Service authentication method, communication device, and system

Abstract

The present application provides a service authentication method, a communication device, and a system. The method includes a first network element sending a first token request to a network repository function network element. After receiving the first token request from the first network element, the network repository function network element can complete verification of the validity of the network function service consumer entity by verifying whether first information of the network function service consumer entity carried in the first token request matches second information of a certificate in an assertion of the network function service consumer entity, without relying on a profile of the network function service consumer entity to verify the validity of the network function service consumer entity. Therefore, even in the case of a network function service consumer entity whose profile is not maintained in the network repository function network element, the network repository function network element can verify the validity of the parameters of the network function service consumer entity, thereby effectively improving the safety of using a network function service.

Description

[Technical field]

[0001] The present application relates to the field of communication technologies, and in particular to a service authentication method, a communication device, and a system. [Background technology]

[0002] The 3rd generation partnership project (3GPP) is a project to develop 5th generation ( 5th It has been proposed to use a service-based architecture (SBA) and an enhancement of service-based architecture (eSBA) in 5G mobile communication systems.

[0003] In SBA or eSBA, all network functions (NFs) support the transport layer security (TLS) protocol. A network function service provider (NFp) entity allows authorized network function service consumer (NFc) entities to access the services of the network function service provider entities. A network repository function (NRF) network element provides services such as management, discovery, and authorization of NFs.

[0004] The authentication process includes the NFc entity requesting authentication from the NRF network element to obtain a token corresponding to the service the NFc entity wants to request, the NRF network element generating the token based on the NFc entity's certificate and sending the token to the NFc entity, and after obtaining the token, the NFc can request the service from the NFp entity having the service based on the token.

[0005] In the above authentication process, upon receiving a token request from an NFc entity, the NRF network element typically validates the parameters carried in the token request (e.g., single network slice selection assistance information (S-NSSAI)) based on the locally stored profile of the NFc entity to prevent the NFc entity from maliciously reporting the parameters of the NFc entity to obtain NRF authentication. However, the NRF does not store some profiles of the NFc. As a result, the NRF cannot validate the parameters of the NFc. Summary of the Invention

[0006] The embodiments of the present application provide a service authentication method, a communication device, and a system to solve the problem that the NRF cannot verify part of the NFc, so that network reliability and security are effectively improved.

[0007] According to a first aspect, an embodiment of the present application provides a service authentication method. The method includes: a first network element sends a first token request to a network repository function network element, the first token request includes first information of a network function service consumer entity and an assertion of the network function service consumer entity, the assertion includes a certificate of the network function service consumer entity, and the certificate includes second information of the network function service consumer entity. After receiving the first token request, the network repository function network element determines whether the first information matches the second information by verification, and after determining that the first information matches the second information, generates a token and sends the token to the first network element. The first network element receives the token.

[0008] In the above technical solution, after receiving the first token request from the first network element, the network repository function network element can complete the verification on the validity of the network function service consumer entity by verifying whether the first information of the network function service consumer entity carried in the first token matches the second information of the certificate in the assertion of the network function service consumer entity, and does not rely on the profile of the network function service consumer entity to verify the validity of the network function service consumer entity. Therefore, even in the case of a network function service consumer entity whose profile is not held in the network repository function network element, the network repository function network element can verify the validity of the parameters of the network function service consumer entity, thereby effectively improving the safety of using the network function service.

[0009] In a possible design, the first information may include the following: a first public land mobile network identifier; a first standalone non-public network identifier; a first single network slice selection assistance information identifier; a first network function instance identifier; 1 The second information includes one or more of a network capability type, a first network capability set, and a first uniform resource identifier. The second information includes one or more of the following: a second public land mobile network identifier, a second standalone non-public network identifier, a second single network slice selection assistance information identifier, a 2 The second network function includes one or more of a network function instance identifier, a second network function type, a second network function set, and a second uniform resource identifier.

[0010] In the above technical solution, the first information and the second information may include parameter information of one or more network function service consumer entities, thereby effectively improving the flexibility and reliability of the technical solution.

[0011] It should be noted that the information contained in the first information is in one-to-one correspondence with the information contained in the second information.

[0012] For example, if the first information includes a first network function instance identifier, the second information includes a second network function instance identifier. As another example, if the first information includes a first standalone non-public network identifier and a first public ground mobile network identifier, the second information includes a second standalone non-public network identifier and a second public ground mobile network identifier. As yet another example, if the first information includes a first public ground mobile network identifier, a first standalone non-public network identifier, and a first network function instance identifier, the second information includes a second public ground mobile network identifier, a second standalone non-public network identifier, and a 2 Contains a network function instance identifier.

[0013] It should be understood that there are multiple specific implementations in which the network repository function network element determines whether the first information matches the second information through verification, including but not limited to the following two implementations.

[0014] Implementation 1: If the first information is the same as the second information, the network repository function network element determines that the first information matches the second information.

[0015] For example, if the first information is a first public land mobile network identifier and the second information is a second public land mobile network identifier, and the first public land mobile network identifier is the same as the second public land mobile network identifier, e.g., both are 1, the network repository function network element determines that the first information matches the second information.

[0016] Implementation 2: If the network repository function network element determines that the first information is a subset of the second information, then the network repository function network element determines that the first information matches the second information.

[0017] For example, the first information is a first standalone non-public network identifier and the second information is Second If the first standalone non-public network identifier is a subset of the second standalone non-public network identifier, and the first standalone non-public network identifier is 1 and the second standalone non-public network identifier is {1,2,4}, the network repository function network element determines that the first information matches the second information.

[0018] In the above technical solution, the network repository function network element can verify the matching relationship between the first information and the second information in multiple ways, thereby further improving the flexibility of the technical solution provided in this embodiment of the present application.

[0019] In a possible design, after receiving the token, the first network element may further send a first service request to the network function service provider entity, the first service request being for requesting the network function service provider entity to provide a service to the network function service consumer entity, the first service request including the token and an assertion, where the token includes the first network function instance identifier and the assertion further includes the second network function instance identifier. After receiving the first service request, the network function service provider entity may determine through verification whether the first network function instance identifier is the same as the second network function instance identifier, and may provide the service to the network function service consumer entity after determining that the first network function instance identifier is the same as the second network function instance identifier.

[0020] In the above technical solution, the network function service provider entity verifies the network function instance identifier in the token carried in the service request and the network function instance identifier carried in the assertion, thereby ensuring the match between the token and the assertion included in the service request, and preventing an attacker from illegally stealing the token and even illegally obtaining the network function service. Therefore, the security of using the network function service is effectively improved.

[0021] It should be noted that the first network element may be a service communication proxy network element, or may be a network function service consumer entity, which is not particularly limited in this embodiment of the present application.

[0022] In a possible design, the first network element is a service communication proxy network element, and before the service communication proxy network element sends the first token request to the network repository function network element, the service communication proxy network element may further receive a second token request or a second service request from the network function service consumer entity, where the second token request or the second service request includes the certificate. The service communication proxy network element then obtains a first fully qualified domain name FQDN and a third network function instance identifier associated with the certificate, and determines that the first FQDN matches the third network function instance identifier.

[0023] In a possible design, the first network element is a service communication proxy network element, and after receiving the token, the first network element may further send the token to a network function service consumer entity and receive a first service request from the network function service provider entity, where the first service request includes the certificate. The service communication proxy network element then obtains the first FQDN and a third network function instance identifier associated with the certificate, and sends the first service request to the network function service provider entity after determining that the first FQDN matches the third network function instance identifier.

[0024] There are multiple implementations in which the service communication proxy network element determines that the first FQDN matches the third network function instance identifier, including but not limited to the following two implementations.

[0025] Implementation 1: The service communication proxy network element obtains a binding relationship between an FQDN and a network function instance identifier from a network repository function network element, and determines whether the first FQDN matches a third network function instance identifier based on the binding relationship.

[0026] Implementation 2: The service communication proxy network element sends a first fully qualified domain name FQDN and a third network function instance identifier to a network repository function network element, and the network repository function network element determines whether the first FQDN matches the third network function instance identifier based on a binding relationship stored locally by the network repository function network element or a binding relationship obtained from a certificate management authority entity.

[0027] In the above technical solution, before sending a service request to the network function service provider entity, the service communication proxy network element first verifies the matching relationship between the FQDN associated with the certificate in the assertion of the network function service consumer entity and the third network function instance identifier, and only after the verification is successful, sends the service request to the network function service provider entity. Therefore, it can be avoided when an attacker illegally steals the assertion and even illegally obtains the network function service, so that the safety of using the network function service is effectively improved.

[0028] In a possible design, the first network element is a network function service consumer entity, and a specific implementation of the first network element sending the first service request to the network function service may be as follows: the network function service consumer entity sends the first service request to the network function service provider entity by using a service communication proxy network element, where the first service request includes a certificate. The service communication proxy network element may receive the first service request from the first network element, and after receiving the first service request, obtain a first fully qualified domain name (FQDN) and a third network function instance identifier associated with the certificate, and after determining that the first FQDN matches the third network function instance identifier, further send the first service request to the network function service provider entity.

[0029] In the above technical solution, before sending a service request to a network function service provider entity, the service communication proxy network element first verifies the matching relationship between the first FQDN and the third network function instance identifier associated with the certificate in the assertion of the network function service consumer entity, and only sends the service request to the network function service provider entity after the verification is successful. Therefore, it can be avoided when an attacker illegally steals the assertion and even illegally obtains the network function service, thereby effectively improving the safety of using the network function service.

[0030] In a possible design, after receiving the first token request and before sending the token to the first network element, the network repository function network element may obtain a first fully qualified domain name FQDN and a third network function instance identifier associated with the certificate and determine that the first FQDN matches the third network function instance identifier and that the first information matches the second information.

[0031] In the above technical solution, before returning the token to the first network element, the network repository function network element first verifies the matching relationship between the first FQDN and the third network function instance identifier associated with the certificate in the assertion of the network function service consumer entity and the first information and the second information in the token request, and returns the token only after the verification is successful. The service communication proxy network element can start the service only after receiving the token. Therefore, it can be avoided that an attacker illegally steals the assertion and even illegally obtains the network function service, thereby effectively improving the safety of using the network function service.

[0032] In a possible design, before sending the first token request to the network repository function network element, the network function service consumer entity may further send a certificate application request to a certificate management authority entity, where the certificate application request includes a certificate template, where the certificate template includes the first FQDN and the second information. After receiving the certificate application request, the certificate management authority entity may generate a certificate based on the first FQDN and the second information and send the certificate to the network function service consumer entity, where the certificate includes the first FQDN.

[0033] In the above technical solution, the network function service consumer entity includes the first FQDN and the second information in the certificate application request, so that the certificate contains richer information, which effectively improves the reliability of the certificate information verification.

[0034] In a possible design, the certificate management authority entity may further generate a binding relationship between the first FQDN and the third network function instance identifier based on the first FQDN in the certificate template and the third network function instance identifier in the second information.

[0035] In the above technical solution, the certificate management authority entity generates a binding relationship between the first FQDN and the third network function instance identifier, which further improves the reliability of certificate validation and effectively avoids the case where an attacker illegally steals a statement and even illegally obtains a service.

[0036] In a possible design, after receiving a first service request from a network function service consumer entity or receiving a service registration request from a network function service provider entity, the network repository function network element may further obtain a binding relationship from a certificate management authority entity.

[0037] In the above technical solution, only after receiving a first service request from a network function service consumer entity or receiving a service registration request from a network function service provider entity, the network repository function network element obtains the binding relationship from the certificate management authority entity, and does not need to store the binding relationship locally, thereby effectively reducing the storage resource of the network repository function network element.

[0038] According to a second aspect, a service authentication method is provided. The method may be applied to a network repository function network element, or may be applied to a chip in the network repository function network element. For example, the method may be applied to a network repository function network element, the method comprising: receiving a first token request from a first network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; determining whether the first information matches the second information by verifying, and after determining that the first information matches the second information, generating a token and transmitting the token to the first network element; Includes.

[0039] In a possible design, after receiving the first token request and before sending the token to the first network element, the network repository function network element may further obtain a first FQDN and a third network function instance identifier associated with the certificate and determine that the first FQDN matches the third network function instance identifier and that the first information matches the second information.

[0040] In a possible design, there are multiple implementations in which the network repository function network element determines whether the first information matches the second information through verification, including but not limited to the following two implementations.

[0041] Implementation 1: If the first information is the same as the second information, it is determined that the first information matches the second information.

[0042] Implementation 2: The first information is determined to match the second information if the first information is a subset of the second information.

[0043] In a possible design, after receiving a first service request from a network function service consumer entity or receiving a service registration request from a network function service provider entity, the network repository function network element may obtain a binding relationship between the FQDN and the network function instance identifier from a certificate management authority.

[0044] According to a third aspect, a service authentication method is provided. The method may be applied to a first network element, or may be applied to a chip in the first network element. For example, the method may be applied to the first network element, the method comprising: sending a first token request to a network repository function network element, the first token request including first information of the network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; A network repository function that receives tokens from network elements and Includes.

[0045] In a possible design, after receiving the token, the first network element may further send a first service request to the network function service provider entity, where the first service request includes the token and an assertion, where the token includes the first network function instance identifier and the assertion further includes the second network function instance identifier, and the first service request is for requesting the network function service provider entity to provide a service to the network function service consumer entity.

[0046] In a possible design, the first network element is a service communication proxy network element, and before sending the first token request to the network repository function network element, the method further includes receiving a second token request or a second service request from the network function service consumer entity, the second token request or the second service request including the certificate, obtaining a first fully qualified domain name FQDN and a third network function instance identifier associated with the certificate, and determining that the first FQDN matches the third network function instance identifier.

[0047] In a possible design, the first network element is a network function service consumer entity, and after receiving the token, the network function service consumer entity may further send a first service request to the network function service provider entity by using the service communication proxy network element, where the first service request indicates to the network function service provider entity to provide a service to the network function service consumer entity.

[0048] In a possible design, when the first network element is a network function service consumer entity, before sending the first token request to the network storage function network element, the network function service consumer entity may further send a certificate application request to a certificate management authority, the certificate application request including a certificate template, the certificate template including the first FQDN and the second information.

[0049] According to a fourth aspect, a service authentication method is provided. The method may be applied to a network function service provider entity or may be applied to a chip in the network function service provider entity. For example, the method may be applied to a network function service provider entity, the method comprising: receiving a first service request from a first network element, the first service request including a token and an assertion, the token including the first network function instance identifier and the assertion including the second network function instance identifier; determining, by verification, whether the first network function instance identifier matches the second network function instance identifier; providing a service to the network function service consumer entity after determining that the first network function instance identifier matches the second network function instance identifier; Includes.

[0050] According to a fifth aspect there is provided a communications device, the device comprising modules configured to perform the method according to the second aspect or any one of the possible implementations of the second aspect.

[0051] In one example, the device comprises: a transceiver unit configured to receive a first token request from a first network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; and a processing unit configured to determine, upon verification, whether the first information matches the second information and to generate a token after determining that the first information matches the second information; wherein the transceiver unit is further configured to transmit the token to the first network element.

[0052] In a possible design, after the transceiver unit receives the first token request and before the transceiver unit transmits the token to the first network element, the processing unit is further configured to obtain a first FQDN and a third network function instance identifier associated with the certificate and determine that the first FQDN matches the third network function instance identifier and that the first information matches the second information.

[0053] In a possible design, before being configured to determine whether the first information matches the second information by verification, the processing unit is particularly configured to determine that the first information matches the second information if the first information is the same as the second information, or to determine that the first information matches the second information if the first information is a subset of the second information.

[0054] According to a sixth aspect there is provided a communications device, the device comprising modules configured to perform the method according to the third aspect or any one of the possible implementations of the third aspect.

[0055] In one example, the device comprises: a processing unit configured to generate a first token request, the first token request including first information of the network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; and a transceiver unit configured to send a first token request to the network repository function network element and to receive a token from the network repository function network element; may include:

[0056] In a possible design, after receiving the token, the transceiver unit is further configured to send a first service request to the network function service provider entity, the first service request including the token and an assertion, the token including the first network function instance identifier and the assertion further including the second network function instance identifier, and the first service request is for requesting the network function service provider entity to provide a service to the network function service consumer entity.

[0057] In a possible design, the first network element is a service communication proxy network element, and before sending the first token request to the network repository function network element, the transceiver unit is further configured to receive a second token request or a second service request from the network function service consumer entity, the second token request or the second service request including the certificate. The processing unit is further configured to obtain a first fully qualified domain name FQDN and a third network function instance identifier associated with the certificate, and determine that the first FQDN matches the third network function instance identifier.

[0058] According to a seventh aspect there is provided a communications device, the device comprising modules configured to perform a method according to the fourth aspect or any one of the possible implementations of the fourth aspect.

[0059] In one example, the device comprises: a transceiver unit configured to receive a first service request from a first network element, the first service request including a token and an assertion, the token including a first network function instance identifier and the assertion including a second network function instance identifier; a processing unit configured to determine, through verification, whether the first network function instance identifier matches the second network function instance identifier, and provide a service to the network function service consumer entity after determining that the first network function instance identifier matches the second network function instance identifier; may include:

[0060] According to an eighth aspect, there is provided a serving authentication system, the system including a communication device according to the fifth aspect or any one of the possible implementations of the fifth aspect, and a communication device according to the sixth aspect or any one of the possible implementations of the sixth aspect.

[0061] Optionally, the system further comprises a communication device according to the seventh aspect.

[0062] According to a ninth aspect, there is provided an electronic device including at least one processor, a memory and a communication interface communicatively connected to the at least one processor, the memory storing instructions executable by the at least one processor, and the at least one processor executing the instructions stored in the memory, such that the electronic device performs a method according to the second aspect or any one of its possible designs, a method according to the third aspect or any one of its possible designs, or a method according to the fourth aspect or any one of its possible implementations.

[0063] According to a tenth aspect, there is provided a computer readable storage medium comprising a program or instructions which, when executed on a computer, performs a method according to the second aspect or any one of its possible implementations, a method according to the third aspect or any one of its possible designs, or a method according to the fourth aspect or any one of its possible implementations.

[0064] According to an eleventh aspect, there is provided a chip coupled to a memory and configured to read and execute program instructions stored in the memory to perform a method according to the second aspect or any one of its possible implementations, a method according to the third aspect or any one of its possible designs, or a method according to the fourth aspect or any one of its possible implementations.

[0065] According to a twelfth aspect there is provided computer program instructions which, when executed on a computer, perform a method according to the second aspect or any one of its possible implementations, a method according to the third aspect or any one of its possible designs, or a method according to the fourth aspect or any one of its possible implementations.

[0066] For technical effects that can be achieved by the design solution of any one of the second to twelfth aspects, please refer to the technical effects that can be achieved by the method according to the first aspect or any one of the possible designs of the first aspect, which will not be described again in detail here. [Brief description of the drawings]

[0067] [Figure 1] 1 is a schematic diagram of the structure of a communication system to which an embodiment of the present application is applied; [Diagram 2] FIG. 1 is a schematic diagram of the structure of a specific communication system to which an embodiment of the present application is applied; [Figure 3A] FIG. 2 is a schematic diagram of an application scenario to which embodiments of the present application may be applied; [Figure 3B] FIG. 2 is a schematic diagram of another application scenario to which embodiments of the present application may be applied; [Figure 3C] FIG. 2 is a schematic diagram of another application scenario to which embodiments of the present application may be applied; [Figure 4] 1 is a schematic flow chart of a service authentication method according to an embodiment of the present application. [Diagram 5] 1 is a schematic flow chart of a service authentication method; [Figure 6] 4 is a schematic flow chart of another service authentication method. [Figure 7] 1 is a schematic flow chart of a service authentication method according to an embodiment of the present application. [Figure 8] 4 is a schematic flow chart of another service authentication method. [Figure 9] 1 is a schematic flow chart of a service authentication method according to an embodiment of the present application. [Figure 10] 1 is a schematic flow chart of a service authentication method according to an embodiment of the present application. [Figure 11] 1 is a simplified flowchart of a certificate application according to an embodiment of the present application. [Figure 12]1 is a schematic flowchart of a method for obtaining a binding relationship by an NRF according to an embodiment of the present application. [Figure 13] 1 is a flowchart of a service authentication method according to an embodiment of the present application. [Figure 14] 1 is a flowchart of a service authentication method according to an embodiment of the present application. [Figure 15] 4 is a flowchart of another service authentication method according to an embodiment of the present application. [Figure 16] 1 is a flowchart of a service authentication method according to an embodiment of the present application. [Figure 17] FIG. 1 is a schematic diagram of a structure of a communication device according to an embodiment of the present application. [Figure 18] FIG. 1 is a schematic diagram of a structure of a communication device according to an embodiment of the present application. [Figure 19] FIG. 1 is a schematic diagram of a structure of a communication device according to an embodiment of the present application. [Figure 20] FIG. 1 is a schematic diagram of a structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0068] First, some terms in the embodiments of the present application will be explained for ease of understanding.

[0069] (1) A certificate is a digital certificate, which is a file that is digitally signed by a certificate authority (CA) and contains public key owner information and a public key. A certificate is for identity authentication between communicating parties. A certificate generally includes information such as a certificate version number, a serial number, a signature, an issuer name, a subject public key info, and a validity, and may also include an issuer unique identifier, a subject unique identifier, and other extensions. An embodiment of this application is related to the certificate of an NF service consumer entity. The certificate may be an application layer certificate, a transport layer security (TLS) certificate, or a certificate shared by the application layer and the transport layer.

[0070] (2) A network function service consumer (NFc) entity is referred to as an "NFc entity" or simply "NFc", and may be an NF that can invoke a function service in a service-based architecture, such as a session management function (SMF) network element, an access and mobility management function (AMF) network element, or an authentication server function (AUSF) network element.

[0071] (3) A network function service provider (NFp) entity is referred to as an “NFp entity” or simply “NFp” and may be, specifically, an NF having function services that can be invoked in a service-based architecture, such as an SMF network element, an AUSF network element, or a unified data management (UDM) network element.

[0072] (4) A network repository function (NRF) network element is referred to as an "NRF network element" or simply "NRF" and is configured to participate in NF automatic management, selection, and extension, including NF service registration, discovery, status monitoring, service authentication, etc., to implement on-demand configuration of network functions and services and interconnection between NFs. For example, the NRF has functions such as token generation and token validation.

[0073] (5) A service communication proxy (SCP) network element, referred to as an “SCP network element” or “SCP” for short, may be for indirect communication between NFs, may be further configured to perform load balancing and NF selection, and may further have functions such as NF registration, discovery, and service authentication.

[0074] In some possible embodiments, the term "network element" may be replaced with "entity", "device", etc. For example, an "AMF network element" may also be described as an "AMF entity" or an "AMF device", and an "SMF network element" may also be described as an "SMF entity" or an "SMF device". For ease of description, "XXX network element" is uniformly abbreviated to "XXX" below. For example, an "AUSF network element" may be abbreviated to "AUSF", and an "SMF network element" may be abbreviated to "SMF".

[0075] It should be understood that each network element as referred to in the present application may be a physical concept. For example, a network element may be a physical single device, or at least two network elements may be integrated into the same physical device. Alternatively, the network elements as referred to in the present application may be a logical concept, for example, a software module or network function corresponding to a service provided by each network element. A network function may be understood as an aggregate function in a virtual implementation, or as a network function providing a service in a service-based architecture.

[0076] In the embodiments of the present application, the term "at least one" refers to one or more, and "multiple" refers to two or more. The term "and / or" refers to an association relationship for describing related objects, and indicates that three relationships may exist. For example, A and / or B refers to three cases: only A exists, both A and B exist, and only B exists. A and B may each be singular or plural. The character " / " generally indicates a "logical or" relationship between related objects. At least one of the following items (fragments) or similar expressions thereof refers to any combination of these items, including any combination of singular items (fragments) or multiple items (fragments). For example, at least one of a, b, or c may represent a, b, c, a and b, a and c, b and c, or a, b, and c.

[0077] In addition, unless otherwise stated, ordinals such as "first" and "second" in the embodiments of the present application are used to distinguish between multiple objects, and are not intended to limit the order, time sequence, priority, or importance of the multiple objects. For example, a first priority criterion and a second priority criterion are simply used to distinguish between different criteria, and do not indicate different contents, priorities, importance, etc. of the two criteria.

[0078] In addition, the terms "including" and "having" in the embodiments, claims, and accompanying drawings of the present application are not exclusive. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules and may further include unlisted steps or modules.

[0079] The technical solutions in the embodiments of the present application may be applied to various communication systems, such as 4th Generation (4G) communication systems, 5th Generation (5G) communication systems, other future evolved systems, or various other wireless communication systems using radio access technologies. The technical solutions in the embodiments of the present application may be applied to any communication system having requirements such as service authorization or authentication. Furthermore, the network elements used in the embodiments of the present application may have different names in future communication systems.

[0080] For example, Figure 1 shows a communication system to which the embodiments of the present application are applied. The communication system includes a first network element, an NRF, and an NFp.

[0081] The first network element may be an NFc. The NFc may request service authorization for the NFp from the NRF, for example, request a token corresponding to the NFp, and initiate a service request to the NFp after obtaining authorization from the NRF (e.g., after obtaining the token).

[0082] The first network element may alternatively be an SCP communicatively connected to the NFc. The SCP may act as a proxy for part of the functionality of the NFc or for the NFc to execute a method. For example, the SCP may, as a proxy for the NFc, request service authorization for the NFp from the NRF or, as a proxy for the NFc, initiate a service request to the NFp.

[0083] In practical application, the communication system shown in FIG. 1 may further include more network elements.

[0084] For example, Figure 2 shows a specific communication system to which an embodiment of the present application is applied. The communication system includes a core network (CN). As a bearer network, the CN provides an interface to a data network and provides terminal devices with communication connectivity, authentication, management, policy control, data service bearers, etc. The CN may include the following network elements: an SMF network element, an AMF network element, a UDM network element, an AUSF network element, a policy control function (PCF) network element, a user plane function (UPF) network element, a network slice selection function (NSSF) network element, a network exposure function (NEF) network element, an NRF, an application function (AF) network element, etc.

[0085] It should be noted that the CN may include one or more CN devices. A CN device may be a network element configured to perform a single network function as described above, or may be a network element configured to perform multiple network functions as described above. When one CN device is configured to perform multiple network functions, the CN device may include one or more function modules configured to perform multiple network functions. The function modules may be software modules or software / hardware modules. This is not limited in the embodiment of the present application.

[0086] It should be noted that AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF, etc. may interact with each other by using service-based interfaces. For example, as shown in Figure 1, Namf, Nsmf, Nausf, Nudm, Nnef, Npcf, Naf, Nnssf, and Nnrf are service-based interfaces provided by AMF, SMF, AUSF, UDM, NEF, PCF, AF, NSSF, and NRF, respectively. N1 and N2 are service-based interfaces between SMF and UPF, and between UPF and DNA, respectively.

[0087] The first network element in Fig. 1 may specifically be the SCP, SMF, AMF, etc. in Fig. 2. The NRF in Fig. 1 may specifically be the NRF in Fig. 2. The NFp in Fig. 1 may specifically be the SMF, AMF, etc. in Fig. 2. UDM , etc.

[0088] It should be understood that Fig. 2 is merely a simplified schematic diagram of an example for ease of understanding. The communication system may further include more network elements or devices. For example, optionally, the communication system further includes a terminal device. Optionally, the communication system further includes a RAN.

[0089] A terminal device, also referred to as a terminal, may include a device that provides voice and / or data connectivity to a user, such as a handheld device with wireless connectivity or a processing device connected to a wireless modem. The terminal device may communicate with the core network through a radio access network (RAN) and exchange voice and / or data with the RAN. A terminal device may be a user equipment (UE), a wireless terminal device, a mobile terminal device, a device-to-device (D2D) communication terminal device, a V2X terminal device, a machine-to-machine / machine-type communications (M2M / MTC) terminal device, an internet of things (IoT) terminal device, a subscriber unit, a subscriber station, a mobile station, a remote station, an access point (AP), a remote terminal, an access terminal, a user terminal, a user agent, a user device, etc. For example, a terminal device may include a mobile phone (also called a "cellular" phone), a computer with a mobile terminal device, or a portable, pocket-sized, handheld, or computer-embedded mobile device. For example, the terminal device may be a device such as a personal communication service (PCS) telephone, a cordless telephone set, a session initiation protocol (SIP) telephone, a wireless local loop (WLL) station, or a personal digital assistant (PDA).The terminal device may alternatively include a limited power device, a device with relatively low power consumption, a device with limited memory capability, or a device with limited computing capability. For example, the terminal device may include an information sensing device such as a barcode, a radio frequency identification (RFID), a sensor, a global positioning system (GPS), or a laser scanner.

[0090] By way of example and not of limitation, in the embodiment of the present application, the terminal device may alternatively be a wearable device. A wearable device may also be called a wearable intelligent device, an intelligent wearable device, etc., and is a general term for a wearable device that is intelligently designed and developed for daily wear by using wearable technology, such as glasses, glasses, watches, clothes, and shoes. A wearable device is a portable device that can be worn directly on the body or integrated into a user's clothes or accessories. A wearable device is not only a hardware device, but also implements powerful functions through software support, data exchange, and cloud interaction. In a broad sense, a wearable intelligent device includes a full-featured large-scale device, such as a smart watch or smart glasses, that can implement all or part of the functions that do not depend on a smartphone, and includes a device that is dedicated to only one type of application function and needs to cooperate with other devices such as a smartphone, such as various smart bands, smart helmets, or smart jewelry that monitor physical signs.

[0091] When the various terminal devices described above are located in a vehicle (for example, placed in or installed in a vehicle), the terminal devices may all be regarded as in-vehicle terminal devices. For example, the in-vehicle terminal device is also called an on-board unit (OBU).

[0092] The RAN is mainly responsible for the access of UEs. The RAN is located on the network side of the communication system and is a device or chip that can be located in a device that has radio transceiver functions. Access network devices include, but are not limited to, evolved node B (eNB), radio network controller (RNC), node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved node B or home node B, HNB), base band unit (BBU), access point (AP) of wireless fidelity (Wi-Fi) system, wireless relay node, wireless backhaul node, transmission and reception point (TRP or transmission point, TP), etc. Alternatively, the access network device may be a gNB or transmission point (TRP or TP) of a 5G system, such as a new radio (NR) system, or one antenna panel or a group of antenna panels (including multiple antenna panels) of a base station of a 5G system, or a network node, such as a baseband unit (BBU) or distributed unit (DU), constituting a gNB or transmission point.

[0093] The embodiments of the present application may be applied to a scenario in which an NFc obtains a token from an NRF to request a service from a corresponding NFp in a service-based architecture.

[0094] 3A to 3C illustrate some possible specific application scenarios according to embodiments of the present application.

[0095] As shown in Fig. 3A, the SCP requests a token from the NRF to request a service from the NFp as a proxy of the NFc. The NRF generates a corresponding token and returns the token to the NFc through the SCP. The SCP, as a proxy of the NFc, sends a service request to the NFp. The NFp receives the service request and returns a service response to the NFc through the SCP.

[0096] As shown in Figure 3B, the NFc sends a service request to the SCP, which then initiates a token request to the NRF as a proxy for the NFc to obtain a token for requesting a service from the NFp. The NRF generates a corresponding token and returns the token to the SCP. The SCP, as a proxy for the NFc, sends the service request to the NFp. The NFp receives the service request and returns a service response to the NFc through the SCP.

[0097] As shown in Fig. 3C, the NFc directly requests a token to request a service from the NFp from the NRF. The NRF generates a corresponding token and returns the token to the NFc. As a proxy of the NFc, the SCP sends the service request to the NFp. The NFp receives the service request and returns a service response to the NFc through the SCP.

[0098] It should be understood that the above several scenarios are not limiting and are merely examples.

[0099] With reference to the accompanying drawings, the following describes a service authentication method provided in an embodiment of the present application.

[0100] After receiving a token request from an NFc at an eSBA or SBA, the NRF typically validates the parameters carried in the token request based on the profile of the NFc shown in Table 1 to prevent the NFc from maliciously reporting the parameters of the NFc to obtain authentication from the NRF. For example, the single-network slice selection assistance information (S-NSSAI) carried in the token request is validated to verify the validity of the NFc. However, the NRF does not hold profiles of some of the NFc (e.g., NFc that are not registered with the NRF). As a result, the NRF cannot validate the parameters of those NFc. [Table 1]

[0101] In view of the above technical problem, an embodiment of the present application provides a service authentication method, which may be applied to the communication system shown in FIG.

[0102] See Figure 4. The method includes the following procedures.

[0103] S401: A first network element sends a first token request to an NRF, and the NRF receives the first token request from the first network element.

[0104] The first network element in this embodiment of the present application may be an NFc or may be an SCP, which is not particularly limited in this embodiment of the present application.

[0105] The NFc in this embodiment of the present application may be any network element that can invoke a function service, such as the SMF or AMF in Figure 2. This is not limited here.

[0106] The first token request includes first information about the NFc and an assertion about the NFc, the assertion including a certificate about the NFc, and the certificate including second information about the NFc.

[0107] The first information may include one or more of the following: (1) a first public land mobile network identifier (PLMN-ID); (2) a first stand-alone non-public network identifier (SNPN-ID); ( 3 ) first single-network slice selection assistance information (single-network slice selection assistance information identifier, S-NSSAI ID); (4) a first network function instance identifier (NF instance ID); (5) First network function type (NF type); (6) a first network function set (NF set); and (7) First universal resource locator (URI).

[0108] The second information may include one or more of the following: (1) 2nd PLMN ID; (2) 2nd SNPN ID; ( 3 )2nd S-NSSAI ID; (4) 2 NF instance ID; (5) 2nd NF type; (6) the second NF set; and (7)Second URI.

[0109] It should be understood that the first PLMN ID and the second PLMN ID are both for identifying the home network and / or visited network of the NFc. The first SNPN ID and the second SNPN ID are both for identifying the home network and / or visited network of the NFc. The first S-NSSAI ID and the second S-NSSAI ID are both for identifying the network slice information of the NFc. The first NF instance ID and the third NF instance ID are both for identifying a specific network element of the NFc. The first NF type and the second NF type are both for identifying a service list provided by the NFp or NFc. The first URI and the second URI are both for identifying a string of an Internet resource name.

[0110] Each piece of information in the first information or the second information may be an identifier (ID) or an ID list, which is not particularly limited in this embodiment of the present application.

[0111] It can be understood that the specific content of the first information corresponds to the specific content of the second information.

[0112] For example, when the first information includes a first SNPN ID, the second information includes a second SNPN ID. As another example, when the first information includes a first SNPN ID and a first PLMN ID, the second information includes a second SNPN ID and a second PLMN ID. As yet another example, when the first information includes a first SNPN ID, a first PLMN ID, and a first NF instance ID, the second information includes a second SNPN ID, a second PLMN ID, and a 2 Contains the NF instance ID.

[0113] Optionally, the second information may be a certificate extension. Zhangfu It is transported by field.

[0114] S402: The NRF determines, by verification, whether the first information matches the second information.

[0115] Specifically, after receiving the first token request, the NRF executes S402 to determine whether the first information matches the second information through verification. If it determines that the first information matches the second information, the NRF executes S403A to S404. If it determines that the first information does not match the second information, the NRF executes S403B to return response information to the first network element indicating that the token request has failed, or rejects the token request from the NFc.

[0116] In this embodiment of the present application, a specific implementation in which the NRF determines whether the first information is consistent with the second information through verification includes, but is not limited to, the following two types.

[0117] Implementation 1: If the first information is the same as the second information, the NRF determines that the first information matches the second information.

[0118] For example, if the first information is a first PLMN ID and the second information is a second PLMN ID, and the first PLMN ID and the second PLMN ID are the same, e.g., both 1, then the NRF determines that the first information matches the second information.

[0119] Implementation 2: The NRF determines that the first information matches the second information if the first information is a subset of the second information.

[0120] For example, if the first information is a first SNPN ID and the second information is a second SNPN ID, and the first SNPN ID is 1 and the second SNPN ID is {1,2,4}, the first SNPN ID is a subset of the second SNPN ID, and the NRF determines that the first information matches the second information.

[0121] It should be understood that when both the first information and the second information include multiple pieces of information, the NRF determining that the first information matches the second information specifically includes the NRF determining that the information included in the first information matches, in a one-to-one correspondence, the information included in the second information.

[0122] For example, if the first information includes a first PLMN ID, a first SNPN ID, a first S-NSSAI ID, and a first NF instance ID, and the second information includes a second PLMN ID, a second SNPN ID, a second S-NSSAI ID, and a third NF instance ID, the NRF determines that the first information matches the second information when it determines that the first PLMN ID matches the second PLMN ID, the first SNPN ID matches the second SNPN ID, and the first NF instance ID matches the third NF instance ID.

[0123] S403A: The NRF generates a token.

[0124] In a possible implementation, the NRF may generate a token based on the first information and the certificate included in the assertion carried in the token request. Specifically, the generated token may carry the first information and the assertion of the NFc, so that other network elements may perform other validation operations based on the first information and the certificate in the token when subsequently using the token.

[0125] S403B: The NRF returns an unsuccessful response to the first network element, and the first network element receives the unsuccessful response, where the unsuccessful response indicates that the token request has failed.

[0126] S404: The NRF transmits the token to the first network element, and the first network element receives the token.

[0127] As can be seen from the above, in this embodiment of the present application, the first information is carried in the token request, and the second information is carried in the certificate of the NFc, so that the NRF can verify the validity of the NFc by verifying the matching relationship between the first information and the second information, and does not rely on the profile of the NFc to verify the validity of the NFc. Therefore, even in the case of an NFc whose profile is not stored in the NRF, the NRF can verify the validity of the parameters of the NFc, so that the safety of using the NF service is effectively improved in this embodiment of the present application.

[0128] 5 is a schematic diagram of a service authentication method. The method includes the following steps:

[0129] S501: The NFc and the NRF discover a service.

[0130] Specifically, the NFc initiates a service discovery request to the NRF. The NRF receives the service discovery request and returns information about the NF services provided by the corresponding NFp to the NFc.

[0131] S502: The NFc sends a token request to the NRF, and the NRF receives the token request.

[0132] Specifically, after receiving a token request, the NRF generates a token and returns the token to the NFc.

[0133] S503: The NRF transmits the token to the NFc, and the NFc receives the token.

[0134] Specifically, after receiving the token, NFc executes S501 again to discover the services provided by NFp, and then executes S504.

[0135] S504: The NFc sends a service request to the NFp through the SCP, and the NFp receives the service request through the SCP, where the service request carries the token and the assertion of the NFc.

[0136] S505: The NFp verifies the assertion and the token.

[0137] Specifically, the process of the NFp validating the token may be to determine, by verification, whether the standard parameters of the token (e.g., validity or PLMN ID) are valid. The process of the NFp validating the assertion may be to determine, by verification, whether the NF instance ID in the assertion matches the NF instance ID in the certificate included in the assertion, or to verify the timestamp, expiration time, network function type of the expected audience, signature, etc. in the assertion. If the NFp determines that the standard parameters in the token are valid and the NF instance ID in the assertion matches the NF instance ID in the certificate included in the assertion, S506 is executed.

[0138] S506: The NFp returns a service response to the NFc via the SCP, and the NFc receives the service response via the SCP.

[0139] In the above method, when the NFc sends a token request directly to the NRF and sends a service request to the NFp through the SCP, the NFc further includes an assertion in the service request, and the NFp determines by verification only whether the NF instance ID in the assertion matches the NF instance ID in the certificate included in the assertion. Therefore, when the NF instance ID in the token does not match the NF instance ID in the assertion, an attacker may illegally obtain a NF service if he illegally obtains the token of the NFc.

[0140] 6 is a schematic flow chart of another service authentication method. The method specifically includes the following steps:

[0141] S600: The NFc and the NRF discover services.

[0142] Specifically, the specific implementation of S600 is similar to that of S501, please refer to the description of S501, and the details will not be described again here.

[0143] S601: The NFc sends a token request to the NRF via the SCP, and the NRF receives the token request via the SCP, where the token request carries the assertion of the NFc.

[0144] S602: The NRF verifies the assertion.

[0145] Specifically, the process by which the NRF validates an assertion may be to determine, through validation, whether the NF instance ID in the assertion matches the NF instance ID in the certificate included in the assertion.

[0146] S603: NRF sends the token to NFc through the SCP, and NFc receives the token through the SCP.

[0147] S604: The NFc sends a service request to the NFp through the SCP, and the NFp receives the service request through the SCP.

[0148] S605: The NFp verifies the token.

[0149] Specifically, the process by which the NFp verifies the token may be to verify standard parameters of the token (eg, validity or PLMN ID).

[0150] S606: The NFp returns the service response to the NFc via the SCP, and the NFc receives the service response via the SCP.

[0151] In the above method, when the NFc sends a token request to the NRF through the SCP and sends a service request to the NFc through the SCP, the NFc includes its assertion in both the token request and the service request, and both the NRF and the NFp verify the assertion. However, there are still cases where the NF instance ID in the token does not match the NF instance ID in the assertion. As a result, there are still cases where an attacker illegally obtains a token from the NRF and further illegally obtains an NF service.

[0152] In order to solve the technical problem that an attacker illegally steals a token of an NFc to illegally obtain an NF service, an embodiment of the present application further provides a service authentication method. The method may be applied to the communication system shown in Fig. 1. See Fig. 7. The method includes the following steps:

[0153] S701: A first network element sends a service request to an NFp, and the NFp receives the service request.

[0154] The service request is to request the NFp to provide an NF service to the NFc. The service request includes a token and an assertion. The token includes a first NF instance ID, and the assertion includes a second NF instance ID.

[0155] The first network element may be an NFc or an SCP, which is not limited here.

[0156] The NFp in this embodiment of the present application may be any network element that has an NF service that can be invoked, such as the SMF or UDM in Figure 2. This is not limited here.

[0157] S702: The NFp determines, by verification, whether the assertion matches the token.

[0158] Specifically, a specific process of the NFp determining whether the assertion matches the token by verification may be that the NFp determines whether the first NF instance ID in the token is the same as the second NF instance ID in the assertion by verification. When the first NF instance ID is the same as the second NF instance ID, the NFp determines that the assertion matches the token and executes S703A. When the first NF instance ID is different from the second NF instance ID, the NFp determines that the assertion does not match the token and executes S703B.

[0159] For example, assuming the first NF instance ID is a universally unique identifier (UUID) and the second NF instance ID is a UUDI, the NFp determines that the first NF instance ID is the same as the second NF instance ID, i.e., the assertion matches the token. As another example, if the first NF instance ID is "###134" and the second NF instance ID is also "###134", the NFp determines that the first NF instance ID is the same as the second NF instance ID, i.e., the assertion matches the token.

[0160] S703A: The NFp returns a service response to the first network element, and the first network element receives the service response.

[0161] In a possible implementation, the first network element is an SCP. After receiving the service response, the SCP sends the service response to the NFc. The service response carries an assertion of the NFp, where the assertion includes a third NF set. After receiving the service response, the NFc determines by verification whether the first NF set requested by the NFc matches the third NF set. If the first NF set matches the third NF set, the NFc accesses the corresponding NF service. If the first NF set does not match the third NF set, the NFc resumes the service request to the NFp.

[0162] In another possible implementation, the first network element is NFc. The service response carries an assertion of NFp, where the assertion includes a third NF set. After receiving the service response, NFc determines by verification whether the first NF set requested by NFc matches the third NF set. If the first NF set matches the third NF set, NFc accesses the corresponding NF service. If the first NF set does not match the third NF set, NFc resumes the service request to NFp.

[0163] The process of NFc determining whether the first NF set is consistent with the third NF set by verification may specifically be determining whether the first NF set is the same as the third NF set, or determining whether an intersection exists between the first NF set and the third NF set. For example, if the first NF set is 1 and the third NF set is also 1, NFc determines that the first NF set is consistent with the third NF set. As another example, if the first NF set is {2,3,5} and the third NF set is {1,2,4}, and there is an intersection {2} between the first NF set and the third NF set, NFc determines that the first NF set is consistent with the third NF set.

[0164] S703B: The NFp returns a non-successful response to the first network element, and the first network element receives the non-successful response, where the non-successful response indicates that the service request of the first network element has failed.

[0165] In the service authentication method shown in Fig. 7, the NFp verifies the NF instance ID in the token carried in the service request and the NF instance ID carried in the assertion to ensure that the token in the service request matches the assertion, avoiding the case where an attacker illegally steals the token and further illegally obtains the NF service. Therefore, the security of using the NF service is effectively improved in this embodiment of the present application.

[0166] Fig. 8 is a schematic flow chart of another service authentication method. Fig. 8 shows a scenario in which NFc sends a service request to NFp through SCP, and the service request triggers SCP to send a token request to NRF. The method specifically includes the following steps:

[0167] S800: The NFc transmits a service request to the NRF via the SCP, and the NRF receives the service request via the SCP.

[0168] Specifically, the NFc includes the NFc's assertion in the service request.

[0169] S801: The SCP and NRF discover services.

[0170] Specifically, the SCP initiates a service discovery request to the NRF, receives information returned by the NRF, and based on the information, determines the NF services provided by the registered NFp, and executes S802 to send a token request to the NRF.

[0171] S802: The SCP sends a token request to the NRF, and the NRF receives the token request.

[0172] Specifically, the SCP includes an assertion of the NFc in the token request.

[0173] S803: The NRF validates the assertion.

[0174] Specifically, after receiving the token request, the NRF verifies the assertion in the token request. After the verification is successful, the NRF generates a token and executes S804 to send the token to the SCP. failure If so, the NRF returns response information to the SCP indicating that the token request has failed.

[0175] S804: The NRF transmits the token to the SCP, and the SCP receives the token.

[0176] S805: The SCP sends a service request to the NFp, and the NFp receives the service request, where the service request carries the token and the assertion of the NFc.

[0177] S806: The NFp validates the token and assertion.

[0178] The specific implementation of S806 is similar to that of S505. Please refer to the description of S505. The details will not be described again here. If both the token and the assertion are successfully verified, the NFp executes S807 and returns a service response to the NFc through the SCP.

[0179] S807: The NFp returns the service response to the NFc via the SCP, and the NFc receives the service response via the SCP.

[0180] In the service authentication method shown in Fig. 8, when an NFc sends a service request to an NFp through an SCP, the NFc includes the assertion of the NFc in the service request, which triggers the SCP to send a token request to the NRF. The SCP also includes the assertion in the token request. After obtaining the token, the SCP also includes the assertion in the service request when sending the service request as a proxy of the NFc. Both the NRF and the NFp verify the assertion of the NFc. The whole service request process depends on the assertion (e.g., the assertion being successfully verified is a prerequisite for generating a token). Therefore, an attacker may steal the assertion of another NFc and even obtain NF services illegally.

[0181] In order to solve the technical problem that an attacker illegally steals an NFc assertion and illegally obtains an NF service, an embodiment of the present application further provides a service authentication method. The method may be applied to the communication system shown in Fig. 1. See Fig. 9. The method includes the following steps:

[0182] S901: The SCP obtains a first fully qualified domain name (FQDN) and a third NF instance ID associated with the certificate.

[0183] In this embodiment of the present application, the first FQDN may be an FQDN in a transport layer certificate of the NFc, and the third NF instance ID may be an NF instance ID in an application layer certificate of the NFc. Alternatively, the first FQDN and the third NF instance ID may be an FQDN and an NF instance ID in a shared certificate of the NFc (e.g., a certificate shared by the transport layer and the application layer).

[0184] S902: The SCP determines that the first FQDN matches the third NF instance ID.

[0185] In a possible implementation, the SCP may receive a service request from the NFc. The service request includes the certificate of the NFc. The SCP performs S901 and S902 to obtain from the certificate a first FQDN and a third NF instance ID associated with the certificate. If the SCP determines that the first FQDN matches the third NF instance ID, the SCP performs S903 to send the service request to the NFp. If the SCP determines that the first FQDN does not match the third NF instance ID, the SCP returns prompt information to the NFc indicating that the service request has failed.

[0186] In another possible implementation, the SCP may receive a token request from the NFc. The token request includes the certificate of the NFc. The SCP executes S901 and S902 to obtain from the certificate the first FQDN and the third NF instance ID associated with the certificate. If the SCP determines that the first FQDN matches the third NF instance ID, the SCP sends the token request to the NRF. If the SCP determines that the first FQDN does not match the third NF instance ID, the SCP returns prompt information to the NFc indicating that the token request failed.

[0187] In a possible implementation, the SCP may determine whether the first FQDN matches the third NF instance ID based on a binding relationship between the FQDN and the NF instance ID.

[0188] In this embodiment of the present application, there are multiple implementations in which the SCP determines whether the first FQDN matches the third NF instance ID based on the binding relationship, including but not limited to the following three implementations:

[0189] Enactment 1: The SCP extracts the first FQDN from the transport layer certificate of the NFc and sends a binding relationship query request to the NRF, where the binding relationship query request carries the first FQDN. The SCP receives the corresponding NF instance ID returned by the NRF and determines whether the NF instance ID matches the third NF instance ID in the application layer certificate in the assertion carried in the token request. If the NF instance ID matches the third NF instance ID, the SCP determines that the first FQDN matches the third NF instance ID. If the NF instance ID does not match the third NF instance ID, the SCP determines that the first FQDN does not match the third NF instance ID.

[0190] Enactment 2: The SCP extracts the 3NF instance ID from the application layer certificate in the assertion of the NFc and sends a binding relationship query request to the NRF, where the binding relationship query request carries the 3NF instance ID. The SCP receives the corresponding FQDN returned by the NRF and determines whether the FQDN matches the first FQDN in the transport layer certificate of the NFc. If the FQDN matches the first FQDN, the SCP determines that the first FQDN matches the 3NF instance ID. If the FQDN does not match the first FQDN, the SCP determines that the first FQDN does not match the 3NF instance ID.

[0191] Action 3: The SCP extracts the first FQDN from the transport layer certificate of the NFc, extracts the third NF instance ID from the application layer certificate in the assertion of the NFc, and sends a binding relationship query request to the NRF, where the binding relationship query request carries the third NF instance ID and the first FQDN. The SCP receives the match result returned by the NRF, which may directly indicate whether the first FQDN matches the third NF instance ID.

[0192] Optionally, the binding relationship may be obtained by the SCP from a certification authority / registration authority (CA / RA) entity. Alternatively, the binding relationship may be previously obtained by the NRF from the CA / RA, stored locally, and then obtained by the SCP from the NRF.

[0193] S903: The SCP sends a service request to the NFp, and the NFp receives the service request.

[0194] Specifically, the SCP may include the assertion and token of the NFc in the service request. After receiving the service request, the NFp may determine whether the assertion matches the token through verification. When it determines that the assertion matches the token, the NFp executes S904 and returns a service response to the SCP. When it determines that the assertion does not match the token, the NFp rejects the service request.

[0195] S904: The NFp returns a service response to the SCP, and the SCP receives the service response.

[0196] Specifically, after receiving the service response, the SCP further sends the service response to the NFc, and the NFc receives the service response.

[0197] In the service authentication method shown in Fig. 9, before sending a service request to the NFp, the SCP first verifies the matching relationship between the FQDN and the NF instance ID associated with the certificate included in the assertion of the NFc, and only after the verification is successful, sends the service request to the NFp. Therefore, it can be avoided that an attacker illegally steals an assertion and even illegally obtains an NF service, and the security of using the NF service can be effectively improved.

[0198] In this embodiment of the present application, the binding relationship may alternatively be verified by other network elements. For example, after receiving a token request from the first network element, the NRF may verify the binding relationship before delivering the token to the first network element. For details, see Figure 10. The following steps are included:

[0199] S1001: A first network element sends a token request to an NRF, and the NRF receives the token request, where the token request carries an assertion of an NFc.

[0200] In a possible implementation, the first network element is an SCP. After receiving a service request or a token request from the NFc, the SCP sends a token request to the NRF.

[0201] In another possible implementation, the first network element is the NFc, which sends the token request directly to the NRF.

[0202] S1002: The NRF obtains the first FQDN and the third NF instance ID associated with the certificate.

[0203] In a possible implementation, the token request carries an assertion of the NFc, the assertion including the application layer certificate and the transport layer certificate of the NFc, and the NRF may extract the FQDN from the transport layer certificate of the NFc and the third NF instance ID from the application layer certificate of the NFc.

[0204] It should be understood that the transport layer certificate may be transmitted by the first network element to the NRF when a transport layer link is established between the first network element and the NRF.

[0205] In another possible implementation, the token request carries an assertion of the NFc, the assertion including the shared certificate of the application layer and the transport layer of the NFc. The NRF may extract the first FQDN and / or the third NF instance ID from the shared certificate.

[0206] S1003: The NRF determines that the first FQDN matches the third NF instance ID.

[0207] In a possible implementation, after receiving a token request from the first network element, the NRF may determine whether the first FQDN matches the third NF instance ID based on the locally stored binding relationship between the FQDN and the NF instance ID. Specifically, if the NRF determines that the first FQDN and the third NF instance ID are in one-to-one correspondence with the FQDN and the NF instance ID in the binding relationship, the NRF determines that the first FQDN matches the third NF instance ID, generates a token, and executes S1004. If the NRF determines that the first FQDN and the third NF instance ID are not in one-to-one correspondence with the FQDN and the NF instance ID in the binding relationship, the NRF determines that the first FQDN does not match the third NF instance ID, and returns response information to the first network element indicating that the token request has failed, or rejects the token request of the first network element.

[0208] In another possible implementation, after receiving a token request from the first network element, the NRF may obtain related parameters (FQDN and / or NF instance ID) of the binding relationship from the CA / RA, and determine whether the first FQDN matches the third NF instance ID based on the related parameters of the binding relationship. A specific implementation in which the NRF obtains related parameters of the binding relationship from the CA / RA is described in detail in the embodiment shown in FIG. 12.

[0209] S1004: The NRF returns the token to the first network element, and the first network element receives the token.

[0210] In a possible implementation, the first network element is an SCP. After receiving the token, the SCP forwards the token to the NFc.

[0211] In another possible implementation, the first network element is an NFc, which receives the token from the NRF.

[0212] In the service authentication method shown in Fig. 10, before returning the token to the first network element, the NRF first verifies the matching relationship between the FQDN and the NF instance ID associated with the certificate included in the assertion of the NFc, and returns the token only after the verification is successful. The NFc or SCP can only initiate a service request after receiving the token. Therefore, the case where an attacker illegally steals the assertion and even illegally obtains the NF service can be avoided, and the security of using the NF service can be effectively improved.

[0213] Optionally, the binding relationship between the FQDN and the NF instance ID may be created by the CA / RA when the NFc applies for a certificate to the CA / RA.

[0214] The following describes how to apply for a certificate.

[0215] 11 is a schematic diagram of a certificate application method. The method includes the following steps:

[0216] S1101: The NFc transmits a first certificate application request to the CA / RA, and the CA / RA receives the first certificate application request.

[0217] Specifically, the first certificate application request includes a certificate template, and the certificate template includes second information, which may include one or more of a third NF instance ID, a second PLMN ID, a second SNPN ID, a second S-NSSAI ID, a second NF type, a second NF set, and a second URI, etc. After receiving the first certificate application request, the CA / RA may generate a first certificate based on the second information.

[0218] S1102: The CA / RA generates a second certificate carrying the second information.

[0219] It should be understood that the first certificate may be an application layer certificate of the NFc.

[0220] S1103: The CA / RA returns the first certificate to the NFc, and the NFc receives the first certificate.

[0221] S1104: The NFc transmits a second certificate application request to the CA / RA, and the CA / RA receives the second certificate application request.

[0222] Specifically, the second certificate application request includes a certificate template, and the certificate template includes the first FQDN. 2 After receiving the certificate application request, the CA / RA may generate a second certificate based on the first FQDN.

[0223] S1105: The CA / RA generates a second certificate carrying the first FQDN.

[0224] No. 2 It should be understood that the certificate may be a transport layer certificate of the NFc.

[0225] S1106: The CA / RA returns the second certificate to the NFc, and the NFc receives the second certificate.

[0226] S1107: The CA / RA binds the third NF instance ID in the second information to the first FQDN to generate a binding relationship between the third NF instance ID and the first FQDN.

[0227] Optionally, the first certificate and the second certificate may be combined into one certificate. Thus, the NFc only needs to apply for a certificate to the CA / RA once. The NFc may include a certificate template including the first FQDN and the second information in a certificate application request sent to the CA / RA. After receiving the certificate application request, the CA / RA may generate a certificate carrying the first FQDN and the second information and a binding relationship between the third NF instance ID and the first FQDN based on the certificate template in the certificate application request.

[0228] The following describes how the NRF obtains the binding relationships.

[0229] 12 is a flowchart of a method for the NRF to obtain a binding relationship. The method includes the following steps:

[0230] S1201: The NRF detects a trigger event.

[0231] The trigger event may be that the NRF receives an NF service registration request from the NFp, that the NRF receives a service discovery request from the NFc, or that the NRF receives a service request from the NFc, which is not particularly limited in this embodiment of the present application.

[0232] S1202: The NRF sends a binding relationship request to the CA / RA, and the CA / RA receives the binding relationship request.

[0233] In a possible implementation, the NRF carries a certificate in the binding relationship request. The certificate may be the transport layer certificate of the NFc (a certificate containing the first FQDN), the application layer certificate of the NFc (a certificate containing the third NF instance ID), or a certificate shared by the transport and application layers of the NFc (i.e., 1st FQDN and 3rd NF instance ID The certificate may be a certificate including:

[0234] In other possible implementations, the NRF carries certificate request parameters in the binding relationship request, which may be the first FQDN in the transport layer certificate of the NFc, the third NF instance ID in the application layer certificate of the NFc, or the first FQDN in the transport layer certificate of the NFc and the third NF instance ID in the application layer certificate.

[0235] S1203: The CA / RA determines a response result corresponding to the binding relationship request.

[0236] In this embodiment of the present application, if the binding relationship request received by the CA / RA carries a transport layer certificate of the NFc, the CA / RA determines that the response result is an application layer certificate in the binding relationship. If the binding relationship request received by the CA / RA carries an application layer certificate of the NFc, the CA / RA determines that the response result is a transport layer certificate in the binding relationship. If the binding relationship request received by the CA / RA carries a shared transport and application layer certificate of the NFc, the CA / RA determines that the response result is a match result of the FQDN and the NF instance ID.

[0237] Correspondingly, if the binding relationship request received by the CA / RA carries the first FQDN in the transport layer certificate of the NFc, the CA / RA determines that the response result is the NF instance ID in the binding relationship. If the binding relationship request received by the CA / RA carries the third NF instance ID in the application layer certificate of the NFc, the CA / RA determines that the response result is the FQDN in the binding relationship. If the binding relationship request received by the CA / RA carries the first FQDN and the third NF instance ID in the shared transport layer and application layer certificate of the NFc, the CA / RA determines that the response result is a match result of the first FQDN and the third NF instance ID.

[0238] S1204: The CA / RA returns a response result to the NRF, and the NRF receives the response result.

[0239] Specifically, after determining the corresponding response result based on the parameters carried in the binding relationship request, the CA / RA returns the response result to the NRF.

[0240] Optionally, after receiving the response result, the NRF may determine, based on the response result, whether the first FQDN matches a third NF instance ID, where the first FQDN and the third NF instance ID are associated with a certificate included in an assertion of the NFc carried in the service request received by the NRF from the SCP, and send the matching result to the SCP.

[0241] It should be understood that the above provides corresponding technical solutions to three technical problems separately. In practical applications, the above implementations may be combined with each other to achieve different technical solutions and technical effects. The following provides a detailed description by using several specific examples.

[0242] Example 1: As shown in Figure 13, with reference to the technical solutions shown in Figure 4, Figure 7 and Figure 9, an embodiment of the present application provides a service authentication method. The method is applied to the application scenario shown in Figure 3A, and the method includes the following steps:

[0243] S1301: The NFc sends a token request to the SCP, and the SCP receives the token request.

[0244] For example, the NFc may be an SMD, an AMF, etc. in the communication system shown in FIG.

[0245] The token request carries an assertion of the NFc and the first information. The assertion includes a certificate of the NFc, and the certificate includes the second information of the NFc. For the specific contents of the first information and the second information, please refer to the relevant description of S401. The details will not be described again here.

[0246] S1302: The SCP determines that the first FQDN matches the third NF instance ID.

[0247] The first FQDN may be an FQDN in a transport layer certificate of the NFc and the third NF instance ID may be an NF instance ID in an application layer certificate of the NFc. Alternatively, the first FQDN and the third NF instance ID may be an FQDN and an NF instance ID in a certificate shared by the transport layer and application layer of the NFc.

[0248] Specifically, the SCP may determine whether the first FQDN matches the third NF instance ID based on a binding relationship between the FQDN and the NF instance ID.

[0249] It can be understood that the specific implementation of the SCP determining that the first FQDN matches the third NF instance ID in S1302 based on the binding relationship is similar to the specific implementation of S902, and the details will not be described again here.

[0250] Optionally, after executing S1302, the SCP may locally store the binding relationship between the FQDN and the NF instance ID, or related parameters in the binding relationship (e.g., the FQDN and the NF instance ID).

[0251] S1303: The SCP sends a token request to the NRF, and the NRF receives the token request.

[0252] Specifically, the token request carries an assertion and first information, and the certificate in the assertion carries second information, where the first information includes a first NF instance ID. After receiving the token and before generating the token, the NRF executes S1304 to determine whether the first information matches the second information. If it determines that the first information matches the second information, the NRF generates a token carrying the certificate and the first NF instance ID, and executes S1305 to return the token to the NFc through the SCP. If it determines that the first information does not match the second information, the NRF returns prompt information to the NFc through the SCP indicating that the token request has failed, or rejects the token request of the NFc.

[0253] S1304: The NRF determines that the first information matches the second information.

[0254] It can be understood that the specific implementation of the NRF determining whether the first information matches the second information in S1304 by verification is similar to the specific implementation of S402, and the details will not be described again here.

[0255] S1305: The NRF transmits the token to the NFc via the SCP, and the NFc receives the token via the SCP.

[0256] S1306: The NFc transmits a service request to the SCP, and the SCP receives the service request.

[0257] Specifically, the NFc includes the NFc's assertion and token in the service request, and the SCP may further execute S1302 again to determine whether there is a match between the first FQDN and the third NF instance ID associated with the certificate in the assertion, or determine whether there is a match between the first FQDN and the third NF instance ID associated with the certificate included in the service request based on the binding relationship or related parameters in the binding relationship stored in S1302.

[0258] S1307: The SCP transmits a service request to the NFp, and the NFp receives the service request.

[0259] Specifically, the service request carries an assertion and a token of the NFc, where the token includes a first NF instance ID, and the assertion includes a second NF instance ID. After receiving the service request, the NFp executes S1308.

[0260] S1308: The NFp determines whether the first NF instance ID is the same as the second NF instance ID.

[0261] Specifically, the NFp determines through verification whether the first NF instance ID in the token is the same as the second NF instance ID in the assertion. If the first NF instance ID is the same as the second NF instance ID, the NFp executes S1309. If the first NF instance ID is different from the second NF instance ID, the NFp returns information indicating that the service request has failed to the NFc through the SCP.

[0262] It can be understood that the specific implementation of the NFp determining whether the first NF instance ID is the same as the second NF instance ID in S1308 by verification is similar to the specific implementation of S702, and the details will not be described again here.

[0263] S1309: The NFp returns a service response to the NFp via the SCP, and the NFp receives the service response via the SCP.

[0264] It can be understood that the specific implementation of S1309 is similar to the specific implementation of S703A, and the details will not be described again here.

[0265] In the technical solution shown in Fig. 13, the NRF verifies the matching relationship between the first information of the NFc carried in the token request and the second information carried in the certificate of the assertion of the NFc, the NFp verifies the matching relationship between the first NF instance ID in the token of the NFc carried in the service request and the second NF instance ID in the assertion, and the SCP verifies the matching relationship between the first FQDN and the third NF instance ID associated with the certificate of the NF carried in the service request. This effectively avoids the case where an attacker illegally steals a token, forges an assertion, and even illegally obtains an NF service. Furthermore, the validity of the NFc does not need to be determined by verification by using the profile of the NFc. Therefore, the NRF can also verify the validity of the parameters of the NFc whose profile is not held in the NRF. Therefore, in this embodiment of the present application, the security of using the NF service can be effectively improved.

[0266] Example 2: The difference between Example 2 and Example 1 is that in Example 1, a token request is initiated by NFc to the NRF through the SCP, and NFc initiates a service request only after receiving the token returned by the NRF through the SCP. In Example 2, NFc sends a service request directly to the NRF through the SCP, triggering the SCP to initiate a token request to the NRF as a proxy for NFc.

[0267] As shown in Figure 14, with reference to the technical solutions shown in Figure 4, Figure 7 and Figure 9, an embodiment of the present application provides another service authentication method. The method may be applied to the application scenario shown in Figure 3B, and the method includes the following steps:

[0268] S1401: The NFc transmits a first service request to the SCP, and the SCP receives the first service request.

[0269] S1402: The SCP determines that the first FQDN matches the third NF instance ID.

[0270] The first FQDN may be an FQDN in a transport layer certificate and the third NF instance ID may be an NF instance ID in an application layer certificate of the NFc. Alternatively, the first FQDN and the third NF instance ID may be an FQDN and an NF instance ID in a certificate shared by the transport layer and application layer of the NFc.

[0271] Specifically, the first service request carries an assertion of the NFc and the first information, where the assertion includes the transport layer certificate and the application layer certificate of the NFc, or the certificate shared by the transport layer and the application layer. The SCP may extract the first FQDN and / or the third NF instance ID from these certificates, and perform step S1402 to determine that the first FQDN matches the third NF instance ID. It can be understood that the specific implementation of S1402 is similar to the specific implementation of S902. Please refer to the description of S902. Details will not be described again here.

[0272] S1403: The SCP sends a token request to the NRF, and the NRF receives the token request.

[0273] Specifically, the token request carries an assertion of the NFc and the first information, the assertion includes a certificate of the NFc, and the certificate includes the second information. For the specific contents of the first information and the second information, please refer to the relevant description of S401. The details will not be described again here.

[0274] Specifically, the first information includes a first NF instance ID. After receiving the token request and before generating the token, the NRF executes S1401 to determine whether the first information matches the second information by verification. If it is determined that the first information matches the second information, the NRF generates a token carrying the certificate and the first NF instance ID, and executes S1405 to return the token to the NFc through the SCP. If it is determined that the first information does not match the second information, the NRF returns prompt information to the NFc through the SCP indicating that the token request has failed, or rejects the token request of the NFc.

[0275] S1404: The NRF determines that the first information matches the second information.

[0276] It can be understood that the specific implementation of the NRF determining whether the first information matches the second information in S1404 by verification is similar to the specific implementation of S402, and the details will not be described again here.

[0277] S1405: The NRF transmits the token to the SCP, and the SCP receives the token.

[0278] S1406: The SCP transmits a second service request to the NFp, and the NFp receives the second service request.

[0279] Specifically, the second service request carries a token and an assertion of NFc, where the token includes the first NF instance ID and the assertion includes the second NF instance ID.

[0280] S1407: The NFp determines that the first NF instance ID is the same as the second NF instance ID.

[0281] Specifically, after receiving the second service request, the NFp determines whether the first NF instance ID is the same as the second NF instance ID through verification. If the first NF instance ID is the same as the second NF instance ID, the NFp executes S1408 and returns a service response to the NFc through the SCP. If the first NF instance ID is different from the second NF instance ID, the NFp returns information indicating that the service request has failed to the NFc through the SCP.

[0282] It can be understood that the specific implementation of the NFp determining whether the first NF instance ID is the same as the second NF instance ID in S1407 by verification is similar to the specific implementation of S702, and the details will not be described again here.

[0283] S1408: The NFp returns the service response to the NFc via the SCP, and the NFc receives the service response via the SCP.

[0284] It can be understood that the specific implementation of S1408 is similar to the specific implementation of S703A, and the details will not be described again here.

[0285] In the technical solution shown in FIG. 14, the SCP verifies the matching relationship between the first FQDN and the third NF instance ID associated with the certificate in the assertion of the NFc carried in the first service request from the NFc, the NRF verifies the matching relationship between the first information and the second information carried in the token request from the SCP, and the NFp verifies the matching relationship between the first NF instance ID and the second NF instance ID in the token and the assertion carried in the second service request from the SCP. This effectively avoids the case where an attacker illegally steals a token, forges an assertion, and even illegally obtains an NF service. Furthermore, the validity of the NFc does not need to be verified by using the profile of the NFc. Therefore, the NRF can also verify the validity of the parameters of the NFc whose profile is not held in the NRF. Therefore, in this embodiment of the present application, the security of using the NF service can be effectively improved, and the SCP does not need to repeatedly verify the matching relationship between the first FQDN and the third NF instance ID associated with the certificate in the assertion of the NFc. This effectively reduces the computational resources.

[0286] Example 3: The difference between this example and examples 1 and 2 is as follows: in example 3, the NFc directly initiates a token request to the NRF and sends a service request to the SCP after receiving the token returned by the NRF. After receiving the service request, the SCP verifies the correspondence between the first FQDN and the third NF instance ID associated with the certificate in the assertion carried in the service request.

[0287] As shown in Figure 15, with reference to the technical solutions shown in Figure 4, Figure 7 and Figure 9, an embodiment of the present application provides yet another service authentication and request method. The method may be applied to the application scenario shown in Figure 3C, and the method includes the following steps:

[0288] S1501: The NFc transmits a token request to the NRF, and the NRF receives the token request.

[0289] Specifically, the token carries first information of the NFc. After receiving the token request, the NRF obtains a certificate of the NFc, which includes second information. The NRF executes S1502 to determine whether the first information matches the second information through verification. If the first information matches the second information, the NRF executes S1503. If the first information does not match the second information, the NRF returns indication information to the NFc indicating that the token request has failed, or rejects the token request of the NFc.

[0290] In this embodiment of the present application, the certificate of the NFc obtained by the NRF may be the certificate of the NFc obtained by the NFR when the NRF establishes a transport layer link to the NFc, may be a certificate of the NFc pre-configured in the NRF, or may be a certificate of the NFc carried in the token request.

[0291] S1502: The NRF determines that the first information matches the second information.

[0292] A specific implementation of the NRF determining whether the first information matches the second information in S1502 by verification is as follows: 402 It can be understood that the specific implementation is similar to that of S402. Please refer to the related description of S402.

[0293] S1503: The NRF transmits the token to the NFc, and the NFc receives the token.

[0294] Specifically, before sending the token to the NFc, the NRF generates a token carrying the certificate and the first NF instance ID.

[0295] S1504: The NFc transmits a service request to the SCP, and the SCP receives the service request.

[0296] Specifically, the service request carries the token and assertion of the NFc, where the assertion includes the certificate of the NFc. After receiving the service request, the SCP may determine the first FQDN and the third NF instance ID associated with the certificate, and perform S1505 to determine whether the first FQDN matches the third NF instance ID. If it determines that the first FQDN matches the third NF instance ID, the SCP continues to perform S1506. If it determines that the first FQDN does not match the third NF instance ID, the SCP returns an indication to the NFc that the service request has failed.

[0297] S1505: The SCP determines that the first FQDN matches the third NF instance ID.

[0298] It can be understood that the specific implementation of the SCP determining that the first FQDN matches the third NF instance ID in S1505 is similar to the specific implementation of S902, and the details will not be described again here.

[0299] S1506: The SCP transmits a service request to the NFp, and the NFp receives the service request.

[0300] Specifically, the service request carries an assertion and a token of NFc, where the token carries a first NF instance ID and the assertion carries a second NF instance ID.

[0301] S1507: The NFp determines whether the first NF instance ID is the same as the second NF instance ID.

[0302] Specifically, after receiving the service request, the NFp determines whether the first NF instance ID is the same as the second NF instance ID through verification. If the first NF instance ID is the same as the second NF instance ID, the NFp executes S1508 and returns a service response to the NFc through the SCP. If the first NF instance ID is different from the second NF instance ID, the NFp returns information indicating that the service request has failed to the NFc through the SCP.

[0303] It can be understood that the specific implementation of the NFp determining whether the first NF instance ID is the same as the second NF instance ID in S1508 by verification is similar to the specific implementation of S702, and the details will not be described again here.

[0304] S1508: The NFp returns the service response to the NFc via the SCP, and the NFc receives the service response via the SCP.

[0305] It can be understood that the specific implementation of S1508 is similar to the specific implementation of S703A, and the details will not be described again here.

[0306] In the technical solution shown in FIG. 15, the NRF verifies a correspondence relationship between the first information carried in the token request from the NFc and the second information in the certificate, the SCP verifies a correspondence relationship between the first FQDN and the third NF instance ID associated with the certificate in the assertion carried in the service request from the NFc, and the NF p The NRF verifies the correspondence between the first NF instance ID in the token of the NFc and the second NF instance ID in the assertion carried in the service request from the SCP. This effectively prevents the case where an attacker illegally steals a token, forges an assertion, and even illegally obtains an NF service. Furthermore, the NRF can also verify the validity of parameters of the NFc whose profile is not held in the NRF. This can effectively improve the security of using the NF service in this embodiment of the present application.

[0307] Certainly, in practical applications, in addition to the above three examples, there may be many other combined solutions, which are not listed one by one here.

[0308] In order to better understand the above solution of the embodiment of the present application, some NF instance IDs in the above embodiment of the present application are further classified here: the first NF instance ID is the NF instance ID carried in the token request of NFc or the NF instance ID in the token, the second NF instance ID is the NF instance ID carried in the assertion of NFc, and the third NF instance ID is the NF instance ID carried in the assertion of NFc.

[0309] It should be noted that in addition to the information listed in the embodiments of the present application, messages such as a token request, a token, a service request, or a service response in the embodiments of the present application may further include other information, which is not limited in the present application.

[0310] In an application scenario where an NFc subscribes to an NF service from an NFc, some attackers may carry an illegal URI in a subscription request to illegally obtain notification information of the NF service. As a result, the network information of the NF service will be disclosed. In view of this, an embodiment of the present application further provides a service authentication method. See Figure 16. The method includes the following steps:

[0311] S1601: The NFc sends a subscription request to the NFp, and the NFp receives the subscription request.

[0312] In a possible implementation, the subscription request carries a first URI of the NFc and a certificate of the NFc, the certificate including a second URI. In this case, the NFp may obtain the first URI and the second URI from the subscription request.

[0313] In another possible implementation, the subscription request carries the first URI of the NFc, and the NFp obtains the certificate of the NFc in other ways, for example from the transport layer, and then obtains the second URI from the certificate of the NFc. In this case, the NFp may also obtain the first URI and the second URI.

[0314] S1602: The NFp determines, through verification, whether the first URI matches the second URI in the certificate.

[0315] Specifically, the process of the NFp determining whether the first URI matches the second URI through verification may specifically include determining that the first URI matches the second URI, or determining that the first URI is a subset of the second URI. For example, if the first URI is "##8888" and the second URI is also "##8888", the NFp determines that the first URI matches the second URI. As another example, if the first URI is "123" and the second URI is {123,456}, and the first NF URI is a subset of the second NF URI, the NFp determines that the first NF URI matches the second NF URI. If the NFp determines that the first URI matches the second URI, the NFp executes S1603A. If the NFp determines that the first URI does not match the second URI, the NFp executes S1603B.

[0316] S1603A: The NFp returns first response information to the NFc, and the NFc receives the first response information, which indicates that the subscription request of the NFc has been successful or that the NFp has accepted the subscription request.

[0317] Specifically, after agreeing to the subscription request sent by the NFc, the NFp may send a notification message regarding the NF services supported by the NFp to the NFc based on a preset periodicity.

[0318] S1603B: The NFp returns second response information to the NFc, and the NFc receives the second response information, which indicates that the subscription request of the NFc has failed or that the NFp has rejected the subscription request.

[0319] In the embodiment shown in Figure 16, the NFp determines through verification whether the first URI in the first information of the NFc carried in the subscription request matches the second URI in the transport layer certificate of the NFc, thereby effectively avoiding the case where the NFc illegally carries an illegal URI in the subscription request to illegally obtain network information, which effectively avoids the network information of the NF service being circumvented.

[0320] Above, the service authentication method provided in the embodiment of the present application has been described with reference to Figures 4 to 16. Hereinafter, the apparatus provided in the embodiment of the present application will be described with reference to Figures 17, 18, and 19.

[0321] Based on the same technical concept, the embodiment of the present application further provides a communication device 1700. The device 1700 has a function for implementing the NRF in the above method example. For example, the device 1700 includes corresponding modules, units, or means for performing steps performed by the NRF in the embodiment shown in Fig. 10. The functions, units, or means may be implemented by software, or may be implemented by hardware, or may be implemented by hardware by executing corresponding software.

[0322] See, for example, FIG. 17. The device 1700 includes: a transceiver unit 1701 configured to receive a first token request from a first network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; a processing unit 1702 configured to determine whether the first information matches the second information by verifying, and to generate a token after determining that the first information matches the second information; wherein the transceiver unit 1701 is further configured to transmit the token to the first network element.

[0323] It should be understood that all the relevant contents of the steps in the above method embodiments may be cited in the functional descriptions of the corresponding functional modules, and the details will not be described again here.

[0324] Based on the same technical concept, the embodiment of the present application further provides a communication device 1800. The device 1800 has a function of implementing the first network element in the above method example. For example, the device 1800 includes corresponding modules, units, or means for performing the steps performed by the first network element in the embodiment shown in Figure 7. The functions, units, or means may be implemented by software, or may be implemented by hardware, or may be implemented by hardware by executing corresponding software.

[0325] See, for example, FIG. a processing unit 1808 configured to generate a first token request, the first token request including first information of the network function service consumer entity and an assertion of the network function service consumer entity, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity; a transceiver unit 1802 configured to send a first token request to the network repository function network element and to receive a token from the network repository function network element; may include:

[0326] It should be understood that all the relevant contents of the steps in the above method embodiments may be cited in the functional descriptions of the corresponding functional modules, and the details will not be described again here.

[0327] Based on the same technical concept, the embodiment of the present application further provides a communication device 1900. The device 1900 has a function for implementing the NFp in the above method example. For example, the device 1900 includes corresponding modules, units, or means for executing steps performed by the NFp in the embodiment shown in Fig. 7. The functions, units, or means may be implemented by software, or may be implemented by hardware, or may be implemented by hardware by executing corresponding software.

[0328] See, for example, FIG. 19. The device 1900 includes: a transceiver unit 1901 configured to receive a first service request from a first network element, the first service request including a token and an assertion, the token including a first network function instance identifier and the assertion including a second network function instance identifier; a processing unit 1902 configured to determine whether the first network function instance identifier matches the second network function instance identifier by verifying, and to provide a service to the network function service consumer entity after determining that the first network function instance identifier matches the second network function instance identifier; may include:

[0329] It should be understood that all the relevant contents of the steps in the above method embodiments may be cited in the functional descriptions of the corresponding functional modules, and the details will not be described again here.

[0330] Based on the same technical concept, the embodiment of the present application further provides an electronic device 2000 configured to implement the method of the embodiment shown in FIG.

[0331] As shown in Fig. 20, an electronic device 2000 may include a processor 2001 configured to execute programs or instructions stored in a memory 2002. When the programs or instructions stored in the memory 2002 are executed, the processor is configured to perform the methods of the embodiments shown in Figs.

[0332] Optionally, the electronic device 2000 may further include a communication interface 2003. In FIG.

[0333] The number of processors 2001, memories 2002, and communication interfaces 2003 does not constitute a limitation for this embodiment of the present application, and may be randomly configured based on service requirements during specific implementation.

[0334] Optionally, the memory 2022 is located external to the electronic device 2000 .

[0335] Optionally, the electronic device 2000 includes a memory 2002 coupled to the at least one processor 2001, the memory 2002 storing instructions that can be executed by the at least one processor 2001. In FIG. 20, the memory 2002 is represented by a dashed line and is optional for the electronic device 2000.

[0336] The processor 2001 and the memory 2002 may be coupled through an interface circuit, or may be integrated together, which is not limited here.

[0337] The specific connection medium between the processor 2001, the memory 2002, and the communication interface 2003 is not limited in this embodiment of the present application. In this embodiment of the present application, the processor 2001, the memory 2002, and the communication interface 2003 are connected through a bus 2004 in FIG. 20. The bus is represented by using a thick line in FIG. 20. The connection manner between the other components is only an example for description and is not limited thereto. The bus may be classified as an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is for representing a bus in FIG. 20, but does not mean that there is only one bus or only one type of bus.

[0338] It should be understood that the processor described in the embodiments of the present application may be implemented by hardware or software. When the processor is implemented by using hardware, the processor may be a logic circuit, an integrated circuit, etc. When the processor is implemented by using software, the processor may be a general-purpose processor and is implemented by reading the software code stored in a memory.

[0339] For example, the processor may be a Central Processing Unit (CPU) or other general purpose processor, a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The general purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.

[0340] It may be understood that the memory described in the embodiments of the present application may be volatile or non-volatile memory, or may include volatile and non-volatile memory. The non-volatile memory may be a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), or a flash memory. The volatile memory may be a Random Access Memory (RAM) used as an external cache. By way of example, and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DRAM), and the like. RateSDRAM, DDR SDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM) may be used.

[0341] It should be noted that when the processor is a general purpose processor, a DSP, an ASIC, an FPGA, other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, the memory (storage medium) may be integrated into the processor.

[0342] It should be noted that memory as described herein is intended to include, without being limited to, these and any other suitable types of memory.

[0343] Based on the same technical concept, the embodiment of the present application further provides a computer-readable storage medium including a program or instruction. When the program or instruction is executed by a computer, the method performed by the NRF, the method performed by the first network element, or the method performed by the NFp in the above method example is executed.

[0344] Based on the same technical concept, an embodiment of the present application further provides a chip, which is coupled to a memory and configured to read and execute program instructions stored in the memory, thereby performing the method performed by the NRF, the method performed by the first network element, or the method performed by the NFp in the above method examples.

[0345] Based on the same technical concept, an embodiment of the present application further provides computer program instructions, which, when executed on a computer, execute the method performed by the NRF, the method performed by the first network element, or the method performed by the NFp in the above method examples.

[0346] The above embodiments may be combined with each other to achieve different technical effects.

[0347] Those skilled in the art should understand that the embodiments of the present application may be provided as a method, a system, or a computer program product. Thus, the present application may take the form of a hardware-only embodiment, a software-only embodiment, or an embodiment that combines software and hardware. Furthermore, the present application may take the form of a computer program product embodied in one or more computer usable storage media (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) that contain computer usable program code.

[0348] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that computer program instructions may be used to implement each process and / or each block of the flowcharts and / or block diagrams, and combinations of processes and / or blocks of the flowcharts and / or block diagrams. These computer program instructions may be provided to a processor of a general purpose computer, a special purpose computer, an embedded computer, or any other programmable data processing device to generate a machine, whereby the instructions executed by the processor or computer of any other programmable data processing device generate an apparatus that performs a particular function in one or more blocks of the block diagrams and / or in one or more processes of the flowcharts.

[0349] These computer program instructions may be stored in a computer readable memory that can instruct a computer or any other programmable data processing device to act in a particular manner, such that the instructions stored in the computer readable memory cause an artifact to be generated that includes an instruction apparatus that implements a particular function in one or more blocks of the block diagrams and / or in one or more processes of the flowcharts.

[0350] It is obvious that a person skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the scope of the embodiments of the present application. The present application intends to cover these modifications and variations, provided that they fall within the scope of protection defined by the following claims and their equivalent technologies.

[0351] [CROSS-REFERENCE TO RELATED APPLICATIONS] This application claims priority to Chinese Patent Application No. 202011197519.5, filed with the China Intellectual Property Office on October 30, 2020, entitled "SERVICE AUTHORIZATION METHOD, COMMUNICATION APPARATUS, AND SYSTEM." The earlier Chinese application is hereby incorporated by reference in its entirety.

Claims

1. receiving, by a network repository function network element, a token request from a network function service consumer entity, the token request carrying first information of the network function service consumer entity, the first information including a first network function type; obtaining, by the network repository function network element, a certificate of the network function service consumer entity, the certificate including second information, the second information including a second network function type; after determining through verification that the first network function type matches the second network function type, sending, by the network repository function network element, a token to the network function service consumer entity; The processing method according to claim 1,

2. The method comprises: and after determining upon verification that the first network function type does not match the second network function type, sending, by the network repository function network element, a non-success response to the network function service consumer entity. The method of claim 1.

3. The method comprises: receiving, by a network function service provider entity, a service request from the network function service consumer entity, the service request including the token and an assertion, the token including a first NF instance ID and the assertion including a second NF instance ID; sending, by the network function service provider entity, a service response to the network function service consumer entity after determining through verification that the first NF instance ID matches the second NF instance ID; Further comprising The method according to claim 1 or 2.

4. The method comprises: and if verification determines that the first NF instance ID does not match the second NF instance ID, sending, by the network function service provider entity, a non-success response to the network function service consumer entity. The method according to claim 3.

5. If verification by the network repository function network element determines that the first network function type matches the second network function type, the method further comprises generating the token.

5. The method according to any one of claims 1 to 4.

6. a transceiver unit configured to receive a token request from a network function service consumer entity, the token request carrying first information of the network function service consumer entity, the first information including a first network function type; a processing unit configured to obtain a certificate of the network capability service consumer entity, the certificate including second information, the second information including a second network capability type, and to determine by verification whether the first network capability type matches the second network capability type; having the transceiver unit is further configured to transmit a token to the network capability service consumer entity after verification determines that the first network capability type matches the second network capability type. Communications equipment.

7. the transceiver unit is further configured to, when the processing unit determines through verification that the first network capability type does not match the second network capability type, send a non-success response to the network capability service consumer entity.

7. The apparatus of claim 6.

8. After verifying that the first network capability type matches the second network capability type, the processing unit is further configured to generate the token.

8. Apparatus according to claim 6 or 7.

9. sending, by a first network element, a first token request to a network repository function network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the first information including a first network function type, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity, the second information including a second network function type; receiving the first token request by the network repository function network element, determining through verification whether the first network function type matches the second network function type, and after determining that the first network function type matches the second network function type, generating a token and sending the token to the first network element; receiving the token by the first network element; A service authentication method comprising the steps of:

10. The method comprises: sending, by the first network element after receiving the token, a first service request to a network function service provider entity, the first service request for requesting the network function service provider entity to provide a service to the network function service consumer entity, the first service request including the token and the assertion, the token including a first network function instance identifier and the assertion further including a second network function instance identifier; receiving the first service request by the network function service provider entity, determining by verification whether the first network function instance identifier is the same as the second network function instance identifier, and providing the service to the network function service consumer entity after determining that the first network function instance identifier is the same as the second network function instance identifier; Further comprising 10. The method of claim 9.

11. the first network element is a service communication proxy network element; Prior to sending, by the first network element, the first token request to the network repository function network element, the method further comprising: receiving, by the service communication proxy network element, a second token request or a second service request from the network function service consumer entity, the second token request or the second service request including the certificate; obtaining, by the service communication proxy network element, a first fully qualified domain name (FQDN) and a third network function instance identifier associated with the certificate, and determining that the first FQDN matches the third network function instance identifier; Further comprising 11. The method according to claim 9 or 10.

12. the first network element is the network function service consumer entity; Sending the first service request by the first network element to the network function service provider entity includes: sending, by the network function service consumer entity, the first service request to the network function service provider entity by using a service communication proxy network element, the first service request including the certificate; receiving, by the service communication proxy network element, the first service request from the first network element; obtaining, after receiving the first service request, a first fully qualified domain name (FQDN) and a third network function instance identifier associated with the certificate; and, after determining that the first FQDN matches the third network function instance identifier, sending the first service request to the network function service provider entity; having The method of claim 10.

13. After receiving the first token request by the network repository function network element and prior to transmitting the token to the first network element, the method further comprises: obtaining, by the network repository function network element, the first fully qualified domain name (FQDN) and the third network function instance identifier associated with the certificate, and determining that the first FQDN matches the third network function instance identifier and that the first network function type matches the second network function type.

13. The method according to claim 11 or 12.

14. determining, by the network repository function network element, whether the first network function type matches the second network function type by verifying, determining that the first network capability type matches the second network capability type if the first network capability type is the same as the second network capability type; or determining that the first network capability type matches the second network capability type if the first network capability type is a subset of the second network capability type; having 14. The method according to any one of claims 9 to 13.

15. A service authentication method applied to a network repository function network element, comprising: receiving a first token request from a first network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the first information including a first network function type, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity, the second information including a second network function type; determining whether the first network function type matches the second network function type by verifying, and after determining that the first network function type matches the second network function type, generating a token and sending the token to the first network element; The method according to claim 1,

16. After receiving the first token request and prior to transmitting the token to the first network element, the method includes: obtaining a first FQDN and a third network function instance identifier associated with the certificate; determining that the first FQDN matches the third network function instance identifier and that the first network function type matches the second network function type; Further comprising The method of claim 15.

17. Determining whether the first network capability type matches the second network capability type by verifying includes: determining that the first network capability type matches the second network capability type if the first network capability type is the same as the second network capability type; or determining that the first network capability type matches the second network capability type if the first network capability type is a subset of the second network capability type; having 17. The method according to claim 15 or 16.

18. A service authentication method applied to a first network element, comprising: sending a first token request to a network repository function network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the first information including a first network function type, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity, the second information including a second network function type; receiving a token from the network repository function network element; The method according to claim 1,

19. After receiving the token, the method comprises: sending a first service request to a network function service provider entity, the first service request including the token and the assertion, the token including a first network function instance identifier and the assertion further including a second network function instance identifier; the first service request is for requesting the network function service provider entity to provide a service to the network function service consumer entity.

20. The method of claim 18.

20. the first network element is a service communication proxy network element; Prior to sending the first token request to the network repository function network element, the method further comprising: receiving a second token request or a second service request from the network function service consumer entity, the second token request or the second service request including the certificate; obtaining a first fully qualified domain name (FQDN) and a third network function instance identifier associated with the certificate; determining that the first FQDN matches the third network function instance identifier; Further comprising 20. The method of claim 18 or 19.

21. a transceiver unit configured to receive a first token request from a first network element, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the first information including a first network function type, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity, the second information including a second network function type; and a processing unit configured to determine, by verification, whether the first network capability type matches the second network capability type, and generate a token after determining that the first network capability type matches the second network capability type; having the transceiver unit is further configured to transmit the token to the first network element. Communications equipment.

22. After the transceiver unit receives the first token request and before the transceiver unit transmits the token to the first network element, the processing unit: Obtaining a first FQDN and a third network function instance identifier associated with the certificate; determining that the first FQDN matches the third network function instance identifier and that the first network function type matches the second network function type; further comprising:

22. The apparatus of claim 21.

23. When configured to determine by verification whether the first network capability type matches the second network capability type, the processing unit: determining that the first network capability type matches the second network capability type if the first network capability type is the same as the second network capability type; or determining that the first network capability type matches the second network capability type if the first network capability type is a subset of the second network capability type; Specifically configured to 23. Apparatus according to claim 21 or 22.

24. a processing unit configured to generate a first token request, the first token request including first information of a network function service consumer entity and an assertion of the network function service consumer entity, the first information including a first network function type, the assertion including a certificate of the network function service consumer entity, the certificate including second information of the network function service consumer entity, the second information including a second network function type; and a transceiver unit configured to send the first token request to a network repository function network element and to receive a token from the network repository function network element; A communication device having the above configuration.

25. After receiving the token, the transceiver unit: and further configured to send a first service request to a network function service provider entity, the first service request including the token and the assertion, the token including a first network function instance identifier and the assertion further including a second network function instance identifier; the first service request is for requesting the network function service provider entity to provide a service to the network function service consumer entity.

25. The apparatus of claim 24.

26. the communication device is a service communication proxy network element; Prior to sending the first token request to the network repository function network element, the transceiver unit: and further configured to receive a second token request or a second service request from the network function service consumer entity, the second token request or the second service request including the certificate; The processing unit is further configured to obtain a first fully qualified domain name (FQDN) and a third network function instance identifier associated with the certificate, and determine that the first FQDN matches the third network function instance identifier.

26. Apparatus according to claim 24 or 25.

27. having a program or instructions; When the program or the instructions are executed on a computer, the method according to any one of claims 1 to 5, claims 15 to 17 or claims 18 to 20 is performed. A computer-readable storage medium.

28. A chip coupled to a memory and configured to read and execute program instructions stored in the memory to perform a method according to any one of claims 1 to 5, claims 15 to 17 or claims 18 to 20.

Images