Communication method, communication device, communication system, storage medium, and program product

Abstract

This disclosure relates to a communication method, communication device, communication system, storage medium, and program product. The method is executed by a first node and includes: sending first information to a second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. The solution of this disclosure can achieve security protection for communication between access network devices and other nodes in a communication system via a service-based interface.

Description

Communication methods, communication equipment, communication systems, storage media and software products Technical Field

[0001] This disclosure relates to the field of wireless communication, and more particularly to a communication method, communication device, communication system, storage medium, and program product. Background Technology

[0002] As communication technologies continue to evolve, the architecture of communication systems also evolves according to changing needs. To improve communication efficiency between nodes in a communication system, enabling direct communication between different nodes is a viable option. In particular, when one party to the communication is located in the access network, the introduction of a service-based interface (SBI) allows access network devices to directly exchange information with other nodes in the communication system. Summary of the Invention

[0003] This disclosure provides a communication method, communication device, communication system, storage medium, and program product to provide a security mechanism for service-based access network devices.

[0004] According to a first aspect of the present disclosure, a communication method is provided. The method is performed by a first node. The method includes: sending first information to a second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0005] According to a second aspect of the present disclosure, a communication method is provided. The method is executed by a second node. The method includes: receiving first information sent by a first node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0006] According to a third aspect of the present disclosure, a communication method is provided. The method is performed by a third node. The method includes: sending authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; the first node requests the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0007] According to a fourth aspect of the present disclosure, a communication method is provided. The method is executed by a communication system. The communication system includes a first node and a second node. The method includes: the first node sending first information to the second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0008] According to a fifth aspect of the present disclosure, a communication device is provided. This communication device is used to perform the communication method as described in any one of the first to third aspects.

[0009] According to a sixth aspect of the present disclosure, a communication system is provided. The communication system includes at least one of the following: a first node, a second node, and a third node. The first node is configured to perform the communication method as described in the first aspect. The second node is configured to perform the communication method as described in the second aspect. The third node is configured to perform the communication method as described in the third aspect.

[0010] According to a seventh aspect of the present disclosure, a storage medium is provided. The storage medium stores instructions. When executed on a communication device, the instructions cause the communication device to perform the communication method as described in any one of the first to third aspects.

[0011] According to an eighth aspect of the present disclosure, a program product is provided. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in any one of the first to third aspects.

[0012] According to a ninth aspect of the present disclosure, a computer program is provided. When this computer program is run on a computer, it causes the computer to perform the communication method as described in any one of the first to third aspects.

[0013] According to a tenth aspect of this disclosure, a chip or chip system is provided. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication method as described in any one of the first to third aspects.

[0014] According to embodiments of this disclosure, security protection can be achieved for communication between access network devices and other nodes in a communication system via service-based interfaces.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not constitute a limitation on the embodiments of this disclosure. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments of the invention.

[0017] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure.

[0018] Figure 2 is an exemplary schematic diagram of a service interface-based communication system architecture provided according to an embodiment of the present disclosure.

[0019] Figure 3A is an exemplary schematic diagram of a first mode of recognition provided according to an embodiment of the present disclosure.

[0020] Figure 3B is an exemplary schematic diagram of the recognized second mode provided according to an embodiment of the present disclosure.

[0021] Figure 4 is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0022] Figure 5A is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0023] Figure 5B is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0024] Figure 5C is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0025] Figure 5D is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0026] Figure 6A is an interactive schematic diagram of an exemplary implementation of the communication method provided according to embodiments of the present disclosure.

[0027] Figure 6B is an interactive schematic diagram of an exemplary implementation of the communication method provided according to embodiments of the present disclosure.

[0028] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure.

[0029] Figure 8A is an exemplary structural diagram of a communication device provided according to an embodiment of the present disclosure.

[0030] Figure 8B is an exemplary structural diagram of a chip provided according to an embodiment of the present disclosure. Detailed Implementation

[0031] This disclosure provides a communication method, communication device, communication system, storage medium, and program product.

[0032] In a first aspect, embodiments of this disclosure provide a communication method. The method is executed by a first node. The method includes: sending first information to a second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0033] In this embodiment, the first node sends first information to the second node to request the second node to perform a first operation. The first information includes authentication information, enabling the second node to authenticate the first node. Thus, when the first node, as an access network device communicating with the second node through a service-based interface, requests the second node to perform the first operation, the second node can use the authentication information to authenticate the first node. This prevents other nodes from impersonating the first node or tampering with the information used by the first node to enable the second node to execute the first operation, thereby achieving communication security between the first and second nodes.

[0034] In conjunction with some embodiments of the first aspect, in some embodiments, the second node may be an NRF.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, the identification information may be determined by the first node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the first node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0036] In conjunction with some embodiments of the first aspect, in some embodiments, the identification information may be determined by a third node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the third node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0037] In conjunction with some embodiments of the first aspect, in some embodiments the above method may further include: receiving authentication information sent by a third node.

[0038] In conjunction with some embodiments of the first aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0039] In conjunction with some embodiments of the first aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0040] In conjunction with some embodiments of the first aspect, in some embodiments, the above method may further include: receiving second information sent by a second node, wherein the second information is used to indicate that the first operation was successful.

[0041] In conjunction with some embodiments of the first aspect, in some embodiments, the first operation may include token generation for a first node, and the second information includes a token generated by a second node.

[0042] In conjunction with some embodiments of the first aspect, in some embodiments the above method may further include: receiving third information sent by a second node, wherein the third information is used to indicate authentication failure for the first node.

[0043] In a second aspect, embodiments of this disclosure provide a communication method. This method is executed by a second node. The method includes: receiving first information sent by a first node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0044] In this embodiment, the first node sends first information to the second node to request the second node to perform a first operation. The first information includes authentication information, enabling the second node to authenticate the first node. Thus, when the first node, as an access network device communicating with the second node through a service-based interface, requests the second node to perform the first operation, the second node can use the authentication information to authenticate the first node. This prevents other nodes from impersonating the first node or tampering with the information used by the first node to enable the second node to execute the first operation, thereby achieving communication security between the first and second nodes.

[0045] In conjunction with some embodiments of the second aspect, in some embodiments, the second node may be an NRF.

[0046] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may be determined by the first node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the first node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0047] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may be determined by a third node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the third node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0048] In conjunction with some embodiments of the second aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0049] In conjunction with some embodiments of the second aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0050] In conjunction with some embodiments of the second aspect, in some embodiments, the above method may further include: verifying the identification information.

[0051] In conjunction with some embodiments of the second aspect, in some embodiments, the operation of verifying the certification information may include at least one of the following: a digital signature of the certification information; a message verification code of the certification information; a second statement verifying the certification information; a third statement verifying the certification information; a fourth statement verifying the certification information; and a fifth statement verifying the certification information.

[0052] In conjunction with some embodiments of the second aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature; a message verification code.

[0053] In conjunction with some embodiments of the second aspect, in some embodiments, the above method may further include: determining that the verification of the identification information is successful; performing a first operation; and sending second information to a first node, wherein the second information indicates that the first operation is successful.

[0054] In conjunction with some embodiments of the second aspect, in some embodiments, the first operation may include token generation for the first node, and the second information includes a token generated by the second node.

[0055] In conjunction with some embodiments of the second aspect, in some embodiments, the first operation may include the registration and / or updating of the first node; wherein, the above method may further include: adding verification information to the configuration file of the first node to confirm successful verification.

[0056] In conjunction with some embodiments of the second aspect, in some embodiments, the above method may further include: determining that the verification of the authentication information has failed; sending third information to the first node, wherein the third information indicates that the authentication for the first node has failed.

[0057] In a third aspect, embodiments of this disclosure provide a communication method. This method is executed by a third node. The method includes: sending authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; the first node requests the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0058] In this embodiment, the third node can provide authentication information to the first node, enabling the first node to provide authentication information to the second node when sending first information to the second node to request the second node to perform a first operation. The second node can then authenticate the first node based on the authentication information. Thus, when the first node, as an access network device communicating with the second node through a service-based interface, requests the second node to perform a first operation, the second node can use the authentication information to authenticate the first node. This prevents other nodes from impersonating the first node or tampering with the information used by the first node to enable the second node to execute the first operation, thereby ensuring communication security between the first and second nodes.

[0059] In conjunction with some embodiments of the third aspect, in some embodiments, the identification information may include at least one of the following: a first statement indicating that the identification information is published by a third node; a second statement indicating that the identification information is identification information related to a first node; a third statement including identification information or type information of a second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0060] In conjunction with some embodiments of the third aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0061] In conjunction with some embodiments of the third aspect, in some embodiments, the above method may further include: receiving fourth information sent by the first node; and determining identification information based on the fourth information.

[0062] In conjunction with some embodiments of the third aspect, in some embodiments, the fourth information may include at least one of the following: identification information of the first node; identification information of the second node; type information of the second node; first indication information, wherein the first indication information is used to indicate the service role of the first node; and second indication information, wherein the second indication information is used to indicate the first node to request the second node to perform a first operation.

[0063] In conjunction with some embodiments of the third aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0064] In conjunction with some embodiments of the third aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0065] In a fourth aspect, embodiments of this disclosure provide a communication method. The method is executed by a communication system. The communication system includes a first node and a second node. The method includes: the first node sending first information to the second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0066] In conjunction with some embodiments of the fourth aspect, in some embodiments, the communication system further includes a third node; wherein the above method may further include: the third node sending identification information to the first node.

[0067] In a fifth aspect, embodiments of this disclosure provide a communication device. The communication device is a first node. The communication device includes a transceiver module. The transceiver module is configured to: send first information to a second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0068] In conjunction with some embodiments of the fifth aspect, in some embodiments, the second node may be an NRF.

[0069] In conjunction with some embodiments of the fifth aspect, in some embodiments, the identification information may be determined by the first node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the first node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0070] In conjunction with some embodiments of the fifth aspect, in some embodiments, the identification information may be determined by a third node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the third node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth scope statement including first instruction information, wherein the first instruction information is used to indicate the service role of the first node; and a fifth statement including second instruction information, wherein the second instruction information is used to indicate the first operation.

[0071] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module may also be configured to receive authentication information sent by a third node.

[0072] In conjunction with some embodiments of the fifth aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0073] In conjunction with some embodiments of the fifth aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0074] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module may also be configured to: receive second information sent by the second node, wherein the second information is used to indicate that the first operation was successful.

[0075] In conjunction with some embodiments of the fifth aspect, in some embodiments, the first operation may include token generation for the first node, and the second information includes a token generated by the second node.

[0076] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module may also be configured to: receive third information sent by the second node, wherein the third information is used to indicate authentication failure for the first node.

[0077] In a sixth aspect, embodiments of this disclosure provide a communication device. The communication device is a second node. The communication device includes a transceiver module. The transceiver module is configured to: receive first information sent by a first node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0078] In conjunction with some embodiments of the sixth aspect, in some embodiments, the second node may be an NRF.

[0079] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may be determined by the first node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the first node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0080] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may be determined by a third node; wherein the identification information includes at least one of the following: a first statement indicating that the identification information is published by the third node; a second statement indicating that the identification information is identification information related to the first node; a third statement including identification information or type information of the second node; a fourth statement indicating the service role of the first node; and a fifth statement indicating a first operation.

[0081] In conjunction with some embodiments of the sixth aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0082] In conjunction with some embodiments of the sixth aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0083] In conjunction with some embodiments of the sixth aspect, in some embodiments, the above-described communication device may further include a processing module; the processing module is configured to: verify the identification information.

[0084] In conjunction with some embodiments of the sixth aspect, in some embodiments, the operation of verifying the certification information may include at least one of the following: a digital signature of the certification information; a message verification code of the certification information; a second statement verifying the certification information; a third statement verifying the certification information; a fourth statement verifying the certification information; and a fifth statement verifying the certification information.

[0085] In conjunction with some embodiments of the sixth aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature; a message verification code.

[0086] In conjunction with some embodiments of the sixth aspect, in some embodiments, the processing module may also be configured to: determine that the verification of the identification information is successful and perform the first operation; the transceiver module may also be configured to: send second information to the first node, wherein the second information indicates that the first operation is successful.

[0087] In conjunction with some embodiments of the sixth aspect, in some embodiments, the first operation may include token generation for the first node, and the second information includes a token generated by the second node.

[0088] In conjunction with some embodiments of the sixth aspect, in some embodiments, the first operation may include the registration and / or updating of the first node; wherein, the processing module may also be configured to add information confirming successful verification of the authentication information to the configuration file of the first node.

[0089] In conjunction with some embodiments of the sixth aspect, in some embodiments, the processing module may also be configured to: determine that the verification of the authentication information has failed; the transceiver module may also be configured to: send third information to the first node, wherein the third information indicates that the authentication for the first node has failed.

[0090] In a seventh aspect, embodiments of this disclosure provide a communication device. The communication device is a third node. The communication device includes a transceiver module. The transceiver module is configured to: send authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; the first node requests the second node to perform a first operation, the first operation being a service operation of a network function service of the second node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0091] In conjunction with some embodiments of the seventh aspect, in some embodiments, the identification information may include at least one of the following: a first statement indicating that the identification information is published by a third node; a second statement indicating that the identification information is identification information related to a first node; a third statement including identification information or type information of a second node; a fourth statement indicating the service role of the first node; and a fifth statement including second instruction information, wherein the second instruction information is used to indicate a first operation.

[0092] In conjunction with some embodiments of the seventh aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0093] In conjunction with some embodiments of the seventh aspect, in some embodiments, the communication device described above may further include a processing module. The transceiver module may also be configured to receive fourth information sent by the first node. The processing module may be configured to determine identification information based on the fourth information.

[0094] In conjunction with some embodiments of the seventh aspect, in some embodiments, the fourth information may include at least one of the following: identification information of the first node; identification information of the second node; type information of the second node; first indication information, wherein the first indication information is used to indicate the service role of the first node; and second indication information, wherein the second indication information is used to indicate the first node to request the second node to perform a first operation.

[0095] In conjunction with some embodiments of the seventh aspect, in some embodiments, the first operation may include at least one of the following: registration of the first node; updating of the first node; deregistration of the first node; discovery of service providers for the first node; and generation of tokens for the first node.

[0096] In conjunction with some embodiments of the seventh aspect, in some embodiments, the service role of the first node may include one of the following: a service provider; a service consumer.

[0097] In an eighth aspect, embodiments of this disclosure provide a communication device. This communication device is used to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0098] In a ninth aspect, embodiments of this disclosure provide a communication system. The communication system includes at least one of the following: a first node, a second node, and a third node. The first node is configured to perform the communication method as described in any of the first aspect and its possible embodiments. The second node is configured to perform the communication method as described in any of the second aspect and its possible embodiments. The third node is configured to perform the communication method as described in any of the third aspect and its possible embodiments.

[0099] In a tenth aspect, embodiments of this disclosure provide a storage medium. The storage medium stores instructions. When executed on a communication device, the instructions cause the communication device to perform the communication method as described in any of the first, second, third, and possible embodiments thereof.

[0100] In an eleventh aspect, embodiments of this disclosure provide a program product. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in any of the first, second, third, and possible embodiments thereof.

[0101] In a twelfth aspect, embodiments of this disclosure provide a computer program. When run on a computer, the computer program causes the computer to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0102] In a thirteenth aspect, embodiments of this disclosure provide a chip or chip system. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0103] It is understood that the aforementioned communication devices, communication systems, storage media, program products, computer programs, chips, and chip systems are all used to execute the methods provided in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0104] This disclosure provides a communication method, a communication device, a communication system, a storage medium, and a program product. In some embodiments, terms such as communication method, information processing method, and information transmission method can be used interchangeably; terms such as communication device, communication equipment, network equipment, network function, and network entity can be used interchangeably; and terms such as communication system and information processing system can be used interchangeably.

[0105] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0106] In the embodiments disclosed herein, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the various embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0107] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0108] In this embodiment of the disclosure, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the," "the," "the," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression.

[0109] In the embodiments of this disclosure, "a plurality of" means two or more.

[0110] In some embodiments, the terms “at least one of A or B, at least one of A and B”, “one or more”, “a plurality of”, “multiple”, etc., may be used interchangeably.

[0111] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "in response to one case A, in response to another case B", etc., may include the following technical solutions depending on the situation: in some embodiments, A (execute A regardless of whether there is a branch B); in some embodiments, B (execute B regardless of whether there is a branch A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, both A and B are executed. The same applies when there are more branches such as A, B, C, etc.

[0112] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execute A regardless of whether a branch B exists); in some embodiments, B (execute B regardless of whether a branch A exists); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, and C.

[0113] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. Similarly, if the object being described is "information", then "first information" and "second information" can be the same information or different information, and their content can be the same or different.

[0114] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0115] In some embodiments, terms such as “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “when…”, “if…”, etc. can be used interchangeably. These descriptions all refer to the device making a corresponding action under certain objective circumstances. They do not necessarily limit the time, nor do they require the device to make a judgment action when implementing it, nor do they mean that there must be other limitations.

[0116] In some embodiments, terms such as “greater than,” “more than,” “higher than,” and “exceeding” can be used interchangeably; terms such as “greater than or equal to,” “not less than,” “more than or equal to,” “not less than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably; terms such as “less than,” “less than,” and “lower than” can be used interchangeably; and terms such as “less than or equal to,” “not greater than,” “less than or equal to,” “not more than,” “lower than or equal to,” “not higher than,” and “below” can be used interchangeably.

[0117] In some embodiments, devices, etc., can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as “device”, “equipment”, “circuit”, “network element”, “node”, “function”, “unit”, “section”, “system”, “network”, “chip”, “chip system”, “entity”, and “subject” can be used interchangeably.

[0118] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0119] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0120] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", and "client" can be used interchangeably.

[0121] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0122] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0123] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0124] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0125] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0126] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure. As shown in Figure 1, the communication system 100 includes a first node 101, a second node 102, and a third node 103.

[0127] In some embodiments, the first node 101 may be an access network device. In some embodiments, the first node 101 may be a service-based access network device.

[0128] In some embodiments, the second node 102 may support service discovery functions, maintain NF configuration files for available NF instances, etc.

[0129] In some embodiments, the second node 102 may be a network repository function (NRF).

[0130] In some embodiments, the third node 103 may be a core network function.

[0131] In some embodiments, the third node 103 may be responsible for providing security-related services or functions.

[0132] In some embodiments, the third node 103 may be, for example, a security service network function (SSNF).

[0133] In some embodiments, the access network device is, for example, a node or device that connects a terminal to a wireless network. In some embodiments, the access network device may include, but is not limited to, at least one of the following in a 5G communication system: evolved Node B (eNB), next-generation evolved Node B (ng-eNB), next-generation Node B (gNB), node B (NB), home node B (HNB), home evolved node B (HeNB), radio backhaul device, radio network controller (RNC), base station controller (BSC), base transceiver station (BTS), base band unit (BBU), mobile switching center, base station in a 6G communication system, open RAN, cloud RAN, base station in other communication systems, and access node in a Wi-Fi system.

[0134] In some embodiments, the technical solutions of this disclosure can be applied to Open Radio Access Network (Open RAN) architectures. In this case, the interfaces between or within access network devices involved in the embodiments of this disclosure can be transformed into internal interfaces of Open RAN. The processes and information interactions between these internal interfaces can be implemented by software or programs.

[0135] In some embodiments, core network equipment may be network elements deployed in the core network. Network elements may be virtual or physical. The core network includes, for example, at least one of the Evolved Packet Core (EPC), 5G Core Network (5GCN), and Next Generation Core (NGC).

[0136] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions proposed in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions proposed in this disclosure are also applicable to similar technical problems.

[0137] The following embodiments of this disclosure can be applied to the communication system 100 shown in FIG1, or to some of the main bodies, but are not limited thereto. The main bodies shown in FIG1 are illustrative. The communication system may include all or some of the main bodies in FIG1, or may include other main bodies outside of FIG1. ​​The number and form of each main body are arbitrary. Each main body may be physical or virtual. The connection relationship between the main bodies is illustrative. The main bodies may not be connected or may be connected. The connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0138] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other communication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0139] According to the white paper titled "6G Architecture Blueprint" published by the 5G Infrastructure Public-Private Partnership (5GPPP), the new 6G architecture should support highly efficient (streamlining) network functions, making them more efficient in terms of capacity, coverage, signaling load, scalability, and energy consumption. Dependencies between network functions can cause unnecessary complexity and even latency. Redesigning network functions can reduce the number of dependencies and processing points. In some embodiments, one way to improve the 6G architecture is to increase the possibility of direct signaling transmission between network functions, thereby eliminating potential bottlenecks. Currently, many services require information transmission between access network devices through the core network. For example, information transmission between NG-RAN devices requires 5GC. In 5GC, although information relay is achieved through the access management function (AMF), information transmission itself requires little or no AMF. To make such information transmission more efficient, service-based interfaces can be introduced for access network devices. This interface allows for direct information exchange between access network devices and network functions, or between access network devices, without going through the AMF.

[0140] Figure 2 is an exemplary schematic diagram of a service-based communication system architecture provided according to an embodiment of the present disclosure. In this communication system architecture, the service-based interface is used for the control plane.

[0141] As shown in Figure 2, in the communication system architecture, the AMF, Session Management Function (SMF), Network Data Analytics Function (NWDAF), Network Exposure Function (NEF), Location Management Function (LMF), Network Repository Function (NRF), Policy Control Function (PCF), Unified Data Management (UDM), and UE Capability Management Function (UCMF) provide corresponding services through service-based interfaces. The UE communicates with the AMF through the N1 interface. The UE communicates with the Next Generation Radio Access Network (NG-RAN) through the Uu interface. The NG-RAN communicates with the AMF through the N2 interface. The NG-RAN communicates with the UPF through the N3 interface. The User Plane Function (UPF) communicates with the SMF through the N4 interface. The UPF communicates with the data network (DN) through the N6 interface.

[0142] Furthermore, NG-RAN can provide services through service-based interfaces. As shown in Figure 2, the service-based interface of NG-RAN can be the Nran interface. NG-RAN can expose its own functionality through service-based interfaces.

[0143] In some embodiments, access network devices such as NG-RAN, when having a service-based interface, may be referred to as service-based access network devices.

[0144] For a long time, base stations have been developed in a single, integrated manner to ensure optimal performance as the "last mile." In some embodiments, the focus on performance should not hinder the exploration of service-based access network equipment. When facing the demands of new services and scenarios in the future, the primary focus can be on the network's adaptability to various scenarios. At the network function layer, necessary network functions can be flexibly combined as needed to provide personalized network services. To optimize network adaptability, research on service-based access network equipment is of paramount importance in future network architecture design.

[0145] In some embodiments, if the access network device evolves to a service-based architecture, it means that the access network device needs to directly interact with network functions other than the AMF (e.g., SMF, LMF, PCF) to consume or provide network services. In other words, the access network device can be a network function consumer (NF consumer) providing services to network functions other than the AMF, or a network function producer (NF producer) providing services to network functions other than the AMF. In some embodiments, in addition to the existing NF types in the core network, the access network device can be regarded as a new type of network function in the radio access network in a service-based architecture (SBA).

[0146] In some embodiments, existing security mechanisms for service-based architectures and / or interfaces can only be applied to network functions in the core network. The main security difference between access network devices and core network functions is that access network devices operate in a higher-risk environment and are more vulnerable to physical attacks compared to core network functions.

[0147] In some embodiments, where the existing 5G service-based architecture only includes core network functions, authentication between core network functions can be achieved in two ways.

[0148] In some embodiments, the case of direct communication is described. In one example, if the public land mobile network (PLMN) uses protection at the transport layer, authentication provided by the transport layer protection solution can be used for authentication between network functions. In one example, if the PLMN does not use protection at the transport layer, authentication between network functions within a PLMN can be implicitly provided by network domain security (NDS) / Internet Protocol (IP) or physical security.

[0149] In some embodiments, the scenario of indirect communication is described. In one example, the network function service provider and the network function service consumer may use implicit authentication, which relies on authentication between the network function service consumer and the service communication proxy (SCP), as well as authentication between the SCP and the network function service provider. Authentication may be provided by a transport layer protection solution, and / or NDS / IP, and / or physical security. In one example, additional authentication of the network function service consumer may be required, in which case the network function service provider may implement additional authentication of the network function service consumer by authenticating client credentials assertion (CCA).

[0150] In some embodiments, the fundamental concept of the NDS / IP architecture is to provide hop-by-hop security. In one example, current backhaul applications from access network devices to the core network employ hop-by-hop security. For communication between access network devices and core network functions, hop-by-hop security depends on the trusted and secure environment of the intermediate nodes between the access network devices and core network functions.

[0151] In some embodiments, access network devices located in higher-risk environments may be vulnerable to attack, but this may not be detected by any intermediate nodes. In such cases, communication between the access network devices and the core network functions is no longer secure, and the core network functions may not even detect this situation.

[0152] In some embodiments, the access network device is not at risk of being attacked, but one or more intermediate nodes cannot be fully trusted. Since the intermediate nodes can terminate security protection, the intermediate nodes may tamper with the communication between the access network device and the core network functions, or impersonate the access network device to communicate with the core network device.

[0153] In some embodiments, in networks such as 6G, if access network nodes deployed at high-risk edges of the network are service-based and can directly interact with network functions of various core networks other than the AMF, relying solely on existing SBA security mechanisms may not be sufficient to protect communication between access network devices and core network functions.

[0154] In some embodiments, when a service-based access network device acts as a service consumer, it needs to provide a corresponding security mechanism to implement authentication related to the access network device.

[0155] In some embodiments, in a service-based scenario, the access network device can act as either a service consumer or a service producer. Before requesting or providing a network service, the service-based access network device needs to register, update, or deregister the network services it supports with the NRF. When the service-based access network device acts as a service consumer, it needs to obtain an access token from the NRF, which is used by the NRF to authorize access to the services provided by the provider. Due to the risks inherent in the physical environment of service-based access network devices, the processes of registering, updating, and deregistering network services, as well as the access token request process, require additional security mechanisms to protect the core network from potential attacks exploiting vulnerabilities in the access network device.

[0156] Therefore, how to protect the communication between service-based access network devices and NRF is a technical problem that urgently needs to be solved.

[0157] Here, important concepts and terms involved in the embodiments of this disclosure are explained.

[0158] 1. OAuth 2.0

[0159] OAuth 2.0 is an authorization architecture that grants third-party applications restricted access to protected HTTP origins. In OAuth 2.0, third-party applications can be referred to as clients. These clients access protected resources by submitting an access token to the HTTP origin. The access token is issued to the client by the authorization server with the consent of the resource owner. In some embodiments, the access token can be obtained by exchanging an authorization grant. An authorization grant represents authorization granted from the resource owner.

[0160] 2. Assertion

[0161] Identification is a type of information packet. This packet facilitates the sharing of identification and security information between security domains.

[0162] In some embodiments, the entity that creates, signs, and / or protects the integrity of the assertion can be considered the issuer of the assertion. In some embodiments, the entity that consumes the assertion and relies on the information in the assertion can be considered the dependent party of the assertion. In some embodiments, the integrity of the assertion can be protected by using a digital signature or message authentication code (MAC) adopted by the issuer. The digital signature or MAC can be used to authenticate the issuer or ensure the integrity of the assertion content. In some embodiments, the assertion can be issued by a third party and can be protected from tampering by the client providing the assertion. In some embodiments, the assertion can be encrypted to prevent unauthorized parties from viewing the content of the assertion.

[0163] In some embodiments, the acquisition of recognition can be achieved through different modes.

[0164] Figure 3A is an exemplary schematic diagram of a first mode of obtaining authentication according to an embodiment of the present disclosure. As shown in Figure 3A, in the first mode, the customer obtains authentication from a third-party entity capable of issuing, updating, converting, and verifying security tokens.

[0165] Figure 3B is an exemplary schematic diagram of a second mode of obtaining authentication according to an embodiment of the present disclosure. As shown in Figure 3B, in the second mode, the customer creates the authentication locally. In order to use a signature or message verification code for the authentication, the customer must obtain key materials, such as a symmetric key or an asymmetric key pair.

[0166] In some embodiments, the authentication can be used for OAuth 2.0 authorization granting. In some embodiments, the authentication can be used for OAuth 2.0 customer authentication. It should be noted that authorization granting and customer authentication can be implemented together or separately.

[0167] In some embodiments, the assertions used in OAuth 2.0 may include at least one of the following: publisher, subject, audience, publication time, timeout, assertion identifier, and scope.

[0168] In some embodiments, the issuer may indicate a unique identifier for the entity issuing the certification. In some embodiments, the issuer may be one of the following: a client, a third-party security token service (STS).

[0169] In some embodiments, the subject can refer to an identified entity. In one example, identification can be used for customer authentication, whereby the subject identifies the customer to the authorization server by using a value of the customer's identifier from the OAuth customer. In another example, authentication can be used for authorization granting, whereby the subject can identify the authorized access party (e.g., a resource owner or authorized representative) requesting an access token.

[0170] In some embodiments, the audience may include a value that identifies the party to be identified.

[0171] In some embodiments, the issued time can indicate the time at which the publication was determined.

[0172] In some embodiments, the timeout period (expires at) can indicate the time at which the timeout is determined.

[0173] In some embodiments, the assertion ID may be a temporary or unique identifier for the assertion.

[0174] In some embodiments, the scope may be used to indicate the scope of authorization.

[0175] In some embodiments, the authentication can be a JWT (JSON Web Token) authentication. In one example, the JWT authentication can be in JWT format. In this case, the authentication identifier can be a JWT authentication identifier.

[0176] In some embodiments, the publisher, subject, audience, publication time, timeout period, identification identifier, scope, etc., in the identification may take the form of a claim. In some embodiments, the identification may include one or more claims. These claims may include at least one of the following: publisher claim, subject claim, audience claim, publication time claim, timeout period claim, identification identifier claim, and scope claim.

[0177] In some embodiments, the assertion may also be referred to as assertion information. In some embodiments, the assertion may also be referred to as an assertion.

[0178] Figure 4 is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. The communication method involved in this embodiment can be applied to a communication system 100. As shown in Figure 4, the communication method of this embodiment includes steps S401 to S408.

[0179] In step S401, the first node 101 sends the fourth information to the third node 103.

[0180] In some embodiments, the first node 101 may send fourth information. In some embodiments, the fourth information may be sent by the first node 101, but is not limited thereto, and may also be sent by other entities.

[0181] In some embodiments, the third node 103 may receive fourth information. In some embodiments, the fourth information may be received by the third node 103, but is not limited thereto, and may also be received by other entities.

[0182] In some embodiments, the first node 101 may be a service-based access network device. In some embodiments, the first node 101 may be an access network device that can communicate with the second node 102 through a service-based interface. In some embodiments, the first node 101 may communicate with the second node 102 through a service-based interface.

[0183] In some embodiments, the first node 101 may be a service consumer. In some embodiments, the service role of the first node 101 may be that of a service consumer.

[0184] In some embodiments, the first node 101 may be a service provider. In some embodiments, the service role of the first node 101 may be that of a service provider.

[0185] In some embodiments, the second node 102 may be an NRF.

[0186] In some embodiments, the third node 103 may be responsible for managing the first node 101 and the service-based network functions in the core network. In some embodiments, the third node 103 may be used to provide security services for the first node 101 and the service-based network functions in the core network.

[0187] In some embodiments, the fourth information can be used by the third node 103 to determine the identification information. In some embodiments, the fourth information can be used to request the third node 103 to generate the identification information. In some embodiments, the fourth information can be used to provide the third node 103 with the information required to generate the identification information.

[0188] In some embodiments, the assertion information, also referred to as assertion or claim, can be used to perform client authentication. In some embodiments, the assertion information can be used by the second node 102 to authenticate the first node 101.

[0189] In some embodiments, the name of the fourth information is not limited, and it may be, for example, identification information request information, identification information generation trigger information, etc.

[0190] In some embodiments, the fourth information may include at least one of the following: identification information of the first node 101, identification information of the second node 102, type information of the second node 102, first indication information, and second indication information.

[0191] In some embodiments, the identification information of the first node 101 can be used to identify the first node 101. In one example, the identification information of the first node 101 may include an identifier of the first node 101. For example, the first node 101 may include the RAN ID of the first node 101.

[0192] In some embodiments, the identification information of the second node 102 can be used to identify the second node 102. In one example, the identification information of the second node 102 may include an identifier of the second node 102. In another example, the identification information of the second node 102 may include an identifier of an instance of the second node 102.

[0193] In some embodiments, the type information of the second node 102 can be used to indicate the type of the second node 102. In some embodiments, the type information of the second node 102 may indicate an NRF.

[0194] In some embodiments, the first indication information may be used to indicate the role of the first node 101. In embodiments of this disclosure, the role may also be referred to as a service role. In one example, the first indication information may indicate that the role of the first node 101 is a service consumer or a service provider.

[0195] In some embodiments, the second indication information may be used to instruct the first node 101 to request the second node 102 to perform a first operation. In some embodiments, the first operation may be a service operation in the network function service of the second node 102.

[0196] In some embodiments, the first node 101 may wish to register with the second node 102. For example, the first node 101 may be a newly deployed service-based access network device. For instance, the first node 101 may transition from a powered-off or offline state to an operational state. Therefore, the first node 101 may register with the second node 102 and store its own profile in the second node 102. In this case, the first operation that the first node 101 requests the second node 102 to perform may be the registration of the first node 101.

[0197] In some embodiments, the first node 101 may want to update its registration in the second node 102. For example, the configuration of the first node 101 may change. Then, the first node 101 may update the configuration file of the first node 101 stored in the second node 102. In this case, the first operation that the first node 101 requests the second node 102 to perform may be an update by the first node 101.

[0198] In some embodiments, the first node 101 may want to remove its registration from the second node 102. For example, the first node 101 may be powered off smoothly. For example, the first node 101 may be disconnected from the network. In this case, the first node 101 may be able to unregister from the second node 102. The first operation that the first node 101 requests the second node 102 to perform may be the unregistration of the first node 101.

[0199] In some embodiments, the first node 101 may be a service consumer and wants to determine the service provider through the second node 102. Then, the first node 101 can discover a suitable service provider through the second node 102. For example, the service provider may be a core network function or another service-based access network device. In this case, the first operation that the first node 101 requests the second node 102 to perform may be the discovery of the service provider for the first node 101.

[0200] In some embodiments, the first node 101 may be a service consumer and desires to obtain a token. This token can be used by the first node 101 to access the service provider. Then, the first node 101 may request the second node 102 to generate the token, thereby obtaining the token through the second node 102. In this case, the first operation that the first node 101 requests the second node 102 to perform may be the generation of a token for the first node 101.

[0201] In some embodiments, the first operation may include one or more of the following: registration of the first node 101, updating of the first node 101, deregistration of the first node 101, discovery of service providers for the first node 101, and token generation for the first node 101. In one example, the first node 101 may request the second node 102 to perform one of the following operations: registration of the first node 101, updating of the first node 101, deregistration of the first node 101, discovery of service providers for the first node 101, and token generation for the first node 101. In one example, the first node 101 may request the second node 102 to perform multiple operations: registration of the first node 101, updating of the first node 101, deregistration of the first node 101, discovery of service providers for the first node 101, and token generation for the first node 101. In one example, the first operation may include registration and / or updating of the first node 101. In one example, the first operation may include registration and / or updating of the first node 101, and discovery of service providers for the first node 101. In one example, the first operation may include registration and / or updating of the first node 101, and token generation for the first node 101. In another example, the first operation may include registration and / or updating of the first node 101, discovery of service providers for the first node 101, and token generation for the first node 101. In yet another example, the first operation may include deregistration of the first node 101, and token generation for the first node 101. It should be noted that the first operation may also have other combinations, and may also include other operations performed by the second node 102; this disclosure does not specifically limit these aspects.

[0202] In some embodiments, the fourth information may be carried in a request message. This request message can be used to request identification information from the third node 103. The first node 101 can send the fourth information to the third node 103 through the request message.

[0203] In step S402, the third node 103 determines the identification information.

[0204] In some embodiments, the third node 103 may determine the identification information upon receiving the fourth information. In some embodiments, the identification information may be generated based on the fourth information.

[0205] In some embodiments, the identification information may include at least one of the following: a first statement, a second statement, a third statement, a fourth statement, and a fifth statement. In some embodiments, the first statement may indicate the publisher of the identification information. For example, the first statement may be a publisher statement. In some embodiments, the second statement may indicate the subject of the identification information. For example, the second statement may be a subject statement. In some embodiments, the third statement may indicate the party verifying the identification information. For example, the third statement may be an audience statement. In some embodiments, the fourth statement may indicate the authorized scope of the identification information. For example, the fourth statement may be a scope statement. In some embodiments, the fifth statement may indicate a first operation. For example, the fifth statement may be an additional statement. In one example, the identification information may include at least one of the following: a publisher statement, a subject statement, an audience statement, a scope statement, and an additional statement. It should be noted that one or more of the first statement, second statement, third statement, fourth statement, and fifth statement may also have other names, and this disclosure does not specifically limit this.

[0206] In some embodiments, the identification information may further include at least one of the following: a timeout declaration, a publication time declaration, and an identification information identifier.

[0207] In some embodiments, a publisher statement can be used to indicate the publisher of the identification information. In some embodiments, a publisher statement may include identification information of a third node 103, in which case the publisher statement may indicate that the publisher of the identification information is the third node 103.

[0208] In some embodiments, a subject declaration can be used to indicate the subject of the identification information. In some embodiments, the subject declaration may include the identification information of the first node 101, in which case the subject declaration may indicate that the subject of the identification information is the first node 101.

[0209] In some embodiments, an audience claim can be used to instruct a party to examine the assertion information. In some embodiments, the audience claim may include identification information for the second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 identified by the identification information. In some embodiments, the audience claim may include type information for the second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 of the type indicated by the type information. For example, the audience claim may indicate that the type of the second node 102 is NRF.

[0210] In some embodiments, a scope statement can be used to indicate the scope of authorization for the identification information. In some embodiments, a scope statement can indicate the service role of the first node 101. In some embodiments, a scope statement can include first indication information. In some embodiments, a scope statement can be determined based on the first indication information. For example, a scope statement can indicate that the service role of the first node 101 is a service consumer. For example, a scope statement can indicate that the service role of the first node 101 is a service provider.

[0211] In some embodiments, an additional statement may be used to indicate a first operation. In some embodiments, the additional statement may be determined based on second indication information. In some embodiments, the additional statement may include second indication information. In some embodiments, the second indication information in the additional statement may indicate a first operation. In some embodiments, the first operation indicated by the additional statement may include at least one of the following: registration of the first node 101, updating of the first node 101, deregistration of the first node 101, discovery of a service provider for the first node 101, and token generation for the first node 101.

[0212] It should be noted that different additional declarations can be used to indicate the registration, update, and deregistration of the first node 101. However, in some cases, the additional declarations can also provide a unified instruction for the registration, update, and deregistration of the first node 101. For example, the additional declaration can instruct on the registration of the first node 101, without distinguishing between the registration, update, and deregistration operations. In this way, the additional declarations can be the same for the registration, update, and deregistration operations of the first node 101.

[0213] In some embodiments, a timeout declaration can be used to indicate a timeout period after which the assessment information is no longer accepted. In other words, after this timeout period, the assessment information is no longer accepted, i.e., the assessment information becomes invalid. In some embodiments, a timeout declaration can indicate a period of time or a point in time. If the assessment information becomes invalid after the time period or point in time has expired.

[0214] In some embodiments, the publication time statement can be used to indicate the time when the identification information was generated. In some embodiments, the publication time statement can indicate a point in time when the identification information was generated by the third node 103.

[0215] In some embodiments, the identification information identifier can be used to uniquely identify the identification information.

[0216] In some embodiments, the identification information may include at least a publisher statement, a subject statement, an audience statement, a scope statement, and additional statements. In some embodiments, the identification information may also include one or more of the following: a timeout statement, a publication time statement, and an identification information identifier.

[0217] In some embodiments, if the fourth information includes the identification information of the second node 102, the third node 103 can obtain the identification information of the second node 102 from the fourth information and add it to the audience statement of the identification information. In some embodiments, if the fourth information includes the type information of the second node 102, the third node 103 can obtain the type information of the second node 102 from the fourth information and add it to the audience statement of the identification information.

[0218] In some embodiments, a trust relationship may exist between the third node 103 and the second node 102. In some embodiments, the third node 103 and the second node 102 may have already completed mutual authentication. In some embodiments, the third node 103 may be configured with a private key, and the second node 102 may be configured with a certificate and / or a public key. The private key in the third node 103 and the certificate and / or public key in the second node 102 may be associated. In some embodiments, the third node 103 and the second node 102 may share a symmetric key.

[0219] In some embodiments, the third node 103 can use a private key to protect the authentication information. In one example, the third node 103 can determine a digital signature of the authentication information based on its private key. This digital signature can be used to protect the authentication information.

[0220] In some embodiments, the third node 103 can utilize a symmetric key to protect the authentication information. In one example, the third node 103 can determine a message verification code for the authentication information based on a symmetric key shared between the second node 102 and the third node 103. This message verification code can be used to protect the authentication information.

[0221] In some embodiments, after generating the authentication information, the third node 103 may use digital signatures and / or message verification codes to protect the generated authentication information.

[0222] In step S403, the third node 103 sends the authentication information to the first node 101.

[0223] In some embodiments, the third node 103 may send authentication information. In some embodiments, the authentication information may be sent by the third node 103, but is not limited thereto, and may also be sent by other entities.

[0224] In some embodiments, the first node 101 may receive authentication information. In some embodiments, the authentication information may be received by the first node 101, but is not limited thereto, and may also be received by other entities.

[0225] In some embodiments, the third node 103 may send the determined identification information to the first node 101.

[0226] In some embodiments, the identification information may be carried in a response message. This response message may be sent in response to the request message in step S401. The third node 103 can send the identification information to the first node 101 through the response message.

[0227] In step S404, the first node 101 obtains the identification information.

[0228] In some embodiments, the first node 101 may receive authentication information from the third node 103. In some embodiments, the first node 101 may obtain the authentication information from a response message from the third node 103 and store the authentication information.

[0229] In some embodiments, the first node 101 can determine the identification information locally. In this case, steps S401 to S403 may not be executed, and the identification information may be generated by the first node 101.

[0230] In some embodiments, the identification information determined by the first node 101 may include at least one of the following: publisher statement, subject statement, audience statement, scope statement, additional statement, timeout statement, publication time statement, and identification information identifier.

[0231] In some embodiments, a publisher statement can be used to indicate the publisher of the identification information. In some embodiments, a publisher statement may include the identification information of the first node 101, in which case the publisher statement may indicate that the publisher of the identification information is the first node 101.

[0232] In some embodiments, a subject declaration can be used to indicate the subject of the identification information. In some embodiments, the subject declaration may include the identification information of the first node 101, in which case the subject declaration may indicate that the subject of the identification information is the first node 101.

[0233] In some embodiments, an audience claim can be used to instruct a party to examine the assertion information. In some embodiments, the audience claim may include identification information for the second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 identified by the identification information. In some embodiments, the audience claim may include type information for the second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 of the type indicated by the type information. For example, the audience claim may indicate that the type of the second node 102 is NRF.

[0234] In some embodiments, a scope statement can be used to indicate the scope of authorization for the identification information. In some embodiments, a scope statement can indicate the service role of the first node 101. In some embodiments, a scope statement can include first indication information. In some embodiments, a scope statement can be determined based on the first indication information. For example, a scope statement can indicate that the service role of the first node 101 is a service consumer. For example, a scope statement can indicate that the service role of the first node 101 is a service provider.

[0235] In some embodiments, an additional statement may be used to indicate a first operation. In some embodiments, the additional statement may be determined based on second indication information. In some embodiments, the additional statement may include second indication information. In some embodiments, the second indication information in the additional statement may indicate a first operation. In some embodiments, the first operation indicated by the additional statement may include at least one of the following: registration of the first node 101, updating of the first node 101, and deregistration of the first node 101.

[0236] It should be noted that different additional declarations can be used to indicate the registration, update, and deregistration of the first node 101. However, in some cases, the additional declarations can also provide a unified instruction for the registration, update, and deregistration of the first node 101. For example, the additional declaration can instruct on the registration of the first node 101, without distinguishing between the registration, update, and deregistration operations. In this way, the additional declarations can be the same for the registration, update, and deregistration operations of the first node 101.

[0237] In some embodiments, a timeout declaration can be used to indicate a timeout period after which the assessment information is no longer accepted. In other words, after this timeout period, the assessment information is no longer accepted, i.e., the assessment information becomes invalid. In some embodiments, a timeout declaration can indicate a period of time or a point in time. If the assessment information becomes invalid after the time period or point in time has expired.

[0238] In some embodiments, the publication time statement can be used to indicate the time when the identification information was generated. In some embodiments, the publication time statement can indicate a point in time when the identification information was generated by the third node 103.

[0239] In some embodiments, the identification information identifier can be used to uniquely identify the identification information.

[0240] In some embodiments, the identification information may include at least a publisher statement, a subject statement, an audience statement, a scope statement, and additional statements. In some embodiments, the identification information may also include one or more of the following: a timeout statement, a publication time statement, and an identification information identifier.

[0241] In some embodiments, a trust relationship may exist between the first node 101 and the second node 102. In some embodiments, the first node 101 and the second node 102 may have already completed mutual authentication. In some embodiments, the first node 101 may be configured with a private key, and the second node 102 may be configured with a certificate and / or a public key. The private key in the first node 101 and the certificate and / or public key in the second node 102 may be associated. In some embodiments, the first node 101 and the second node 102 may share a symmetric key.

[0242] In some embodiments, the first node 101 can use a private key to protect the authentication information. In one example, the first node 101 can determine a digital signature of the authentication information based on the private key of the third node 103. This digital signature can be used to protect the authentication information.

[0243] In some embodiments, the first node 101 can utilize a symmetric key to protect the authentication information. In one example, the first node 101 can determine a message verification code for the authentication information based on a symmetric key shared between the second node 102 and the first node 101. This message verification code can be used to protect the authentication information.

[0244] In some embodiments, after generating the authentication information, the first node 101 may use digital signatures and / or message verification codes to protect the generated authentication information.

[0245] In step S405, the first node 101 sends the first information to the second node 102.

[0246] In some embodiments, the first node 101 may send first information. In some embodiments, the first information may be sent by the first node 101, but is not limited thereto, and may also be sent by other entities.

[0247] In some embodiments, the second node 102 may receive the first information. In some embodiments, the first information may be received by the second node 102, but is not limited thereto, and may also be received by other entities.

[0248] In some embodiments, upon obtaining identification information, the first node 101 may send first information to the second node 102.

[0249] In some embodiments, the first information may be used to request the second node 102 to perform the first operation.

[0250] In some embodiments, the name of the first information is not limited, and it may be, for example, operation request information, operation instruction information, etc.

[0251] In some embodiments, the first information may include identification information. In one example, the first information may include identification information determined by the third node 103. In another example, the first information may include identification information determined by the first node 101.

[0252] In some embodiments, the first information may further include identification information of the first node 101. In some embodiments, the identification information of the first node 101 carried in the first information may be used to indicate the sender of the first information.

[0253] In some embodiments, the first information can be sent via a service-based interface. In some embodiments, the first node 101 can send the first information to the second node 102 via the service-based interface.

[0254] In some embodiments, the first information may be carried in a registration request message. This update request message can be used to request the registration of the first node 101 in the second node 102. In this case, additional declarations of identification information in the first information may indicate a first operation to register the first node 101. In some embodiments, the registration request message may also carry a configuration file of the first node 101. This configuration file may, for example, be a new configuration file.

[0255] In some embodiments, the first information may be carried in an update request message. This update request message may be used to request an update to the configuration file of the first node 101 in the second node 102. In this case, additional declarations of identification information in the first information may indicate that the first operation is to update the first node 101. In some embodiments, the update request message may also carry the configuration file of the first node 101. This configuration file may, for example, be an updated configuration file.

[0256] In some embodiments, the first information may be carried in a deregistration request message. This deregistration request message may be used to request the removal of the first node 101 from the second node 102. In this case, additional statements of identification information in the first information may indicate that the first operation is to deregister the first node 101. In some embodiments, the deregistration request message may also carry indication information indicating that the first node 101 is unavailable.

[0257] In some embodiments, the first information may be carried in a discovery request message. This discovery request message may be used to request the second node 102 to provide available service providers. In this case, additional statements of identification information in the first information may instruct the first operation to discover a service provider for the first node 101. In some embodiments, the discovery request message may also carry identification information of the service provider to be discovered, and / or demand information for the required service.

[0258] In some embodiments, the first information may be carried in a token request message. This token request message can be used to request a token from the second node 102 to enable the first node 101 to access the service provider's services. In this case, additional claims of authentication information in the first information may instruct the first operation to generate a token for the first node 101.

[0259] In step S406, the second node 102 verifies the information.

[0260] In some embodiments, upon receiving the first information, the second node 102 can verify the authentication information. Based on the verification of the authentication information, the second node 102 can determine whether the first node 101 provides the first operation requested by the first node 101.

[0261] In some embodiments, the identification information may be determined by the third node 103. In this case, the verification of the identification information may include at least one of the following: verifying the digital signature of the identification information; verifying the message verification code of the identification information; verifying the subject statement of the identification information; verifying the audience statement of the identification information; verifying the scope statement of the identification information; and verifying additional statements of the identification information.

[0262] In some embodiments, verifying the digital signature of the authentication information may include: identifying a third node 103 based on the publisher's statement of the authentication information; obtaining the certificate or public key of the third node 103; and verifying the digital signature of the authentication information based on the certificate or public key. In some embodiments, the second node 102 may obtain the identification information of the third node 103 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the certificate or public key associated with the third node 103 locally based on the identification information of the third node 103. For example, this certificate or public key corresponds to the private key used by the third node 103 when determining the digital signature of the authentication information. Next, the second node 102 may verify the digital signature of the authentication information based on the certificate or public key.

[0263] In some embodiments, verifying the message verification code of the authentication information may include: identifying a third node 103 based on the publisher's statement of the authentication information; obtaining the symmetric key shared between the third node 103 and the second node 102; and verifying the message verification code of the authentication information based on the symmetric key. In some embodiments, the second node 102 may obtain the identification information of the third node 103 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the symmetric key shared between the third node 103 and the second node 102 locally based on the identification information of the third node 103. Next, the second node 102 may verify the message verification code of the authentication information based on the symmetric key.

[0264] In some embodiments, verifying the subject statement in the identification information may include determining whether the subject statement in the identification information matches the identification information of the first node 101 carried in the first information. In some embodiments, the second node 102 may obtain the identification information of the first node 101 from the subject statement in the identification information. Then, the second node 102 may match the identification information of the first node 101 in the subject statement with the identification information of the first node 101 carried in the first information to determine whether they are consistent. If they are consistent, the verification of the subject statement is successful; if they are inconsistent, the verification of the subject statement fails.

[0265] In some embodiments, verifying the audience claim in the identification information may include determining whether the audience claim in the identification information matches the identifier or type of the second node 102 itself. In some embodiments, the second node 102 may obtain its identifier information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own identifier to determine if they are consistent. In some embodiments, the second node 102 may obtain its type information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own type to determine if they are consistent. If they are consistent, the audience claim verification is successful; if they are inconsistent, the audience claim verification fails.

[0266] In some embodiments, verifying the scope statement of the identification information may include determining whether the scope statement in the identification information matches the role of the first node 101. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service consumer. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. For example, the first information may be used to request the second node 102 to provide a service provider or to request the second node 102 to provide a token. The second node 102 may determine the actual role of the first node 101 as a service consumer based on the purpose of the first information. The second node 102 may match the first indication information with the actual role of the first node 101 to determine whether they are consistent. If they are consistent, the scope statement verification is successful; if they are inconsistent, the scope statement verification fails. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service provider. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. For example, the first information is used to request registration, and / or update, and / or deregistration from the second node 102. The second node 102 can determine the actual role of the first node 101 as a service provider based on the purpose of the first information. The second node 102 can match the first instruction information with the actual role of the first node 101 to determine whether they match. If they match, the scope declaration verification is successful; if they do not match, the scope declaration verification fails.

[0267] In some embodiments, verifying additional claims in the identification information may include determining whether the additional claims in the identification information match the purpose of the first information. In one example, the second node 102 may determine whether the additional claims in the identification information match the request type of a request message carrying the first information. In some embodiments, the second node 102 may match the first operation indicated by the second indication information in the additional claims with the request type of the request message to determine whether they are consistent. If they are consistent, the verification of the additional claims is successful; if they are inconsistent, the verification of the additional claims fails. In one example, the first operation indicated by the second indication information in the additional claims of the identification information determined by the third node 103 may include at least one of the following: registration of the first node 101, update of the first node 101, deregistration of the first node 101, discovery of a service provider for the first node 101, and token generation for the first node 101. In one example, the request type may include at least one of the following: registration, update, deregistration, discovery of a service provider, and token generation. For example, if the second indication information in the additional declaration indicates that the first operation is registration for the first node 101, and the request type of the request message is registration, then the second node 102 can determine that the two are consistent. Conversely, if the second indication information in the additional declaration indicates that the first operation is discovery of a service provider for the first node 101, and the request type of the request message is token generation, then the second node 102 can determine that the two are inconsistent. It should be noted that in some cases, the second indication information indicates that the first operation can be a registration-related operation; in such cases, if the request type of the request message is any of registration, update, or deregistration, the second node 102 can determine that the two are consistent.

[0268] In some embodiments, the identification information may be determined by the first node 101. In this case, the verification of the identification information may include at least one of the following: verifying the digital signature of the identification information; verifying the message verification code of the identification information; verifying the subject statement of the identification information; verifying the audience statement of the identification information; verifying the scope statement of the identification information; and verifying additional statements of the identification information.

[0269] In some embodiments, verifying the digital signature of the authentication information may include: identifying a first node 101 based on the publisher's statement of the authentication information; obtaining the certificate or public key of the first node 101; and verifying the digital signature of the authentication information based on the certificate or public key. In some embodiments, a second node 102 may obtain the identification information of the first node 101 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the certificate or public key associated with the first node 101 locally based on the identification information of the first node 101. For example, this certificate or public key corresponds to the private key used by the first node 101 when determining the digital signature of the authentication information. Next, the second node 102 may verify the digital signature of the authentication information based on the certificate or public key.

[0270] In some embodiments, verifying the message verification code of the authentication information may include: determining a first node 101 based on the publisher's statement of the authentication information; obtaining the symmetric key shared between the first node 101 and the second node 102; and verifying the message verification code of the authentication information based on the symmetric key. In some embodiments, the second node 102 may obtain the identification information of the first node 101 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the symmetric key shared between the first node 101 and the second node 102 locally based on the identification information of the first node 101. Next, the second node 102 may verify the message verification code of the authentication information based on the symmetric key.

[0271] In some embodiments, verifying the subject statement in the identification information may include determining whether the subject statement in the identification information matches the identification information of the first node 101 carried in the first information. In some embodiments, the second node 102 may obtain the identification information of the first node 101 from the subject statement in the identification information. Then, the second node 102 may match the identification information of the first node 101 in the subject statement with the identification information of the first node 101 carried in the first information to determine whether they are consistent. If they are consistent, the verification of the subject statement is successful; if they are inconsistent, the verification of the subject statement fails.

[0272] In some embodiments, verifying the audience claim in the identification information may include determining whether the audience claim in the identification information matches the identifier or type of the second node 102 itself. In some embodiments, the second node 102 may obtain its identifier information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own identifier to determine if they are consistent. In some embodiments, the second node 102 may obtain its type information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own type to determine if they are consistent. If they are consistent, the audience claim verification is successful; if they are inconsistent, the audience claim verification fails.

[0273] In some embodiments, verifying the scope statement of the identification information may include determining whether the scope statement in the identification information matches the role of the first node 101. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service consumer. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. The second node 102 may determine the actual role of the first node 101 as a service consumer based on the purpose of the first information. The second node 102 may match the first indication information with the actual role of the first node 101 to determine whether they are consistent. If they are consistent, the scope statement verification is successful; if they are inconsistent, the scope statement verification fails. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service provider. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. For example, the first information may be used to request the second node 102 to register, and / or update, and / or deregister. The second node 102 can determine the actual role of the first node 101 as a service provider based on the purpose of the first information. The second node 102 can match the first instruction information with the actual role of the first node 101 to determine whether they are consistent. If they are consistent, the scope declaration verification is successful; if they are inconsistent, the scope declaration verification fails.

[0274] In some embodiments, verifying additional claims in the identification information may include determining whether the additional claims in the identification information match the purpose of the first information. In one example, the second node 102 may determine whether the additional claims in the identification information match the request type of the request message carrying the first information. In some embodiments, the second node 102 may match the first operation indicated by the second indication information in the additional claims with the request type of the request message to determine whether they are consistent. If they are consistent, the verification of the additional claims is successful; if they are inconsistent, the verification of the additional claims fails. In one example, the first operation indicated by the second indication information in the additional claims of the identification information determined by the third node 103 may include at least one of the following: registration of the first node 101, update of the first node 101, deregistration of the first node 101, discovery of service providers for the first node 101, and token generation for the first node 101. In one example, the request type may include at least one of the following: registration, update, and deregistration. For example, if the second indication information in the additional claims indicates that the first operation is registration of the first node 101, and the request type of the request message is registration, then the second node 102 may determine that they are consistent. For example, if the second indication information in the additional declaration indicates that the first operation is an update of the first node 101, and the request type of the request message is "deregister," then the second node 102 can determine that the two are inconsistent. It should be noted that in some cases, the second indication information indicates that the first operation can be a registration-related operation; in such cases, if the request type of the request message is any one of registration, update, or deregistration, the second node 102 can determine that the two are consistent.

[0275] In some embodiments, the digital signature of the verification information and the message verification code of the verification information can be executed selectively or together. In some embodiments, the verification information can be protected by a digital signature, in which case the second node 102 can verify the digital signature. In some embodiments, the verification information can be protected by a message verification code, in which case the second node 102 can verify the message verification code.

[0276] In some embodiments, the operation of verifying the assertion information may include: verifying the digital signature of the assertion information; verifying the subject claim of the assertion information; verifying the audience claim of the assertion information; verifying the scope claim of the assertion information; and verifying additional claims of the assertion information. In some embodiments, the various verifications of the assertion information described above may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the digital signature; if the digital signature verification is successful, the second node 102 may verify the subject claim; if the subject claim verification is successful, the second node 102 may verify the audience claim; if the audience claim verification is successful, the second node 102 may verify the scope claim; and if the scope claim verification is successful, the second node 102 may verify additional claims. It is understood that the order of the above verifications is not limited to this.

[0277] In some embodiments, the operation of verifying the certification information may include: verifying the message verification code of the certification information; verifying the subject statement of the certification information; verifying the audience statement of the certification information; verifying the scope statement of the certification information; and verifying the additional statements of the certification information. In some embodiments, the various verifications in the above verification of the certification information may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the message verification code; if the message verification code verification is successful, the second node 102 may verify the subject statement; if the subject statement verification is successful, the second node 102 may verify the audience statement; if the audience statement verification is successful, the second node 102 may verify the scope statement; if the scope statement verification is successful, the second node 102 may verify the additional statements. It is understood that the order of the above verifications is not limited to this.

[0278] In some embodiments, the verification of the authentication information may further include at least one of the following: verifying a timeout declaration and verifying a publication time declaration. In some implementations, if the verification of the digital signature, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration. In some implementations, if the verification of the message verification code, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration.

[0279] In some embodiments, if at least one of the above-mentioned tests performed on the assertion information fails, the second node 102 may determine that the test on the assertion information has failed. In some embodiments, if all of the above-mentioned tests performed on the assertion information succeed, the second node 102 may determine that the test on the assertion information has succeeded.

[0280] In some embodiments, failure to verify the authentication information means that the second node 102 fails to authenticate the first node 101.

[0281] In step S407, the second node 102 performs the first operation.

[0282] In some embodiments, if the verification of the authentication information is successful, the second node 102 may perform the first operation.

[0283] In some embodiments, the request message may be a registration request message. The second node 102 can perform the registration of the first node 101 based on the registration request message. In some embodiments, the second node 102 may mark the first node 101 as available and store the configuration file of the first node 101.

[0284] In some embodiments, the request message may be an update request message. The second node 102 can execute an update of the first node 101 based on the update request message. In some embodiments, the second node 102 can update the configuration file of the first node 101 stored locally. For example, the second node 102 can replace the existing configuration file with the updated configuration file.

[0285] In some embodiments, the request message may be a deregistration request message. The second node 102 can then execute the deregistration of the first node 101 based on the deregistration request message. In some embodiments, the second node 102 may mark the first node 101 as unavailable. In one example, the second node 102 may remove the configuration file of the first node 101 from its local machine.

[0286] In some embodiments, the request message may be a discovery request message. The second node 102 can perform service provider discovery based on the discovery request message. In some embodiments, the second node 102 can determine the corresponding service provider based on the service provider's identification information and / or service requirements carried in the discovery request message.

[0287] In some embodiments, the request message may be a token request message. The second node 102 can generate a token based on the token request message. In some embodiments, the second node 102 can generate a token that can be used by the first node 101 to access the services of the service provider.

[0288] In some embodiments, if the verification of the certification information is successful, the second node 102 can add the verification result to the configuration file of the first node 101. In some embodiments, the second node 102 can add the information indicating successful verification of the certification information to the configuration file of the first node 101 upon registration and / or update of the first node 101.

[0289] In some embodiments, when a first node 101 is registered with a second node 102 and the configuration file of the first node 101 includes information indicating successful authentication, the second node 102 can identify the first node 101 as a service provider in response to a token request message from another first node (not shown). For example, the first node 101's identification information can be included in the token's audience declaration. In some embodiments, when another first node requests a token from the second node 102 to access the service of the first node 101 via a token request message, the second node 102 must first determine whether the configuration file of the first node 101 includes information indicating successful authentication before generating the token. The second node 102 generates the token if the configuration file of the first node 101 includes information indicating successful authentication; otherwise, it refuses to generate the token. This ensures that the service provider accessed by the service consumer via the token has been additionally authenticated with authentication information, or ensures that a service provider that has not been additionally authenticated with authentication information cannot provide services to the service consumer.

[0290] In step S408, the second node 102 sends a response message to the first node 101.

[0291] In some embodiments, the second node 102 may send a response message. In some embodiments, the response message may be sent by the second node 102, but is not limited to this; it may also be sent by other entities.

[0292] In some embodiments, the first node 101 may receive a response message. In some embodiments, the response message may be received by the first node 101, but is not limited thereto, and may also be received by other entities.

[0293] In some embodiments, the response message may be sent by the second node 102 in response to the request message. In some embodiments, the response message may be used to notify the first node 101 of the result of the first operation requested by the first node 101.

[0294] In some embodiments, the response message may include one of the following: second information, third information.

[0295] In some embodiments, the second node 102 may send second information to the first node 101. In some embodiments, the second information may be used to indicate that the first operation was successful. In some embodiments, the second information may be used to indicate that the second node 102 has completed the first operation requested by the first node 101.

[0296] In some embodiments, where the first operation is the discovery of a service provider, the second information may include information about the service provider. For example, the second information may include the service provider's identification information and / or configuration information.

[0297] In some embodiments, where the first operation is token generation, the second information may include the token determined by the second node 102.

[0298] In some embodiments, the second node 102 may send third information to the first node 101. In some embodiments, the second information may be used to indicate that the first operation failed. In some embodiments, the second information may be used to indicate that the second node 102 failed to authenticate the first node 101.

[0299] In some embodiments, the third information may include the reason for the authentication failure of the first node 101. In some embodiments, the reason for failure may include at least one of the following: failure to verify the digital signature of the authentication information; failure to verify the message verification code of the authentication information; failure to verify the subject statement of the authentication information; failure to verify the subject statement of the authentication information; failure to verify the audience statement of the authentication information; failure to verify the scope statement of the authentication information; failure to verify the additional statement of the authentication information; failure to verify the timeout statement of the authentication information; failure to verify the publication time statement of the authentication information.

[0300] The communication method of this disclosure embodiment can be implemented through steps S401 to S408.

[0301] The communication method involved in the embodiments of this disclosure may include at least one of steps S401 to S408. For example, step S403 may be implemented as a standalone embodiment. For example, step S404 may be implemented as a standalone embodiment. For example, step S405 may be implemented as a standalone embodiment. For example, a combination of steps S401 and S403 may be implemented as a standalone embodiment. For example, a combination of steps S403 and S405 may be implemented as a standalone embodiment. For example, a combination of steps S404 and S405 may be implemented as a standalone embodiment. For example, a combination of steps S405 and S406 may be implemented as a standalone embodiment. For example, a combination of steps S401, S403, and S405 may be implemented as a standalone embodiment. For example, a combination of steps S404, S405, and S406 may be implemented as a standalone embodiment. For example, a combination of steps S403, S405, and S406 may be implemented as a standalone embodiment. It should be noted that the possible independent embodiments consisting of one or more steps in steps S401 and S408 are not limited thereto.

[0302] In some embodiments, steps S401, S402, S404, S405, S406, S407, and S408 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0303] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0304] In some embodiments, the names of information, etc., are not limited to the names described in the embodiments. Terms such as "information", "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "domain", "field", "symbol", "symbol", "codebook", "codeword", "codepoint", "bit", "data", "program", and "chip" can be used interchangeably.

[0305] In some embodiments, the terms “radio”, “wireless”, “radio access network (RAN)”, “access network (AN)”, and “RAN-based” can be used interchangeably.

[0306] In some embodiments, “get,” “obtain,” “receive,” “transmit,” “bidirectional transmission,” and “send and / or receive” can be used interchangeably and can be interpreted as receiving from other entities, obtaining from protocols, obtaining from higher layers, obtaining through self-processing, or autonomous implementation, among other meanings.

[0307] In some embodiments, terms such as “send,” “transmit,” “report,” “distribute,” “transfer,” “bidirectional transmission,” “send and / or receive” can be used interchangeably.

[0308] In some embodiments, terms such as "certain", "preset", "default", "set", "indicated", "a certain", "any", and "first" can be used interchangeably. "Certain A", "preset A", "default A", "set A", "indicated A", "a certain A", "any A", and "first A" can be interpreted as A pre-defined in a protocol or the like, or as A obtained through setting, configuration, or instruction, or as specific A, a certain A, any A, or first A, but are not limited thereto.

[0309] In some embodiments, the terms “authentication,” “verification,” “validation,” and “check” can be used interchangeably.

[0310] In some embodiments, terms such as “identification,” “identification information,” “customer identification,” and “assertion” can be used interchangeably.

[0311] Figure 5A is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 5A, the method includes steps S5101 to S5105.

[0312] In step S5101, the first node 101 sends the fourth information to the third node 103.

[0313] The optional implementation of step S5101 can be found in the optional implementation of step S401 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0314] In some embodiments, the fourth information may be used to request the third node 103 to determine the identification information.

[0315] In step S5102, the third node 103 sends the identification information to the first node 101.

[0316] The optional implementation of step S5102 can be found in the optional implementation of step S403 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0317] In step S5103, the first node 101 sends the first information to the second node 102.

[0318] The optional implementation of step S5103 can be found in the optional implementation of step S405 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0319] In some embodiments, the first information may include at least one of the following: identification information and identification information of the first node 101.

[0320] In step S5104, the second node 102 verifies the verification information.

[0321] The optional implementation of step S5104 can be found in the optional implementation of step S406 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0322] In step S5105, the second node 102 performs the first operation.

[0323] The optional implementation of step S5105 can be found in the optional implementation of step S407 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0324] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0325] Figure 5B is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 5B, the method includes steps S5201 to S5204.

[0326] In step S5201, the first node 101 determines the identification information.

[0327] The optional implementation of step S5201 can be found in the optional implementation of step S404 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0328] In step S5202, the first node 101 sends the first information to the second node 102.

[0329] The optional implementation of step S5202 can be found in the optional implementation of step S405 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0330] In some embodiments, the first information may include at least one of the following: identification information and identification information of the first node 101.

[0331] In step S5203, the second node 102 verifies the verification information.

[0332] The optional implementation of step S5203 can be found in the optional implementation of step S406 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0333] In step S5204, the second node 102 performs the first operation.

[0334] The optional implementation of step S5204 can be found in the optional implementation of step S407 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0335] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0336] Figure 5C is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 5C, the method includes steps S5301 to S5305.

[0337] In step S5301, the first node 101 obtains the identification information.

[0338] The optional implementations of step S5301 can be found in the optional implementations of steps S401, S402, S403, and S404 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0339] In step S5302, the first node 101 sends the first information to the second node 102.

[0340] The optional implementation of step S5302 can be found in the optional implementation of step S405 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0341] In some embodiments, the first information may include at least one of the following: identification information and identification information of the first node 101.

[0342] In step S5303, the second node 102 verifies the verification information.

[0343] The optional implementation of step S5303 can be found in the optional implementation of step S406 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0344] In step S5304, the second node 102 performs the first operation.

[0345] The optional implementation of step S5304 can be found in the optional implementation of step S407 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0346] In step S5305, the second node 102 sends a response message to the first node 101.

[0347] The optional implementation of step S5305 can be found in the optional implementation of step S408 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0348] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0349] Figure 5D is an exemplary interaction diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 5D, the method includes steps S5401 to S5402.

[0350] In step S5401, the first node 101 obtains the identification information.

[0351] In some embodiments, the first node 101 may receive authentication information from the third node 103. In some embodiments, the authentication information may be determined by the third node 103 based on a request from the first node 101.

[0352] In some embodiments, the identification information may be determined by the first node 101.

[0353] In some embodiments, the identification information may include at least one of the following: publisher statement, subject statement, audience statement, scope statement, and additional statement.

[0354] In some embodiments, the authentication information may be protected by at least one of the following: digital signature, message verification code.

[0355] In step S5402, the first node 101 sends the first information to the second node 102.

[0356] In some embodiments, the first information may include identification information.

[0357] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0358] In the following, the technical solutions of the embodiments of this disclosure will be described by way of specific implementation.

[0359] This disclosure focuses on additional security mechanisms for processes between service-based RAN nodes (i.e., the first node) and NRFs (i.e., the second node). The main objectives of this disclosure are: (1) to enhance the security of current 5G SBA to support protection for communication between service-based RAN and NRF during the registration / update / deregistration process of SBI services; and (2) to enhance the security of current 5G SBA to support protection for communication between service-based RAN and NRF during the access token request process.

[0360] In some embodiments, this disclosure proposes additional authentication for service-based RAN nodes pointing to the NRF during network service registration / update / deregistration processes and access token request processes.

[0361] 1. Registration / Update / Remove Registration Process

[0362] Figure 6A is an interactive schematic diagram of an exemplary embodiment of the communication method provided according to embodiments of the present disclosure. This embodiment relates to a registration / update / deregistration process between service-based RNA and NRF. As shown in Figure 6A, the communication method includes steps S6101 to S6103.

[0363] In step S6101, the service-based RAN sends a registration / update / deregistration request message to the NRF to notify the NRF of its own profile when the service-based RAN first becomes operational, or to notify the NRF of its updated profile (e.g., having updated capabilities) when triggered after a scaling operation, or to notify the NRF of its unavailability when a smooth shutdown or network disconnection is imminent. The registration / update / deregistration request message includes an authentication signature for the NRF to use for authentication.

[0364] In some embodiments, it is determined that at least the following statements are included:

[0365] -iss(publisher): Instance identifier of SSNF, or instance identifier of RAN based on service;

[0366] -sub(subject): Instance identifier of the RAN node based on the service;

[0367] -aud(audience): The type or instance identifier of the NRF;

[0368] -scope: The limitation on a specific scope, for example, RAN as a service consumer or service provider;

[0369] - Additional scope / uses: The specific uses of the designation, for example, the designation is used for registration, renewal, or deregistration;

[0370] -exp(timeout): The timeout period during which the JWT is no longer accepted;

[0371] -iat(publishing time): Publish time, marking the time when the JWT was created;

[0372] -jti (JWT identifier): A unique identifier for a JWT, primarily used to prevent duplicate JWTs.

[0373] In some embodiments, the identity can be generated by the SSNF or the service-based RAN itself.

[0374] In some embodiments, the stated purpose may include a single purpose (e.g., for registration only) or any combination of multiple purposes (e.g., registration and update), depending on the cybersecurity policy.

[0375] In step S6102, before the NRF stores the configuration file of the service-based RAN and marks the service-based RAN as available, or before the NRF updates the configuration file of the service-based RAN, or before the NRF marks the service-based RAN as unavailable, the NRF first verifies the received assertion.

[0376] In some embodiments, assuming that the verification of the identified digital signature and the verification of all preceding claims in the identification are successful, the NRF verifies the additional scope / use of the identification. If the use declared as additional scope / use matches the request type (registration / update / deregistration) sent by the RAN based on the service, the NRF then verifies the timestamp (iat) and / or timeout (exp).

[0377] In some embodiments, if the certification test is successful, the NRF may include the certification test result in the service-based RAN configuration file.

[0378] In some embodiments, if the verification fails, the NRF will not store / update / mark as unavailable for the service-based RAN.

[0379] In step S6103, the NRF returns a registration / update / deregistration response message to the service-based RAN. If any verification in step S6102 fails, the NRF indicates the failure of service-based RAN authentication in the response message. If all verifications in step S6102 succeed, the NRF confirms that the RAN service registration / update / deregistration has been accepted via a response.

[0380] In the embodiments disclosed herein, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations in other embodiments.

[0381] 2. Access Token Request Process

[0382] In some embodiments, the difference between the access token request process in this disclosure and the access token request process in related technologies is that the NRF only has a certificate for generating an SSNF that identifies the RNA service consumer, but the NRF does not have a certificate for the RAN service consumer.

[0383] Figure 6B is an interactive schematic diagram of an exemplary implementation of a communication method provided according to embodiments of the present disclosure. This implementation relates to a process for obtaining an access token from an NRF based on a service-based RAN request. As shown in Figure 6B, the communication method includes steps S6201 to S6203.

[0384] In step S6201, the RAN service consumer sends an access token request message to the NRF. In addition to the RAN service consumer's identifier, the NF type of the desired NF service provider instance, the requested "scope" including the desired NF service name, and optionally "additional scope" information, the message also includes the RAN service consumer's identification published by the SSNF.

[0385] In some embodiments, the determination includes at least the following statements:

[0386] -iss(publisher): The instance identifier of SSNF;

[0387] -sub(subject): Instance identifier of the RAN node based on the service;

[0388] -aud(audience): The type or instance identifier of the NRF;

[0389] -scope: The limitation on a specific scope, for example, RAN as a service consumer or service provider;

[0390] - Additional scope / purpose: The specific purpose identified, such as an access token request;

[0391] -exp(timeout): The timeout period during which the JWT is no longer accepted;

[0392] -iat(publishing time): Publish time, marking the time when the JWT was created;

[0393] -jti (JWT identifier): A unique identifier for a JWT, primarily used to prevent duplicate JWTs.

[0394] In some embodiments, the use statement indicates that it can only be used for access token requests.

[0395] In step S6202, the NRF first verifies the received assertion.

[0396] In some embodiments, assuming that the verification of the identified digital signature and the verification of all preceding claims in the identification are successful, the NRF verifies the identified additional scope / use. If the use declared as additional scope / use matches the request type sent by the service-based RAN (i.e., an access token request), the NRF then verifies the timestamp (iat) and / or timeout (exp).

[0397] In some embodiments, the NRF generates an access token that includes a suitable claim only if the authentication verification is successful. In some embodiments, if the authentication verification fails, the NRF considers the RAN service consumer's authentication to have failed and rejects the access token request from the RAN service consumer.

[0398] In some embodiments, when generating an access token, if the requested service will be provided by a RAN service provider, the NRF needs to verify the assertion check result in the service-based RAN's profile. When assigning values ​​to the audience claims of the access token, the NRF only assigns service-based RANs whose profiles have a positive assertion check result.

[0399] In step S6203, the NRF returns an access token response to the RAN service consumer. If any of the checks in step S6202 fails, the NRF indicates the failure of service-based RAN authentication in the response message. If all checks in step S6202 succeed, the NRF includes the access token in the response message.

[0400] In the embodiments disclosed herein, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations in other embodiments.

[0401] In some embodiments, considering that security policies for service registration, update, and deregistration of a service-based RAN may differ, operators may decide that each process requires specific credentials (i.e., credentials that can be used in a particular process) to achieve stricter security requirements, or that processes can share the same credentials (e.g., credentials can be used in registration, update, and deregistration processes) to achieve more lenient security requirements. These different security policies are configured in the SSNF, which then determines how to assign values ​​to additional scopes / users when generating credentials. With successful credentials verification, the NRF not only ensures that the service-based RAN has been authenticated by an SSNF trusted by the NRF, but also ensures that the credentials are used for the correct purpose; for example, credentials used for deregistration cannot be used for registration or update purposes, and credentials used for registration cannot be used for access token purposes.

[0402] In some embodiments, a prerequisite for generating an access token for a RAN service consumer is that the authentication of the RAN service consumer requesting the access token is successfully verified. This ensures that a token for accessing the requested service is issued to the RAN service consumer that has been authenticated using enhanced security methods.

[0403] In some embodiments, when generating an access token, if the requested service is provided by a RAN service provider, the NRF selects only service-based RAN instances with positive authentication results in their selector profiles, based on the audience claim in the access token. This ensures that only RAN service providers authenticated using enhanced security methods can provide services to service consumers.

[0404] This disclosure also proposes an apparatus (also referred to as a communication device, etc.) for implementing any of the above methods. For example, this disclosure proposes an apparatus including a unit or module for implementing the steps performed by the first node in any of the above methods. For example, this disclosure proposes another apparatus including a unit or module for implementing the steps performed by the second node in any of the above methods. For example, this disclosure proposes yet another apparatus including a unit or module for implementing the steps performed by the third node in any of the above methods.

[0405] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0406] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a central processing unit, microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), etc.

[0407] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure. As shown in Figure 7, the communication device 700 may include at least one of the following: a transceiver module 701 and a processing module 702.

[0408] In some embodiments, the communication device 700 may be a first node. In some embodiments, the transceiver module 701 may be configured to: send first information to a second node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of the network function service of the second node; wherein the first information includes authentication information, which is used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the first node in any of the above methods (e.g., steps S401, S403, S405, S408, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the first node in any of the above methods besides the communication steps such as sending and receiving (e.g., step S404, but not limited thereto).

[0409] In some embodiments, the communication device 700 may be a second node. In some embodiments, the transceiver module 701 may be configured to: receive first information sent by a first node, wherein the first information is used to request the second node to perform a first operation, the first operation being a service operation of the network function service of the second node; wherein the first information includes authentication information, which is used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the second node in any of the above methods (e.g., steps S405, S408, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the second node in any of the above methods besides the communication steps such as sending and receiving (e.g., steps S406, S407, but not limited thereto).

[0410] In some embodiments, the communication device 700 may be a third node. In some embodiments, the transceiver module 701 may be configured to: send authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node, and the first node requests the second node to perform a first operation, wherein the first operation is a service operation of the network function service of the second node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps (e.g., steps S401, S403, but not limited thereto) performed by the third node in any of the above methods, which will not be described in detail here. Optionally, the processing module 702 may be configured to perform at least one of the other steps (e.g., step S402, but not limited thereto) performed by the third node in any of the above methods, excluding the communication steps such as sending and receiving.

[0411] In some embodiments, the communication device shown in FIG7 can be implemented as a communication equipment.

[0412] In some embodiments, the transceiver module may include a transmitting module and / or a receiving module. The transmitting and receiving modules may be separate or integrated. Optionally, the transceiver module may be interchangeable with a transceiver.

[0413] In some embodiments, the processing module may be a single module or may include multiple sub-modules. Optionally, the multiple sub-modules may each perform all or part of the steps required by the processing module. Optionally, the processing module may be interchangeable with a processor.

[0414] Figure 8A is a schematic diagram of the structure of a communication device provided according to an embodiment of the present disclosure. The communication device 8100 can be a network device (e.g., access network device, core network device, etc.), a terminal (e.g., user equipment, etc.), a chip, chip system, or processor that supports the network device in implementing any of the above methods, or a chip, chip system, or processor that supports the terminal in implementing any of the above methods. The communication device 8100 can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0415] As shown in Figure 8A, the communication device 8100 includes one or more processors 8101. The processor 8101 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the communication device (e.g., base station, baseband chip, terminal device, terminal device chip, DU or CU, etc.), execute programs, and process program data. Optionally, the communication device 8100 can be used to execute any of the above methods. Optionally, one or more processors 8101 can be used to invoke instructions to cause the communication device 8100 to execute any of the above methods.

[0416] In some embodiments, the communication device 8100 further includes one or more transceivers 8102. When the communication device 8100 includes one or more transceivers 8102, the transceiver 8102 performs at least one of the communication steps such as sending and / or receiving in the above method (e.g., steps S401, S403, S405, S408, but not limited thereto), and the processor 8101 performs at least one of other steps (e.g., steps S402, S404, S406, S407, but not limited thereto). In optional embodiments, the transceiver may include a receiver and / or a transmitter, which may be separate or integrated together. Optionally, the terms transceiver, transceiver unit, transceiver, transceiver circuit, interface circuit, interface, etc., can be used interchangeably; the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc., can be used interchangeably; and the terms receiver, receiving unit, receiver, receiving circuit, etc., can be used interchangeably.

[0417] In some embodiments, the communication device 8100 further includes one or more memories 8103 for storing data. Optionally, all or part of the memories 8103 may be located outside the communication device 8100. In an optional embodiment, the communication device 8100 may include one or more interface circuits 8104. Optionally, the interface circuits 8104 are connected to the memories 8103 and can be used to receive data from the memories 8103 or other devices, and to send data to the memories 8103 or other devices. For example, the interface circuits 8104 can read data stored in the memories 8103 and send that data to the processor 8101.

[0418] The communication device 8100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 8100 described in this disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG8A. The communication device may be a standalone device or may be part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally, the IC collection may also include storage components for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0419] Figure 8B is a schematic diagram of the structure of a chip provided according to an embodiment of the present disclosure. For cases where the communication device 8100 can be a chip or a chip system, please refer to the schematic diagram of the chip 8200 shown in Figure 8B, but it is not limited thereto.

[0420] Chip 8200 includes one or more processors 8201. Chip 8200 is used to perform any of the methods described above.

[0421] In some embodiments, chip 8200 further includes one or more interface circuits 8202. Optionally, terms such as interface circuit, interface, and transceiver pin can be used interchangeably. In some embodiments, chip 8200 further includes one or more memories 8203 for storing data. Optionally, all or part of the memories 8203 may be located outside of chip 8200. Optionally, interface circuit 8202 is connected to memory 8203, and interface circuit 8202 can be used to receive data from memory 8203 or other devices, and interface circuit 8202 can be used to send data to memory 8203 or other devices. For example, interface circuit 8202 can read data stored in memory 8203 and send the data to processor 8201.

[0422] In some embodiments, the interface circuit 8202 performs at least one of the communication steps such as sending and / or receiving in the above method (e.g., steps S401, S403, S405, S408, but not limited thereto). The interface circuit 8202 performing the communication steps such as sending and / or receiving in the above method refers, for example, to the interface circuit 8202 performing data interaction between the processor 8201, the chip 8200, the memory 8203, or the transceiver device. In some embodiments, the processor 8201 performs at least one of other steps (e.g., steps S402, S404, S406, S407, but not limited thereto).

[0423] The modules and / or devices described in the various embodiments, such as virtual devices, physical devices, and chips, can be combined or separated arbitrarily as needed. Optionally, some or all steps can also be performed collaboratively by multiple modules and / or devices, which is not limited here.

[0424] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0425] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0426] This disclosure also proposes a program product that, when executed by a communication device 8100, causes the communication device 8100 to perform any of the above methods. Optionally, the program product is a computer program product.

[0427] This disclosure also proposes a computer program that, when run on a computer, causes the computer to perform any of the above methods.

[0428] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only.

[0429] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

A communication method performed by a first node, wherein The method comprises: sending first information to a second node, wherein the first information is used to request the second node to perform a first operation, and the first operation is a service operation of a network function service of the second node; wherein the first information comprises attestation information, and the attestation information is used for the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. The method of claim 1, wherein, The attestation information is determined by the first node; wherein the attestation information comprises at least one of: a first statement indicating that the attestation information is issued by the first node; a second statement indicating that the attestation information is attestation information related to the first node; a third statement comprising identification information or type information of the second node; a fourth statement indicating a service role of the first node; a fifth statement indicating the first operation. The method of claim 1, wherein, The attestation information is determined by a third node; wherein the method further comprises: receiving the attestation information sent by the third node; wherein the attestation information comprises at least one of: a first statement indicating that attestation information is issued by the third node; a second statement indicating that the attestation information is attestation information related to the first nodes; a third statement comprising identification information or type information of the second node; a fourth statement indicating the service role of the first node; a fifth statement indicating the first operation. The method according to claim 2 or 3, wherein The service role of the first node comprises one of: a service provider; a service consumer. The method of any one of claims 1 to 4, wherein, The first operation comprises at least one of: registration of the first node; update of the first node; deregistration of the first node; discovery of a service provider for the first node; token generation for the first node. The method of any one of claims 1 to 5, wherein, The method further comprises one of: receiving second information sent by the second node, wherein the second information is used to indicate that the first operation is successful; receiving third information sent by the second node, wherein the third information is used to indicate that authentication for the first node fails. The method of claim 6, wherein, The first operation comprises token generation for the first node, and the second information comprises a token generated by the second node. The method of any one of claims 1 to 7, wherein, The second node is a network repository function (NRF). A communication method, performed by a second node, wherein The method comprises: receiving first information sent by a first node, wherein the first information is used to request a second node to perform a first operation, and the first operation is a service operation of a network service of the second node; wherein the first information comprises attestation information, and the attestion information is used for the second node to authenticate the first node; wherein the first node is a network device, and the first node and the second node communicate through a service-based interface. The method of claim 9, wherein, The first information comprises attestation information, and the attestation information is used for the second node to authenticat the first node; wherein the attestation information comprises at least one of: a first statement, indicating that the attestation information is issued by the first node; a second statement, indicating that the attestation information is attestation information related to the first node; a third statement, comprising identification information or type information of the second node; a fourth statement, indicating a service role of the first node; a fifth statement, indicating the first operation. a fourth statement indicating a service role of the first node; a fifth statement indicating the first operation. The method of claim 9, wherein, The attestation information is determined by a third node; The attestation information comprises at least one of: a first statement indicating that the attestation information is issued by the third node; a second statement indicating that the attestation information is related to the first node; a third statement comprising identification information or type information of the second node; a fourth statement indicating a service role of the first node; a fifth statement indicating the first operation. The method according to claim 10 or 11, wherein The service role of the first node comprises one of: a service provider; a service consumer. The method of any one of claims 9 to 12, wherein, The first operation comprises at least one of: registration of the first node; update of the first node; de-registration of the first node; discovery of a service provider for the first node; token generation for the first node. The method of any one of claims 9 to 13, wherein, The method further comprises: verifying the attestation information. The method of claim 14, wherein, The verifying the attestation information comprises at least one of: verifying a digital signature of the attestation information; verifying a message authentication code of the attestation information; checking the second statement of the attestation information; checking the third statement of the attestation information; checking the fourth statement of the attestation information; checking the fifth statement of the attestation information. The method of claim 15, wherein, The attestation information is protected by at least one of: a digital signature; a message authentication code. The method of any one of claims 14 to 16, wherein, The method further comprises: determining that the verification of the attestation information is successful, performing the first operation, and sending second information to the first node, wherein the second information indicates that the first operation is successful; or determining that the verification of the attestation information fails, and sending third information to the first node, wherein the third information indicates that the authentication for the first node fails. The method of claim 17, wherein, The first operation comprises token generation for the first node, and the second information comprises a token generated by the second node. The method of claim 17, wherein, The first operation comprises registration and / or update of the first node. The method further comprises: in a case where it is determined that the verification of the attestation information is successful, adding information that the verification of the attestation information is successful in a configuration file of the first node. The method of any one of claims 9 to 19, wherein The second node is a network storage function (NRF). A communication method, performed by a third node, wherein The method comprises: sending attestation information to a first node, wherein the attestation information is used by a second node to authenticate the first node, the first node requests the second node to perform a first operation, and the first operation is a service operation of a network function service of the second node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. The method of claim 21, wherein, The attestation information comprises at least one of: a first statement indicating that the attestation information issued by the third node; a second statement indicating that the attestation information is related to the attestation information of the first node; a third statement comprising identification information or type information of the second node; a third statement comprising identification information or type information of the second node; a fourth statement indicates a service role of the first node; The method of claim 21 or 22, wherein, a fifth statement indicating the first operation. The method further comprises: receiving fourth information sent by the first node; determining the attestation information according to the fourth information. The method of any one of claim 23, wherein, The fourth information includes at least one of: identification information of the first node; identification information of the second node; type information of the second node; first indication information, where the first indication information is used to indicate a service role of the first node; second indication information, where the second indication information is used to indicate the first operation requested by the first node to be performed by the second node. The method according to claim 22 or 24, wherein The service role of the first node includes one of: a service provider; a service consumer. The method of any one of claims 21 to 25, wherein, The first operation includes at least one of: registration of the first node; update of the first node; de-registration of the first node; discovery of a service provider for the first node; token generation for the first node. The method of any one of claims 21 to 26, wherein, The second node is a network repository function (NRF). A communication method performed by a communication system, wherein The communication system includes a first node and a second node; The method includes: The first node sends first information to the second node, where the first information is used to request the second node to perform a first operation, and the first operation is a service operation of a network function service of the second node; The first information includes identification information, which is used for the second node to authenticate the first node; The first node is an access network device, and the first node and the second node communicate through a service-based interface. A communication device characterized by comprising: The communication device is configured to perform the communication method according to any one of claims 1-8, 9-20, 21-27. A communication system characterized by The communication device is configured to perform the communication method according to any one of claims 1-8, 9-20, 21-27. A storage medium storing instructions, the instructions comprising: The program or instruction is executed by the communication device to implement the steps of the communication method according to any one of claims 1-8, 9-20, 21-27. A program product comprising at least one of a program, instructions, characterized in that ​

Images