Communication method, communication device, communication system, storage medium, and program product

Abstract

The present disclosure relates to a communication method, a communication device, a communication system, a storage medium and a program product. The method is performed by a first node, and comprises: obtaining identification information; and sending first information to a second node, wherein the first information is used to request the second node to provide a service; wherein the first information comprises the identification information, and the identification information is used for the second node to authenticate the first node; and wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Through the scheme of the present disclosure, the security protection of the communication of the access network device as a service consumer through the service-based interface can be achieved.

Description

Communication methods, communication equipment, communication systems, storage media and software products Technical Field

[0001] This disclosure relates to the field of wireless communication, and more particularly to a communication method, communication device, communication system, storage medium, and program product. Background Technology

[0002] As communication technologies continue to evolve, the architecture of communication systems also evolves according to changing needs. To improve communication efficiency between nodes in a communication system, enabling direct communication between different nodes is a viable option. In particular, when one party to the communication is located in the access network, the introduction of a service-based interface (SBI) allows access network devices to directly exchange information with other nodes in the communication system. Summary of the Invention

[0003] This disclosure provides a communication method, communication device, communication system, storage medium, and program product to provide a security mechanism for service-based access network devices.

[0004] According to a first aspect of the present disclosure, a communication method is provided. The method is performed by a first node. The method includes: acquiring authentication information; sending first information to a second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0005] According to a second aspect of the present disclosure, a communication method is provided. The method is performed by a second node. The method includes: receiving first information sent by a first node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0006] According to a third aspect of the present disclosure, a communication method is provided. The method is performed by a third node. The method includes: sending authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0007] According to a fourth aspect of the present disclosure, a communication method is provided. The method is executed by a communication system. The communication system includes a first node and a second node. The method includes: the first node acquiring authentication information; the first node sending first information to the second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0008] According to a fifth aspect of the present disclosure, a communication device is provided. This communication device is used to perform the communication method as described in any one of the first to third aspects.

[0009] According to a sixth aspect of the present disclosure, a communication system is provided. The communication system includes at least one of the following: a first node, a second node, and a third node. The first node is configured to perform the communication method as described in the first aspect. The second node is configured to perform the communication method as described in the second aspect. The third node is configured to perform the communication method as described in the third aspect.

[0010] According to a seventh aspect of the present disclosure, a storage medium is provided. The storage medium stores instructions. When executed on a communication device, the instructions cause the communication device to perform the communication method as described in any one of the first to third aspects.

[0011] According to an eighth aspect of the present disclosure, a program product is provided. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in any one of the first to third aspects.

[0012] According to a ninth aspect of the present disclosure, a computer program is provided. When this computer program is run on a computer, it causes the computer to perform the communication method as described in any one of the first to third aspects.

[0013] According to a tenth aspect of this disclosure, a chip or chip system is provided. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication method as described in any one of the first to third aspects.

[0014] According to embodiments of this disclosure, security protection can be achieved for communication between access network devices and other nodes in a communication system via service-based interfaces.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not constitute a limitation on the embodiments of this disclosure. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments of the invention.

[0017] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure.

[0018] Figure 2 is an exemplary schematic diagram of a service interface-based communication system architecture provided according to an embodiment of the present disclosure.

[0019] Figure 3A is an exemplary schematic diagram of a first mode of recognition provided according to an embodiment of the present disclosure.

[0020] Figure 3B is an exemplary schematic diagram of the recognized second mode provided according to an embodiment of the present disclosure.

[0021] Figure 4A is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0022] Figure 4B is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0023] Figure 5 is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0024] Figure 6A is an interactive schematic diagram of an exemplary implementation of the communication method provided according to embodiments of the present disclosure.

[0025] Figure 6B is an interactive schematic diagram of an exemplary implementation of the communication method provided according to embodiments of the present disclosure.

[0026] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure.

[0027] Figure 8A is an exemplary structural diagram of a communication device provided according to an embodiment of the present disclosure.

[0028] Figure 8B is an exemplary structural diagram of a chip provided according to an embodiment of the present disclosure. Detailed Implementation

[0029] This disclosure provides a communication method, communication device, communication system, storage medium, and program product.

[0030] In a first aspect, embodiments of this disclosure provide a communication method. The method is executed by a first node. The method includes: acquiring authentication information; sending first information to a second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0031] In this embodiment, when a first node requests a service from a second node, the first node can obtain authentication information and send it to the second node. This allows the second node to authenticate the first node based on the authentication information provided by the first node. Since the first node is a service-based access network device, the second node can authenticate the access network device acting as a service consumer by verifying the authentication information, thus improving the security of the access network device.

[0032] In conjunction with some embodiments of the first aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0033] In conjunction with some embodiments of the first aspect, in some embodiments, the operation of obtaining identification information may include: receiving identification information sent by a third node.

[0034] In conjunction with some embodiments of the first aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including the identification information of a third node; a second statement, including the identification information of a first node; a third statement, including the identification information or type information of a second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, the above method may further include: sending second information to a third node, wherein the second information is used by the third node to determine the identification information.

[0036] In conjunction with some embodiments of the first aspect, in some embodiments, the second information may include at least one of the following: first indication information for indicating that the first node is a service consumer; identification information of the first node; identification information of the second node; and type information of the second node.

[0037] In conjunction with some embodiments of the first aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of a third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0038] In conjunction with some embodiments of the first aspect, in some embodiments, the operation of obtaining identification information may include: determining the identification information.

[0039] In conjunction with some embodiments of the first aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of the first node; a second statement, including identification information of the first node; a third statement, including identification information or type information of the second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0040] In conjunction with some embodiments of the first aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of the first node; and a message verification code, determined based on a symmetric key shared between the first node and the second node.

[0041] In conjunction with some embodiments of the first aspect, in some embodiments, the above method may further include: receiving third information sent by the second node, wherein the third information is used to indicate that the second node has failed to verify the identification information.

[0042] In conjunction with some embodiments of the first aspect, in some embodiments, the third information may include the reason for failure of the verification of the authentication information; wherein the reason for failure includes at least one of the following: failure of verification of the digital signature of the authentication information; failure of verification of the message verification code of the authentication information; failure of verification of the second statement of the authentication information; failure of verification of the third statement of the authentication information; failure of verification of the fourth statement of the authentication information.

[0043] In a second aspect, embodiments of this disclosure provide a communication method. This method is executed by a second node. The method includes: receiving first information sent by a first node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0044] In this embodiment, when a first node requests a service from a second node, the first node can obtain authentication information and send it to the second node. This allows the second node to authenticate the first node based on the authentication information provided by the first node. Since the first node is a service-based access network device, the second node can authenticate the access network device acting as a service consumer by verifying the authentication information, thus improving the security of the access network device.

[0045] In conjunction with some embodiments of the second aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0046] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may be determined by a third node.

[0047] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including the identification information of a third node; a second statement, including the identification information of a first node; a third statement, including the identification information or type information of a second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0048] In conjunction with some embodiments of the second aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of a third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0049] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may be determined by the first node.

[0050] In conjunction with some embodiments of the second aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of the first node; a second statement, including identification information of the first node; a third statement, including identification information or type information of the second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0051] In conjunction with some embodiments of the second aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of the first node; and a message verification code, determined based on a symmetric key shared between the first node and the second node.

[0052] In conjunction with some embodiments of the second aspect, in some embodiments the above method may further include: verifying the identification information.

[0053] In conjunction with some embodiments of the second aspect, in some embodiments, the operation of verifying the certification information may include at least one of the following: verifying the digital signature of the certification information; verifying the message verification code of the certification information; verifying the second statement of the certification information; verifying the third statement of the certification information; and verifying the fourth statement of the certification information.

[0054] In conjunction with some embodiments of the second aspect, in some embodiments, the operation of verifying the digital signature of the authentication information may include: verifying the digital signature based on a certificate or public key; wherein the certificate or public key is associated with the private key of a first node, or the certificate or public key is associated with the private key of a third node.

[0055] In conjunction with some embodiments of the second aspect, in some embodiments, the message verification code for verifying the authentication information may include: verifying the message verification code based on a symmetric key; wherein the symmetric key is shared by the first node and the second node, or the symmetric key is shared by the third node and the second node.

[0056] In conjunction with some embodiments of the second aspect, in some embodiments, the above method may further include: sending third information to the first node, wherein the third information is used to indicate that the second node has failed to verify the identification information.

[0057] In conjunction with some embodiments of the second aspect, in some embodiments, the third information may include the reason for failure of the verification of the authentication information; wherein the reason for failure includes at least one of the following: failure of verification of the digital signature of the authentication information; failure of verification of the message verification code of the authentication information; failure of verification of the second statement of the authentication information; failure of verification of the third statement of the authentication information; failure of verification of the fourth statement of the authentication information.

[0058] In a third aspect, embodiments of this disclosure provide a communication method. This method is executed by a third node. The method includes: sending authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0059] In this embodiment, the third node can provide authentication information to the first node, which can be used by the second node to authenticate the first node. The first node is a service-based access network device, which allows the second node to authenticate the access network device as a service consumer by verifying the authentication information, thus improving the security of the access network device.

[0060] In conjunction with some embodiments of the third aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0061] In conjunction with some embodiments of the third aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including the identification information of the third node; a second statement, including the identification information of the first node; a third statement, including the identification information or type information of the second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0062] In conjunction with some embodiments of the third aspect, in some embodiments, the above method may further include: receiving second information sent by the first node; and determining identification information based on the second information.

[0063] In conjunction with some embodiments of the third aspect, in some embodiments, the second information may include at least one of the following: first indication information for indicating that the first node is a service consumer; identification information of the first node; identification information of the second node; and type information of the second node.

[0064] In conjunction with some embodiments of the third aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of the third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0065] In a fourth aspect, embodiments of this disclosure provide a communication method. The method is executed by a communication system. The communication system includes a first node and a second node. The method includes: the first node acquiring authentication information; the first node sending first information to the second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0066] In conjunction with some embodiments of the fourth aspect, in some embodiments, the communication system further includes a third node; wherein, the operation of the first node to obtain the identification information may include: the third node sending the identification information to the first node.

[0067] In a fifth aspect, embodiments of this disclosure provide a communication device. The communication device is a first node. The communication device includes a transceiver module. The transceiver module is configured to: acquire authentication information; send first information to a second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0068] In conjunction with some embodiments of the fifth aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0069] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module can be configured to receive authentication information sent by a third node.

[0070] In conjunction with some embodiments of the fifth aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of a third node; a second statement, including identification information of a first node; a third statement, including identification information or type information of a second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0071] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module may also be configured to: send second information to a third node, wherein the second information is used by the third node to determine the identification information.

[0072] In conjunction with some embodiments of the fifth aspect, in some embodiments, the second information may include at least one of the following: first indication information for indicating that the first node is a service consumer; identification information of the first node; identification information of the second node; and type information of the second node.

[0073] In conjunction with some embodiments of the fifth aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of a third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0074] In conjunction with some embodiments of the fifth aspect, in some embodiments, the communication device may further include a processing module; the processing module is configured to: determine identification information.

[0075] In conjunction with some embodiments of the fifth aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of the first node; a second statement, including identification information of the first node; a third statement, including identification information or type information of the second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0076] In conjunction with some embodiments of the fifth aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of the first node; and a message verification code, determined based on a symmetric key shared between the first node and the second node.

[0077] In conjunction with some embodiments of the fifth aspect, in some embodiments, the transceiver module may also be configured to: receive third information sent by the second node, wherein the third information is used to indicate that the second node has failed to verify the identification information.

[0078] In conjunction with some embodiments of the fifth aspect, in some embodiments, the third information may include the reason for failure of the verification of the authentication information; wherein the reason for failure includes at least one of the following: failure of verification of the digital signature of the authentication information; failure of verification of the message verification code of the authentication information; failure of verification of the second statement of the authentication information; failure of verification of the third statement of the authentication information; failure of verification of the fourth statement of the authentication information.

[0079] In a sixth aspect, embodiments of this disclosure provide a communication device. The communication device is a second node. The communication device includes a transceiver module. The transceiver module is configured to: receive first information sent by a first node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0080] In conjunction with some embodiments of the sixth aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0081] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may be determined by a third node.

[0082] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of a third node; a second statement, including identification information of a first node; a third statement, including identification information or type information of a second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0083] In conjunction with some embodiments of the sixth aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of a third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0084] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may be determined by the first node.

[0085] In conjunction with some embodiments of the sixth aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of the first node; a second statement, including identification information of the first node; a third statement, including identification information or type information of the second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0086] In conjunction with some embodiments of the sixth aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of the first node; and a message verification code, determined based on a symmetric key shared between the first node and the second node.

[0087] In conjunction with some embodiments of the sixth aspect, in some embodiments, the above-described communication device may further include a processing module; the processing module is configured to: verify the identification information.

[0088] In conjunction with some embodiments of the sixth aspect, in some embodiments, the processing module may be configured to perform at least one of the following: verifying the digital signature of the certification information; verifying the message verification code of the certification information; verifying the second statement of the certification information; verifying the third statement of the certification information; and verifying the fourth statement of the certification information.

[0089] In conjunction with some embodiments of the sixth aspect, in some embodiments, the processing module may be configured to: verify the digital signature based on a certificate or public key; wherein the certificate or public key is associated with the private key of a first node, or the certificate or public key is associated with the private key of a third node.

[0090] In conjunction with some embodiments of the sixth aspect, in some embodiments, the processing module can be configured to: verify the message verification code based on a symmetric key; wherein the symmetric key is shared by the first node and the second node, or the symmetric key is shared by the third node and the second node.

[0091] In conjunction with some embodiments of the sixth aspect, in some embodiments, the transceiver module may also be configured to: send third information to the first node, wherein the third information is used to indicate that the second node has failed to verify the identification information.

[0092] In conjunction with some embodiments of the sixth aspect, in some embodiments, the third information may include the reason for failure of the verification of the authentication information; wherein the reason for failure includes at least one of the following: the verification of the digital signature of the authentication information fails; the verification of the message verification code of the authentication information fails; the verification of the second statement of the authentication information fails; the verification of the third statement of the authentication information fails; the verification of the fourth statement of the authentication information fails.

[0093] In a seventh aspect, embodiments of this disclosure provide a communication device. The communication device is a third node. The communication device includes a transceiver module. The transceiver module is configured to: send authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface.

[0094] In conjunction with some embodiments of the seventh aspect, in some embodiments, the first node may be a service consumer and the second node may be a service provider.

[0095] In conjunction with some embodiments of the seventh aspect, in some embodiments, the identification information may include at least one of the following: a first statement, including identification information of a third node; a second statement, including identification information of a first node; a third statement, including identification information or type information of a second node; and a fourth statement, including first indication information, wherein the first indication information is used to indicate that the first node is a service consumer.

[0096] In conjunction with some embodiments of the seventh aspect, in some embodiments, the transceiver module may also be configured to: receive second information sent by the first node; the above-mentioned communication device may also include a processing module; the processing module is configured to: determine identification information based on the second information.

[0097] In conjunction with some embodiments of the seventh aspect, in some embodiments, the second information may include at least one of the following: first indication information for indicating that the first node is a service consumer; identification information of the first node; identification information of the second node; and type information of the second node.

[0098] In conjunction with some embodiments of the seventh aspect, in some embodiments, the authentication information may be protected by at least one of the following: a digital signature, determined based on the private key of a third node; and a message verification code, determined based on a symmetric key shared between the third node and the second node.

[0099] In an eighth aspect, embodiments of this disclosure provide a communication device. This communication device is used to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0100] In a ninth aspect, embodiments of this disclosure provide a communication system. The communication system includes at least one of the following: a first node, a second node, and a third node. The first node is configured to perform the communication method as described in any of the first aspect and its possible embodiments. The second node is configured to perform the communication method as described in any of the second aspect and its possible embodiments. The third node is configured to perform the communication method as described in any of the third aspect and its possible embodiments.

[0101] In a tenth aspect, embodiments of this disclosure provide a storage medium. The storage medium stores instructions. When executed on a communication device, the instructions cause the communication device to perform the communication method as described in any of the first, second, third, and possible embodiments thereof.

[0102] In an eleventh aspect, embodiments of this disclosure provide a program product. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in any of the first, second, third, and possible embodiments thereof.

[0103] In a twelfth aspect, embodiments of this disclosure provide a computer program. When run on a computer, the computer program causes the computer to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0104] In a thirteenth aspect, embodiments of this disclosure provide a chip or chip system. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication methods described in any of the first, second, third, and possible embodiments thereof.

[0105] It is understood that the aforementioned communication devices, communication systems, storage media, program products, computer programs, chips, and chip systems are all used to execute the methods provided in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0106] This disclosure provides a communication method, a communication device, a communication system, a storage medium, and a program product. In some embodiments, terms such as communication method, information processing method, and information transmission method can be used interchangeably; terms such as communication device, communication equipment, network equipment, network function, and network entity can be used interchangeably; and terms such as communication system and information processing system can be used interchangeably.

[0107] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0108] In the embodiments disclosed herein, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the various embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0109] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0110] In this embodiment of the disclosure, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the," "the," "the," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression.

[0111] In the embodiments of this disclosure, "a plurality of" means two or more.

[0112] In some embodiments, the terms “at least one of A or B, at least one of A and B”, “one or more”, “a plurality of”, “multiple”, etc., may be used interchangeably.

[0113] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "in response to one case A, in response to another case B", etc., may include the following technical solutions depending on the situation: in some embodiments, A (execute A regardless of whether there is a branch B); in some embodiments, B (execute B regardless of whether there is a branch A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, both A and B are executed. The same applies when there are more branches such as A, B, C, etc.

[0114] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execute A regardless of whether a branch B exists); in some embodiments, B (execute B regardless of whether a branch A exists); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, and C.

[0115] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. Similarly, if the object being described is "information", then "first information" and "second information" can be the same information or different information, and their content can be the same or different.

[0116] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0117] In some embodiments, terms such as “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “when…”, “if…”, etc. can be used interchangeably. These descriptions all refer to the device making a corresponding action under certain objective circumstances. They do not necessarily limit the time, nor do they require the device to make a judgment action when implementing it, nor do they mean that there must be other limitations.

[0118] In some embodiments, terms such as “greater than,” “more than,” “higher than,” and “exceeding” can be used interchangeably; terms such as “greater than or equal to,” “not less than,” “more than or equal to,” “not less than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably; terms such as “less than,” “less than,” and “lower than” can be used interchangeably; and terms such as “less than or equal to,” “not greater than,” “less than or equal to,” “not more than,” “lower than or equal to,” “not higher than,” and “below” can be used interchangeably.

[0119] In some embodiments, devices, etc., can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as “device”, “equipment”, “circuit”, “network element”, “node”, “function”, “unit”, “section”, “system”, “network”, “chip”, “chip system”, “entity”, and “subject” can be used interchangeably.

[0120] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0121] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0122] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", and "client" can be used interchangeably.

[0123] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0124] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0125] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0126] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0127] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0128] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure. As shown in Figure 1, the communication system 100 includes a first node 101, a second node 102, and a third node 103.

[0129] In some embodiments, the first node 101 may be an access network device. In some embodiments, the first node 101 may be a service-based access network device.

[0130] In some embodiments, the second node 102 may be an access network device or a core network function. In one example, the second node 102 may be another access network device different from the first node 101. In another example, the second node 102 may be a network function deployed in the core network.

[0131] In some embodiments, the third node 103 may be a core network function.

[0132] In some embodiments, the third node 103 may be responsible for providing security-related services or functions.

[0133] In some embodiments, the third node 103 may be, for example, a security service network function (SSNF).

[0134] In some embodiments, the access network device is, for example, a node or device that connects a terminal to a wireless network. In some embodiments, the access network device may include, but is not limited to, at least one of the following in a 5G communication system: evolved Node B (eNB), next-generation evolved Node B (ng-eNB), next-generation Node B (gNB), node B (NB), home node B (HNB), home evolved node B (HeNB), radio backhaul device, radio network controller (RNC), base station controller (BSC), base transceiver station (BTS), base band unit (BBU), mobile switching center, base station in a 6G communication system, open RAN, cloud RAN, base station in other communication systems, and access node in a Wi-Fi system.

[0135] In some embodiments, the technical solutions of this disclosure can be applied to Open Radio Access Network (Open RAN) architectures. In this case, the interfaces between or within access network devices involved in the embodiments of this disclosure can be transformed into internal interfaces of Open RAN. The processes and information interactions between these internal interfaces can be implemented by software or programs.

[0136] In some embodiments, core network equipment may be network elements deployed in the core network. Network elements may be virtual or physical. The core network includes, for example, at least one of the Evolved Packet Core (EPC), 5G Core Network (5GCN), and Next Generation Core (NGC).

[0137] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions proposed in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions proposed in this disclosure are also applicable to similar technical problems.

[0138] The following embodiments of this disclosure can be applied to the communication system 100 shown in FIG1, or to some of the main bodies, but are not limited thereto. The main bodies shown in FIG1 are illustrative. The communication system may include all or some of the main bodies in FIG1, or may include other main bodies outside of FIG1. ​​The number and form of each main body are arbitrary. Each main body may be physical or virtual. The connection relationship between the main bodies is illustrative. The main bodies may not be connected or may be connected. The connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0139] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other communication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0140] According to the white paper titled "6G Architecture Blueprint" published by the 5G Infrastructure Public-Private Partnership (5GPPP), the new 6G architecture should support highly efficient (streamlining) network functions, making them more efficient in terms of capacity, coverage, signaling load, scalability, and energy consumption. Dependencies between network functions can cause unnecessary complexity and even latency. Redesigning network functions can reduce the number of dependencies and processing points. In some embodiments, one way to improve the 6G architecture is to increase the possibility of direct signaling transmission between network functions, thereby eliminating potential bottlenecks. Currently, many services require information transmission between access network devices through the core network. For example, information transmission between NG-RAN devices requires 5GC. In 5GC, although information relay is achieved through the access management function (AMF), information transmission itself requires little or no AMF. To make such information transmission more efficient, service-based interfaces can be introduced for access network devices. This interface allows for direct information exchange between access network devices and network functions, or between access network devices, without going through the AMF.

[0141] Figure 2 is an exemplary schematic diagram of a service-based communication system architecture provided according to an embodiment of the present disclosure. In this communication system architecture, the service-based interface is used for the control plane.

[0142] As shown in Figure 2, in the communication system architecture, the AMF, Session Management Function (SMF), Network Data Analytics Function (NWDAF), Network Exposure Function (NEF), Location Management Function (LMF), Network Repository Function (NRF), Policy Control Function (PCF), Unified Data Management (UDM), and UE Capability Management Function (UCMF) provide corresponding services through service-based interfaces. The UE communicates with the AMF through the N1 interface. The UE communicates with the Next Generation Radio Access Network (NG-RAN) through the Uu interface. The NG-RAN communicates with the AMF through the N2 interface. The NG-RAN communicates with the UPF through the N3 interface. The User Plane Function (UPF) communicates with the SMF through the N4 interface. The UPF communicates with the data network (DN) through the N6 interface.

[0143] Furthermore, NG-RAN can provide services through service-based interfaces. As shown in Figure 2, the service-based interface of NG-RAN can be the Nran interface. NG-RAN can expose its own functionality through service-based interfaces.

[0144] In some embodiments, access network devices such as NG-RAN, when having a service-based interface, may be referred to as service-based access network devices.

[0145] For a long time, base stations have been developed in a single, integrated manner to ensure optimal performance as the "last mile." In some embodiments, the focus on performance should not hinder the exploration of service-based access network equipment. When facing the demands of new services and scenarios in the future, the primary focus can be on the network's adaptability to various scenarios. At the network function layer, necessary network functions can be flexibly combined as needed to provide personalized network services. To optimize network adaptability, research on service-based access network equipment is of paramount importance in future network architecture design.

[0146] In some embodiments, if the access network device evolves to a service-based architecture, it means that the access network device needs to directly interact with network functions other than the AMF (e.g., SMF, LMF, PCF) to consume or provide network services. In other words, the access network device can be a network function consumer (NF consumer) providing services to network functions other than the AMF, or a network function producer (NF producer) providing services to network functions other than the AMF. In some embodiments, in addition to the existing NF types in the core network, the access network device can be regarded as a new type of network function in the radio access network in a service-based architecture (SBA).

[0147] In some embodiments, existing security mechanisms for service-based architectures and / or interfaces can only be applied to network functions in the core network. The main security difference between access network devices and core network functions is that access network devices operate in a higher-risk environment and are more vulnerable to physical attacks compared to core network functions.

[0148] In some embodiments, where the existing 5G service-based architecture only includes core network functions, authentication between core network functions can be achieved in two ways.

[0149] In some embodiments, the case of direct communication is described. In one example, if the public land mobile network (PLMN) uses protection at the transport layer, authentication provided by the transport layer protection solution can be used for authentication between network functions. In another example, if the PLMN does not use protection at the transport layer, authentication between network functions within a PLMN can be implicitly performed by network domain security (NDS) / Internet Protocol (IP) or physical security.

[0150] In some embodiments, the scenario of indirect communication is described. In one example, the network function service provider and the network function service consumer may use implicit authentication, which relies on authentication between the network function service consumer and the service communication proxy (SCP), as well as authentication between the SCP and the network function service provider. Authentication may be provided by a transport layer protection solution, and / or NDS / IP, and / or physical security. In one example, additional authentication of the network function service consumer may be required, in which case the network function service provider may verify client credentials assertions to implement additional authentication of the network function service consumer.

[0151] In some embodiments, the fundamental concept of the NDS / IP architecture is to provide hop-by-hop security. In one example, current backhaul applications from access network devices to the core network employ hop-by-hop security. For communication between access network devices and core network functions, hop-by-hop security depends on the trusted and secure environment of the intermediate nodes between the access network devices and core network functions.

[0152] In some embodiments, access network devices located in higher-risk environments may be vulnerable to attack, but this may not be detected by any intermediate nodes. In such cases, communication between the access network devices and the core network functions is no longer secure, and the core network functions may not even detect this situation.

[0153] In some embodiments, the access network device is not at risk of being attacked, but one or more intermediate nodes cannot be fully trusted. Since the intermediate nodes can terminate security protection, the intermediate nodes may tamper with the communication between the access network device and the core network functions, or impersonate the access network device to communicate with the core network device.

[0154] In some embodiments, in networks such as 6G, if access network nodes deployed at high-risk edges of the network are service-based and can directly interact with network functions of various core networks other than the AMF, relying solely on existing SBA security mechanisms may not be sufficient to protect communication between access network devices and core network functions.

[0155] In some embodiments, when a service-based access network device acts as a service consumer, it needs to provide a corresponding security mechanism to implement authentication related to the access network device.

[0156] Therefore, how to protect access network equipment that acts as a service consumer is a technical problem that urgently needs to be solved.

[0157] Here, important concepts and terms involved in the embodiments of this disclosure are explained.

[0158] 1. OAuth 2.0

[0159] OAuth 2.0 is an authorization architecture that grants third-party applications restricted access to protected HTTP origins. In OAuth 2.0, third-party applications can be referred to as clients. These clients access protected resources by submitting an access token to the HTTP origin. The access token is issued to the client by the authorization server with the consent of the resource owner. In some embodiments, the access token can be obtained by exchanging an authorization grant. An authorization grant represents authorization granted from the resource owner.

[0160] 2. Assertion

[0161] Identification is a type of information packet. This packet facilitates the sharing of identification and security information between security domains.

[0162] In some embodiments, the entity that creates, signs, and / or protects the integrity of the assertion can be considered the issuer of the assertion. In some embodiments, the entity that consumes the assertion and relies on the information in the assertion can be considered the dependent party of the assertion. In some embodiments, the integrity of the assertion can be protected by using a digital signature or message authentication code (MAC) adopted by the issuer. The digital signature or MAC can be used to authenticate the issuer or ensure the integrity of the assertion content. In some embodiments, the assertion can be issued by a third party and can be protected from tampering by the client providing the assertion. In some embodiments, the assertion can be encrypted to prevent unauthorized parties from viewing the content of the assertion.

[0163] In some embodiments, the acquisition of recognition can be achieved through different modes.

[0164] Figure 3A is an exemplary schematic diagram of a first mode of obtaining authentication according to an embodiment of the present disclosure. As shown in Figure 3A, in the first mode, the customer obtains authentication from a third-party entity capable of issuing, updating, converting, and verifying security tokens.

[0165] Figure 3B is an exemplary schematic diagram of a second mode of obtaining authentication according to an embodiment of the present disclosure. As shown in Figure 3B, in the second mode, the customer creates the authentication locally. In order to use a signature or message verification code for the authentication, the customer must obtain key materials, such as a symmetric key or an asymmetric key pair.

[0166] In some embodiments, the authentication can be used for OAuth 2.0 authorization granting. In some embodiments, the authentication can be used for OAuth 2.0 customer authentication. It should be noted that authorization granting and customer authentication can be implemented together or separately.

[0167] In some embodiments, the assertions used in OAuth 2.0 may include at least one of the following: publisher, subject, audience, publication time, timeout, assertion identifier, and scope.

[0168] In some embodiments, the issuer may indicate a unique identifier for the entity issuing the certification. In some embodiments, the issuer may be one of the following: a client, a third-party security token service (STS).

[0169] In some embodiments, the subject can refer to an identified entity. In one example, identification can be used for customer authentication, whereby the subject identifies the customer to the authorization server by using a value of the customer's identifier from the OAuth customer. In another example, authentication can be used for authorization granting, whereby the subject can identify the authorized access party (e.g., a resource owner or authorized representative) requesting an access token.

[0170] In some embodiments, the audience may include a value that identifies the party to be identified.

[0171] In some embodiments, the issued time can indicate the time at which the publication was determined.

[0172] In some embodiments, the timeout period (expires at) can indicate the time at which the timeout is determined.

[0173] In some embodiments, the assertion ID may be a temporary or unique identifier for the assertion.

[0174] In some embodiments, the scope may be used to indicate the scope of authorization.

[0175] In some embodiments, the authentication can be a JWT (JSON Web Token) authentication. In one example, the JWT authentication can be in JWT format. In this case, the authentication identifier can be a JWT authentication identifier.

[0176] In some embodiments, the publisher, subject, audience, publication time, timeout period, identification identifier, scope, etc., in the identification may take the form of a claim. In some embodiments, the identification may include one or more claims. These claims may include at least one of the following: publisher claim, subject claim, audience claim, publication time claim, timeout period claim, identification identifier claim, and scope claim.

[0177] In some embodiments, the assertion may also be referred to as assertion information. In some embodiments, the assertion may also be referred to as an assertion.

[0178] Figure 4A is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. The communication method involved in this embodiment can be applied to a communication system 100. As shown in Figure 4A, the communication method of this embodiment includes steps S4101 to S4109.

[0179] In step S4101, the first node 101 sends the second information to the third node 103.

[0180] In some embodiments, the first node 101 may send second information. In some embodiments, the second information may be sent by the first node 101, but is not limited to this, and may also be sent by other entities.

[0181] In some embodiments, the third node 103 may receive the second information. In some embodiments, the second information may be received by the third node 103, but is not limited to this, and may also be received by other entities.

[0182] In some embodiments, the first node 101 may be a service-based access network device. In some embodiments, the first node 101 may be an access network device that can communicate with the second node 102 through a service-based interface. In some embodiments, the first node 101 may communicate with the second node 102 through a service-based interface.

[0183] In some embodiments, the first node 101 may be a service consumer. In one example, the first node 101 may request services from network functions in the core network. In some embodiments, the second node 102, which communicates with the first node 101, may be a service provider.

[0184] In some embodiments, the second node 102 may be a network function in the core network. In some embodiments, the second node 102 may be another service-based access network device.

[0185] In some embodiments, the third node 103 may be responsible for managing the first node 101 and the second node 102. In some embodiments, the third node 103 may be used to provide security services for the first node 101, the second node 102, etc.

[0186] In some embodiments, the second information can be used by the third node 103 to determine the identification information. In some embodiments, the second information can be used to request the third node 103 to generate the identification information. In some embodiments, the second information can be used to provide the third node 103 with the information required to generate the identification information.

[0187] In some embodiments, the authentication information, also referred to as authentication or assertion, can be used to grant authorization and / or authenticate clients. In some embodiments, the authentication information can be used by the second node 102, acting as a service provider, to authenticate the first node 101, acting as a service consumer.

[0188] In some embodiments, the name of the second information is not limited, and it may be, for example, identification information request information, identification information generation trigger information, etc.

[0189] In some embodiments, the second information may include at least one of the following: first indication information, identification information of the first node 101, identification information of the second node 102, and type information of the second node 102.

[0190] In some embodiments, the first indication information can be used to indicate the role of the first node 101. In one example, the first indication information can indicate that the role of the first node 101 is a service consumer. Of course, the role of the first node 101 can also be a service provider, and this disclosure does not specifically limit this.

[0191] In some embodiments, the identification information of the first node 101 can be used to identify the first node 101. In one example, the identification information of the first node 101 may include an identifier of the first node 101. For example, the first node 101 may include the RAN ID of the first node 101.

[0192] In some embodiments, the identification information of the second node 102 can be used to identify the second node 102. In one example, the identification information of the second node 102 may include an identifier of the second node 102. In another example, the identification information of the second node 102 may include an identifier of an instance of the second node 102.

[0193] In some embodiments, the type information of the second node 102 can be used to indicate the type of the second node 102. In some embodiments, the type information of the second node 102 can indicate the exact type of the second node 102. In one example, the exact type can be used to determine which network function the second node 102 is. For example, the type indicated by the type information of the second node 102 can be at least one of the following: SMF, PCF, UPF, LMF, UDM, NWDAF, NRF. Of course, the type information of the second node 102 can also indicate other network functions, and this disclosure does not specifically limit this.

[0194] It should be noted that the second node 102 here can be the node that the first node 101 wants to access. In other words, the second node 102 can be the node that the first node 101 wants to access.

[0195] In some embodiments, the second information may include first indication information. In some embodiments, the second information may include the first indication information and the identification information of the first node 101. In some embodiments, the second information may include the first indication information and the identification information of the second node 102. In some embodiments, the second information may include the first indication information and the type information of the second node 102. In some embodiments, the second information may include the first indication information, the identification information of the first node 101, and the identification information of the second node 102. In some embodiments, the second information may include the first indication information, the identification information of the first node 101, and the type information of the second node 102.

[0196] In some embodiments, the second information may be carried in a request message. The first node 101 may send the second information to the third node 103 via the request message.

[0197] In step S4102, the third node 103 determines the identification information.

[0198] In some embodiments, the third node 103 may determine the identification information upon receiving the second information. In some embodiments, the identification information may be generated based on the second information.

[0199] In some embodiments, the identification information may include at least one of the following: a first statement, a second statement, a third statement, and a fourth statement. In some embodiments, the first statement may indicate the publisher of the identification information. For example, the first statement may be a publisher statement. In some embodiments, the second statement may indicate the subject of the identification information. For example, the second statement may be a subject statement. In some embodiments, the third statement may indicate the party verifying the identification information. For example, the third statement may be an audience statement. In some embodiments, the fourth statement may indicate the scope of authorization for the identification information. For example, the fourth statement may be a scope statement. In one example, the identification information may include at least one of the following: a publisher statement, a subject statement, an audience statement, and a scope statement. It should be noted that one or more of the first statement, second statement, third statement, and fourth statement may also have other names, and this disclosure does not specifically limit this.

[0200] In some embodiments, the identification information may further include at least one of the following: a timeout declaration, a publication time declaration, and an identification information identifier.

[0201] In some embodiments, a publisher statement can be used to indicate the publisher of the identification information. In some embodiments, a publisher statement may include identification information of a third node 103, in which case the publisher statement may indicate that the publisher of the identification information is the third node 103.

[0202] In some embodiments, a subject declaration can be used to indicate the subject of the identification information. In some embodiments, the subject declaration may include the identification information of the first node 101, in which case the subject declaration may indicate that the subject of the identification information is the first node 101.

[0203] In some embodiments, an audience claim may be used to instruct a party to examine the assertion information. In some embodiments, an audience claim may include identification information of a second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 identified by the identification information. In some embodiments, an audience claim may include type information of a second node 102, in which case the audience claim may instruct the assertion information to be examined by a second node 102 of the type indicated by the type information.

[0204] In some embodiments, a scope statement can be used to indicate the scope of authorization of the identification information. In some embodiments, a scope statement can indicate that the first node 101 is a service consumer. In one example, a scope statement may include first indication information. In some embodiments, the scope statement may be determined based on the first indication information. In this case, the identification information is only used when the first node 101 is a service consumer.

[0205] In some embodiments, a timeout declaration can be used to indicate a timeout period after which the assessment information is no longer accepted. In other words, after this timeout period, the assessment information is no longer accepted, i.e., the assessment information becomes invalid. In some embodiments, a timeout declaration can indicate a period of time or a point in time. If the assessment information becomes invalid after the time period or point in time has expired.

[0206] In some embodiments, the publication time statement can be used to indicate the time when the identification information was generated. In some embodiments, the publication time statement can indicate a point in time when the identification information was generated by the third node 103.

[0207] In some embodiments, the identification information identifier can be used to uniquely identify the identification information.

[0208] In some embodiments, the identification information may include at least a publisher statement, a subject statement, an audience statement, and a scope statement. In some embodiments, the identification information may also include one or more of the following: a timeout statement, a publication time statement, and an identification information identifier.

[0209] In some embodiments, when the second information includes identification information of the second node 102, the third node 103 can obtain the identification information of the second node 102 from the second information and add it to the audience declaration of the identification information. In some embodiments, when the second information includes type information of the second node 102, the third node 103 can obtain the type information of the second node 102 from the second information and add it to the audience declaration of the identification information. In some embodiments, when the second information does not include identification information and type information of the second node 102, the third node 103 can set the audience declaration to a generic type. In one example, the generic type can be used to substantially determine the type of the second node 102. For example, the generic type indicated by the type information of the second node 102 can be a network function of the core network or an access network device.

[0210] In some embodiments, a trust relationship may exist between the third node 103 and the second node 102. In some embodiments, the third node 103 and the second node 102 may have already completed mutual authentication. In some embodiments, the third node 103 may be configured with a private key, and the second node 102 may be configured with a certificate and / or a public key. The private key in the third node 103 and the certificate and / or public key in the second node 102 may be associated. In some embodiments, the third node 103 and the second node 102 may share a symmetric key.

[0211] In some embodiments, the third node 103 can use a private key to protect the authentication information. In one example, the third node 103 can determine a digital signature of the authentication information based on its private key. This digital signature can be used to protect the authentication information.

[0212] In some embodiments, the third node 103 can utilize a symmetric key to protect the authentication information. In one example, the third node 103 can determine a message verification code for the authentication information based on a symmetric key shared between the second node 102 and the third node 103. This message verification code can be used to protect the authentication information.

[0213] In some embodiments, after generating the authentication information, the third node 103 may use digital signatures and / or message verification codes to protect the generated authentication information.

[0214] In step S4103, the third node 103 sends the authentication information to the first node 101.

[0215] In some embodiments, the third node 103 may send authentication information. In some embodiments, the authentication information may be sent by the third node 103, but is not limited thereto, and may also be sent by other entities.

[0216] In some embodiments, the first node 101 may receive authentication information. In some embodiments, the authentication information may be received by the first node 101, but is not limited thereto, and may also be received by other entities.

[0217] In some embodiments, the third node 103 may send the determined identification information to the first node 101.

[0218] In some embodiments, the identification information may be carried in a response message. This response message may be sent in response to the request message in step S4101. The third node 103 can send the identification information to the first node 101 through the response message.

[0219] In step S4104, the first node 101 stores the identification information.

[0220] In some embodiments, the first node 101 may store the received authentication information locally. In some embodiments, the first node 101 may obtain authentication information from a response message and store the authentication information.

[0221] In some embodiments, the identification information can be securely stored in the first node 101. For example, the first node 101 can store the identification information in a secure environment.

[0222] In step S4105, the first node 101 sends the first information to the second node 102.

[0223] In some embodiments, the first node 101 may send first information. In some embodiments, the first information may be sent by the first node 101, but is not limited thereto, and may also be sent by other entities.

[0224] In some embodiments, the second node 102 may receive the first information. In some embodiments, the first information may be received by the second node 102, but is not limited thereto, and may also be received by other entities.

[0225] In some embodiments, upon obtaining identification information, the first node 101 may send first information to the second node 102.

[0226] In some embodiments, the first information may be used to request the second node 102 to provide services. In some embodiments, the first information may be used to request access to the second node 102.

[0227] In some embodiments, the name of the first information is not limited, and it may be, for example, service request information, service requirement information, service indication information, etc.

[0228] In some embodiments, the first information may include at least one of the following: authentication information, a token, and identification information of the first node 101. In one example, the first information may include authentication information. In one example, the first information may include authentication information and identification information of the first node 101. In one example, the first information may include authentication information and a token. In one example, the first information may include authentication information, a token, and identification information of the first node 101.

[0229] In some embodiments, the token may be issued by the NRF for the first node 101 to enable access to the second node 102 by the first node 101. In some embodiments, the token may be an access token.

[0230] In some embodiments, the identification information of the first node 101 carried in the first information can be used to indicate the sender of the first information.

[0231] In some embodiments, the first information may be carried in the service request. The service request may be used to request the second node 102 to provide services.

[0232] In some embodiments, the second node 102 may be an NRF, and the service request may be a registration request. In this case, the first information carried in the registration request may not include a token.

[0233] In some embodiments, the first information can be sent via a service-based interface. In some embodiments, the first node 101 can send the first information to the second node 102 via the service-based interface.

[0234] In step S4106, the second node 102 verifies the information.

[0235] In some embodiments, upon receiving the first information, the second node 102 can verify the authentication information. Based on the verification of the authentication information, the second node 102 can determine whether the first node 101 is a legitimate service consumer.

[0236] In some embodiments, the verification of the certification information may include at least one of the following: verifying the digital signature of the certification information; verifying the message verification code of the certification information; verifying the subject statement of the certification information; verifying the audience statement of the certification information; and verifying the scope statement of the certification information.

[0237] In some embodiments, verifying the digital signature of the authentication information may include: identifying a third node 103 based on the publisher's statement of the authentication information; obtaining the certificate or public key of the third node 103; and verifying the digital signature of the authentication information based on the certificate or public key. In some embodiments, the second node 102 may obtain the identification information of the third node 103 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the certificate or public key associated with the third node 103 locally based on the identification information of the third node 103. For example, this certificate or public key corresponds to the private key used by the third node 103 when determining the digital signature of the authentication information. Next, the second node 102 may verify the digital signature of the authentication information based on the certificate or public key.

[0238] In some embodiments, verifying the message verification code of the authentication information may include: identifying a third node 103 based on the publisher's statement of the authentication information; obtaining the symmetric key shared between the third node 103 and the second node 102; and verifying the message verification code of the authentication information based on the symmetric key. In some embodiments, the second node 102 may obtain the identification information of the third node 103 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the symmetric key shared between the third node 103 and the second node 102 locally based on the identification information of the third node 103. Next, the second node 102 may verify the message verification code of the authentication information based on the symmetric key.

[0239] In some embodiments, verifying the subject statement in the identification information may include determining whether the subject statement in the identification information matches the identification information of the first node 101 carried in the first information. In some embodiments, the second node 102 may obtain the identification information of the first node 101 from the subject statement in the identification information. Then, the second node 102 may match the identification information of the first node 101 in the subject statement with the identification information of the first node 101 carried in the first information to determine whether they are consistent. If they are consistent, the verification of the subject statement is successful; if they are inconsistent, the verification of the subject statement fails.

[0240] In some embodiments, verifying the audience claim in the identification information may include determining whether the audience claim in the identification information matches the identifier or type of the second node 102 itself. In some embodiments, the second node 102 may obtain its identifier information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own identifier to determine if they are consistent. In some embodiments, the second node 102 may obtain its type information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the audience claim with its own type to determine if they are consistent. If they are consistent, the audience claim verification is successful; if they are inconsistent, the audience claim verification fails.

[0241] In some embodiments, verifying the scope statement of the identification information may include determining whether the scope statement in the identification information matches the role of the first node 101. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service consumer. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. For example, if the first information is used to request a service from the second node 102, the second node 102 may determine that the first node 101 is a service consumer based on the purpose of the first information. The second node 102 may match the first indication information with the actual role of the first node 101 to determine whether they are consistent. If they are consistent, the scope statement verification is successful; if they are inconsistent, the scope statement verification fails.

[0242] In some embodiments, the digital signature of the verification information and the message verification code of the verification information can be executed selectively or together. In some embodiments, the verification information can be protected by a digital signature, in which case the second node 102 can verify the digital signature. In some embodiments, the verification information can be protected by a message verification code, in which case the second node 102 can verify the message verification code.

[0243] In some embodiments, the operation of verifying the assertion information may include: verifying the digital signature of the assertion information; verifying the subject claim of the assertion information; verifying the audience claim of the assertion information; and verifying the scope claim of the assertion information. In some embodiments, the various verifications in the above verification of the assertion information may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the digital signature; if the digital signature verification is successful, the second node 102 may verify the subject claim; if the subject claim verification is successful, the second node 102 may verify the audience claim; if the audience claim verification is successful, the second node 102 may verify the scope claim. It is understood that the order of the above verifications is not limited to this.

[0244] In some embodiments, the operation of verifying the certification information may include: verifying the message verification code of the certification information; verifying the subject statement of the certification information; verifying the audience statement of the certification information; and verifying the scope statement of the certification information. In some embodiments, the various verifications in the above verification of the certification information may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the message verification code; if the message verification code verification is successful, the second node 102 may verify the subject statement; if the subject statement verification is successful, the second node 102 may verify the audience statement; if the audience statement verification is successful, the second node 102 may verify the scope statement. It is understood that the order of the above verifications is not limited to this.

[0245] In some embodiments, the verification of the authentication information may further include at least one of the following: verifying a timeout declaration and verifying a publication time declaration. In some implementations, if the verification of the digital signature, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration. In some implementations, if the verification of the message verification code, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration.

[0246] In some embodiments, if at least one of the above-mentioned tests performed on the assertion information fails, the second node 102 may determine that the test on the assertion information has failed. In some embodiments, if all of the above-mentioned tests performed on the assertion information succeed, the second node 102 may determine that the test on the assertion information has succeeded.

[0247] In some embodiments, failure to verify the authentication information means that the second node 102 fails to authenticate the first node 101.

[0248] In step S4107, the second node 102 sends third information to the first node 101.

[0249] In some embodiments, the second node 102 may send third information. In some embodiments, the third information may be sent by the second node 102, but is not limited thereto, and may also be sent by other entities.

[0250] In some embodiments, the first node 101 may receive third information. In some embodiments, the third information may be received by the first node 101, but is not limited thereto, and may also be received by other entities.

[0251] In some embodiments, the third information may be sent if the second node 102 determines that the verification of the identification information has failed.

[0252] In some embodiments, the third information may be used to indicate that the second node 102 failed to verify the identification information.

[0253] In some embodiments, the name of the third information is not limited, and it may be, for example, a failure indication message, a failure notification message, an invalidation indication message, etc.

[0254] In some embodiments, the third information may include indication information. This indication information is used to indicate that the verification of the certification information has failed.

[0255] In some embodiments, the third information may include the reason for the failure of the verification of the assertion information. In one example, where the third information includes a reason for failure, the third information may implicitly indicate the failure of the verification of the assertion information through the reason for failure.

[0256] In some embodiments, the reasons for failure may include at least one of the following: failure to verify the digital signature of the identification information; failure to verify the message verification code of the identification information; failure to verify the subject statement of the identification information; failure to verify the audience statement of the identification information; failure to verify the scope statement of the identification information; failure to verify the timeout statement of the identification information; failure to verify the publication time statement of the identification information.

[0257] In some embodiments, the third information may include indication information and a reason for failure. In some embodiments, the third information may include only indication information. In some embodiments, the third information may include only a reason for failure. In some embodiments, when the third information includes indication information, the indication information is used to explicitly indicate that the verification of the determination information has failed. In some embodiments, when the third information includes only a reason for failure, the third information may implicitly indicate that the verification of the determination information has failed through the reason for failure.

[0258] In step S4108, the second node 102 verifies the token.

[0259] In some embodiments, if the verification of the authentication information is successful, the second node 102 may verify the token carried in the first information.

[0260] In some embodiments, if the token verification is successful, the second node 102 can determine that the authentication of the first node 101 is successful. In some embodiments, if both the verification of the authentication information and the verification of the token are successful, the second node 102 can determine that the authentication of the first node 101 is successful.

[0261] It should be noted that steps S4107 and S4108 can be executed selectively. If the verification of the identification information fails, step S4107 is executed, and step S4108 is not executed. If the verification of the identification information succeeds, step S4108 is executed, and step S4107 is not executed.

[0262] In step S4109, the second node 102 sends the fourth information to the first node 101.

[0263] In some embodiments, the second node 102 may send fourth information. In some embodiments, the fourth information may be sent by the second node 102, but is not limited thereto, and may also be sent by other entities.

[0264] In some embodiments, the first node 101 may receive fourth information. In some embodiments, the fourth information may be received by the first node 101, but is not limited thereto, and may also be received by other entities.

[0265] In some embodiments, the fourth information may be sent upon successful authentication of the first node 101 by the second node 102.

[0266] In some embodiments, the fourth information may be used to indicate successful authentication of the first node 101. In some embodiments, the fourth information may be used to indicate that the first node 101 is permitted to access the services of the second node 102.

[0267] In some embodiments, the fourth information may be carried in the service response. This service response may be sent in response to the service request in step S4105. The second node 102 can send the fourth information to the first node 101 via the service response.

[0268] In some embodiments, in addition to sending the fourth information, the second node 102 may provide the requested service to the first node 101. For example, the second node 102 may perform related operations based on the service request received in step S4105.

[0269] The communication method of this embodiment can be implemented through steps S4101 to S4109.

[0270] The communication method involved in the embodiments of this disclosure may include at least one of steps S4101 to S4109. For example, step S4103 may be implemented as a standalone embodiment. For example, step S4105 may be implemented as a standalone embodiment. For example, a combination of steps S4101 and S4103 may be implemented as a standalone embodiment. For example, a combination of steps S4103 and S4105 may be implemented as a standalone embodiment. For example, a combination of steps S4105 and S4106 may be implemented as a standalone embodiment. For example, a combination of steps S4101, S4102, and S4103 may be implemented as a standalone embodiment. For example, a combination of steps S4101, S4103, and S4105 may be implemented as a standalone embodiment. For example, a combination of steps S4103, S4105, and S4106 may be implemented as a standalone embodiment. For example, a combination of steps S4105, S4106, and S4107 may be implemented as a standalone embodiment. It should be noted that the possible independent embodiments consisting of one or more steps in steps S4101 and S4109 are not limited thereto.

[0271] In some embodiments, at least two of steps S4101 to S4109 may be executed simultaneously or in a different order. For example, steps S4106 and S4108 may be executed simultaneously or in a different order.

[0272] In some embodiments, steps S4101, S4102, S4104, S4105, S4106, S4107, S4108, and S4109 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0273] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0274] Figure 4B is an exemplary interactive schematic diagram of the communication method provided according to an embodiment of the present disclosure. The communication method involved in the embodiment of the present disclosure can be applied to the communication system 100. As shown in Figure 4B, the communication method of the embodiment of the present disclosure includes steps S4201 to S4206.

[0275] In step S4201, the first node 101 determines the identification information.

[0276] In some embodiments, the identification information may be determined by the first node 101.

[0277] In some embodiments, the authentication information can be used to grant authorization and / or authenticate customers. In some embodiments, the authentication information can be used by the second node 102, acting as a service provider, to authenticate the first node 101, acting as a service consumer.

[0278] In some embodiments, the first node 101 may be a service-based access network device. In some embodiments, the first node 101 may be an access network device that can communicate with the second node 102 through a service-based interface. In some embodiments, the first node 101 may communicate with the second node 102 through a service-based interface.

[0279] In some embodiments, the first node 101 may be a service consumer. In one example, the first node 101 may request services from network functions in the core network. In some embodiments, the second node 102, which communicates with the first node 101, may be a service provider.

[0280] In some embodiments, the second node 102 may be a network function in the core network. In some embodiments, the second node 102 may be another service-based access network device.

[0281] In some embodiments, the identification information may include at least one of the following: a first statement, a second statement, a third statement, and a fourth statement. In some embodiments, the first statement may indicate the publisher of the identification information. For example, the first statement may be a publisher statement. In some embodiments, the second statement may indicate the subject of the identification information. For example, the second statement may be a subject statement. In some embodiments, the third statement may indicate the party verifying the identification information. For example, the third statement may be an audience statement. In some embodiments, the fourth statement may indicate the scope of authorization for the identification information. For example, the fourth statement may be a scope statement. In one example, the identification information may include at least one of the following: a publisher statement, a subject statement, an audience statement, and a scope statement. It should be noted that one or more of the first statement, second statement, third statement, and fourth statement may also have other names, and this disclosure does not specifically limit this.

[0282] In some embodiments, the identification information may further include at least one of the following: a timeout declaration, a publication time declaration, and an identification information identifier.

[0283] In some embodiments, a publisher statement can be used to indicate the publisher of the identification information. In some embodiments, a publisher statement may include the identification information of the first node 101, in which case the publisher statement may indicate that the publisher of the identification information is the first node 101.

[0284] In some embodiments, a subject declaration can be used to indicate the subject of the identification information. In some embodiments, the subject declaration may include the identification information of the first node 101, in which case the subject declaration may indicate that the subject of the identification information is the first node 101.

[0285] In some embodiments, an audience claim may be used to instruct a party to examine the assertion information. In some embodiments, an audience claim may include identification information of a second node 102, in which case the audience claim may instruct the assertion information to be examined by the second node 102 identified by the identification information. In some embodiments, an audience claim may include type information of a second node 102, in which case the audience claim may instruct the assertion information to be examined by a second node 102 of the type indicated by the type information.

[0286] In some embodiments, the type information of the second node 102 in the audience declaration can be used to indicate the type of the second node 102. In some embodiments, the type information of the second node 102 can indicate the exact type of the second node 102. In one example, the exact type can be used to determine which network function the second node 102 is. For example, the type indicated by the type information of the second node 102 can be at least one of the following: SMF, PCF, UPF, LMF, UDM, NWDAF, NRF. Of course, the type information of the second node 102 can also indicate other network functions, and this disclosure does not specifically limit this. In some embodiments, the type information of the second node 102 can indicate the general type of the second node 102. In one example, the general type can be used to substantially determine the type of the second node 102. For example, the general type indicated by the type information of the second node 102 can be a core network function or an access network device.

[0287] In some embodiments, a scope statement can be used to indicate the scope of authorization of the identification information. In some embodiments, a scope statement can indicate that the first node 101 is a service consumer. In one example, a scope statement may include first indication information. In some embodiments, the scope statement may be determined based on the first indication information. In this case, the identification information is only used when the first node 101 is a service consumer.

[0288] In some embodiments, a timeout declaration can be used to indicate a timeout period after which the assessment information is no longer accepted. In other words, after this timeout period, the assessment information is no longer accepted, i.e., the assessment information becomes invalid. In some embodiments, a timeout declaration can indicate a period of time or a point in time. If the assessment information becomes invalid after the time period or point in time has expired.

[0289] In some embodiments, the publication time statement can be used to indicate the time when the identification information was generated. In some embodiments, the publication time statement can indicate a point in time when the identification information was generated by the first node 101.

[0290] In some embodiments, the identification information identifier can be used to uniquely identify the identification information.

[0291] In some embodiments, the identification information may include at least a publisher statement, a subject statement, an audience statement, and a scope statement. In some embodiments, the identification information may also include one or more of the following: a timeout statement, a publication time statement, and an identification information identifier.

[0292] In some embodiments, a trust relationship may exist between the first node 101 and the second node 102. In some embodiments, the first node 101 and the second node 102 may have already completed mutual authentication. In some embodiments, the first node 101 may be configured with a private key, and the second node 102 may be configured with a certificate and / or a public key. The private key in the first node 101 and the certificate and / or public key in the second node 102 may be associated. In some embodiments, the first node 101 and the second node 102 may share a symmetric key.

[0293] In some embodiments, the first node 101 can use a private key to protect the authentication information. In one example, the first node 101 can determine a digital signature of the authentication information based on its private key. This digital signature can be used to protect the authentication information.

[0294] In some embodiments, the first node 101 can utilize a symmetric key to protect the authentication information. In one example, the first node 101 can determine a message verification code for the authentication information based on a symmetric key shared between the second node 102 and the first node 101. This message verification code can be used to protect the authentication information.

[0295] In some embodiments, after generating the authentication information, the first node 101 may use digital signatures and / or message verification codes to protect the generated authentication information.

[0296] In step S4202, the first node 101 sends the first information to the second node 102.

[0297] The optional implementation of step S4202 can be found in the optional implementation of step S4105 in Figure 4A, as well as other related parts in the embodiment involved in Figure 4A, which will not be repeated here.

[0298] In step S4203, the second node 102 verifies the verification information.

[0299] In some embodiments, upon receiving the first information, the second node 102 can verify the authentication information. Based on the verification of the authentication information, the second node 102 can determine whether the first node 101 is a legitimate service consumer.

[0300] In some embodiments, the verification of the certification information may include at least one of the following: verifying the digital signature of the certification information; verifying the message verification code of the certification information; verifying the subject statement of the certification information; verifying the audience statement of the certification information; and verifying the scope statement of the certification information.

[0301] In some embodiments, verifying the digital signature of the authentication information may include: identifying a first node 101 based on the publisher's statement of the authentication information; obtaining the certificate or public key of the first node 101; and verifying the digital signature of the authentication information based on the certificate or public key. In some embodiments, a second node 102 may obtain the identification information of the first node 101 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the certificate or public key associated with the first node 101 locally based on the identification information of the first node 101. For example, this certificate or public key corresponds to the private key used by the first node 101 when determining the digital signature of the authentication information. Next, the second node 102 may verify the digital signature of the authentication information based on the certificate or public key.

[0302] In some embodiments, verifying the message verification code of the authentication information may include: identifying a third node 103 based on the publisher's statement of the authentication information; obtaining the symmetric key shared between the third node 103 and the second node 102; and verifying the message verification code of the authentication information based on the symmetric key. In some embodiments, the second node 102 may obtain the identification information of the third node 103 from the publisher's statement of the authentication information. Then, the second node 102 may obtain the symmetric key shared between the third node 103 and the second node 102 locally based on the identification information of the third node 103. Next, the second node 102 may verify the message verification code of the authentication information based on the symmetric key.

[0303] In some embodiments, verifying the subject statement in the identification information may include determining whether the subject statement in the identification information matches the identification information of the first node 101 carried in the first information. In some embodiments, the second node 102 may obtain the identification information of the first node 101 from the subject statement in the identification information. Then, the second node 102 may match the identification information of the first node 101 in the subject statement with the identification information of the first node 101 carried in the first information to determine whether they are consistent. If they are consistent, the verification of the subject statement is successful; if they are inconsistent, the verification of the subject statement fails.

[0304] In some embodiments, verifying the audience claim in the identification information may include determining whether the audience claim in the identification information matches the identifier or type of the second node 102 itself. In some embodiments, the second node 102 may obtain its identifier information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the subject claim with its own identifier to determine if they are consistent. In some embodiments, the second node 102 may obtain its type information from the audience claim in the identification information. Then, the second node 102 may match the identifier information of the second node 102 in the subject claim with its own type to determine if they are consistent. If they are consistent, the audience claim verification is successful; if they are inconsistent, the audience claim verification fails.

[0305] In some embodiments, verifying the scope statement of the identification information may include determining whether the scope statement in the identification information matches the role of the first node 101. In some embodiments, the second node 102 may obtain first indication information from the scope statement of the identification information. The first indication information indicates that the first node 101 is a service consumer. Then, the second node 102 may determine the actual role of the first node 101 based on the first information. For example, if the first information is used to request a service from the second node 102, the second node 102 may determine that the first node 101 is a service consumer based on the purpose of the first information. The second node 102 may match the first indication information with the actual role of the first node 101 to determine whether they are consistent. If they are consistent, the scope statement verification is successful; if they are inconsistent, the scope statement verification fails.

[0306] In some embodiments, the digital signature of the verification information and the message verification code of the verification information can be executed selectively or together. In some embodiments, the verification information can be protected by a digital signature, in which case the second node 102 can verify the digital signature. In some embodiments, the verification information can be protected by a message verification code, in which case the second node 102 can verify the message verification code.

[0307] In some embodiments, the operation of verifying the assertion information may include: verifying the digital signature of the assertion information; verifying the subject claim of the assertion information; verifying the audience claim of the assertion information; and verifying the scope claim of the assertion information. In some embodiments, the various verifications in the above verification of the assertion information may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the digital signature; if the digital signature verification is successful, the second node 102 may verify the subject claim; if the subject claim verification is successful, the second node 102 may verify the audience claim; if the audience claim verification is successful, the second node 102 may verify the scope claim. It is understood that the order of the above verifications is not limited to this.

[0308] In some embodiments, the operation of verifying the certification information may include: verifying the message verification code of the certification information; verifying the subject statement of the certification information; verifying the audience statement of the certification information; and verifying the scope statement of the certification information. In some embodiments, the various verifications in the above verification of the certification information may be performed sequentially or simultaneously. In one example, the second node 102 may first verify the message verification code; if the message verification code verification is successful, the second node 102 may verify the subject statement; if the subject statement verification is successful, the second node 102 may verify the audience statement; if the audience statement verification is successful, the second node 102 may verify the scope statement. It is understood that the order of the above verifications is not limited to this.

[0309] In some embodiments, the verification of the authentication information may further include at least one of the following: verifying a timeout declaration and verifying a publication time declaration. In some implementations, if the verification of the digital signature, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration. In some implementations, if the verification of the message verification code, subject declaration, audience declaration, and scope declaration is successful, the second node 102 may perform verification of the timeout declaration and / or publication time declaration.

[0310] In some embodiments, if at least one of the above-mentioned tests performed on the assertion information fails, the second node 102 may determine that the test on the assertion information has failed. In some embodiments, if all of the above-mentioned tests performed on the assertion information succeed, the second node 102 may determine that the test on the assertion information has succeeded.

[0311] In some embodiments, failure to verify the authentication information means that the second node 102 fails to authenticate the first node 101.

[0312] In step S4204, the second node 102 sends third information to the first node 101.

[0313] The optional implementation of step S4204 can be found in the optional implementation of step S4107 in Figure 4A, as well as other related parts in the embodiment involved in Figure 4A, which will not be repeated here.

[0314] In step S4205, the second node 102 verifies the token.

[0315] The optional implementation of step S4205 can be found in the optional implementation of step S4108 in Figure 4A, as well as other related parts in the embodiment involved in Figure 4A, which will not be repeated here.

[0316] In step S4206, the second node 102 sends the fourth information to the first node 101.

[0317] The optional implementation of step S4206 can be found in the optional implementation of step S4109 in Figure 4A, as well as other related parts in the embodiment involved in Figure 4A, which will not be repeated here.

[0318] The communication method of this embodiment can be implemented through steps S4201 to S4206.

[0319] The communication method involved in the embodiments of this disclosure may include at least one of steps S4201 to S4206. For example, step S4202 may be implemented as a standalone embodiment. For example, a combination of steps S4201 and S4202 may be implemented as a standalone embodiment. For example, a combination of steps S4202 and S4203 may be implemented as a standalone embodiment. For example, a combination of steps S4203 and S4204 may be implemented as a standalone embodiment. For example, a combination of steps S4201, S4202, and S4203 may be implemented as a standalone embodiment. It should be noted that the possible standalone embodiments consisting of one or more steps in steps S4201 and S4206 are not limited thereto.

[0320] In some embodiments, at least two of steps S4201 to S4206 may be executed simultaneously or in a different order. For example, steps S4203 and S4205 may be executed simultaneously or in a different order.

[0321] In some embodiments, steps S4201, S4203, S4204, S4205, and S4206 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0322] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0323] In some embodiments, the names of information, etc., are not limited to the names described in the embodiments. Terms such as "information", "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "domain", "field", "symbol", "symbol", "codebook", "codeword", "codepoint", "bit", "data", "program", and "chip" can be used interchangeably.

[0324] In some embodiments, the terms “radio”, “wireless”, “radio access network (RAN)”, “access network (AN)”, and “RAN-based” can be used interchangeably.

[0325] In some embodiments, “get,” “obtain,” “receive,” “transmit,” “bidirectional transmission,” and “send and / or receive” can be used interchangeably and can be interpreted as receiving from other entities, obtaining from protocols, obtaining from higher layers, obtaining through self-processing, or autonomous implementation, among other meanings.

[0326] In some embodiments, terms such as “send,” “transmit,” “report,” “distribute,” “transfer,” “bidirectional transmission,” “send and / or receive” can be used interchangeably.

[0327] In some embodiments, terms such as "certain", "preset", "default", "set", "indicated", "a certain", "any", and "first" can be used interchangeably. "Certain A", "preset A", "default A", "set A", "indicated A", "a certain A", "any A", and "first A" can be interpreted as A pre-defined in a protocol or the like, or as A obtained through setting, configuration, or instruction, or as specific A, a certain A, any A, or first A, but are not limited thereto.

[0328] In some embodiments, the terms “authentication,” “verification,” “validation,” and “check” can be used interchangeably.

[0329] In some embodiments, terms such as “identification,” “identification information,” “customer identification,” and “assertion” can be used interchangeably.

[0330] Figure 5 is an exemplary interactive schematic diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 5, the method includes steps S501 and S502.

[0331] In step S501, the first node 101 obtains the identification information.

[0332] In some embodiments, the first node 101 may receive identification information from the third node 103. In some embodiments, the identification information may be determined by the third node 103 based on second information provided by the first node 101.

[0333] In some embodiments, the identification information may be determined by the first node 101.

[0334] In some embodiments, the identification information may include at least one of the following: publisher statement, subject statement, audience statement, and scope statement.

[0335] In some embodiments, the authentication information may be protected by at least one of the following: digital signature, message verification code.

[0336] In step S502, the first node 101 sends the first information to the second node 102.

[0337] In some embodiments, the first information may include identification information.

[0338] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0339] In the following, the technical solutions of the embodiments of this disclosure will be described by way of specific implementation.

[0340] This disclosure relates to additional security mechanisms for a service-based RAN node (i.e., the first node) acting as a service consumer. The primary objective of this disclosure is to enhance the security of current 5G SBA systems to support protection for communication between the service-based RAN acting as a service consumer and the core NF (i.e., the second node) acting as a service provider.

[0341] In some embodiments, if the RAN node is used as a regular NF in the SBA architecture, all existing SBI security mechanisms, if supported by the RAN node, can be applied to it. However, considering that the RAN node is more vulnerable to attack than the core NF (also known as the core network NF), this disclosure proposes additional client authentication for service-based RAN nodes as service consumers, similar to NF service consumers in an indirect communication mode via SCP. Since SBI security is based on the OAuth 2.0 framework, OAuth 2.0 client authentication can be used.

[0342] In some embodiments, "client" refers to the application requesting access to the resource server. Client authentication is a process in which the authorization server verifies the identity of the requesting client. Two common and traditional OAuth authentication flows are the authorization code flow and the client credential flow. Compared to these two traditional methods, client authentication provides a more efficient and secure approach to client authentication.

[0343] An assertion is an information packet that allows for the sharing of identification and security information between security domains. An assertion typically includes information related to the principal, the party issuing the assertion, the time of its issuance, and the conditions under which the assertion is considered valid—for example, when and where the assertion can be used. Client assertions use a token format, namely JWT (JSON Web Tokens), which includes a publisher statement, a subject statement, an audience statement, a timeout statement, etc.

[0344] In some embodiments, this disclosure proposes two methods for service-based RAN nodes to obtain customer identification.

[0345] Method 1: Identify source as third party

[0346] The first approach involves the service-based RAN node obtaining client authentication from a third-party entity capable of issuing, updating, converting, and verifying security tokens. A trust relationship is required between the third-party entity and the NF service provider. This entity acts as the authentication issuer, whose role is to fulfill requests from the service-based RAN node, generate the requested authentication, fill in the appropriate information in the authentication, and protect the authentication's integrity using a digital signature or message verification code. This entity can be a network management function dedicated to managing service-based RAN nodes and / or service-based NFs, such as a Security Service NF (SSNF) (i.e., the third node), dedicated to providing "security services" to other service-based NFs (including service-based RAN nodes).

[0347] Figure 6A is an interactive schematic diagram of an exemplary implementation of the communication method provided according to embodiments of the present disclosure. This implementation involves a service-based RAN (SB-RAN) authentication process using authentication from a third party.

[0348] In some embodiments, a trust relationship is assumed between the SSNF and the NF / NRF. For verification of client authentication issued by the SSNF, the NF / NRF is configured with the SSNF's certificate / public key or shares a symmetric key with the SSNF.

[0349] As shown in Figure 6A, the communication method includes steps S6101 to S6108.

[0350] In step S6101, the service-based RAN node sends a message to request client authentication from the SSNF. This request message may include information necessary for authentication, such as the type or instance identifier of the NF / NRF to be accessed, and whether the service-based RAN node's role is that of a service consumer or a service provider.

[0351] In step S6102, the SSNF generates a client authentication (i.e., authentication information) based on the received information. The SSNF can sign the authentication using its own private key, or it can protect the authentication's integrity using a symmetric key shared with the NF / NRF.

[0352] In some embodiments, the customer designates that at least one of the following statements is included:

[0353] -iss(publisher): The instance identifier of SSNF in this method;

[0354] -sub(subject): Instance identifier of the RAN node based on the service;

[0355] -aud(audience): The type or instance identifier of the NF / NRF, or the default / generic NF type (e.g., core NF);

[0356] -scope: The scope of the identification is limited, that is, in this case, it is a service consumer. This means that the identification can only be used by NF / SB-RAN as a service consumer.

[0357] -exp(timeout): The timeout period during which the JWT is no longer accepted;

[0358] -iat(publishing time): Publish time, marking the time when the JWT was created;

[0359] -jti (JWT identifier): A unique identifier for a JWT, primarily used to prevent duplicate JWTs.

[0360] In some embodiments, where the authentication request in step S6101 does not include information related to the type or instance identifier of the NF / NRF to be accessed, the audience claim can be set to a generic NF type (e.g., core NF).

[0361] In step S6103, SSNF returns a client authentication response message, which contains the generated and protected authentication.

[0362] In step S6104, the service-based RAN node obtains the customer identification from the response message and stores the customer identification for authentication by the NF / NRF in subsequent service request processes.

[0363] In some embodiments, the credentials can be stored in the secure environment of the service-based RAN node so that even if the RAN node is attacked and in danger, the attacker cannot obtain the credentials stored in the service-based RAN node.

[0364] In step S6105, the service-based RAN node sends a service request to the NF / NRF, which includes a token and customer authentication.

[0365] In some embodiments, in the case of NRF, the service request may be a registration request, and the registration request does not contain a token.

[0366] In step S6106, the NF / NRF first verifies the received customer credentials.

[0367] In some embodiments, based on the publisher's statement in the certification, the NF / NRF first obtains the SSNF's certificate / public key locally, or a symmetric key shared with the SSNF. Then, the NF / NRF uses the SSNF's certificate / public key to verify the certified signature. Alternatively, the NF / NRF verifies the certified MAC using the symmetric key shared with the SSNF. If the verification fails, the NF / NRF continues with step S6107a.

[0368] In some embodiments, if the digital signature passes verification, the NF / NRF then checks whether the subject claim in the determination matches the identity of the service requester (i.e., the RAN node based on the service). If they do not match, the NF / NRF continues with step S6107a.

[0369] In some embodiments, if the subject claim matches the identifier of the service-based RAN node, the NF / NRF then checks whether the audience claim matches its own type or instance identifier, or the type of the general core NF. If they do not match, the NF / NRF continues with step S6107a.

[0370] In some embodiments, if the audience claim matches the type or instance identifier of the NF / NRF, the NF / NRF then checks whether the scope claim matches the role of the service-based RAN node, i.e., whether the service-based RAN node is a service consumer. If the scope claim is not a service consumer, the NF / NRF continues to execute step S6107a.

[0371] In some embodiments, if the scope claim matches the role of the service-based RAN as a service consumer, the NF / NRF checks the timestamp (iat) and / or timeout (exp).

[0372] In step S6107, either step S6107a or step S6107b may be performed.

[0373] In some embodiments, in step S6107a, if any of the checks in step S6106 fail, the NF / NRF returns a service response indicating that the customer authentication check has failed. This means that the NF / NRF's authentication of the service-based RAN has failed.

[0374] In some embodiments, in step S6107b, if all the verifications in step S6106 are successful, it means that the NF / NRF has successfully authenticated the service-based RAN. Afterwards, the NF / NRF further verifies the token.

[0375] In step S6108, if the token passes the verification, the NF / NRF takes action as requested and returns a successful service response to the service-based RAN node.

[0376] In the embodiments disclosed herein, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations in other embodiments.

[0377] In some embodiments, upon successful customer authentication verification, the NF / NRF ensures that the service consumer (i.e., the service-based RAN node) has been certified by an SSNF trusted by the NF / NRF if it submits a protected (signature- or integrity-protected) customer authentication. Any other entity claiming to be a service-based RAN but lacking a protected authentication issued by the SSNF or submitting a forged authentication cannot interact with the NF / NRF to access any services, even if that entity has established a connection with the NF / NRF directly or indirectly through SCP.

[0378] In some embodiments, considering that the security requirements of service consumers and service providers may differ, it is proposed that the authentication can be bound to the specific role of the service-based RAN node, i.e., as a service consumer or a service provider. This ensures that authentication obtained or claimed by the service-based RAN node can be used within a limited scope so that the authentication is not misused; for example, a service-based RAN node acting as a service provider cannot use the authentication obtained for requesting services to authenticate an NF service consumer.

[0379] In some embodiments, the publisher (e.g., an SSNF or a service-based RAN node) can set a long or short timeout for the authentication based on the operator's security policy. A shorter timeout requires the service-based RAN node to refresh the authentication more frequently, which mitigates the risk of authentication being replayed or misused.

[0380] Method 2: Self-generated recognition

[0381] The second approach involves the service-based RAN node creating the assertion locally. To apply a signature or message verification code to the assertion, the service-based RAN node must obtain key materials, either a symmetric key or an asymmetric key pair. If an asymmetric key pair is used, this method is very similar to client credentials assertion (CCA), which is used by the NF service consumer.

[0382] Figure 6B is an interactive schematic diagram of an exemplary embodiment of the communication method provided according to an embodiment of the present disclosure. This embodiment involves an SB-RAN authentication process using self-generated certification.

[0383] In some embodiments, it is assumed that the service-based RAN node is configured with a private key or shares a symmetric key with the NF / NRF. For customer authentication verification of the service-based RAN node, the NF / NRF is configured with the service-based RAN node's certificate / public key or shares a symmetric key with the service-based RAN node.

[0384] As shown in Figure 6B, the communication method includes steps S6201 to S6205.

[0385] In step S6201, the service-based RAN node generates a client identification based on necessary information. This necessary information may include, for example, the type or instance identifier of the NF / NRF to be accessed. The service-based RAN node can sign the identification using its own private key, or it can protect the identification's integrity using a symmetric key shared with the NF / NRF.

[0386] In some embodiments, the customer designates that at least one of the following statements is included:

[0387] -iss(publisher): In this method, the instance identifier is based on the RAN node of the service;

[0388] -sub(subject): Instance identifier of the RAN node based on the service;

[0389] -aud(audience): The type or instance identifier of the NF / NRF, or the default / generic NF type (e.g., core NF);

[0390] -scope: The scope of the identification is limited, that is, in this case, it is a service consumer. This means that the identification can only be used by NF / SB-RAN as a service consumer.

[0391] -exp(timeout): The timeout period during which the JWT is no longer accepted;

[0392] -iat(publishing time): Publish time, marking the time when the JWT was created;

[0393] -jti (JWT identifier): A unique identifier for a JWT, primarily used to prevent duplicate JWTs.

[0394] In some embodiments, where the authentication request in step S6101 does not include information related to the type or instance identifier of the NF / NRF to be accessed, the audience claim can be set to a generic NF type (e.g., core NF).

[0395] In step S6202, the service-based RAN node sends a service request to the NF / NRF, which includes a token and customer authentication.

[0396] In some embodiments, in the case of NRF, the service request may be a registration request, and the registration request does not contain a token.

[0397] In step S6203, the NF / NRF first verifies the received customer credentials.

[0398] In some embodiments, based on the publisher's statement in the assertion, the NF / NRF first obtains the certificate / public key of the service-based RAN locally, or a symmetric key shared with the service-based RAN. Then, the NF / NRF uses the certificate / public key of the service-based RAN to verify the asserted signature. Alternatively, the NF / NRF verifies the asserted MAC using the symmetric key shared with the service-based RAN. If the verification fails, the NF / NRF continues with step S6204a.

[0399] In some embodiments, if the digital signature passes verification, the NF / NRF then checks whether the subject claim in the identification matches the identifier of the service requester (i.e., the RAN node based on the service). If they do not match, the NF / NRF continues with step S6204a.

[0400] In some embodiments, if the subject claim matches the identifier of the service-based RAN node, the NF / NRF then checks whether the audience claim matches its own type or instance identifier, or the type of the general core NF. If they do not match, the NF / NRF continues with step S6204a.

[0401] In some embodiments, if the audience claim matches the type or instance identifier of the NF / NRF, the NF / NRF then checks whether the scope claim matches the role of the service-based RAN node, i.e., whether the service-based RAN node is a service consumer. If the scope claim is not a service consumer, the NF / NRF continues to execute step S6204a.

[0402] In some embodiments, if the scope claim matches the role of the service-based RAN as a service consumer, the NF / NRF checks the timestamp (iat) and / or timeout (exp).

[0403] In step S6204, either step S6204a or step S6204b may be performed.

[0404] In some embodiments, in step S6204a, if any of the checks in step S6203 fail, the NF / NRF returns a service response indicating that the customer authentication check has failed. This means that the NF / NRF's authentication of the service-based RAN has failed.

[0405] In some embodiments, in step S6204b, if all the checks in step S6203 are successful, the token is checked after NF / NRF.

[0406] In step S6205, if the token passes the verification, the NF / NRF takes action as requested and returns a successful service response to the service-based RAN node.

[0407] In the embodiments disclosed herein, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations in other embodiments.

[0408] In some embodiments, with successful client authentication verification, the NF / NRF can ensure that the received service request originated from the original service consumer (i.e., the service-based RAN node) if a protected (signature- or integrity-protected) client authentication is submitted. Any authentication forged by an intermediate node (between the service-based RAN and the NF / NRF) cannot be verified by the NF / NRF because the intermediate node does not know the private key paired with the public key in the service-based RAN credentials configured in the NF / NRF, or the symmetric key shared between the service-based RAN node and the NF / NRF. Therefore, any entity not protected by client authentication cannot impersonate a service-based RAN node.

[0409] This disclosure also proposes an apparatus (also referred to as a communication device, etc.) for implementing any of the above methods. For example, this disclosure proposes an apparatus including a unit or module for implementing the steps performed by the first node in any of the above methods. For example, this disclosure proposes another apparatus including a unit or module for implementing the steps performed by the second node in any of the above methods. For example, this disclosure proposes yet another apparatus including a unit or module for implementing the steps performed by the third node in any of the above methods.

[0410] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0411] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a central processing unit, microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), etc.

[0412] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure. As shown in Figure 7, the communication device 700 may include at least one of the following: a transceiver module 701 and a processing module 702.

[0413] In some embodiments, the communication device 700 may be a first node. In some embodiments, the transceiver module 701 may be configured to: acquire authentication information; send first information to a second node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information, which is used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the first node in any of the above methods (e.g., steps S4101, S4103, S4105, S4107, S4109, S4202, S4204, S4206, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the first node in any of the above methods besides the communication steps such as sending and receiving (e.g., steps S4104, S4201, but not limited thereto).

[0414] In some embodiments, the communication device 700 may be a second node. In some embodiments, the transceiver module 701 may be configured to: receive first information sent by a first node, wherein the first information is used to request the second node to provide services; wherein the first information includes authentication information, which is used by the second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the second node in any of the above methods (e.g., steps S4105, S4107, S4109, S4202, S4204, S4206, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the second node in any of the above methods besides the communication steps such as sending and receiving (e.g., steps S4106, S4108, S4203, S4205, but not limited thereto).

[0415] In some embodiments, the communication device 700 may be a third node. In some embodiments, the transceiver module 701 may be configured to: send authentication information to a first node, wherein the authentication information is used by a second node to authenticate the first node; wherein the first node is an access network device, and the first node and the second node communicate through a service-based interface. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps (e.g., steps S4101, S4103, but not limited thereto) performed by the third node in any of the above methods, which will not be elaborated further here. Optionally, the processing module 702 may be configured to perform at least one of the other steps (e.g., step S4102, but not limited thereto) performed by the third node in any of the above methods, excluding the communication steps such as sending and receiving.

[0416] In some embodiments, the communication device shown in FIG7 can be implemented as a communication equipment.

[0417] In some embodiments, the transceiver module may include a transmitting module and / or a receiving module. The transmitting and receiving modules may be separate or integrated. Optionally, the transceiver module may be interchangeable with a transceiver.

[0418] In some embodiments, the processing module may be a single module or may include multiple sub-modules. Optionally, the multiple sub-modules may each perform all or part of the steps required by the processing module. Optionally, the processing module may be interchangeable with a processor.

[0419] Figure 8A is a schematic diagram of the structure of a communication device provided according to an embodiment of the present disclosure. The communication device 8100 can be a network device (e.g., access network device, core network device, etc.), a terminal (e.g., user equipment, etc.), a chip, chip system, or processor that supports the network device in implementing any of the above methods, or a chip, chip system, or processor that supports the terminal in implementing any of the above methods. The communication device 8100 can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0420] As shown in Figure 8A, the communication device 8100 includes one or more processors 8101. The processor 8101 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the communication device (e.g., base station, baseband chip, terminal device, terminal device chip, DU or CU, etc.), execute programs, and process program data. Optionally, the communication device 8100 can be used to execute any of the above methods. Optionally, one or more processors 8101 can be used to invoke instructions to cause the communication device 8100 to execute any of the above methods.

[0421] In some embodiments, the communication device 8100 further includes one or more transceivers 8102. When the communication device 8100 includes one or more transceivers 8102, the transceivers 8102 perform at least one of the communication steps such as sending and / or receiving in the above method (e.g., steps S4101, S4103, S4105, S4107, S4109, S4202, S4204, S4206, but not limited thereto), and the processor 8101 performs at least one of other steps (e.g., steps S4102, S4104, S4106, S4108, but not limited thereto). In optional embodiments, the transceivers may include a receiver and / or a transmitter, which may be separate or integrated together. Optionally, terms such as transceiver, transceiver unit, transceiver, transceiver circuit, interface circuit, and interface can be used interchangeably; terms such as transmitter, transmitting unit, transmitter, and transmitting circuit can be used interchangeably; and terms such as receiver, receiving unit, receiver, and receiving circuit can be used interchangeably.

[0422] In some embodiments, the communication device 8100 further includes one or more memories 8103 for storing data. Optionally, all or part of the memories 8103 may be located outside the communication device 8100. In an optional embodiment, the communication device 8100 may include one or more interface circuits 8104. Optionally, the interface circuits 8104 are connected to the memories 8103 and can be used to receive data from the memories 8103 or other devices, and to send data to the memories 8103 or other devices. For example, the interface circuits 8104 can read data stored in the memories 8103 and send that data to the processor 8101.

[0423] The communication device 8100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 8100 described in this disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG8A. The communication device may be a standalone device or may be part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally, the IC collection may also include storage components for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0424] Figure 8B is a schematic diagram of the structure of a chip provided according to an embodiment of the present disclosure. For cases where the communication device 8100 can be a chip or a chip system, please refer to the schematic diagram of the chip 8200 shown in Figure 8B, but it is not limited thereto.

[0425] Chip 8200 includes one or more processors 8201. Chip 8200 is used to perform any of the methods described above.

[0426] In some embodiments, chip 8200 further includes one or more interface circuits 8202. Optionally, terms such as interface circuit, interface, and transceiver pin can be used interchangeably. In some embodiments, chip 8200 further includes one or more memories 8203 for storing data. Optionally, all or part of the memories 8203 may be located outside of chip 8200. Optionally, interface circuit 8202 is connected to memory 8203, and interface circuit 8202 can be used to receive data from memory 8203 or other devices, and interface circuit 8202 can be used to send data to memory 8203 or other devices. For example, interface circuit 8202 can read data stored in memory 8203 and send the data to processor 8201.

[0427] In some embodiments, the interface circuit 8202 performs at least one of the communication steps such as sending and / or receiving in the above-described method (e.g., steps S4101, S4103, S4105, S4107, S4109, S4202, S4204, S4206, but not limited thereto). The interface circuit 8202 performing the communication steps such as sending and / or receiving in the above-described method refers, for example, to the interface circuit 8202 performing data interaction between the processor 8201, the chip 8200, the memory 8203, or the transceiver device. In some embodiments, the processor 8201 performs at least one of other steps (e.g., steps S4102, S4104, S4106, S4108, but not limited thereto).

[0428] The modules and / or devices described in the various embodiments, such as virtual devices, physical devices, and chips, can be combined or separated arbitrarily as needed. Optionally, some or all steps can also be performed collaboratively by multiple modules and / or devices, which is not limited here.

[0429] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0430] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0431] This disclosure also proposes a program product that, when executed by a communication device 8100, causes the communication device 8100 to perform any of the above methods. Optionally, the program product is a computer program product.

[0432] This disclosure also proposes a computer program that, when run on a computer, causes the computer to perform any of the above methods.

[0433] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only.

[0434] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A communication method performed by a first node, wherein, The method includes: Obtain certification information; Send a first message to the second node, wherein the first message is used to request the second node to provide services; The first information includes the identification information, which is used by the second node to authenticate the first node. The first node is an access network device, and the first node and the second node communicate through a service-based interface.

2. The method of claim 1, wherein, The first node is the service consumer, and the second node is the service provider.

3. The method of claim 1 or 2, wherein, The acquisition of identification information includes: Receive the authentication information sent by the third node.

4. The method of claim 3, wherein, The identification information includes at least one of the following: The first declaration includes the identification information of the third node; The second statement includes the identification information of the first node; The third statement includes the identification or type information of the second node; The fourth statement includes a first instruction, wherein the first instruction is used to indicate that the first node is a service consumer.

5. The method of claim 3 or 4, wherein, The method further includes: Send second information to the third node, wherein the second information is used by the third node to determine the identification information.

6. The method of claim 5, wherein, The second information includes at least one of the following: The first indication information is used to indicate that the first node is a service consumer; The identification information of the first node; The identification information of the second node; The type information of the second node.

7. The method of any one of claims 3 to 6, wherein, The identification information is protected by at least one of the following: The digital signature is determined based on the private key of the third node; The message verification code is determined based on the symmetric key shared between the third node and the second node.

8. The method of claim 1 or 2, wherein, The acquisition of identification information includes: Determine the aforementioned identification information.

9. The method of claim 7, wherein, The identification information includes at least one of the following: The first declaration includes the identification information of the first node; The second statement includes the identification information of the first node; The third statement includes the identification or type information of the second node; The fourth statement includes a first instruction, wherein the first instruction is used to indicate that the first node is a service consumer.

10. The method of claim 8 or 9, wherein, The identification information is protected by at least one of the following: The digital signature is determined based on the private key of the first node; The message verification code is determined based on the symmetric key shared between the first node and the second node.

11. The method of any one of claims 1 to 10, wherein, The method further includes: The third information sent by the second node is received, wherein the third information is used to indicate that the second node failed to verify the identification information.

12. The method of claim 11, wherein, The third piece of information includes the reason for the failure of the verification of the identification information; The reasons for failure include at least one of the following: The verification of the digital signature of the authentication information failed; The verification of the message verification code for the identified information failed. The verification of the second statement regarding the identified information failed. The verification of the third statement regarding the identified information failed. The verification of the fourth statement regarding the identified information failed.

13. A communication method performed by a second node, wherein, The method includes: Receive first information sent by the first node, wherein the first information is used to request the second node to provide services; The first information includes identification information, which is used by the second node to authenticate the first node. The first node is an access network device, and the first node and the second node communicate through a service-based interface.

14. The method of claim 13, wherein, The first node is the service consumer, and the second node is the service provider.

15. The method of claim 13 or 14, wherein, The identification information is determined by the third node.

16. The method of claim 15, wherein, The identification information includes at least one of the following: The first declaration includes the identification information of the third node; The second statement includes the identification information of the first node; The third statement includes the identification or type information of the second node; The fourth statement includes a first instruction, wherein the first instruction is used to indicate that the first node is a service consumer.

17. The method of claim 15 or 16, wherein, The identification information is protected by at least one of the following: The digital signature is determined based on the private key of the third node; The message verification code is determined based on the symmetric key shared between the third node and the second node.

18. The method according to claim 13 or 14, wherein, The identification information is determined by the first node.

19. The method of claim 18, wherein, The identification information includes at least one of the following: The first declaration includes the identification information of the first node; The second statement includes the identification information of the first node; The third statement includes the identification or type information of the second node; The fourth statement includes a first instruction, wherein the first instruction is used to indicate that the first node is a service consumer.

20. The method according to claim 18 or 19, wherein, The identification information is protected by at least one of the following: The digital signature is determined based on the private key of the first node; The message verification code is determined based on the symmetric key shared between the first node and the second node.

21. The method according to any one of claims 13 to 20, wherein, The method further includes: The identified information is then verified.

22. The method according to claim 21, wherein, The verification of the identified information includes at least one of the following: Verify the digital signature of the authentication information; The message verification code is used to verify the identified information; A second statement verifying the aforementioned assertions; A third statement verifying the aforementioned assertions; The fourth statement regarding the verification of the aforementioned information.

23. The method according to claim 22, wherein, The digital signature used to verify the authentication information includes: The digital signature is verified based on a certificate or public key; The certificate or public key is associated with the private key of the first node, or the certificate or public key is associated with the private key of the third node.

24. The method according to claim 22, wherein, The message verification code for verifying the identified information includes: The message verification code is verified based on a symmetric key; The symmetric key is shared by the first node and the second node, or the symmetric key is shared by the third node and the second node.

25. The method according to any one of claims 21 to 24, wherein, The method further includes: A third message is sent to the first node, wherein the third message is used to indicate to the second node that the verification of the identification information has failed.

26. The method of claim 25, wherein, The third piece of information includes the reason for the failure of the verification of the identification information; The reasons for failure include at least one of the following: The verification of the digital signature of the authentication information failed; The verification of the message verification code for the identified information failed. The verification of the second statement regarding the identified information failed. The verification of the third statement regarding the identified information failed. The verification of the fourth statement regarding the identified information failed.

27. A communication method, executed by a third node, wherein, The method includes: Send authentication information to the first node, wherein the authentication information is used by the second node to authenticate the first node; The first node is an access network device, and the first node and the second node communicate through a service-based interface.

28. The method according to claim 27, wherein, The first node is the service consumer, and the second node is the service provider.

29. The method according to claim 27 or 28, wherein, The identification information includes at least one of the following: The first declaration includes the identification information of the third node; The second statement includes the identification information of the first node; The third statement includes the identification or type information of the second node; The fourth statement includes a first instruction, wherein the first instruction is used to indicate that the first node is a service consumer.

30. The method according to any one of claims 27 to 29, wherein, The method further includes: Receive the second information sent by the first node; The identification information is determined based on the second information.

31. The method according to claim 30, wherein, The second information includes at least one of the following: The first indication information is used to indicate that the first node is a service consumer; The identification information of the first node; The identification information of the second node; The type information of the second node.

32. The method of any one of claims 27-31, wherein, The identification information is protected by at least one of the following: The digital signature is determined based on the private key of the third node; The message verification code is determined based on the symmetric key shared between the third node and the second node.

33. A communication method, executed by a communication system, wherein, The communication system includes a first node and a second node; The method includes: The first node obtains the identification information; The first node sends first information to the second node, wherein the first information is used to request the second node to provide services; The first information includes the identification information, which is used by the second node to authenticate the first node. The first node is an access network device, and the first node and the second node communicate through a service-based interface.

34. The method according to claim 33, wherein, The communication system also includes a third node; The first node obtains the identification information, including: The third node sends the identification information to the first node.

35. A communications device, characterized by The communication device is used to perform the communication method as described in any one of claims 1 to 12, 13 to 26, and 27 to 32.

36. A communication system, characterized in that, The network element includes at least one of a first node, a second node, and a third node, wherein the first node is configured to implement the communication method as described in any one of claims 1 to 12, the second node is configured to implement the communication method as described in any one of claims 13 to 26, and the second network element is configured to implement the communication method as described in any one of claims 27 to 32.

37. A storage medium storing instructions, characterized in that, When the instructions are executed on the communication device, the communication device performs the communication method as described in any one of claims 1 to 12, 13 to 26, and 27 to 32.

38. A program product comprising at least one of a program and instructions, characterized in that, When at least one of the programs or instructions is executed by the communication device, it implements the steps of the communication method as described in any one of claims 1 to 12, 13 to 26, and 27 to 32.

Images