary IDs are replaced, making it impossible for IDs to be linked to specific users.

[0047] (2) Security: Service authorization identification material (i.e., info5) is used to enable data SP to verify service authorization.

[0048] (3) Flexibility: The data service management function and the data service configuration file management function are responsible for selecting services on behalf of users and authorizing services on behalf of data SPs. Multiple service providers (SPs) can be easily added to the system.

[0049] refer to Figure 1As a non-limiting illustrative example, a simplified schematic of a communication system is provided. Communication system 100 includes a radio access network 120. Radio access network 120 may be a next-generation (e.g., sixth-generation, 6G or later) radio access network, or an older (e.g., 5G or 4G) radio access network. One or more electronic devices (EDs) 110a, 110b, 110c, 110d, 110e, 110f, 110g, 110h, 110i, 110j (generally referred to as 110) may be interconnected or connected to one or more network nodes (170a, 170b, generally referred to as 170) in radio access network 120. Core network 130 may be part of the communication system and may depend on or be independent of the radio access technology used in communication system 100. Communication system 100 also includes a public switched telephone network (PSTN) 140, the Internet 150, and other networks 160.

[0050] Figure 2 An exemplary communication system 100 is illustrated. Generally, the communication system 100 enables multiple wireless or wired components to transmit data and other content. The purpose of the communication system 100 may be to provide content such as voice, data, video, and / or text via broadcast, multicast, unicast, etc. The communication system 100 can operate by sharing resources (e.g., carrier spectrum bandwidth) among its constituent components. The communication system 100 may include terrestrial communication systems and / or non-terrestrial communication systems. The communication system 100 can provide a wide range of communication services and applications (e.g., earth monitoring, remote sensing, passive sensing and positioning, navigation and tracking, autonomous delivery and mobility, etc.). The communication system 100 can provide high availability and robustness through the joint operation of terrestrial and non-terrestrial communication systems. For example, integrating a non-terrestrial communication system (or components thereof) into a terrestrial communication system can create a heterogeneous network that can be viewed as comprising multiple layers. Compared to traditional communication networks, heterogeneous networks can achieve better overall performance through efficient multi-link joint operation between terrestrial and non-terrestrial networks, more flexible functional sharing, and faster physical layer link switching.

[0051] Terrestrial communication systems and non-terrestrial communication systems can be considered subsystems of a communication system. Figure 5In the example shown, communication system 100 includes electronic devices (EDs) 110a, 110b, 110c, and 110d (generally referred to as ED 110), radio access networks (RANs) 120a and 120b, a non-terrestrial communication network 120c, a core network 130, a public switched telephone network (PSTN) 140, the Internet 150, and other networks 160. RANs 120a and 120b include corresponding base stations (BSs) 170a and 170b, which are generally referred to as terrestrial transmit and receive points (T-TRPs) 170a and 170b. The non-terrestrial communication network 120c includes access nodes 172, which are generally referred to as non-terrestrial transmit and receive points (NT-TRPs) 172.

[0052] Alternatively or additionally, any ED 110 can be used to connect, access, or communicate with any T-TRP 170a, 170b, NT-TRP 172, Internet 150, core network 130, PSTN 140, other network 160, or any combination thereof. In some examples, ED 110a can perform uplink and / or downlink transmissions with T-TRP 170a via terrestrial air interface 190a. In some examples, ED 110a, 110b, 110c, and 110d can also communicate directly with each other via one or more side-channel air interfaces 190b. In some examples, ED 110d can perform uplink and / or downlink transmissions with NT-TRP 172 via non-terrestrial air interface 190c.

[0053] Air interfaces 190a and 190b can use similar communication technologies, such as any suitable wireless access technology. For example, communication system 100 can implement one or more channel access methods in air interfaces 190a and 190b, such as code division multiple access (CDMA), space division multiple access (SDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), or single-carrier FDMA (SC-FDMA, also known as Discrete Fourier Transform spread OFDMA (DFT-s-OFDMA)). Air interfaces 190a and 190b can employ other higher-dimensional signal spaces, which may involve combinations of orthogonal and / or non-orthogonal dimensions.

[0054] The non-terrestrial air interface 190c enables communication between the ED 110d and one or more NT-TRP 172s via a wireless link or simply via a link. In some examples, the link is a dedicated connection for unicast transmission, a connection for broadcast transmission, or a connection between a group of ED 110s and one or more NT-TRP 172s for multicast transmission.

[0055] RANs 120a and 120b communicate with core network 130 to provide various services, such as voice, data, and other services, to EDs 110a, 110b, and 110c. RANs 120a and 120b and / or core network 130 may communicate directly or indirectly with one or more other RANs (not shown), which may or may not be directly served by core network 130, and may or may not use the same radio access technology as RANs 120a, RAN 120b, or both. Core network 130 may also serve as a gateway access between (i) RANs 120a and 120b or EDs 110a, 110b, and 110c, or both, and (ii) other networks (e.g., PSTN 140, Internet 150, and other networks 160). Furthermore, some or all of EDs 110a, 110b, and 110c may include the functionality to communicate with different wireless networks via different radio links using different radio technologies and / or protocols. ED 110a, 110b, and 110c can communicate with a service provider or exchange (not shown) via a wired communication channel and with the Internet 150, rather than wirelessly (or as a supplement to wireless communication). PSTN 140 may include a circuit-switched telephone network for providing plain old telephone service (POTS). The Internet 150 may include a network of computers and subnets (intranets) or both, and also includes protocols such as Internet Protocol (IP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP). ED 110a, 110b, and 110c may be multimode devices capable of operating according to various wireless access technologies, and also include multiple transceivers required to support these technologies.

[0056] Figure 3Another example of an ED 110 and base stations 170a, 170b, and / or 170c is shown. The ED 110 is used to connect people, objects, machines, etc. The ED 110 can be widely used in various scenarios, such as cellular communication, device-to-device (D2D), vehicle-to-everything (V2X), peer-to-peer (P2P), machine-to-machine (M2M), machine-type communications (MTC), Internet of Things (IoT), virtual reality (VR), augmented reality (AR), mixed reality (MR), metaverse, digital twin, industrial control, autonomous driving, telemedicine, smart grids, smart furniture, smart offices, smart wearables, smart transportation, smart cities, drones, robots, remote sensing, passive sensing, positioning, navigation and tracking, autonomous delivery and mobility, etc.

[0057] Each ED 110 represents any suitable end-user equipment for wireless operation and may include (or be referred to as): user equipment / device (UE), wireless transmit / receive unit (WTRU), mobile station, fixed or mobile subscriber unit, cellular phone, station (STA), machine-type communication (MTC) device, personal digital assistant (PDA), smartphone, laptop, computer, tablet, wireless sensor, consumer electronics, smartbook, vehicle, automobile, truck, bus, train, or IoT device, wearable device (e.g., watch, glasses, head-mounted device, etc.), industrial equipment, or devices comprising or including the above (e.g., communication module, modem, or chip), etc. Future generations of ED 110 may be referred to using other terms. Base stations 170a and 170b are T-TRPs, referred to below as T-TRP 170. Figure 3As shown, NT-TRP will be referred to as NT-TRP 172 below. Each ED 110 connected to T-TRP 170 and / or NT-TRP 172 can be dynamically or semi-statically enabled (i.e., established, activated, or enabled), disabled (i.e., released, deactivated, or disabled), and / or configured in response to one or more of connectivity availability and connectivity necessity.

[0058] ED 110 includes a transmitter 201 and a receiver 203 coupled to one or more antennas 204. Only one antenna 204 is shown in the figure to avoid congestion. One, some, or all of the antennas 204 may alternatively be panels. The transmitter 201 and receiver 203 may be integrated as a transceiver, etc. The transceiver is used to modulate data or other content for transmission through at least one antenna 204 or a network interface controller (NIC). The transceiver is also used to demodulate data or other content received by at least one antenna 204. Each transceiver includes any suitable structure for generating signals for wireless or wired transmission and / or processing signals received wirelessly or wiredly. Each antenna 204 includes any suitable structure for transmitting and / or receiving wireless or wired signals.

[0059] ED 110 includes at least one memory 208. Memory 208 stores instructions and data used, generated, or collected by ED 110. For example, memory 208 may store software instructions or modules executed by one or more processing units (e.g., processor 210) for implementing some or all of the functionality and / or embodiments described herein. Each memory 208 includes any suitable one or more volatile and / or non-volatile storage and retrieval devices. Any suitable type of memory can be used, such as random access memory (RAM), read-only memory (ROM), hard disk, optical disk, subscriber identity module (SIM) card, memory stick, secure digital (SD) memory card, and on-processor cache, etc.

[0060] ED 110 may also include one or more input / output devices (not shown) or interfaces (e.g., connected to or Figure 1(Wired interface of Internet 150 in the network). Input / output devices or interfaces support interaction with users or other devices in the network. Each input / output device or interface includes any suitable structure for providing or receiving information from the user and / or for network interface communication. Suitable structures include, for example, speakers, microphones, keypads, keyboards, displays, touchscreens, etc.

[0061] ED 110 includes a processor 210 for performing the following operations: operations related to preparing to transmit uplink transmissions to NT-TRP 172 and / or T-TRP 170; operations related to processing downlink transmissions received from NT-TRP 172 and / or T-TRP 170; and operations related to processing sidelink transmissions transmitted to and from other ED 110s. Processing operations related to preparing for uplink transmissions may include operations such as encoding, modulation, transmit beamforming, and symbol generation for transmission. Processing operations related to processing downlink transmissions may include operations such as receive beamforming, demodulation, and decoding of received symbols. According to an embodiment, the downlink transmission may be received by receiver 203 possibly using receive beamforming, and processor 210 may extract signaling from the downlink transmission (e.g., by detecting and / or decoding signaling). For example, an example of signaling may be a reference signal transmitted by NT-TRP 172 and / or T-TRP 170. In some embodiments, processor 210 performs transmit beamforming and / or receive beamforming based on beam direction indications (e.g., beam angle information (BAI)) received from T-TRP 170. In some embodiments, processor 210 may perform operations related to network access (e.g., initial access) and / or downlink synchronization, such as operations related to detecting synchronization sequences, decoding, and acquiring system information. In some embodiments, processor 210 may perform channel estimation using reference signals received from NT-TRP 172 and / or T-TRP 170.

[0062] Processor 210 may be part of transmitter 201 and / or receiver 203, but is not shown in the figures. Although not shown, memory 208 may be part of processor 210.

[0063] The processing components in processor 210, transmitter 201, and receiver 203 can be implemented by the same or different one or more processors, which execute instructions stored in memory (e.g., memory 208). Alternatively, some or all of the processing components in processor 210, transmitter 201, and receiver 203 can be implemented using hardware accelerators such as a programmable field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), graphics processing unit (GPU), or artificial intelligence (AI) accelerator.

[0064] In some implementations, the T-TRP 170 can use other names, such as base station, base transceiver station (BTS), wireless base station, network node, network device, network-side device, transmit / receive node, Node B, evolved NodeB (eNodeB or eNB), home eNodeB, next-generation NodeB (gNB), transmission point (TP), site controller, access point (AP), wireless router, relay station, ground node, ground network device, ground base station, base band unit (BBU), remote radio unit (RRU), active antenna unit (AAU), remote radio head (RRH), central unit (CU), distributed unit (DU), location node, etc. The T-TRP 170 can be a macro BS, pico BS, relay node, host node, or a combination thereof. T-TRP 170 may refer to the aforementioned equipment or to a device within the aforementioned equipment (e.g., a communication module, modem, or chip).

[0065] In some embodiments, the various parts of T-TRP 170 may be distributed. For example, some of the modules of T-TRP 170 may be located at the far end of the device housing the antenna 256 of T-TRP 170 and may be coupled to the device housing the antenna 256 via a communication link (not shown) sometimes referred to as a fronthaul (e.g., a common public radio interface (CPRI)). Therefore, in some embodiments, the term T-TRP 170 may also refer to network-side modules that perform processing operations such as determining the location of ED 110, resource allocation (scheduling), message generation, and encoding / decoding, which are not necessarily part of the device housing the antenna 256 of T-TRP 170. These modules may also be coupled to other T-TRPs. In some embodiments, T-TRP 170 may actually be multiple T-TRPs that operate together (e.g., by using coordinated multicast) to serve ED 110.

[0066] T-TRP 170 includes at least one transmitter 252 and at least one receiver 254 coupled to one or more antennas 256. Only one antenna 256 is shown in the figure to avoid congestion. One, some, or all of the antennas 256 may alternatively be panels. The transmitter 252 and receiver 254 may be integrated as a transceiver. T-TRP 170 also includes a processor 260 for performing operations including operations related to: preparing transmission for downlink transmission to ED 110, processing uplink transmission received from ED 110, preparing transmission for backhaul transmission to NT-TRP 172, and processing transmission received from NT-TRP 172 via backhaul. Processing operations related to preparing transmission for downlink or backhaul transmission may include operations such as encoding, modulation, precoding (e.g., multiple input multiple output (MIMO) precoding), transmit beamforming, and symbol generation for transmission. Processing operations related to receiving or backhauling transmissions in the uplink may include receive beamforming, demodulating received symbols, and decoding received symbols. Processor 260 may also perform operations related to network access (e.g., initial access) and / or downlink synchronization, such as generating the contents of a synchronization signal block (SSB), generating system information, etc. In some embodiments, processor 260 may also generate indications, such as a beam direction (BAI), that scheduler 253 can schedule for transmission. Processor 260 performs other network-side processing operations described herein, such as determining the location of ED 110, determining the deployment location of NT-TRP 172, etc. In some embodiments, processor 260 may generate signaling, for example, to configure one or more parameters of ED 110 and / or one or more parameters of NT-TRP 172. Any signaling generated by processor 260 is transmitted by transmitter 252. It should be noted that the term "signaling" as used herein may alternatively be referred to as control signaling. Signaling can be transmitted in physical layer control channels such as the physical downlink control channel (PDCCH). In this case, the signaling can be called dynamic signaling. Signaling transmitted in the downlink physical layer control channel is called downlink control information (DCI). Signaling transmitted in the uplink physical layer control channel is called uplink control information (UCI). Signaling transmitted in the sidelink physical layer control channel is called sidelink control information (SCI).Signaling can be included in higher-layer (e.g., above the physical layer) data packets transmitted over physical layer data channels such as the Physical Downlink Shared Channel (PDSCH). In this case, the signaling can be referred to as higher-layer signaling, static signaling, or semi-static signaling. Higher-layer signaling can also refer to Radio Resource Control (RRC) protocol signaling or Media Access Control-Control Element (MAC-CE) signaling.

[0067] Scheduler 253 may be coupled to processor 260. Scheduler 253 may be included within T-TRP 170 or may operate separately from T-TRP 170. Scheduler 253 may schedule uplink, downlink, lateral link, and / or backlink transmissions, including issuing scheduling authorizations and / or configuring unscheduled (e.g., “configured authorizations”) resources. T-TRP 170 also includes memory 258 for storing information and data. Memory 258 stores instructions and data used, generated, or collected by T-TRP 170. For example, memory 258 may store software instructions or modules executed by processor 260 for implementing some or all of the functionality and / or embodiments described herein.

[0068] Although not shown, processor 260 may be part of transmitter 252 and / or receiver 254. Furthermore, although not shown, processor 260 may implement scheduler 253. Although not shown, memory 258 may be part of processor 260.

[0069] The processing components of processor 260, scheduler 253, transmitter 252, and receiver 254 may each be implemented by the same or different one or more processors for executing instructions stored in memory (e.g., memory 258). Alternatively, some or all of the processing components in processor 260, scheduler 253, transmitter 252, and receiver 254 may be implemented using dedicated circuitry such as a programmable FPGA, hardware accelerator (e.g., GPU or AI accelerator), or ASIC.

[0070] Although the NT-TRP 172 is illustrated only as a drone, it can be implemented in any suitable non-terrestrial form, such as satellites and high-altitude platforms, including international mobile communication base stations and unmanned aerial vehicles. Furthermore, in some implementations, the NT-TRP 172 may be referred to by other names, such as a non-terrestrial node, a non-terrestrial network device, or a non-terrestrial base station. The NT-TRP 172 includes a transmitter 272 and a receiver 274 coupled to one or more antennas 280. Only one antenna 280 is shown in the figure to avoid congestion. One, some, or all of the antennas may alternatively be panels. The transmitter 272 and receiver 274 can be integrated into a transceiver. NT-TRP 172 also includes a processor 276 for performing operations related to: preparing transmissions for downlink transmissions to ED 110, processing uplink transmissions received from ED 110, preparing transmissions for backhaul transmissions to T-TRP 170, and processing transmissions received from T-TRP 170 via backhaul. Processing operations related to preparing transmissions for downlink or backhaul transmissions may include operations such as encoding, modulation, precoding (e.g., MIMO precoding), transmit beamforming, and symbol generation for transmission. Processing operations related to processing transmissions received in the uplink or via backhaul may include operations such as receive beamforming, demodulating received symbols, and decoding received symbols. In some embodiments, processor 276 performs transmit beamforming and / or receive beamforming based on beam direction information (e.g., BAI) received from T-TRP 170. In some embodiments, processor 276 may generate signaling, for example, to configure one or more parameters of ED 110. In some embodiments, the NT-TRP 172 implements physical layer processing but not higher-level functions such as medium access control (MAC) or radio link control (RLC) layer functions. Since this is merely an example, the NT-TRP 172 may more generally implement higher-level functions in addition to physical layer processing.

[0071] The NT-TRP 172 also includes a memory 278 for storing information and data. Although not shown, a processor 276 may be part of the transmitter 272 and / or the receiver 274. Although not shown, the memory 278 may be part of the processor 276.

[0072] The processing components of processor 276, transmitter 272, and receiver 274 may each be implemented by the same or different one or more processors for executing instructions stored in memory (e.g., memory 278). Alternatively, some or all of the processing components in processor 276, transmitter 272, and receiver 274 may be implemented using dedicated circuitry such as a programmable FPGA, hardware accelerator (e.g., GPU or AI accelerator), or ASIC. In some embodiments, NT-TRP 172 may actually be multiple NT-TRPs that operate together (e.g., through coordinated multipoint transmission) to serve ED 110.

[0073] T-TRP 170, NT-TRP 172 and / or ED 110 may include other components, but for clarity these components have been omitted.

[0074] One or more steps of the methods in the embodiments provided herein can be derived from... Figure 4 The corresponding unit or module is executed. Figure 4 Units or modules in the device are shown, such as in ED 110, T-TRP 170, or NT-TRP 172. For example, signals may be transmitted by a transmitting unit or a transmitting module. Signals may be received by a receiving unit or a receiving module. Signals may be processed by a processing unit or a processing module. Other steps may be performed by an artificial intelligence (AI) module or a machine learning (ML) module. The corresponding units or modules may be implemented using hardware, one or more components or devices executing software, or a combination thereof. For example, one or more of these units or modules may be circuits such as integrated circuits. Examples of integrated circuits include programmable FPGAs, GPUs, or ASICs. For example, one or more of these units or modules may be logical, such as logical functions executed by circuits, a portion of an integrated circuit, or software instructions executed by a processor. It should be understood that if these modules are implemented using software executed by a processor, etc., then these modules may be retrieved by the processor, in whole or in part, individually or collectively, for processing, in one or more instances, and these modules themselves may include instructions for further deployment and instantiation.

[0075] Additional details regarding ED 110, T-TRP 170, and NT-TRP 172 are known to those skilled in the art. Therefore, these details are omitted herein.

[0076] The technical solutions described in this application are applicable to next-generation (e.g., 6G or higher) networks, or older (e.g., 5G or 4G) networks.

[0077] The proposed 6G system architecture supports 6GXaaS services through technologies such as network function virtualization and network slicing. The 6G system architecture employs a service-based interaction mechanism between 6G services.

[0078] 6G systems adopt a service-based architecture and the XaaS concept. XaaS services in 6G systems are divided into three layers. The conceptual structure of a 6G system is as follows: Figure 5 As shown.

[0079] The infrastructure layer includes the infrastructure that supports 6G services. This includes wireless network infrastructure (e.g., RAN, CN), cloud / data center infrastructure, satellite networks, storage / database infrastructure, sensing networks, etc. This infrastructure can be provided by a single provider or by multiple providers.

[0080] Each piece of infrastructure can have its own control and management functions, represented as control and management (C / M) functions for infrastructure management. Each of these pieces of infrastructure is a type of Infrastructure as a Service.

[0081] The C / M layer includes control and management services for 6G systems. These services are developed and deployed using slicing technology and leveraging resources provided by the infrastructure layer. 6G services in the C / M layer may include: Resource management (RM) as a service provides the ability to manage the lifecycle of various slices and allocate over-the-air resources to wireless devices; -6G tasks are defined as services provided to customers by the 6G system. A task can be a type of service provided by a single 6G XaaS service, or a type of service that requires contributions from multiple XaaS services.

[0082] - Mission management (MM) refers to the ability of a service provider to programmatically provide XaaS services in the service layer to provide mission services.

[0083] - The Confederation Network (CONET) as a Service provides the ability for multiple partners to jointly offer 6G services. This capability is provided through consortium formation, mutual authentication and authorization among partners, and protocol negotiation regarding the recording and traceability of selected actions performed by partners, ensuring a trusted environment for the operation of 6G systems.

[0084] Service provisioning management (SPM) refers to the ability to control and manage a customer's access to 6G services and provide requested services. This capability can be provided through unified mutual authentication, authorization and policies, key management, quality of service (QoS) guarantees, and billing between any pair of XaaS service providers and customers. These customers include not only end customers in the physical world but also digital representatives in the digital world.

[0085] - Connectivity management (CM) as a service utilizes 5G connectivity management capabilities, but extends to include the digital world.

[0086] Protocol as a Service (PCA) provides the ability to design customized protocol stacks for identified interfaces.

[0087] These protocol stacks can be predefined for selection on demand, or designed on demand.

[0088] - Cybersecurity as a Service provides infrastructure owners with the ability to detect potential security risks to their infrastructure.

[0089] XaaS services in the C / M layer support both the control and management of the 6G system itself and provide support to vertical industries upon request. For example, RM services can provide air resource management for the RAN and also provide services to vertical industries to enable them to allocate air resources to their end customers. XaaS in the C / M layer can be deployed using slicing technology.

[0090] The service layer includes 6G services provided to customers. In the conceptual architecture of a 6G system: - AI services are represented as NET4AI as a Service. Artificial intelligence services provide AI capabilities to support a wide range of AI applications.

[0091] The service of data collection, data cleaning, data analysis, and data delivery is referred to as DAM as a service. This service provides the ability to manage the lifecycle of statistical data, including data acquisition, de-identification, analysis, and delivery of information statistics from any type of sensor, device, and network function.

[0092] - Data storage and sharing services can be represented as NET4Data as a Service, which provides the ability to reliably store and share data under the control of the data owner and in accordance with the regulations of the authoritative body regarding the control of identified data.

[0093] Providing services for the digital world can be represented as NET4DW as a Service. Digital world services provide the ability to build, control, and manage the digital world. The digital world is defined as the digital realization of the physical world.

[0094] - 6G blockchain service is represented as NET4BC as a service. 6G connectivity service is represented as NET4Con as a service. This service provides the capability to support 6G blockchain services.

[0095] - Enhanced connectivity services, such as network for connectivity (NET4CON) as a service. This service provides the ability to exchange messages and data between supporting new 6G services.

[0096] All XaaS services in this layer utilize resources provided within the infrastructure and are developed and deployed using network function virtualization and slicing technologies. The capabilities of each service in 6G services are provided by its control and management functions, as well as service-specific data processing functions.

[0097] In addition to supporting 6G XaaS services in the service layer, the 6G system also utilizes the 5G system to provide vertical services. The difference between 6G XaaS services and other vertical industries is that vertical industries are purely customers who require other XaaS services to support their operation, while each service in the XaaS provides its capabilities to the 6G customer.

[0098] Any pair of XaaS services in a 6G system can also be customer and provider to each other. For example, the infrastructure owner provides its resources to XaaS services in the service layer and the C / M layer; the RM service may need the capabilities provided by NET4AI, DAM, and NET4DW when managing resources for vertical slices; and the operation of the CONET service and the NET4Data service may need the capabilities provided by NET4BC.

[0099] Key concepts of 6G systems may include: - Define the basic XaaS service by decoupling various integrated services from the basic XaaS service. The basic XaaS service provides unique capabilities to support specific types of services, such as NET4AI service, NET4DW service, DAM service, NET4Data service, blockchain service, task management service, etc.

[0100] - Allows multiple partners to jointly operate the 6G system.

[0101] - Define the data plane of the 6G system, including the data plane processing functions of XaaS services. Programming the interconnection of these functions through task management services enables support for various customized customer services.

[0102] - By classifying basic control and management services and combining these services into basic XaaS services in the control and management (C / M) layer, the 6G system architecture is simplified.

[0103] - Define the C / M plane of the 6G system, which includes C / M functionality in XaaS services and may include 5G CP (e.g., AMF) depending on the implementation options.

[0104] - Define a basic architecture structure (BAS), which is a unified infrastructure with a minimal number of interfaces and is independent of the infrastructure type.

[0105] - Use the BAS concept to simplify the standardization, development and deployment of 6G systems, while supporting various infrastructure deployment scenarios.

[0106] -By applying BAS or a subset thereof to the infrastructure based on the capabilities, capacity, and requirements of the infrastructure network, it can be adapted to various deployment scenarios.

[0107] -Utilize the SBI interface concept and apply SBI interaction to both the 6G C / M plane and the 6G data plane.

[0108] -Simplify the SBI interface by introducing a trusted GW on the data plane and C / M plane of the 6G system.

[0109] - By introducing CONET capabilities, NET4BC capabilities, and the anonymity services provided by trusted GWs on the C / M plane and data plane of the 6G system, trustworthiness is improved from the perspective of 6G system operation.

[0110] - Enhance trustworthiness from the perspective of end-customer privacy protection by providing unified mutual authentication, IDM, and data cleansing through SPM service, DAM service, and 6G blockchain service.

[0111] - Simplify roaming management of wireless devices in the physical and digital worlds through unified authentication that includes all participating partners and customers.

[0112] - By introducing the BAS concept, multiple architectural options can be defined without investing a lot of effort, supporting multiple development paths from 5G systems to 6G systems.

[0113] - Backward compatibility is supported by leveraging the advantages of SBA and its additional features. 5G users can access 5G services using 6G systems.

[0114] - Thanks to the concept of anonymous service provision implemented in the trusted GW of the 6G C / M plane and 6G data plane, future expansion can be supported by adding new XaaS services while minimizing the impact on standardization and deployment.

[0115] This section first introduces relevant technologies and concepts to better understand the technical solution proposed in this application.

[0116] This application focuses on user identification when a user requests a service over a network. It assumes that the user subscribed to the service with the assistance of a third party or the network.

[0117] Cloud-based storage services have become an outsourcing solution for individuals and organizations to share data digitally. Despite these advantages, users must rely on storage services, data access controls, user privacy, and data availability to ensure data confidentiality. While advanced encryption algorithms can protect data confidentiality, cloud-based servers can retrieve shared encryption keys and possess knowledge of the data. More importantly, services typically know the user's identity to verify their eligibility to access the requested data according to access controls, thus ensuring user traceability within the data storage system. Crucially, the lack of anonymity may discourage users from using such services in sensitive contexts. It should be noted that cloud-based storage services are merely one example of scenarios where user ID privacy is a concern.

[0118] Figure 6This scenario describes a general-purpose data storage system. Such a system provides data storage services. This data can be private, confidential, public, etc. The system includes data service management, data service profile management, data service provider (SP) and identifier management (IDM) functions. These functions are deployed by different providers. The data service management function is responsible for service selection, service session creation, and service session release. The data service profile management function manages service profiles. The data service provider (SP) provides services to users. The IDM function is responsible for ID mapping, storing credentials for IDs used for authentication. To prevent users from being tracked by different providers, temporary IDs are assigned to users. These temporary IDs are used to communicate with different entities or functional groups (NFs). For example, in the data service management function, ID2 is assigned to a user for communication; in the data service profile management function, ID1 is assigned to a user for communication; in data SP1, ID3 is assigned to a user for communication; and in data SP2, ID5 is assigned to a user for communication. These temporary IDs are stored in the IDM function and cannot be accessed by the data service management function, the data service configuration file management function, or the data SP link.

[0119] A user's real ID is stored in the IDM (Integrated Device Manager) function, but the IDM function is interested in what services the user has subscribed to. The Data Service Management function faithfully executes the service delivery process and responds to user requests, but is interested in the user's privacy (e.g., the user's real identity). The Data Service Profile Management function can send fake service subscriptions to mislead the Data Service Management function, which is also interested in the user's privacy (e.g., the user's real identity). Data Service Providers (SPs) are interested in users who frequently access their services. Data SPs can be trusted to provide services to users. Data SPs can offer different services to users. Specific services can be provided by different providers.

[0120] like Figure 6As shown, a user requests a service from the data service management function using ID2. The data service management function can identify the user's ID2 and the service ID of the service. The data service management function then sends a request to the data service profile management function using the user's ID2 and service ID. The data service profile management function cannot identify the user's ID2, so it sends an ID mapping request to the IDM function using the user's ID2. The IDM function sends the user's ID1 back to the data service profile management function. Subsequently, the data service profile management function checks the user's service profile and sends back an instruction on access permissions for the service. Then, the data service management function sends a request to the data SP using the user's ID2 and service ID. Similarly, the data SP sends an ID mapping request to the IDM function using the user's ID2 and obtains the user's ID3. The data SP identifies the user based on ID3 and provides the service to the user.

[0121] In some cases, the data service management function sends an ID mapping request to the IDM function, which includes ID2, the ID of the data service profile management function, and the ID of the data SP. In this case, the data service management function obtains ID1 and ID3 from the IDM function. Next, the data service management function sends a request to the data service profile management function through ID1 and the service ID, and obtains an instruction for access to the service. Subsequently, the data service management function sends a request to the data SP through ID3 and the service ID, and the data SP provides services to the user. Temporary IDs are used to protect the user's ID privacy, but the technical solution of using temporary IDs when identifying users still has the following problems: (1) the linkability (or traceability) of temporary IDs may leak the user's ID privacy; (2) since the data SP is not able to verify the instruction, the data service profile management function can send false instructions for access to the service.

[0122] To address these issues, this application provides a method that enables entities to identify users using distinct temporary IDs while protecting user ID privacy. Furthermore, this method can also protect service privacy.

[0123] The method proposed in this application can be used in systems that include IDM functionality, a first network function, a second network function, and a third network function. The system may also include other network functions, such as a service log server, without limitation.

[0124] The responsibilities of these network functions are as follows.

[0125] The first network function is responsible for: service identification; service session management, such as service session creation and service session termination; and establishing or configuring secure tunnels between users and service providers (in this application, the third network function is referred to as the third network function).

[0126] The second network function is responsible for: user subscription and registration; maintaining a list of user service profiles; user identification and verification of users and services; and constructing the fifth piece of information, which will be described in detail in the following embodiments.

[0127] The third network function is responsible for: user identification; service permission determination, indicating whether the user has permission to access the requested service; and service provision.

[0128] The IDM function is responsible for: maintaining ID configuration files; ID mapping; and constructing first and second information, which are described in detail in the following embodiments.

[0129] In other words, the first network function is responsible for service management, the second network function is responsible for managing service configuration files, and the third network function is responsible for providing services to users.

[0130] This application focuses on user identification when a user requests services in a future network. In this patent, it is assumed that the user subscribes to the service through a third party or network. The key technologies are as follows: (1) To avoid the traceability of the user ID, temporary IDs are used by different providers. (2) To prevent the temporary ID from being linked to a specific user, user identification materials replace the temporary ID for communication. (3) We decouple the service from the user ID, thereby protecting service privacy and ID privacy. (4) We use service permission identification materials to ensure that the user subscribes to the service from the data SP.

[0131] The basic concept of this application is a method that enables entities to identify users through different temporary IDs while protecting user ID privacy. In this concept, info1 replaces ID1, info2 replaces ID3, and info3 replaces ID2. In other words, info1 is used for user identification by data service profile management during communication between data service management and data service profile management; info2 is used for user identification by data SP during communication between data service management and data SP; and info3 is used during communication between data service management and data service profile management.

[0132] The proposed method can be applied to two different scenarios, where user identification can be triggered by either a first network function or a second network function. The following example uses a cloud-based storage system to illustrate these two scenarios. In this example, the first network function can be a data service management function, the second network function can be a data service configuration file management function, and the third network function can be a data service provider (SP).

[0133] To describe the proposed technical solution, for the sake of brevity, the information or parameters used in the following embodiments will be introduced first. Details regarding the information or parameters can be described in the following embodiments.

[0134] (1) Information 1 (simplified as info1 in the following examples) info1 is generated by the IDM function using the first algorithm represented by algorithm_info1. The inputs used to generate info1 include information known only to the IDM function and the data service profile management function (such as the device's ID1), or information provided by the data service profile management function. The output of algorithm_info1 is info1.

[0135] (2) Information 2 (simplified as info2 in the following examples) info2 is generated by the IDM function using a second algorithm represented by algorithm_info2. The input used to generate info2 includes all the IDs of the devices in at least one data SP. The output of algorithm_info2 is a polynomial function.

[0136] (3) Information 3 (simplified as info3 in the following embodiments) info3 is generated by the Data Service Management function using a third algorithm represented by algorithm_info3. The input used to generate info3 includes information known only to the Data Service Management function and the IDM function. The output of algorithm_info3 is info3.

[0137] (4) Information about the data owner (simplified as info_data_owner in the following examples) The `info_data_owner` is generated by the IDM using `algorithm_info_data_owner`. The inputs for generating `info_data_owner` include all IDs of the data owners in at least one data SP. The output of `algorithm_info_data_owner` is a polynomial function. `info_data_owner` is used for user identification of the data owner, implemented by the third network function, during communication between the first and third network functions.

[0138] (5) Info5 (simplified as info5 in the following examples) info5 is generated by the data service profile management function using the fifth algorithm represented by algorithm_info5. The inputs used to generate info5 include information known only to the data service profile management function and the data service provider (SP).

[0139] The details of how to calculate the above information will be described in the following embodiments.

[0140] The service configuration file includes one or more information elements, as shown in Table 1. The service configuration file is stored in the data service configuration file management function.

[0141] Table 1

[0142] In addition, the ID profile includes one or more information elements, as shown in Table 2. The ID profile is stored in the IDM function.

[0143] Table 2

[0144] The service_log configuration file includes one or more information elements, as shown in Table 3.

[0145] Table 3

[0146] In this embodiment, it is assumed that the services are deployed by different providers. Each service provider can provide a set of services. Users have different temporary IDs under different domains. Users have subscribed to the services through the data service profile management function, which stores the user's service profile.

[0147] In this application, the requirements for info1, info2 and info3 are as follows: info1 is used for communication between data service management functions and data service configuration file management. info1 can be identified by data service management functions, but not by data service management functions and data service providers (SPs). info2 is used for communication between the data service management function and the data service provider (SP). info2 can be identified by the data SP, but not by the data service management function or the data service configuration file management function. info3 is used for communication between data service management functions and data service configuration file management functions. info3 can be identified by IDM, but not by data service configuration file management functions or data SP.

[0148] The presence of shared information between info1 and info2 prevents the data service configuration file management function from sending false instructions regarding access permissions to the service.

[0149] Furthermore, the above information is constructed as follows.

[0150] (1) info1 - Generated by IDM using algorithm_info1.

[0151] - Input: Information is known only by IDM and data service configuration files, for example, ID1.

[0152] Output: info1.

[0153] (2) info2 - Generated by IDM using algorithm_info2.

[0154] - Input: All IDs linked to a specific user.

[0155] Output: polynomial function info2.

[0156] (3) info5 - Generated using algorithm_info5 by the data service configuration file management.

[0157] - Input: Information is known only to the data service configuration file manager and the data SP.

[0158] Output: info5.

[0159] (4) info3 - Generated using algorithm_info3 by the data service management function.

[0160] - Input: Information is known only to the data service management function and IDM.

[0161] Output: info3.

[0162] (5) User identification of info1 performed by data service configuration file management - Use algorithm_info1 to calculate the value.

[0163] - Input: Information is known only by IDM and data service configuration files, for example, ID1.

[0164] - Compare this value with info1.

[0165] (6) User identification of info2 performed by data SP - Use algorithm_info2 to compute polynomial functions.

[0166] - Input: User ID from data SP.

[0167] Output: 1 or 0.

[0168] (7) User identification of info5 performed by data SP - Use algorithm_info5 to calculate the value.

[0169] - Input: Information is known only to the data service configuration file manager and the data SP.

[0170] - Compare this value with info5.

[0171] (8) User identification of info3 performed by IDM - Use algorithm_info3 to calculate the value.

[0172] - Input: Information is known only to the data service management function and IDM.

[0173] - Compare this value with info3.

[0174] Existing technologies provide technical solutions for data storage services that use encryption algorithms to protect data confidentiality. However, services typically know the user's identity to verify their eligibility to access requested data based on access controls, thus ensuring user traceability within the data storage system. Temporary IDs are used for user privacy protection, but these temporary IDs can be linked to specific users, thereby leaking user ID privacy. Therefore, a system and method for user identification in data storage services are provided, wherein network functions or entities can identify users through different temporary IDs, while these network functions or entities cannot link temporary IDs to specific users.

[0175] Figure 7This scenario involves user authentication triggered by the data service management function. In this scenario, the data service management function sends an ID mapping request to the IDM function. The data service management function retrieves info1 and info2 from the IDM function. info1 is used for user authentication implemented by the data service profile management function during communication between the data service management function and the data service profile management function. info2 is used for user authentication implemented by the data SP during communication between the data service management function and the data SP. The data service management function sends a request to the data service profile management function using info1 and the service ID to obtain an indication of permission to access the service. Subsequently, the data service management function sends a request to the data SP using info2 and the service ID, and then the data SP provides the service to the user. The aforementioned issues can be resolved using info1 and info2.

[0176] Figure 7 The details of the method flow shown are below. Figure 8 The information is provided in the text.

[0177] Figure 8 This is a schematic flowchart of a communication method according to some embodiments of this application.

[0178] In step 301, the first network function sends a first message to the IDM function.

[0179] Accordingly, the IDM function receives the first message from the first network function.

[0180] For example, the first network function could be Figure 7 The data service management function in the middle, the second network function can be Figure 7 The data service configuration file management function in the system.

[0181] The first message is used to request ID mapping. The first message includes the device's second ID, such as ID2. The first message may also include the ID of a second network function.

[0182] In step 302, the IDM obtains the device's first ID based on the second ID and the ID of the second network function. The IDM also obtains first information (info1 in some embodiments) based on a first algorithm and second information (info2 in some embodiments) based on a second algorithm.

[0183] The first information is used for user identification implemented by the second network function during communication between the first network function and the second network function. The first information is obtained by the IDM function based on a first algorithm and information known only to the IDM function and the second network function. For example, the information known only to the IDM function and the second network function may include the device's first ID or a random number generated by the second network function.

[0184] Therefore, the IDM obtains the first information based on the first algorithm and the first ID, or the IDM obtains the first information based on the first algorithm and information provided by the second network function (such as a random number generated by the second network function).

[0185] The first piece of information can be identified through the second network function, but not through the first and third network functions.

[0186] The second information is used for user identification implemented by the third network function during communication between the first network function and the third network function. The second information is obtained by the IDM function based on a second algorithm and one or more IDs of a device in at least one third network function, such as ID3 in third network function 1 (e.g., ID3 in data SP1) and ID5 in third network function 2 (e.g., ID5 in data SP2). The second information can be identified by the third network function but not by the first or second network functions. For example, the third network function could be... Figure 7 Data SP in the middle.

[0187] Because there is common information between the first and second information, the second network function (e.g., data service configuration file management) is unable to send false instructions regarding access to the service.

[0188] In step 303, the IDM function sends a second message to the first network function. The first network function receives the second message from the IDM function.

[0189] The second message includes the first information, the second information, the ID of the first algorithm, and the ID of the second algorithm.

[0190] In step 304, the first network function sends a third message to the second network function. The second network function receives the third message from the first network function.

[0191] The third message is a request for services for the device, and includes the first information, the ID of the first algorithm, and the service ID. The service ID is obtained by the first network function based on the service request included in the message from the device.

[0192] In step 305, the second network function performs user identification, device and service verification, service permission determination (or service permission identification), and calculation of the fifth information.

[0193] Specifically, user identification is performed by comparing the received first information with a first value. The first value is calculated by the second network function using a first algorithm and information known only to the second network function and the IDM function (e.g., a first ID). The second network function compares the first value with the first information. If the first value and the first information are the same, user identification is successful; otherwise, user identification fails. Furthermore, the second network function verifies the device and service based on service credentials stored in the second network function.

[0194] Service permission determination is performed by checking the device's service profile against the service ID. If this fails, the second network function sends a service denial indication for the device to access the service.

[0195] Assuming user identification, authentication, and service authorization determination are all successful, the second network function calculates the fifth information based on the fifth algorithm and information known only to the second and third network functions (e.g., the service profile ID known to the second and third network functions). In other words, the fifth information is obtained based on publicly available information between the second and third network functions. The fifth information is used by the third network function for service authorization determination. In some embodiments, the fifth information may be the service profile ID, or it may be information derived from the service profile ID, such as encrypted version of the service profile ID.

[0196] In step 306, the second network function sends a fourth message to the first network function. The first network function receives the fourth message from the second network function.

[0197] The fourth message is a response to the third message and indicates the device's service access permissions. The fourth message includes the fifth information and the ID of the fifth algorithm.

[0198] In step 307, the first network function sends a fifth message to the third network function. The third network function receives the fifth message from the first network function.

[0199] The fifth message is used to request the service and includes the second message, the fifth message, the service ID, the ID of the second algorithm, and the ID of the fifth algorithm.

[0200] In step 308, the third network function performs user identification and service permission determination, and provides services to the device.

[0201] Specifically, the third network function performs user identification based on the second information, the second algorithm included in the fifth message, and the device ID in the third network function. The third network function uses the device ID as input, employs the second algorithm to compute a polynomial function, and outputs either 1 or 0. For example, an output of 1 indicates successful user identification, while an output of 0 indicates failure.

[0202] Furthermore, the third network performs service permission determination by comparing the fifth information included in the fifth message with the second value. The second value is calculated by the third network function based on the fifth algorithm and information known only to the second and third network functions. If the second value is the same as the received fifth information, the third network function allows the device to access the service. Otherwise, the third network function does not allow the device to access the service.

[0203] The first network function, the second network function, and the third network function are provided by different providers.

[0204] Assuming that user identification and service authorization are both successful, the third network function provides the service to the device.

[0205] Figure 9 This scenario involves user identification triggered by the data service configuration file management function. In this scenario, the data service management generates an info3 that can be identified by the IDM function and sends a request to the data service configuration file management function using info3 and the service ID. The data service configuration file management function sends an ID mapping request to the IDM function using info3 and ID1, and obtains info2, which is used by the data service provider (SP) to identify the user. Subsequently, the data service management function sends a request to the data SP using info2 and the service ID, and then the data SP provides services to the user. The use of info2 and info3 can solve this problem.

[0206] Figure 9 The details of the method flow shown are below. Figure 10 The information is provided in the text.

[0207] Figure 10 This is a schematic flowchart of a communication method according to some embodiments of this application.

[0208] In step 401, the first network function sends a first message to the second network function. Correspondingly, the second network function receives the first message from the first network function.

[0209] For example, the first network function could be Figure 9 The data service management function in the middle, the second network function can be Figure 9 The data service configuration file management function in the system.

[0210] The first message includes third information (info3 in some embodiments), the ID of the third algorithm used to generate info3, and a service ID. The third information is generated by the first network function using the third algorithm based on information known only to the first network function and the IDM function (e.g., the device's second ID).

[0211] The third information is used for communication between the first network function and the second network function. The third information can be identified by the IDM function, but cannot be identified by the second network function and the third network function.

[0212] In step 402, the second network function sends a second message to the IDM function, which includes the third information and the ID of the third algorithm.

[0213] The IDM function receives a second message from the second network function.

[0214] In step 403, the IDM function performs user identification and ID mapping, and calculates the second information (info2).

[0215] Specifically, the IDM function performs user identification by comparing a third value with third information included in the second message. The IDM function uses a third algorithm and information known only to the first network function and the IDM function to calculate the third value and obtain the device's second ID. Furthermore, the IDM obtains the device's first ID (ID1) based on the device's second ID. The IDM function calculates second information based on the second algorithm and one or more IDs of the device from at least one third network function (data SP). This second information is used for user identification implemented by the third network function.

[0216] In step 404, IDM sends a third message to the second network function. The second network function receives the third message from the second network function.

[0217] The third message includes the second information, the ID of the second algorithm, and the first ID of the device.

[0218] In step 405, the second network function performs service permission determination, verifies the device and services, and generates the fifth information.

[0219] The second network function performs service permission determination by checking the service profile based on the service ID. The second network function also performs authentication of the device and services based on service credentials stored in the second network function. The second network function generates fifth information for use by the third network function in service permission determination. This fifth information is generated using a fifth algorithm based on common information between the second and third network functions. The fifth information can be the service profile ID or information derived from the service profile ID.

[0220] In step 406, the second network function sends a fourth message to the first network function. The first network function receives the fourth message from the second network function.

[0221] The fourth message includes the second information, the fifth information, the ID of the second algorithm, and the ID of the fifth algorithm.

[0222] In step 407, the first network function sends a fifth message to the third network function. The fifth message includes the second information, the ID of the second algorithm, the fifth information, the ID of the fifth algorithm, and the service ID.

[0223] The third network function receives the fifth message from the first network function.

[0224] In step 408, the third network function performs user identification and service permission determination, and provides services to the device.

[0225] The third network function performs user identification based on the second information and the second algorithm. Specifically, the third network function takes the device ID (e.g., the device's third ID, ID3) as input, uses the second algorithm to calculate a polynomial function, and outputs 1 or 0. If the output is 1, it indicates successful user identification; if the output is 0, it indicates failure. The third network function performs service permission determination by comparing the second value with the received fifth information. The second value is calculated using the fifth algorithm and information known only to the second and third network functions.

[0226] Assuming that user identification and service authorization are both successful, the third network function provides services to the device.

[0227] It should be noted that, Figure 7 or Figure 9 The names of entities or NFs can be other names. The above technical solutions can be used in other services, not limited to data storage services. Therefore, data service management functionality can be service management functionality, and the service can be data storage service or billing service, etc. Data service configuration file management functionality can be service configuration file management functionality; for example, if a billing service is used, it applies not only to service configuration files but also to billing policies. A data service provider (SP) can be a function that provides services to users.

[0228] This application aims to provide a method that enables entities to identify users (i.e., devices) through distinct IDs while protecting user ID privacy. Figure 8 In the code, info1 replaces ID1, info2 replaces ID3, and info3 replaces ID2.

[0229] This application provides a user identification method in a system, wherein network functions or entities can identify users through different temporary IDs, and network functions or entities cannot link temporary IDs to specific users.

[0230] Figure 11 This is an example of the network topology for this application. Figure 11 This describes a system model for user identification when a user requests a service. The user can be a terminal device or an end client. The system includes a data service management function, a data service profile management function, multiple data service providers (SPs), an individual service manager (IDM) function, and a service log server. The data service management function, data service profile management function, data SPs, and IDM function are deployed by different providers. The service log server can be integrated into either the data service management function or the data service profile management function. The data service management function can request service log records with ID2 from the service log server, or the data service profile management function can request service log records with ID1 from the service log server. Temporary IDs are used to identify the user across different entities. For example, ID2 is assigned to the user to identify them through the data service management function, and ID1 is assigned to the user to identify them through the data service profile management function. ID3 is assigned to the user for identification through data SP1, and ID5 is assigned to the user for identification through data SP2.

[0231] The data service management function is responsible for service identification and service session management, such as service session creation and service session cancellation, and is also responsible for establishing or configuring secure tunnels between users and data service providers (SPs).

[0232] The data service configuration file management is responsible for one or more of the following: user subscription registration; maintaining a list of user service configuration files; verifying users and services; and building info5.

[0233] Data service providers (SPs) are responsible for one or more of the following: user identification; identification of user access rights to their services; and service provision.

[0234] The service log server is responsible for maintaining the service_log configuration file.

[0235] The IDM function is responsible for one or more of the following: maintaining ID profiles; ID mapping; and building info1 and info2.

[0236] Figure 12 for Figure 11 The example shown illustrates the user identification process in the system. The process is as follows: In step 501, the user sends message 1 to the data service management function. Message 1 includes the user's temporary ID, such as ID2, or a service request. Message 1 can be a service request.

[0237] In step 502, the data service management function identifies the service based on service requirements to obtain the service ID. The data service management function can also obtain the data SP that provides the service to the user.

[0238] In step 503, the data service management function sends message 2 to the IDM function. Message 2 includes the user's ID2 and the ID of the data service configuration file management function. Message 2 may be an ID mapping request.

[0239] In step 504, the IDM function implements ID mapping, selects the algorithm for calculating info1 and info2, and calculates info1 and info2.

[0240] Specifically, IDM uses ID2 and the ID from the data service configuration file management function to perform ID mapping to obtain another user ID, such as user ID1. In other words, ID1 is obtained based on ID2 and the ID from the data service configuration file management function.

[0241] In some embodiments, the IDM function can calculate info1 based on ID1.

[0242] In some embodiments, the IDM function can calculate info1 based on information obtained from the data service profile management function. Specifically, the IDM function requests information from the data service profile management function to be used as input for calculating info1. The IDM function receives a response from the data service profile management function. The response includes information for calculating info1 (which we refer to as information #A). For example, information #A could be a random number generated by the data service profile management function. After receiving information #A, the IDM function uses information #A and a first algorithm to calculate info1.

[0243] In step 505, IDM sends message 3 to the data service management function.

[0244] Message 3 includes the IDs of info1, info2, algorithm_info1, and algorithm_info2. Message 3 can be an ID mapping response.

[0245] It should be noted that alogorithm_info1 represents the first algorithm used to calculate info1, alogorith_info2 represents the second algorithm used to calculate info2, and so on.

[0246] In step 506, the data service management function sends message 4 to the data service configuration file management function.

[0247] Message 4 includes info1, the service ID, and the ID of algorithm_info1. Message 4 may also include the ID of the data SP. It should be noted that whether message 4 includes the data SP ID depends on the deployment location of the service log server. For example, if the service log server is deployed in the data service management function, then message 4 includes the data SP ID; or if the service log server is deployed in the data service configuration file management function, then message 4 does not include the data SP ID. Message 4 can be a permission request.

[0248] In step 507, the data service configuration file management function performs the following actions.

[0249] The data service configuration file management function performs initial user identification by comparing info1 with a first value. The first value is calculated using algorithm_info1 and information known only to the data service configuration file management function and the IDM function, such as ID1, or information provided by the data service configuration file management function, such as a random number generated by the data service configuration file management function. Specifically, if the calculated first value matches the received info1, user identification is successful; otherwise, user identification fails. The data service configuration file management function then verifies the user and service based on the service credentials included in the service configuration file.

[0250] If the initial user identification and verification of the user and service are successful, the data service profile management function further determines service permissions by checking the user's service profile based on the service ID, such as ID1. If service permission identification fails, the data service profile management function generates a service denial instruction for the user's access to the service. If service permission identification is successful, the data service profile management function also calculates info5.

[0251] info5 is generated using algorithm_info5 based solely on information known only to the data service configuration file manager and the data service provider (SP). algorithm_info5 is selected by the data service configuration file management function.

[0252] In step 508, the data service configuration file management function sends message 5 to the data service management function.

[0253] Message 5 includes info5 and the ID of algorithm_info5. Message 5 may also include the ID of the data SP, as described in step 506. Message 5 may be the permission response corresponding to message 4.

[0254] In step 509, the data service management function sends message 6 to the data SP.

[0255] Message 6 includes info2, the service ID, the ID of algorithm_info2, info5, and the ID of algorithm_info5. Message 6 can be a service access request.

[0256] In step 510, the data SP performs the following actions.

[0257] The data SP performs secondary user identification based on second information and a second algorithm. The data SP takes the device's ID (e.g., ID3) as input, uses the second algorithm to calculate a polynomial function, and outputs 0 or 1. An output of 1 indicates successful user identification, while an output of 0 indicates failure.

[0258] The data service provider (SP) determines service permissions by comparing the received info5 value with a second value. This second value is calculated using algorithm_info5 and information known only to the data service configuration file management function and the data SP.

[0259] If the second user identity verification and service permission verification are both successful, then the data SP proceeds to step 511.

[0260] In step 511, the data SP sends message 7 to the data service management function.

[0261] Message 7 indicates that the service was successfully provided. Message 7 can be the service access response corresponding to message 6.

[0262] In step 512, the data service management writes service log records to the service log server and establishes a secure tunnel between the user and the data SP.

[0263] In step 513, the data service management function sends a service response to the user.

[0264] We have added the following new features: (1) User identification via data service profile management and data SP. info1 or info2 replaces the user's temporary ID and is used for user identification, thereby decoupling the linking of the temporary ID. (2) Service permission identification via data SP. info5 is used to ensure that users subscribe to services from data PS. These new features can provide anonymous service access while providing protection for user ID privacy.

[0265] In this application, user identification is implemented by the data service profile management function and the data SP. info1 or info2 replaces the user's temporary ID and is used for user identification, thereby decoupling the linkability of the temporary ID. Service permission identification is implemented by the data SP. info5 is used to ensure that the user subscribes to services from the data SP. These changes provide anonymous service access while offering ID privacy protection for the user.

[0266] To illustrate this clearly, we will use data sharing services as an example to introduce the proposed technical solution.

[0267] Figure 13 This is an example of a user identification process according to some embodiments of this application. In this scenario, a user needs a data download service from a data storage system. For example, a user wants to download first data from the data storage system. There are three issues to be addressed: (1) Since a temporary ID is assigned to both the user and the data owner, it is necessary to identify both the user and the data owner simultaneously. (2) The data service management function may not be aware of the data service provider (SP) storing the data owner's data. (3) The data service provider should check the data owner's access rules to ensure that the user is qualified to access the data owner's data.

[0268] In step 601, the user sends message 1 to the data service management function.

[0269] Message 1 includes the user ID, such as device ID2, and the data owner ID. Message 1 also includes the service request.

[0270] In step 602, the data service management function identifies the service based on service requirements to obtain the service ID. The data service management can then obtain the data SP that provides the service to the user.

[0271] In step 603, the data service management function sends message 3 to the IDM function.

[0272] Message 3 includes ID2, the ID of the data service configuration file management function, and the ID of the data owner.

[0273] In step 604, the IDM performs ID mapping based on the user ID (e.g., ID2) and the ID of the data service configuration file management function to obtain another user ID (e.g., ID1). Furthermore, the IDM selects an algorithm for calculating info1, info2, and info_data_owner, and generates info1, info2, and info_data_owner.

[0274] In some embodiments, the IDM function can use algorithm_info1 and ID1 to compute info1. info1 is the input to algorithm_info1. In some embodiments, the IDM function can use algorithm_info1 and information provided by the data service profile management function, such as a random number generated by the data service profile management function, to compute info1. The process by which the IDM function obtains information from the data service profile management function is described as steps 605 to 606.

[0275] The IDM function uses a second algorithm_info2 and one or more IDs of devices in at least one data SP (e.g., device ID3 in data SP1 and device ID5 in data SP2) to calculate info2. The IDM function uses algorithm_info_data_owner to calculate info_data_owner. The inputs used to generate info_data_owner include the IDs of all data owners in at least one data SP. info_data_owner is used by the data SP to identify the user of the data owner during communication between the data service management function and the data SP.

[0276] In step 605, the IDM function sends message 5 to the data service configuration file management function.

[0277] Message 5 is a request for information used to calculate info1. Furthermore, message 5 can be considered a request for public information between the IDM function and the data service configuration file management function. Message 5 includes ID1.

[0278] In step 606, the data service configuration file management function sends message 6 to the IDM function.

[0279] Message 6 can be a response to message 5. Message 6 may include a random number generated by the data service configuration file management function.

[0280] In step 607, IDM sends message 7 to the data service management function.

[0281] Message 7 includes the IDs of info1, info2, info_data_owner, algorithm_info1, alforithm_info2, and algorithm_info_data_owner.

[0282] In step 608, the data service management function sends message 8 to the data service configuration file management function.

[0283] Message 8 can be referenced from the permission request described in step 506, and will not be repeated here.

[0284] In step 609, the data service configuration file management function realizes the first user identity recognition, user and service verification, and service permission determination.

[0285] For details of step 609, please refer to step 507, and I will not repeat them here.

[0286] In step 610, the data service configuration file management function sends message 10 to the data service management function.

[0287] Step 610 can be referenced from step 508. Message 10 is an example of the permission response in step 508, and will not be described again.

[0288] In step 611, the data service management function sends message 11 to the data SP.

[0289] Message 11 includes info2, service ID, algorithm_info2 ID, info5, algorithm_info5 ID, info_data_owner, and algorithm_info_data_owner ID.

[0290] In step 612, the data SP performs second user identification and service permission identification, as described in step 510. Compared to step 510, the data SP can also verify the info_data_owner. Specifically, the data SP uses the data owner's ID as input, calculates a polynomial function using algorithm_info_data_owner, and outputs 1 or 0. For example, if the output is 1, it indicates successful verification of info_data_owner; otherwise, it indicates failure. Furthermore, the data SP can check the data owner's access rules. If a service request from the device matches the data owner's access rules, the service request will be allowed. The data SP can send a notification to the data owner that their data will be accessed.

[0291] In step 613, the data SP sends message 14 to the data service management function.

[0292] Message 14 may be an indication of successful service delivery. Message 14 may also include parameters such as security materials. These security materials may include keys used for data encryption / decryption, or inputs used for key generation. Message 14 may also include information about how a tunnel is established between the user and the data service provider (SP).

[0293] Optionally, the process may also include steps 614 to 616.

[0294] In step 614, the data service management function can write service log records to the server log server.

[0295] In step 615, the data service management function can send message 16 to the data service configuration file management function.

[0296] Message 16 includes info1, service ID, and data SP ID.

[0297] In step 616, the data service configuration file management function can write service log records to the server log server.

[0298] In step 617, the data service management function establishes a tunnel between the user and the data SP.

[0299] In step 618, the data service management function sends message 18 to the user. Message 18 indicates that the data upload was successful.

[0300] In data storage services, user identification parameters (such as info1 or info2) are used to replace temporary user IDs for communication, thereby decoupling the linkability of temporary IDs. Therefore, the proposed method can prevent users from being tracked when accessing data storage services. Furthermore, service permission identification parameters (such as info5) are used to ensure that users subscribe to services from the data service provider. This can be prevented from using fake service profiles through data service profile management functionality.

[0301] Figure 14 This is an example of an identification process according to an embodiment of this application. In this scenario, a user requests a service from a DN. The proposed process, as described in Clause 4.3.2 of 3GPP 23.502, can be integrated into the PDU session establishment. Data service management can be a session management function (SMF), data service profile management can be unified data management (UDM), data SP can be data network authentication, authorization, and accounting (DN-AAA), and the IDM function is a new function responsible for ID management.

[0302] In step 701, the user sends message 1 to the data service management function (e.g., SMF).

[0303] In step 702, the SMF sends message 2 to the IDM function.

[0304] In step 703, IDM performs ID mapping based on user ID (e.g., ID2) and ID of data service configuration file management function (e.g., UDM), and obtains another user ID (e.g., ID1).

[0305] ID1 can be used to calculate info1. Optionally, the IDM function can obtain information for calculating info1 from the data service profile management function, as described in steps 704 to 705.

[0306] In step 704, IDM sends message 4 to the data service profile management function (e.g., UDM).

[0307] Message 4 includes ID1.

[0308] In step 705, UDM sends message 5 to the IDM function.

[0309] Message 5 may include a random number generated by the data service management function.

[0310] In step 706, the IDM function calculates info1 and info2.

[0311] Specifically, IDM selects the algorithm used to compute info1 and info2, then uses algorithm_info1 to compute info1 and algorithm_info2 to compute info2.

[0312] In step 707, IDM sends message 7 to SMF.

[0313] Message 7 includes the IDs of info1, info2, algorithm_info1, and algorithm_info2.

[0314] In step 708, SMF sends message 8 to UDM.

[0315] Message 8 includes info1, the service ID, and the ID of algorithm_info1.

[0316] In step 709, UDM performs user identification and service permission determination.

[0317] Specifically, the UDM performs a first user identification by comparing the received info1 with a first value calculated based on ID1 and algorithm_info1. The UDM also performs service permission determination, as described in step 507. If both the first user identification and service permission determination are successful, the UDM also calculates info5 using algorithm_info5. The inputs used to calculate info5 include information known only to the data service profile management function and the data SP, such as the service profile ID stored in the data service profile management function.

[0318] In step 710, UDM sends message 10 to SMF.

[0319] Message 10 includes the IDs of info5 and algorithm_info5. Message 10 may also include the ID of the data SP.

[0320] In step 711, the SMF sends message 11 to the data SP (e.g., DN-AAA).

[0321] Message 11 includes info2, the service ID, the ID of algorithm_info2, info5, and the ID of algorithm_info5. Message 11 can be a service access request.

[0322] In step 712, DN-AAA performs second user identification, service permission determination and user authentication, and user access service authorization.

[0323] The second step, user identification and service permission determination, can be referred to in step 510, and will not be repeated here.

[0324] In step 713, DN-AAA sends message 13 to SMF.

[0325] Message 13 can be a service response, indicating that the service was successfully provided.

[0326] In step 714, the SMF creates and configures the PDU session. For details, see section 4.3.2 of 3GPP 23.502 [1], which is not limited here.

[0327] In step 715, the SMF can send message 15 to the user.

[0328] Message 15 can be a PDU session establishment acceptance message and an indication of successful data upload.

[0329] In this embodiment, we provide a process for integrating user identification into PDU session establishment in a 5G system. By decoupling user ID and service ID, this process can protect user ID privacy and service privacy compared to existing technologies in 5G.

[0330] Figure 15 This is an example of another scenario in this application. In this embodiment, a method is provided that... Figure 9 The corresponding user identification process.

[0331] In step 801, the user sends message 1 to the data service management function.

[0332] Message 1 can be a service request. Message 1 includes the user ID (e.g., user ID2) and the service request.

[0333] In step 802, the data service management function obtains the service ID and generates info3.

[0334] The service ID is obtained based on the service requirements. info3 is generated using the info3 algorithm by taking the user ID (e.g., ID2) as input.

[0335] In step 803, the data service management function sends message 3 to the data service configuration file management function.

[0336] Message 3 can be an authorization request. Message 3 includes info3, the service ID, and the ID of algorithm info3.

[0337] In step 804, the data service configuration file management function sends message 4 to IDM.

[0338] Message 4 includes info3 and the ID of algorithm info3.

[0339] In step 805, the IDM function performs first user identification and ID mapping, and calculates info2.

[0340] Specifically, the IDM function performs first user identification based on info3 and obtains the user ID, such as device ID2. The IDM function performs ID mapping based on ID2 to obtain the IDs of other devices used in at least one data SP and the IDs of devices used in the service profile management function. For example, the IDM function obtains device ID3 used in data SP1 and ID5 used in data SP2, and also obtains device ID1 used in the service profile management function. Furthermore, the IDM function selects algorithm_info2 for calculating info2 and uses this algorithm_info2 to calculate info2 based on the obtained device IDs used in at least one data SP. For example, the IDM function uses algorithm 2 to calculate info2 based on ID3 and ID5. Device ID1 is used in the following step t.

[0341] In step 806, IDM sends message 6 to the data service configuration file management function.

[0342] Message 6 can be an ID mapping response. Message 6 includes the IDs of info2, ID1, and algorithm_info2.

[0343] In step 807, the data service configuration file management function determines service permissions and verifies users and services based on ID1, and calculates info5.

[0344] The service permission determination function is performed by checking the user's service profile (e.g., ID1) based on the service ID. If this fails, the data service profile management function generates a service denial indication for the user's access to the service. Authentication of the user and service is then performed based on the service credentials included in the service profile. Here, info5 is generated using algorithm_info5 based on the service profile ID.

[0345] In step 808, the data service configuration file management function sends message 8 to the data service management function.

[0346] Message 8 includes info2, the ID of algorithm_info2, info5, and the ID of algorithm_info5. Message 8 can be a permission response.

[0347] In step 809, the data service management function sends message 9 to the data SP.

[0348] Message 9 includes info2, the service ID, the ID of algorithm_info2, info5, and the ID of algorithm_info5. Message 9 can be a service access request.

[0349] In step 810, the data SP performs second user identification and service permission determination.

[0350] User identification is achieved using algorithm_info2 by comparing the received info2 with a second value (e.g., device ID3) that can be used to calculate the user ID.

[0351] Service permissions are determined by comparing the received info5 with a third value calculated using algorithm_info5.

[0352] In step 811, the data SP sends message 11 to the data service management function.

[0353] Message 11 indicates that the service was successfully provided. Message 11 can be a response to the access service.

[0354] In step 812, the data service management function establishes a tunnel between the user and the data SP.

[0355] In step 813, the data service management function sends message 13 to the user.

[0356] Message 13 is an indication that the service was successfully provided. Message 13 may be the service response corresponding to message 1 described in step 801.

[0357] In this embodiment, we provide another technical solution for user identification when a user requests a service. In this scenario, info3 is used for user identification implemented by the IDM function, replacing the temporary ID (e.g., ID2) identified by the data service management function. This avoids user ID tracking, thereby protecting user privacy.

[0358] The methods proposed in the embodiments of this application have been described in detail above. The communication device provided in this application will be described in detail below.

[0359] Figure 16 This is a schematic block diagram of a communication device 10 according to an embodiment of this application. The communication device may be a communication apparatus or an apparatus applied to a communication apparatus capable of implementing any network function in the embodiments of this application. For example, the apparatus may be a chip, a chip system, or a circuit, etc., without limitation. The communication apparatus may be a first network function, an IDM function, a second network function, or a third network function, or a chip installed in any of these network functions.

[0360] The communication device 10 includes a processing module 1001. The processing module 1001 may be a processor, processing circuit, processing board, processing unit, or processing device, etc. The processing module 1001 is used to implement processing and / or operations within the communication device, excluding sending and / or receiving actions.

[0361] The communication device 10 may further include a communication module 1002. The communication module 1002 is used to implement sending and / or receiving operations. The communication module 1002 may also be referred to as a transceiver module, transceiver, or transceiver device, etc., and is used to implement receiving (which may be called input) and / or sending (which may be called output) operations.

[0362] For example, if communication device 10 corresponds to Figure 8 In the first network function, communication module 1002 is used to send a first message to the IDM function and receive a second message from the IDM function. Communication module 1002 is also used to send a third message to the second network function and receive a fourth message from the second network function.

[0363] For example, if communication device 10 corresponds to Figure 8 The second network function, communication module 1002, is used to receive a third message from the first network function and send a fourth message to the first network function. Processing module 1001 is used to implement step 305.

[0364] For example, if communication device 10 corresponds to Figure 8 In the IDM (Internet Device Management) module, communication module 1002 is used to receive a first message from the first network function and send a second message to the first network function. Processing module 1001 is used to implement step 302. Communication module 1002 is also used to send the second message to the first network function.

[0365] For example, if communication device 10 corresponds to Figure 8 The third network function, communication module 1002, is used to receive the fifth message from the first network function. Processing module 1001 is used to implement step 308.

[0366] In short, the operation and / or function of device 10 are intended to implement the corresponding steps of the above method embodiments.

[0367] Figure 17This is a schematic block diagram of a communication device according to an embodiment of the present application. The communication device 20 includes at least one processor 21. The at least one processor 21 is coupled to at least one memory 22. The at least one memory 22 is used to store one or more instructions and / or executable computer code. The at least one processor 21 is used to invoke one or more instructions and / or executable computer code to cause the communication device 20 to implement the methods provided in the embodiments of the present application. Optionally, the communication device 20 may further include at least one memory 22. Optionally, the communication device 20 may further include at least one communication interface 23, the at least one communication interface 23 being used to input and / or output information or data.

[0368] In one implementation, the communication device 20 can be any of the network functions in the above method embodiments. For example, the communication device 20 can be a first network function, an IDM function, a second network function, or a third network function. In this implementation, the processor 21 can be a baseband device, and the communication interface 23 can be a radio frequency device.

[0369] In another implementation, the communication device 20 may be a chip (or chip system) installed on a communication device such as a first network function, IDM function, second network function, or third network function. In this embodiment, the processor 21 may be a circuit, such as a logic circuit, integrated circuit, etc. The communication interface 13 may be a transceiver, interface circuit, input / output interface, bus, module, pin, or other type of interface.

[0370] This application also provides a communication system. The communication system may include any of the communication devices described in any method embodiment of the method embodiments. For example, the communication system may include one or more of the following network functions: a first network function, an IDM function, a second network function, and a third network function. The communication system may also include terminal devices or other network functions, without limitation.

[0371] Embodiments of this application also provide a computer storage medium that can store one or more instructions for performing any of the methods described above.

[0372] Embodiments of this application also provide a computer program product that can store one or more instructions for performing any of the methods described above.

[0373] In the embodiments of this application, "and / or" describes the association relationship between associated objects and indicates that three relationships can exist. For example, A and / or B can represent the following three cases: only A exists, both A and B exist, and only B exists. The character " / " generally represents an "OR" relationship between associated objects. "At least one" refers to one or more. "At least one of A and B" is similar to "A and / or B" in describing the association relationship between associated objects and indicates that three relationships can exist. For example, at least one of A and B can represent the following three cases: only A exists, both A and B exist, and only B exists.

[0374] Furthermore, the use of the singular forms of “a / an” and “the” in the embodiments of this application and the appended claims is intended to include the plural forms, unless the context clearly indicates otherwise.

[0375] Those skilled in the art will recognize that, based on the examples described in conjunction with the embodiments disclosed in this specification, the units and algorithm steps can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether a function is implemented through hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but should not consider such embodiments to be beyond the scope of this application.

[0376] Those skilled in the art will understand that, for convenience and simplicity, the specific working process of the above-described systems, devices, and units can be referred to the corresponding process in the above-described method embodiments, and will not be repeated here.

[0377] In the several embodiments provided in this application, the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the described apparatus embodiments are merely examples. For instance, unit partitioning is a logical functional partitioning, and other partitioning methods may be used in actual embodiments. For example, multiple units or components may be merged or integrated into another system, or some features may be ignored or not performed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed can be implemented through various communication interfaces. Indirect coupling or communication connection between devices or units can be implemented electronically, mechanically, or otherwise.

[0378] Furthermore, the functional units in the embodiments of this application can be integrated into a processing unit, each unit can exist physically independently, or two or more units can be integrated into a unit.

[0379] When these functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The technical solution of this application can be implemented as a software product. This software product is stored in a storage medium and includes several instructions to instruct a computer device (which may be a personal computer, server, network device, etc.) to execute all or part of the steps of the method described in the embodiments of this application. The aforementioned storage medium includes any medium capable of storing program code, such as a USB flash drive, portable hard drive, ROM, RAM, disk, or optical disk.

[0380] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one position or distributed across multiple network units. Some or all units can be selected according to actual requirements to achieve the purpose of the embodiment. Furthermore, the functional units in the embodiments of this application may be integrated into one processing unit, or each unit may exist physically independently, or two or more units may be integrated into one unit.

[0381] The above descriptions are merely some specific implementations of this application and are not intended to limit the scope of protection of this application. Any variations or substitutions that are readily conceived by those skilled in the art within the scope of the technology disclosed in this application are within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication method characterized by comprising: Performed by a first network function, which is responsible for service management, the method includes: Send a first message to the Identifier Management (IDM) function, wherein the first message includes a second identifier ID of the device, and the first message is used to request ID mapping; Receive a second message from the IDM function, wherein the second message includes first information, an ID of a first algorithm for generating the first information, second information, and an ID of a second algorithm for generating the second information; Wherein, the first information is used for user identification implemented by the second network function responsible for managing the service configuration file, and the first information is generated by the IDM function according to the first algorithm and the first ID of the device known only to the IDM function and the second network function, and the first ID is obtained by the IDM function according to the second ID and the ID of the second network function; or, the first information is generated based on information provided by the second network function that is known only to the IDM function and the second network function. The second information is used for user identification implemented by a third network function that provides services to the device, and the second information is generated by the IDM function based on the second algorithm and the device ID in at least one third network function; The first network function, the second network function, and the third network function are provided by different providers.

2. The method of claim 1, wherein, The method further includes: Send a third message to the second network function, wherein the third message is used to request services for the device, and the third message includes the first information, the ID of the first algorithm, and the service ID; A fourth message is received from the second network function, wherein the fourth message indicates the service permission of the device to access the service, the fourth message includes fifth information for determining the service permission implemented by the third network function and an ID of a fifth algorithm for generating the fifth information, the fifth information being generated based on public information between the second network function and the third network function.

3. The method according to claim 2, characterized in that, The fifth piece of information includes the service profile ID or information derived from the service profile ID.

4. The method according to any one of claims 1 to 3, characterized in that, The information provided by the second network function includes random numbers generated by the second network function.

5. The method according to any one of claims 2 to 4, characterized in that, The method further includes: Send a fifth message to the third network function, wherein the fifth message is used to request the service, and the fifth message includes the second information, the fifth information, the service ID, the ID of the second algorithm, and the ID of the fifth algorithm.

6. A communication method characterized by comprising: Performed by the IDM (Identifier Management Device) function, the communication method includes: A first message is received from a first network function responsible for service management, wherein the first message includes a second identifier ID of a device known only by the first network function and the IDM function, and the first message is used to request ID mapping; Based on the second ID and the ID of the second network function, obtain the first ID of the device; Obtain first information and second information, wherein the first information is used for user identification implemented by a second network function responsible for managing service profiles, the first information is obtained according to a first algorithm and the first ID of the device known only by the IDM function and the second network function or according to information provided by the second network function, and the second information is obtained according to a second algorithm and the ID of a device in at least one third network function; Send a second message to the first network function, wherein the second message includes the first information, the ID of the first algorithm, the second information, and the ID of the second algorithm.

7. The method of claim 6, wherein, The method further includes: Send a sixth message to the second network function, wherein the sixth message is used to request information for calculating the first information; Receive the information provided by the second network function, wherein the information provided by the second network function includes a random number generated by the second network function.

8. A communication method characterized by comprising: Performed by a second network function, which is responsible for managing service configuration files, the method includes: A third message is received from a first network function, wherein the third message is used to request services for a device, the third message includes first information, an identifier ID and a service ID of a first algorithm for generating the first information, the first information being generated by an identifier management IDM function based on the first algorithm and a first ID of the device known only to the IDM function and the second network function, the first ID being obtained by the IDM function based on a second ID of the device and the ID of the second network function, or the first information being generated based on information provided by the second network function known only to the IDM function and the second network function; Perform user identification and verify the device and the service based on service credentials stored in the second network function, wherein the user identification is performed by comparing a first value with the received first information included in the third message, the first value being calculated using the first algorithm and the first ID of the device or a random number generated by the second network function; After the user identification and the verification of the device and the service are successful, a fourth message is sent to the first network function, wherein the fourth message indicates the device's service permission to access the service, and the fourth message includes fifth information used by the third network function to determine the service permission and an ID of a fifth algorithm used to generate the fifth information, the fifth information being generated based on public information between the second network function and the third network function.

9. The method of claim 8, wherein, The fifth piece of information includes the service profile ID or information derived from the service profile ID.

10. The method according to claim 8 or 9, characterized in that, Before receiving the third message from the first network function, the method further includes: A sixth message is received from the IDM function, wherein the sixth message is used to request information for calculating the first information; Information is provided to the IDM function, wherein the information provided by the second network function includes the random number generated by the second network function.

11. A communication method characterized by comprising: Performed by a third network function, which is responsible for providing services to the device, the method includes: A fifth message is received from a first network function, wherein the fifth message is used to request a service, the fifth message includes second information, fifth information, service identifier ID, ID of a second algorithm for generating the second information, and ID of a fifth algorithm for generating the fifth information, the second information is used for user identification implemented by the third network function, and the second information is generated by the identifier management IDM function based on the second algorithm and the ID of a device in at least one third network function; The user identification and service permission determination are performed, wherein the user identification is performed based on the second algorithm and the second information included in the fifth message and the device ID in the third network function, and the service permission determination is performed by comparing the fifth information included in the fifth message with a second value, wherein the second value is calculated based on the fifth algorithm included in the fifth message and information known only to the second network function and the third network function; After the user identity verification and service permission determination are successful, the service is provided to the device; The first network function, the second network function, and the third network function are provided by different providers.

12. The method of claim 11, wherein, The method further includes: Send a successful indication to the first network function.

13. A method of communication, comprising: Performed by a first network function, which is responsible for service management, the method includes: Send a first message to the second network function, wherein the first message includes third information, an identifier ID and a service ID of a third algorithm, the third information being generated by the first network function using the third algorithm based on information known only to the first network function and the identifier management IDM function, and the third information being used for user identification implemented by the IDM function. A second message is received from the second network function, wherein the second message includes second information, the ID of the second algorithm, fifth information, and the ID of the fifth algorithm. The second information is used for user identification implemented by the third network function. The second information is generated by the IDM function based on the ID of a device in at least one third network function and the second algorithm. The fifth information is used for service permission determination implemented by the third network function. The fifth information is generated by the second network function using the fifth algorithm based on information known only to the second network function and the third network function. The first network function, the second network function, and the third network function are provided by different providers.

14. The method of claim 13, wherein, The method further includes: Send a third message to the third network function, wherein the third message includes the second information, the ID of the second algorithm, the fifth information, the ID of the fifth algorithm, and the service ID.

15. The method according to claim 13 or 14, characterized in that, The method further includes: Receive an indication from the third network function, wherein the indication is used to indicate that the service was successfully provided.

16. A method of communication, comprising: The method, performed by the identifier management IDM function, includes: A fourth message is received from the second network function, wherein the fourth message includes third information and an identifier ID of a third algorithm, the third information being generated by the first network function using the third algorithm based on information known only to the first network function and the IDM function; User identification is performed based on the third information and the information known only by the first network function and the IDM; the second ID of the device is obtained using the third algorithm; and the first ID of the device is obtained based on the second ID. Second information is generated using a second algorithm and the ID of a device in at least one third network function, wherein the second information is used for user identification implemented by the third network function; Send a fifth message to the second network function, wherein the fifth message includes second information, the ID of the second algorithm, and the first ID of the device.

17. A method of communication, comprising: Performed by a second network function, which is responsible for managing service configuration files, the method includes: A first message is received from a first network function, wherein the first message includes third information, an identifier ID and a service ID of a third algorithm, the third information being generated by the first network function using the third algorithm based on information known only to the first network function and the identifier management IDM function; Send a fourth message to the IDM function, wherein the fourth message includes the third information and the ID of the third algorithm; A fifth message is received from the IDM function, wherein the fifth message includes second information, the ID of the second algorithm, and the first ID of the device, the second information being used for user identification implemented by the third network function, and the second information being generated by the IDM function using the second algorithm based on the ID of the device in at least one third network function; The first network function, the second network function, and the third network function are provided by different providers.

18. The method of claim 17, wherein, The method further includes: Service permission determination is performed by checking the service configuration file based on the service ID. The device and service are verified based on the service credentials stored in the service configuration file. Based on information known only to the second network function and the third network function, a fifth algorithm is used to generate fifth information, wherein the fifth information is used for service permission determination implemented by the third network function.

19. The method of claim 18, wherein, The method further includes: Send a second message to the first network function, wherein the second message includes the second information, the fifth information, the ID of the second algorithm, and the ID of the fifth algorithm.

20. A method of communication, comprising: Performed by a third network function, which is responsible for providing services to the device, the method includes: A third message is received from a first network function, wherein the third message includes second information, an ID of a second algorithm, fifth information, an identifier ID and a service ID of the fifth algorithm, wherein the second information is generated by an identifier management (IDM) function using the second algorithm based on the ID of a device in at least one third network function; and the fifth information is generated by the second network function using the fifth algorithm based on information known only to the second network function and the third network function. The user identification and service permission determination are performed, wherein the user identification is performed based on the second information and the second algorithm, and the service permission determination is performed based on the fifth information and the fifth algorithm.

21. The method of claim 20, wherein, The method further includes: If the user identification and service permission determination are successful, a service provision success indication will be sent; or Send an instruction to deny the device access to the service.

22. A communications device, characterized by The communication device includes a processor configured to execute one or more instructions stored in a memory, causing the communication device to implement the method according to any one of claims 1 to 5, or the method according to claim 6 or 7, or the method according to any one of claims 8 to 10, or the method according to claim 11 or 12; or The communication device is configured to implement the method according to any one of claims 13 to 15, or the method according to claim 16, or the method according to any one of claims 17 to 19, or the method according to claim 20 or 21.

23. The communication apparatus according to claim 22, wherein, The communication device also includes the memory.

24. The communication apparatus according to claim 22 or 23, wherein, The communication device includes a communication interface, which is used to input and / or output information or data.

25. A communications device, characterized by The communication device includes functions or units that implement the method according to any one of claims 1 to 5, or the method according to claim 6 or 7, or the method according to any one of claims 8 to 10, or the method according to claim 11 or 12; or Implement the method according to any one of claims 13 to 15, or the method according to claim 16, or the method according to any one of claims 17 to 19, or the method according to claim 20 or 21.

26. A communications device, characterized by The communication device includes a circuit and a communication interface, the communication interface being used to receive information and / or data to be processed by the circuit, and to send the information and / or data to the circuit; the circuit is used to implement the method according to any one of claims 1 to 5, or the method according to claim 6 or 7, or the method according to any one of claims 8 to 10, or the method according to claim 11 or 12; or Implement the method according to any one of claims 13 to 15, or the method according to claim 16, or the method according to any one of claims 17 to 19, or the method according to claim 20 or 21.

27. The communication apparatus according to claim 26, wherein The communication interface is also used to output information and / or data processed by the circuit.

28. A communication system, characterized by Includes one or more of the following communication devices: A communication apparatus for performing the method according to any one of claims 1 to 5; A communication device that performs the method according to claim 6 or 7; A communication apparatus for performing the method according to any one of claims 8 to 10; A communication device that performs the method according to claim 11 or 12.

29. A communication system, characterized by Includes one or more of the following communication devices: A communication apparatus for performing the method according to any one of claims 13 to 15; A communication device that performs the method according to claim 16; A communication apparatus for performing the method according to any one of claims 17 to 19; A communication device that performs the method according to claim 20 or 21.

30. A computer-readable storage medium, characterized in that, Includes one or more instructions that, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 5, or the method according to claim 6 or 7, or the method according to any one of claims 8 to 10, or the method according to claim 11 or 12; or Implement the method according to any one of claims 13 to 15, or the method according to claim 16, or the method according to any one of claims 17 to 19, or the method according to claim 20 or 21.

31. A computer program product, characterised in that, Includes one or more instructions that, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 5, or the method according to claim 6 or 7, or the method according to any one of claims 8 to 10, or the method according to claim 11 or 12; or Implement the method according to any one of claims 13 to 15, or the method according to claim 16, or the method according to any one of claims 17 to 19, or the method according to claim 20 or 21.

Images