Network function management method and communication apparatus

Abstract

Embodiments of the present application provide a network function (NF) management method and a communication apparatus. The method comprises: a first device receives information of a second device, wherein the first device is a device in a blockchain, the second device is an NF entity, and the first device is used for performing automated management on the second device by using a smart contract; and the first device writes the information of the second device into the blockchain. Therefore, on the basis of the blockchain technology, NF instances and services thereof in network deployment are discovered by means of a decentralized mechanism, and the discovery process of the NF instances and the services thereof is implemented in a distributed manner without affecting identity authentication or security, so that the system architecture is safer and simpler, and maintenance is more convenient.

Description

Network function management method and communication device Technical Field

[0001] The present application relates to the field of wireless communication technology, and more specifically, to a network function (NF) management method and a communication device. Background Art

[0002] Currently, the fifth-generation core network (5GC) has achieved service-oriented decoupling, resulting in more sophisticated NFs (network function services) (NFS). While this network gains agility, it also increases management complexity. To address this, the 3rd Generation Partnership Project (3GPP) defines a network repository function (NRF) to automatically manage all NFs, including registration, discovery, and status monitoring. Upon commencing operation, an NF proactively reports its NFS information to the NRF and uses it to locate its peer NFS. In 5GC networks, a centralized NRF architecture is often employed, with multiple NRFs interconnected. However, with this centralized architecture, if one NRF fails or is attacked, all NFs managed by that NRF (or all NFs registered with it) are at risk of loss or tampering, exposing them to the risk of single points of failure or attack. Furthermore, the need for coordinated configuration of multiple NRFs complicates configuration.

[0003] Therefore, building a concise and secure system architecture for NF instances and their services is an urgent problem to be solved.

[0004] Summary of the Invention

[0005] The embodiments of the present application provide a NF management method that uses a decentralized mechanism to discover NF instances and their services in the network. This method implements the NF instance and service discovery process in a distributed manner without compromising identity authentication or security, making the system architecture more secure and simpler, and making maintenance more convenient.

[0006] In a first aspect, a method for managing a NF is provided. The method may be executed by a first device, or by a component of the first device (e.g., a chip or circuit), without limitation. For ease of description, the method is described below using the first device as an example.

[0007] The method may include: a first device receiving information of a second device, the first device being a device in a blockchain, the second device being a network function entity, and the first device being used to automatically manage the second device using a smart contract; and the first device writing the information of the second device into the blockchain.

[0008] In the above solution, the first device writes the information of the second device into the blockchain, thereby implementing the NF instance and service discovery process in a distributed manner through a decentralized mechanism without affecting authentication or security, making the system architecture safer and simpler, and maintenance more convenient.

[0009] In one possible implementation, automated management of the second device includes any of the following: opening an account for the second device, registering the second device, discovering the target device of the second device, subscribing and notifying the target subscription device of the second device, and remotely certifying the second device.

[0010] In one possible implementation, the information of the second device includes registration information and signature information, wherein the signature information is a signature of the information of the second device using the private key of the second device, and the information of the second device is used to register the second device. The method also includes: the first device uses the acquired public key of the second device to verify the signature information; wherein the first device writes the information of the second device into the blockchain, including: when the first device successfully verifies the signature information, the first device writes the registration information into the blockchain, and the registration information includes the area to which the second device belongs, the identifier of the blockchain, the identifier of the second device, the type of the second device, the status of the second device, and at least one of the following information: the full address domain name of the second device, the address of the second device, the operator to which the second device belongs, the services that the second device can support, and special registration parameters for the second device type.

[0011] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, NF registration can effectively avoid single point failure or single point attack problems, making NF management safer and more convenient without affecting identity authentication or security.

[0012] In a possible implementation, after the second device is registered, the information of the second device includes an identifier of the second device and updated registration information and signature information.

[0013] In one possible implementation, the information of the second device includes a status of the second device, and the status of the second device is undiscoverable; wherein the first device writes the information of the second device into the blockchain, including: the first device writes the status of the second device as undiscoverable into the blockchain.

[0014] In the above solution, based on the use of blockchain technology to discover NF instances in the network and the network architecture of their services, the status of NFs is managed, which can effectively avoid the problems of single point failure or single point attack, making the management of NFs safer and more convenient without affecting identity authentication or security.

[0015] In one possible implementation, the information of the second device includes the public key of the second device, the identifier of the second device, and the measurement reference value of the second device; wherein, the first device receives the information of the second device, including: the first device receives the information of the second device from the network management device, and the information of the second device is used to open an account for the second device.

[0016] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, and open accounts for NFs, it can effectively avoid the problem of single point failure or single point attack, making the management of NFs safer and more convenient without affecting identity authentication or security.

[0017] In one possible implementation, the information of the second device includes query information, and the information of the second device is used to discover the target device of the second device. The method also includes: the first device queries the target device based on the query information; the first device sends the address of the target device and the public key of the target device; wherein the query information includes at least one of the following information: the region to which the device belongs, the identifier of the blockchain, the type of device, the address of the device, the operator to which the device belongs, the name of the service that the device can support, and the device's dedicated filtering parameters.

[0018] In the above solution, based on the use of blockchain technology to discover NF instances and the network architecture they serve, the target devices of NF are discovered, which can effectively avoid the problem of single point failure or single point attack, making the management of NF safer and more convenient without affecting identity authentication or security.

[0019] In one possible implementation, the information of the second device includes an identifier of the second device and target subscription device parameters, and the information of the second device is used to subscribe to the target subscription device of the second device, wherein the target subscription device parameters include at least one of the following information: the region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, a list of services that the target subscription device can support, and dedicated registration parameters for the target subscription device type.

[0020] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, subscribing to the target subscription devices of the NF can effectively avoid the problem of single point failure or single point attack, making the management of NF safer and more convenient without affecting identity authentication or security.

[0021] In one possible implementation, when the first device determines that the target subscription device parameters have changed, the method further includes: the first device sends notification information, the notification information is used to indicate that the target subscription device parameters have changed, and the notification information includes the identifier of the target subscription device and the changed field in the target subscription device parameters.

[0022] In the above solution, when the target subscription device of the NF changes (for example, the information of the target subscription device in the blockchain changes or is added), the first device can promptly notify the NF.

[0023] In one possible implementation, the information of the second device is the certification response information encrypted by the second device using the private key of the second device, the certification response information includes a first random number and the measurement value of the second device, and the information of the second device is used to remotely certify the second device; before the first device receives the information of the second device, the method also includes: the first device obtains the public key of the second device; the first device sends remote certification request information encrypted by the public key of the second device to the second device, and the remote certification request information includes a second random number.

[0024] In one possible implementation, the first device writes information of the second device into the blockchain, including: the first device decrypts the proof response information using the public key of the second device to obtain a first random number and a measurement value of the second device; the first device measures the first random number and the second random number, as well as the measurement reference value and the measurement value of the second device stored in the first device, and writes the measurement results into the blockchain.

[0025] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, remote attestation of NF can effectively avoid the problem of single point failure or single point attack, making the management of NF safer and more convenient without affecting identity authentication or security.

[0026] In one possible implementation, the first device writes the information of the second device into the blockchain, including: the first device writes the information of the second device into the blockchain in the following data format: data initiator, data recipient, data transaction type, timestamp, blockchain identifier, time limit, data transaction content, and data signature; wherein the data transaction type includes any one of the following: account opening of the second device, registration of the second device, discovery of the target device of the second device, subscription and notification of the target subscription device of the second device, and remote certification of the second device.

[0027] In one possible implementation, the method further includes: the first device sending a response message, where the response message is used to indicate that the first device has successfully received the information of the second device, or is used to indicate that the information of the second device has been written into the blockchain.

[0028] In a second aspect, a method for managing an NF is provided. The method can be executed by a second device, or by a component of the second device (e.g., a chip or circuit), without limitation. For ease of description, the method is described below using the second device as an example.

[0029] The method may include: the second device determines the information of the second device; the second device sends the information of the second device to the first device, the first device is a device in the blockchain, the second device is a network function entity, and the first device is used to automatically manage the second device using a smart contract.

[0030] In the above scheme, the second device sends its own information to the first device (the device in the blockchain) so that the first device can write the corresponding information into the blockchain. In this way, through the decentralized mechanism, the NF instance and service discovery process can be distributed without affecting authentication or security, making the system architecture safer and simpler, and maintenance more convenient.

[0031] In one possible implementation, automated management of the second device includes any of the following: opening an account for the second device, registering the second device, discovering the target device of the second device, subscribing and notifying the target subscription device of the second device, and remotely certifying the second device.

[0032] In one possible implementation, the information of the second device includes registration information and signature information, and the information of the second device is used to register the second device, wherein the signature information is a signature of the information of the second device using the private key of the second device, and the registration information includes the region to which the second device belongs, the identifier of the blockchain, the identifier of the second device, the type of the second device, the status of the second device, and at least one of the following information: the full address domain name of the second device, the address of the second device, the operator to which the second device belongs, the services that the second device can support, and special registration parameters for the second device type.

[0033] In a possible implementation, after the second device is registered, the information of the second device includes an identifier of the second device and updated registration information and signature information.

[0034] In a possible implementation manner, the information of the second device includes a status of the second device, and the status of the second device is undiscoverable.

[0035] In one possible implementation, the information of the second device includes query information, and the information of the second device is used to discover the target device of the second device. The query information includes at least one of the following information: the region to which the device belongs, the identifier of the blockchain, the type of device, the address of the device, the operator to which the device belongs, the name of the service that the device can support, and the dedicated filtering parameters of the device; wherein the response information includes the address of the device and the public key of the device.

[0036] In one possible implementation, the information of the second device includes an identifier of the second device and target subscription device parameters, and the information of the second device is used to subscribe to the target subscription device of the second device, wherein the target subscription device parameters include at least one of the following information: the region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, a list of services that the target subscription device can support, and dedicated registration parameters for the target subscription device type.

[0037] In a possible implementation manner, the method further includes: the second device receiving notification information from the first device, the notification information being used to indicate a change in a target subscription device parameter, the notification information including an identifier of the target subscription device and a changed field in the target subscription device parameter.

[0038] In one possible implementation, the information of the second device is the proof response information encrypted by the second device using the private key of the second device, the proof response information includes a first random number and a measurement value of the second device, and the information of the second device is used to remotely prove the second device; before the second device sends the information of the second device to the first device, the method also includes: the second device receives the remote proof request information encrypted by the public key of the second device from the first device using the second device, and the remote proof request information includes a second random number.

[0039] In one possible implementation, the second device receives response information, where the response information is used to indicate that the first device has successfully received the information of the second device, or is used to indicate that the information of the second device has been written into the blockchain.

[0040] The beneficial effects corresponding to the method provided in the second aspect can refer to the beneficial effects corresponding to the method shown in the first aspect, and will not be repeated here.

[0041] According to a third aspect, a communication system is provided, comprising: a second device sending information of the second device to a first device, the first device being a device in a blockchain, the second device being a network function entity, and the first device being used to automatically manage the second device using a smart contract; the first device writing the information of the second device into the blockchain; and the first device sending response information to the second device, the response information being used to indicate that the information of the second device has been written into the blockchain.

[0042] In the above solution, the first device writes the information of the second device into the blockchain, thereby implementing the NF instance and service discovery process in a distributed manner through a decentralized mechanism without affecting authentication or security, making the system architecture safer and simpler, and maintenance more convenient.

[0043] In a fourth aspect, a communication device is provided, comprising a unit for executing the method shown in the first aspect above. The communication device may be a first device, or may be executed by a chip or circuit provided in the first device. This application does not limit this.

[0044] The communication device comprises:

[0045] The transceiver unit is used to receive information from the second device, the communication device is a device in the blockchain, the second device is a network function entity, and the communication device is used to automatically manage the second device using a smart contract; the processing unit is used to write the information of the second device into the blockchain.

[0046] In one possible implementation, automated management of the second device includes any of the following: opening an account for the second device, registering the second device, discovering the target device of the second device, subscribing and notifying the target subscription device of the second device, and remotely certifying the second device.

[0047] In one possible implementation, the information of the second device includes registration information and signature information, wherein the signature information is a signature of the information of the second device using the private key of the second device, and the information of the second device is used to register the second device. The processing unit is further used to verify the signature information using the obtained public key of the second device; when the communication device successfully verifies the signature information, the processing unit is further used to write the registration information into the blockchain, and the registration information includes the area to which the second device belongs, the identifier of the blockchain, the identifier of the second device, the type of the second device, the status of the second device, and at least one of the following information: the full address domain name of the second device, the address of the second device, the operator to which the second device belongs, the services that the second device can support, and special registration parameters for the second device type.

[0048] In a possible implementation, after the second device is registered, the information of the second device includes an identifier of the second device and updated registration information and signature information.

[0049] In one possible implementation, the information of the second device includes a status of the second device, and the status of the second device is undiscoverable; the processing unit is further configured to write the status of the second device as undiscoverable into the blockchain.

[0050] In one possible implementation, the information of the second device includes the public key of the second device, the identifier of the second device, and the measurement reference value of the second device; the transceiver unit is also used to receive information about the second device from the network management device, and the information of the second device is used to open an account for the second device.

[0051] In one possible implementation, the information of the second device includes query information, and the information of the second device is used to discover the target device of the second device. The processing unit is further used to query the target device based on the query information; the transceiver unit is further used to send the address of the target device and the public key of the target device; wherein the query information includes at least one of the following information: the region to which the device belongs, the identifier of the blockchain, the type of device, the address of the device, the operator to which the device belongs, the name of the service that the device can support, and the device's dedicated filtering parameters.

[0052] In one possible implementation, the information of the second device includes an identifier of the second device and target subscription device parameters, and the information of the second device is used to subscribe to the target subscription device of the second device, wherein the target subscription device parameters include at least one of the following information: the region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, a list of services that the target subscription device can support, and dedicated registration parameters for the target subscription device type.

[0053] In one possible implementation, when the communication device determines that the parameters of the target subscription device have changed, the transceiver unit is further used to send notification information, which is used to indicate that the parameters of the target subscription device have changed. The notification information includes the identifier of the target subscription device and the changed fields in the parameters of the target subscription device.

[0054] In one possible implementation, the information of the second device is the proof response information encrypted by the second device using the private key of the second device, the proof response information includes a first random number and the measurement value of the second device, and the information of the second device is used to remotely prove the second device; the processing unit is also used to obtain the public key of the second device; the transceiver unit is also used to send remote proof request information encrypted by the public key of the second device to the second device, and the remote proof request information includes a second random number.

[0055] In one possible implementation, the processing unit is further used to decrypt the proof response information using the public key of the second device to obtain the first random number and the measurement value of the second device; the processing unit is further used to measure the first random number and the second random number, as well as the measurement reference value of the second device and the measurement value of the second device stored in the first device, and write the measurement results into the blockchain.

[0056] In one possible implementation, the processing unit is further configured to write information of the second device into the blockchain in the following data format: data initiator, data recipient, data transaction type, timestamp, blockchain identifier, timeliness, data transaction content, and data signature;

[0057] The data transaction type includes any one of the following: account opening for the second device, registration of the second device, discovery of the target device of the second device, subscription and notification of the target subscription device of the second device, and remote certification of the second device.

[0058] In one possible implementation, the transceiver unit is further configured to send a response message, where the response message is configured to indicate that the information of the second device has been written into the blockchain.

[0059] The explanation and beneficial effects of the communication device-related contents provided in the fourth aspect can refer to the method shown in the first aspect and will not be repeated here.

[0060] In the fifth aspect, a communication device is provided, comprising a unit for executing the method shown in the second aspect above. The communication device may be a second device, or may be executed by a chip or circuit provided in the second device. This application does not limit this.

[0061] The communication device comprises:

[0062] A processing unit is used to determine information about a communication device; a transceiver unit is used to send information about the communication device to a first device, where the first device is a device in a blockchain, the communication device is a network functional entity, and the first device is used to automatically manage the communication device using a smart contract.

[0063] In one possible implementation, automated management of communication devices includes any of the following: opening an account for a communication device, registering a communication device, discovering a target device for the communication device, subscribing to and notifying a target subscription device for the communication device, and remotely certifying the communication device.

[0064] In one possible implementation, the information of the communication device includes registration information and signature information, and the information of the communication device is used to register the communication device, wherein the signature information is a signature of the information of the communication device using the private key of the communication device, and the registration information includes the region to which the communication device belongs, the identifier of the blockchain, the identifier of the communication device, the type of the communication device, the status of the communication device, and at least one of the following information: the full address domain name of the communication device, the address of the communication device, the operator to which the communication device belongs, the services that the communication device can support, and special registration parameters for the type of communication device.

[0065] In a possible implementation manner, after the communication device is registered, the information of the communication device includes an identification of the communication device and updated registration information and signature information.

[0066] In a possible implementation manner, the information of the communication device includes a status of the communication device, and the status of the communication device is undiscoverable.

[0067] In one possible implementation, the information of the communication device includes query information, and the information of the communication device is used to discover the target device of the communication device. The query information includes at least one of the following information: the region to which the device belongs, the identifier of the blockchain, the type of device, the address of the device, the operator to which the device belongs, the name of the service that the device can support, and the dedicated filtering parameters of the device; wherein the response information includes the address of the device and the public key of the device.

[0068] In one possible implementation, the information of the communication device includes an identifier of the communication device and target subscription device parameters, and the information of the communication device is used to subscribe to the target subscription device of the communication device, wherein the target subscription device parameters include at least one of the following information: the region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, a list of services that the target subscription device can support, and dedicated registration parameters for the target subscription device type.

[0069] In a possible implementation manner, the transceiver unit is further configured to receive notification information from the first device, where the notification information is used to indicate a change in a target subscription device parameter, and the notification information includes an identifier of the target subscription device and a changed field in the target subscription device parameter.

[0070] In one possible implementation, the information of the communication device is the certification response information encrypted by the communication device using the private key of the communication device, the certification response information includes a first random number and a measurement value of the second device, and the information of the communication device is used to remotely certify the communication device; the transceiver unit is also used to receive remote certification request information from the first device encrypted using the public key of the communication device, the remote certification request information includes a second random number.

[0071] In one possible implementation, the transceiver unit is further used to receive response information, where the response information is used to indicate that the first device has successfully received the information of the communication device, or is used to indicate that the information of the communication device has been written into the blockchain.

[0072] The explanation and beneficial effects of the communication device-related contents provided in the fifth aspect can be referred to the method shown in the second aspect and will not be repeated here.

[0073] In a sixth aspect, a communication device is provided, which includes: a memory for storing programs; and at least one processor for executing computer programs or instructions stored in the memory to execute a method of any possible implementation of the first to third aspects above.

[0074] In one implementation, the apparatus is a first device.

[0075] In another implementation, the apparatus is a chip, a chip system, or a circuit used in the first device.

[0076] In a seventh aspect, the present application provides a processor for executing the methods provided in the above aspects.

[0077] For the operations such as sending and acquiring / receiving involved in the processor, unless otherwise specified, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be understood as processor output, reception, input and other operations, and can also be understood as sending and receiving operations performed by the radio frequency circuit and antenna. This application does not limit this.

[0078] In an eighth aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a method for executing any possible implementation of the first to third aspects above.

[0079] In a ninth aspect, a computer program product comprising instructions is provided, which, when run on a computer, enables the computer to execute a method according to any possible implementation method of the first to third aspects above.

[0080] In the tenth aspect, a chip is provided, which includes a processor and a communication interface. The processor reads instructions stored in a memory through the communication interface and executes a method of any possible implementation method of the above-mentioned first to third aspects.

[0081] Optionally, as an implementation method, the chip also includes a memory, in which a computer program or instruction is stored, and the processor is used to execute the computer program or instruction stored in the memory. When the computer program or instruction is executed, the processor is used to execute the method of any possible implementation method of the first to third aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] FIG1 shows a schematic diagram of a network architecture 100 applicable to an embodiment of the present application.

[0083] FIG2 shows a schematic flow chart of a NF management method 200 provided in an embodiment of the present application.

[0084] FIG3 shows a schematic flow chart of a NF management method 300 provided in an embodiment of the present application.

[0085] FIG4 shows a schematic flow chart of a NF management method 400 provided in an embodiment of the present application.

[0086] FIG5 shows a schematic flow chart of a NF management method 500 provided in an embodiment of the present application.

[0087] FIG6 shows a schematic flow chart of a NF management method 600 provided in an embodiment of the present application.

[0088] FIG7 shows a schematic block diagram of a communication device 700 provided in an embodiment of the present application.

[0089] FIG8 shows a schematic block diagram of another communication device 800 provided in an embodiment of the present application.

[0090] FIG9 shows a schematic diagram of a chip system 900 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0091] The technical solution in this application will be described below with reference to the accompanying drawings.

[0092] First, let’s briefly introduce the concepts of blockchain, smart contracts, etc. involved in the embodiments of this application.

[0093] 1. Blockchain

[0094] Blockchain technology implements a chained data structure that connects blocks of data and information in chronological order, using cryptographic methods to ensure tamper-proof and unforgeable distributed storage. Generally, the data and information in a blockchain are referred to as "transactions."

[0095] Blockchain technology is not a single technology, but a system that integrates technologies such as point-to-point transmission, consensus mechanism, distributed data storage and cryptographic principles. The system has the technical characteristics of full disclosure and tamper-proof.

[0096] First, peer-to-peer transmission: Nodes participating in the blockchain are independent and peer-to-peer, and data and information are synchronized between nodes using peer-to-peer transmission technology. Nodes can be different physical machines or different instances in the cloud.

[0097] Second, consensus mechanism: The blockchain consensus mechanism refers to the process by which multiple participating nodes, under pre-set logical rules, reach consensus on specific data and information through interaction. Consensus mechanisms rely on well-designed algorithms, resulting in variations in performance, latency, computing resources consumed, and transmission resources consumed.

[0098] Third, distributed data storage: Distributed storage in a blockchain means that each participating node stores independent and complete data, ensuring that data storage is fully transparent across nodes. Unlike traditional distributed data storage, which divides data into multiple copies for backup or synchronous storage according to specific rules, blockchain distributed data storage relies on consensus among independent, equal-status nodes within the blockchain to achieve highly consistent data storage.

[0099] Fourth, cryptographic principles: Blockchain is usually based on asymmetric encryption technology to achieve trusted information dissemination, verification, etc.

[0100] The concept of a "block" is to organize one or more data records into "blocks," the size of which can be customized based on the specific application scenario. A "chain" is a data structure that connects these blocks of data records in chronological order using hashing technology. In a blockchain, each block consists of a "block header" and a "block body." The "block body" contains the transaction records packaged into the block, while the "block header" contains the root hash of all transactions in the block and the hash of the previous block. The blockchain's data structure ensures that the data stored on the blockchain is tamper-proof.

[0101] 2. Smart Contracts

[0102] A smart contract is a collection of code and data, also known as a "programmable contract." Generally speaking, a smart contract is defined through program code and has pre-set execution conditions; actions are executed when these conditions are triggered. The "smart" in this contract refers to the execution intelligence; that is, if certain pre-set conditions are met, the contract automatically executes.

[0103] The technical solutions provided in this application can be applied to various communication systems, such as: fifth generation (5G) or new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The technical solutions provided in this application can also be applied to device to device (D2D) communication, vehicle-to-everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0104] Currently, 5GC networks have achieved service-oriented decoupling, with more refined NFs or NFSs. While the network gains agility, it also increases management complexity. To this end, 3GPP defines the NRF to be responsible for the automated management of all NFSs, including registration, discovery, and status detection. Upon startup, the NF proactively reports its NFS information to the NRF and uses the NRF to locate the peer NFS. In 5GC networks, a centralized NRF architecture is often used, with multiple NRFs interconnected. However, with this centralized architecture, if one NRF fails or is attacked, all NFs managed by that NRF (or all NFs registered with that NRF) are at risk of loss or tampering, exposing them to the risk of single points of failure or attack. Furthermore, the need for coordinated configuration of multiple NRFs complicates configuration.

[0105] This application proposes a NF management method based on blockchain technology. This method uses a decentralized mechanism to discover NF instances and their services in the network. Due to the technical characteristics of blockchain technology such as anti-tampering and security, the NF instance and service discovery process can be implemented in a distributed manner without affecting identity authentication or security, making the system architecture safer and simpler and maintenance more convenient.

[0106] The following describes a network architecture suitable for this application in conjunction with FIG1 .

[0107] As an example, FIG1 shows a schematic diagram of a network architecture 100 .

[0108] As shown in Figure 1, the network architecture 100 includes multiple block nodes (or blockchain nodes) and multiple NFs. Multiple block nodes constitute a blockchain (BC). Multiple NFs can be located in different areas. In Figure 1, area 1 includes NF1 and NF2, area 2 includes NF3 and NF4, area 3 includes NF5 and NF6, area 4 includes NF7 and NF8, area 9 includes NF9 and NF10, and area 6 includes NF11 and NF12. Each NF is directly connected to the blockchain. The block node connected to the NF in the blockchain can send the NF data to other nodes in the blockchain to achieve data sharing. It should be noted that in the embodiments of the present application, "node" and "device" have the same meaning.

[0109] Furthermore, blockchains lack centralized hardware or management. All nodes have equal rights and obligations, and the damage or loss of any one node does not affect the operation of the entire blockchain. Therefore, blockchains are decentralized. Data exchange between nodes in a blockchain does not require mutual trust. The operating rules of the entire blockchain are open and transparent, and all data content is public. Therefore, within the blockchain's rules and timeframe, nodes cannot and will not deceive each other, thus making blockchains trustless. The blockchain's overall data blocks are maintained by all nodes in the system with maintenance functions, and these maintenance nodes are open to anyone, thus exhibiting the characteristic of collective maintenance. Blockchains utilize a distributed database, ensuring that every participating node has a complete copy of the database. Unless a single node controls more than 51% of the nodes in the network, modifications to the database by a single node are invalid and cannot affect the data on other nodes. Therefore, blockchains possess a reliable database.

[0110] In this application, the block nodes in the blockchain can be private nodes, operator network nodes (for example, base station equipment, core network equipment, etc.), or stations deployed by certain industry organizations, groups and individuals.

[0111] In this application, NF can be a user plane function (UPF) network element, an access and mobility management function (AMF) network element, a session management function (SMF) network element, a network exposure function (NEF) network element, a policy control function (PCF) network element, a unified data management (UDM) network element, an application function (AF) network element, an authentication server function (AUSF) network element, a network slice selection function (NSSF) network element, etc., and this application is not limited to this. In this application, the UPF network element, AMF network element, SMF network element, NEF network element, PCF network element, UDM network element, AF network element, AUSF network element, and NSSF network element are respectively referred to as UPF, AMF, SMF, NEF, PCF, UDM, AF, AUSF, and NSSF.

[0112] The following is a brief description of the above network elements.

[0113] 1. UPF: The UPF primarily provides user-plane functions, including forwarding and processing user messages, connecting to the data network (DN), session anchoring, and quality of service (QoS) policy enforcement. For example, the UPF can receive user-plane data from the DN and send it to the terminal device via the access network (AN). The UPF can also receive user-plane data from the terminal device via the AN device and forward it to the DN.

[0114] 2. AMF: AMF is mainly used for access control, mobility management, attachment and detachment functions.

[0115] 3. SMF: SMF is mainly responsible for session management (such as session establishment, modification, and release), Internet Protocol (IP) address allocation and management, UPF selection and control, etc.

[0116] 4. NEF: NEF is mainly used to securely open the services and capabilities provided by 3GPP network functions to the outside world.

[0117] 5. PCF: PCF is mainly used to guide the unified policy framework of network behavior and provide policy rule information for control plane network elements (such as AMF, SMF, etc.).

[0118] 6. UDM: UDM is mainly used for UE contract data management, including the storage and management of UE identification, UE access authorization, etc.

[0119] 7. AF: AF is mainly used to provide services to the 3GPP network, such as interacting with PCF for policy control.

[0120] 8. AUSF: AUSF is mainly used for user authentication, etc., to implement 3GPP and non-3GPP access authentication.

[0121] 9. NSSF: NSSF is mainly used to determine the network slice instance that the UE is allowed to access based on the UE's slice selection auxiliary information, subscription information, etc.

[0122] It should be understood that the above-mentioned AMF, SMF, UPF, PCF, UDM, NEF, AF, AUSF, NSSF and other functions or network elements can be understood as network elements for implementing different functions, for example, they can be combined into network slices as needed. These network elements can be independent devices, or they can be integrated into the same device to implement different functions, or they can be network elements in hardware devices, or they can be software functions running on dedicated hardware, or they can be virtualized functions instantiated on a platform (for example, a cloud platform). This application does not limit the specific form of the above-mentioned network elements.

[0123] It should also be understood that the above network elements or functions may be divided into one or more services, and further, there may be services that exist independently of the network functions. In this application, instances of the above functions, instances of services included in the above functions, or instances of services that exist independently of the network functions may all be referred to as service instances.

[0124] It should be understood that the term "and / or" in this document simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0125] The following describes in detail a NF management method proposed in this application with reference to FIG2 .

[0126] FIG2 is a schematic diagram of a NF management method 200 provided in an embodiment of the present application.

[0127] S210: The first device receives information from the second device.

[0128] Exemplarily, the first device is a device in a blockchain. It should be understood that the first device can be a component running a blockchain program. The first device can run on a physical machine, a virtual machine, or a container, etc. The first device can be deployed together with an existing NF, or the first device can be deployed separately, etc. This application does not limit the first device.

[0129] It should be understood that a device in a blockchain can also be referred to as a blockchain node, or a block node. For example, a device in a blockchain can be the block node in Figure 1.

[0130] Exemplarily, the second device is a NF. For example, the second device can be an AMF, a UDM, a PCF, etc. For another example, the second device can be any NF in NF1-NF12 in Figure 1. This application does not limit the second device.

[0131] The first device is used to automatically manage the second device using a smart contract.

[0132] It should be understood that the first device is used to automatically manage the second device using a smart contract, which can be understood as the first device located in the blockchain, which can at least execute the corresponding functions of the NRF in the 5GC network to automatically manage the second device.

[0133] Illustratively, the first device automatically managing the second device may include any of the following:

[0134] Open an account for the second device, register the second device, discover the target device of the second device, subscribe and notify the target subscription device of the second device, and remotely attest the second device.

[0135] It should be noted that the above-mentioned automatic management of the second device by the first device is only an example, and this application does not limit this.

[0136] In one possible implementation, the first device receives information about the second device from a third device. Accordingly, the third device sends information about the second device to the first device. The information about the second device is used to open an account for the second device.

[0137] Exemplarily, the third device may be a network management device, for example, the third device is an operation, administration and maintenance (OAM) device, or other device with a network management function.

[0138] In this case, the information of the second device includes an identifier of the second device, a public key of the second device, and a measurement reference value of the second device, wherein the measurement reference value of the second device is used to verify the credibility and integrity of the device.

[0139] Among them, opening an account for the second device can be understood as storing the public information of the second device (NF) in the blockchain, which is used to verify the NF identity during subsequent NF registration.

[0140] In one possible implementation, a first device receives information about the second device from a second device. Correspondingly, the second device sends the information about the second device to the first device. The information about the second device is used to automatically manage the second device.

[0141] It should be understood that before the second device sends the second device information to the first device, the second device determines the second device information. Generally, the second device determines the second device information according to specific needs.

[0142] The information of the second device may include the following contents depending on its function (or the requirements of the second device):

[0143] In a possible implementation manner, the information of the second device is used to register and manage the second device.

[0144] Exemplarily, performing registration management on the second device may include registering the second device, updating registration information of the second device, deregistering (or deregistering) the second device, and the like.

[0145] In the scenario of registering the second device, the information of the second device includes registration information and signature information.

[0146] Registering the second device may be understood as verifying the identity of the second device so as to register the second device in the network and mark the second device as a device that can be discovered by other devices (such as NF).

[0147] Specifically, the signature information is a signature of the second device's information using the second device's private key. The registration information includes the region to which the second device belongs, the blockchain identifier, the second device identifier, the second device type, the second device status, and at least one of the following information: the second device's full address domain name, the second device's address, the second device's operator, the services supported by the second device, and dedicated registration parameters for the second device type.

[0148] It should be understood that the second device can support one or more services, and the services supported by different second devices may be different or the same.

[0149] Specifically, the dedicated registration parameters of the second device type are parameters dedicated to the second device. It should be understood that the dedicated registration parameters of different types of second devices are different.

[0150] In a scenario where the registration information of the second device is updated, the information of the second device includes an identifier of the second device, updated registration information, and signature information.

[0151] Here, updating the registration information of the second device can be understood as updating the registration information of the second device stored in the blockchain.

[0152] In the scenario of deregistering (or canceling) the second device, the information of the second device includes the identifier of the second device, the status of the second device, and signature information.

[0153] Among them, deregistering (or canceling) the second device can be understood as changing the state of the second device to an undiscoverable state (or an unavailable state) in the blockchain, or canceling the second device from the network.

[0154] In one possible implementation, the information of the second device is used to open an account for the second device.

[0155] In this case, the information of the second device includes the public key of the second device, the identifier of the second device, and the measurement reference value of the second device. The measurement reference value of the second device is a trusted measurement value stored in the platform configuration register (PCR) for verifying device integrity and protecting data.

[0156] In one possible implementation, the information of the second device is used to discover the target device of the second device. The target device of the second device is a device that meets the second device query condition (query information). Discovering the target device of the second device can be understood as searching for a device that meets the second device query condition (query information) among the information of multiple NFs stored on the blockchain based on the query information. This device is the target device of the second device.

[0157] In this case, the information of the second device includes query information, which includes at least one of the following information: the region to which the device belongs, the identifier of the blockchain, the type of device, the address of the device, the operator to which the device belongs, the name of the service that the device can support, and the dedicated filtering parameters of the device.

[0158] In a possible implementation manner, the information of the second device is used to subscribe to and notify a target subscription device of the second device.

[0159] Among them, the target subscription device of the second device is the device to which the second device requests subscription. Subscribing to and notifying the target subscription device of the second device can be understood as subscribing to the target subscription device parameters of the target subscription device. When the target subscription device parameters of the target subscription device change (change or addition, etc.), the second device is notified.

[0160] In this case, the information of the second device includes the identifier of the second device and the target subscription device parameters, and the target subscription device parameters include at least one of the following information: the region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, the list of services that the target subscription device can support, and the dedicated registration parameters of the target subscription device type.

[0161] In one possible implementation, the information of the second device is used to remotely authenticate the second device.

[0162] Here, remote certification of the second device can be understood as determining whether the second device can achieve trusted communication.

[0163] In this case, the information of the second device is authentication response information encrypted by the second device using a private key of the second device, and the authentication response information includes the first random number and the measurement value of the second device.

[0164] S220: The first device writes the information of the second device into the blockchain.

[0165] In one possible implementation, the first device writes the information of the second device into the blockchain in the following data format: data initiator, data recipient, data transaction type, timestamp, blockchain identifier, time limit, data transaction content, and data signature.

[0166] The data transaction type includes any one of the following: account opening for the second device, registration of the second device, discovery of the target device of the second device, subscription and notification of the target subscription device of the second device, and remote certification of the second device.

[0167] For example, the first device writes the information of the second device into the blockchain according to the following data format and content:

[0168] The data initiator is the second device, the data recipient is the NRF application contract address, the data transaction type is the account opening of the second device, the timestamp is timestamp, the blockchain identifier is BC instance ID, the time limit is timeout, the data transaction content is the public key of the second device, the identifier of the second device, and the measurement reference value of the second device, and the data signature is the private key signature of the second device (that is, the signature of the second device's information by the private key of the second device).

[0169] It should be noted that the above-mentioned method of the first device writing the information of the second device into the blockchain in a data format is only an example, and this application is not limited to this.

[0170] It should be noted that the method of writing information into the blockchain can refer to the relevant technology of writing transactions in the blockchain in the existing technology, such as writing transactions into the blockchain through a consensus algorithm, etc. This application does not limit the method of writing information into the blockchain.

[0171] Optionally, in S230 , the first device sends response information.

[0172] Accordingly, the second device receives the response information.

[0173] The response information indicates that the second device's information has been written to the blockchain. This solution, based on blockchain technology, uses a decentralized mechanism to discover NF instances and their services in the network. This distributed implementation of NF instance and service discovery, without compromising authentication or security, simplifies the system architecture and makes maintenance easier.

[0174] The above is combined with Figure 2 to illustrate the NF management method provided in this application. Based on Figure 2, in combination with Figures 3-6, the process of different automated management performed by the first device on the second device (registering and managing the second device, opening an account for the second device, discovering the target device of the second device, and subscribing to the target subscription device of the second device) is described in detail.

[0175] FIG3 is a schematic diagram of a NF management method 300 provided in an embodiment of the present application.

[0176] S310: The second device sends first information of the second device to the first device.

[0177] Accordingly, the first device receives the first information from the second device.

[0178] It should be understood that the first information of the second device is determined by the second device.

[0179] The first information of the second device is used to register and manage the second device.

[0180] Exemplarily, the first device may be a device in a blockchain, the second device may be a NF, and the first device is used to automatically manage the second device using a smart contract.

[0181] In a possible implementation, in a scenario where the second device is registered, the first information of the second device includes registration information and signature information.

[0182] It should be noted that the first information of the second device mentioned above can refer to the relevant description of the information of the second device when the information of the second device is used to register the second device in S210. Here, in order to avoid redundancy, its detailed description is omitted.

[0183] Illustratively, the registration information may include the content shown in Table 1.

[0184] Table 1 Contents of registration information

[0185] In a possible implementation, in a scenario where the registration information of the second device is updated (the second device updates the registration information), the first information of the second device includes an identifier of the second device, updated registration information, and signature information.

[0186] Specifically, after the second device has been registered, or in other words, the second device is a device that has been registered in the blockchain, the first information received by the first device from the second device may include the second device's identifier, updated registration information, and signature information. The updated registration information is information that updates one or more items of information in the initial registration information of the second device stored in the blockchain (e.g., the registration information in S310). For example, the status of the second device in the updated registration information is different from the status of the second device in the initial registration information.

[0187] In a possible implementation, when deregistering (or canceling) the second device, the first information of the second device includes an identifier of the second device, a status of the second device, and signature information, wherein the status of the second device is undiscoverable.

[0188] Optionally, when the first information of the second device includes registration information, the method 300 may further include S320 - S330 .

[0189] S320: The first device obtains the public key of the second device.

[0190] In one possible implementation, the first device obtains the public key of the second device from the blockchain.

[0191] It should be noted that this application does not limit the order of the above S310 and S320. For example, S310 can be executed first, and then S320; or S320 can be executed first, and then S310; or S310 and S320 can be executed at the same time.

[0192] S330: The first device verifies the signature information using the public key of the second device.

[0193] Specifically, after obtaining the public key of the second device, the first device uses the public key of the second device to verify the signature information in the first information received from the second device.

[0194] Furthermore, after the first device receives the first information of the second device, the first device writes the first information of the second device into the blockchain, and the method 300 also includes S340.

[0195] S340: The first device writes the first information of the second device into the blockchain.

[0196] In one possible implementation, a blockchain consensus algorithm is used, and the first device writes the first information of the second device into the blockchain.

[0197] In one possible implementation, in a scenario where the second device is registered (in this case, the first information of the second device includes registration information), if the first device successfully verifies the signature information in S330, the first device writes the registration information into the blockchain.

[0198] Exemplarily, the first device writes the registration information into the blockchain in the following data format:

[0199] The data initiator is the second device, the data recipient is the NRF application contract address, the data transaction type is the registration of the second device, the timestamp is timestamp, the blockchain identifier is BC instance ID, the time limit is timeout, the data transaction content is registration information, and the data signature is the private key signature of the second device.

[0200] In one possible implementation, when the registration information of the second device is updated (in this case, the first information of the second device includes the updated registration information), the first device writes the identifier of the second device and the updated registration information into the blockchain.

[0201] Exemplarily, the first device writes the second device's identifier and updated registration information into the blockchain in the following data format:

[0202] The data initiator is the second device, the data recipient is the NRF application contract address, the data transaction type is registration update, the timestamp is timestamp, the blockchain identifier is BC instance ID, the time limit is timeout, the data transaction content is the identifier of the second device and the updated registration information, and the data signature is the private key signature of the second device.

[0203] In one possible implementation, in a scenario where the second device is deregistered (or unregistered) (in this case, the first information of the second device includes the status of the second device, and the status of the second device is undiscoverable), the first device writes the identifier of the second device and the status of the second device as undiscoverable into the blockchain.

[0204] Exemplarily, the first device writes the identifier of the second device and the status of the second device as undiscoverable into the blockchain in the following data format:

[0205] The data initiator is the second device, the data recipient is the NRF application contract address, the data transaction type is the deregistration of the second device, the timestamp is timestamp, the blockchain identifier is BC instance ID, the time limit is timeout, the data transaction content is the identifier of the second device and the status of the second device, and the data signature is the private key signature of the second device.

[0206] It should be understood that the state of the second device being an undiscoverable state can be understood as the second device being in an unregistered state.

[0207] It should be noted that the first device may also determine whether the second device has been deregistered through heartbeat information.

[0208] Specifically, if the first device does not receive heartbeat information from the second device within a period of time, the heartbeat information is used to indicate that the second device is working normally, then the first device sends the first information of the second device to other devices in the blockchain, wherein the first information of the second device includes the identification of the second device, the status of the second device (the status of the second device is undiscoverable), and signature information. Further, the first device writes the status of the second device as unavailable into the blockchain through the consensus mechanism of the blockchain.

[0209] It should be noted that the method in the above S340 for the first device to write the first information of the second device into the blockchain can be referred to the description in S220, and will not be repeated here.

[0210] Optionally, in S350, the first device sends response information to the second device.

[0211] Correspondingly, the second device receives the response information from the first device.

[0212] The response information is used to indicate that the first device has successfully received the first information of the second device, or to indicate that the first information of the second device has been written into the blockchain.

[0213] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, NFs are registered and managed, making the management of NFs more secure and convenient without affecting identity authentication or security.

[0214] FIG4 is a schematic diagram of a NF management method 400 provided in an embodiment of the present application.

[0215] S410: The network management device sends second information of the second device to the first device.

[0216] Correspondingly, the first device receives the second information of the second device from the network management device.

[0217] It should be understood that the second information of the second device is determined by the network management device.

[0218] The second information of the second device is used to open an account for the second device.

[0219] Exemplarily, the first device may be a device in a blockchain, the network management device may be an OAM, the second device may be a NF, and the first device is used to automatically manage the second device using a smart contract.

[0220] In a possible implementation manner, the second information of the second device includes an identifier of the second device, a public key of the second device, and a measurement reference value of the second device.

[0221] The measurement reference value of the second device is used to verify the credibility and integrity of the device. Exemplarily, the measurement reference value of the second device is a trustworthy measurement value stored in the PCR, specifically a hash value, which is not limited in this application.

[0222] Exemplarily, the second device signs the second information of the second device using the private key of the second device to form the private key signature of the second device, and sends the signature to the first device.

[0223] S420: The first device writes the second information of the second device into the blockchain.

[0224] In one possible implementation, the first device writes the second information of the second device (the identifier of the second device, the public key of the second device, and the measurement reference value of the second device) into the blockchain in the following data format:

[0225] The data initiator is OAM, the data recipient is the NRF application contract address, the data transaction type is account opening for the second device, the timestamp is timestamp, the blockchain identifier is BC instance ID, the expiration time is timeout, the data transaction content is the second device identifier, the second device public key, and the second device measurement reference value, and the data signature is the OAM private key signature. It should be understood that the OAM private key signature is used to sign the second information of the second device.

[0226] It should be noted that the method in the above S420 for the first device to write the second information of the second device into the blockchain can be referred to the description in S220, and will not be repeated here.

[0227] Optionally, in S430, the first device sends response information to the network management device.

[0228] Correspondingly, the network management device receives response information from the first device.

[0229] The response information is used to indicate that the first device has successfully received the second information of the second device, or to indicate that the second information of the second device has been written into the blockchain.

[0230] FIG5 is a schematic diagram of a NF management method 500 provided in an embodiment of the present application.

[0231] S510: The second device sends third information of the second device to the first device.

[0232] Accordingly, the first device receives the third information of the second device from the second device.

[0233] It should be understood that the third information of the second device is determined by the second device.

[0234] The third information of the second device is used to discover the target device of the second device.

[0235] Among them, the target device of the second device is a device that meets the query conditions (query information) of the second device. Discovering the target device of the second device can be understood as searching for a device that meets the query conditions of the second device in the public information of multiple NFs stored in the blockchain based on the query information. This device is the target device of the second device.

[0236] Exemplarily, the first device may be a device in a blockchain, the second device may be a NF, and the first device is used to automatically manage the second device using a smart contract.

[0237] In one possible implementation manner, the third information of the second device includes query information, and the query information includes at least one of the following information:

[0238] The region to which the device belongs, the blockchain identifier, the type of device, the address of the device, the operator to which the device belongs, the names of services that the device can support, and the device's dedicated filtering parameters.

[0239] S520: The first device queries the target device according to the third information of the second device.

[0240] Specifically, after receiving the query information, the first device searches the blockchain for devices that match the query information and determines the queried device as the target device.

[0241] S530: The first device sends target device information to the second device.

[0242] Accordingly, the second device receives the target device information from the first device.

[0243] The target device information includes the address of at least one target device and its public key.

[0244] It should be noted that, in the process of discovering the target device of the second device, a service communication proxy (SCP) may also participate in the discovery process of the target device.

[0245] In a possible implementation manner, after the second device receives the target device information, the SCP may select the target device.

[0246] In one possible implementation, the SCP acts as an interaction agent between the first device and the second device. The second device requests the first device to discover the target device through the SCP. After the first device determines the target device information (discovers the target device, or queries the target device), the SCP selects the target device and performs subsequent message routing.

[0247] Optionally, after the second device receives the target device information (or discovers the target device), it may establish a connection with the target device. The method 500 may further include S540-S548.

[0248] S540: The second device sends a link establishment request message to the target device.

[0249] Correspondingly, the target device receives the link establishment request information from the second device.

[0250] The link establishment request information is used to request the establishment of a connection between the second device and the target device. The link establishment request information includes the identifier of the second device, the public key of the second device, the first random number, and the signature of the second device. The first random number is a random number generated by the second device.

[0251] Exemplarily, the second device signs the link establishment request information using the private key of the second device, further encrypts the signed link establishment request information using the public key of the target device, and sends the encrypted information to the target device.

[0252] S541: The target device verifies the link establishment request information.

[0253] Specifically, after receiving the link establishment request information encrypted by the second device using the public key of the target device, the target device decrypts the link establishment request information using the private key of the target device, and further verifies the signature using the public key of the second device.

[0254] S542: The target device sends a query request message to the first device.

[0255] Correspondingly, the first device receives the query request information from the target device.

[0256] Specifically, when the target device successfully verifies the signature of the decrypted link establishment request information, it sends the query request information to the first device.

[0257] The query request information is used to request to query the public key of the second device, and the query request information includes the identifier of the second device.

[0258] S543: The first device sends query response information to the target device.

[0259] Correspondingly, the target device receives the query response information from the first device.

[0260] The query response information includes the identifier of the second device and the public key of the second device.

[0261] S544, the target device verifies the query result.

[0262] Specifically, the target device compares the public key of the second device obtained in S540 with the public key of the second device in the response information received in S543 to see whether they are the same.

[0263] S545: The target device sends a link establishment response message to the second device.

[0264] Correspondingly, the second device receives link establishment response information from the target device.

[0265] The link establishment response information includes a first random number and a second random number, and the second random number is a random number generated by the target device.

[0266] Exemplarily, when the public keys of the two second devices compared by the target device in S564 are identical, the target device encrypts the link establishment response information using the public key of the second device and sends the encrypted information to the second device.

[0267] S546: The second device verifies the first random number.

[0268] Specifically, after the second device receives the link establishment response information encrypted by the target device using the public key of the second device, it decrypts the link establishment response information using the private key of the second device and compares the first random number obtained by decryption with the first random number locally stored on the second device to see whether they are equal.

[0269] Optionally, when the two first random numbers are equal, the second device derives a symmetric key using the first random number and the second random number, and the symmetric key is used for integrity protection and encryption of data.

[0270] S547: The second device sends a link establishment completion message to the target device.

[0271] Correspondingly, the target device receives link establishment completion information from the second device.

[0272] The link establishment completion information indicates that the connection between the second device and the target device is successfully established. The link establishment completion information includes a message hash value calculated using the integrity algorithm and the key. It should be understood that the link establishment completion information is encrypted using the first random number and the second random number.

[0273] S548, the target device performs verification.

[0274] Specifically, after receiving the link establishment completion information, the target device performs decryption and integrity verification.

[0275] It should be noted that in subsequent communications, the second device and the target device use a symmetric key for encryption and decryption.

[0276] It should be noted that, in the process of establishing a connection between the second device and the target device in S540-S548, the second device may also communicate with the target device via SCP, which is not limited in this application.

[0277] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, the network architecture is used to discover the target devices of NF without affecting authentication or security, making the management of NF more secure and convenient.

[0278] FIG6 is a schematic diagram of a NF management method 600 provided in an embodiment of the present application.

[0279] S610: The second device sends fourth information of the second device to the first device.

[0280] Accordingly, the first device receives fourth information from the second device.

[0281] It should be understood that the fourth information of the second device is determined by the second device.

[0282] The fourth information of the second device is used to subscribe to the target subscription device of the second device.

[0283] Among them, the target subscription device of the second device is the device to which the second device requests subscription. Subscribing to and notifying the target subscription device of the second device can be understood as subscribing to the target subscription device parameters of the target subscription device. When the target subscription device parameters of the target subscription device change (change or addition, etc.), the second device is notified.

[0284] Exemplarily, the first device may be a device in a blockchain, the second device may be a NF, and the first device is used to automatically manage the second device using a smart contract.

[0285] In one possible implementation, the fourth information of the second device includes an identifier of the second device and a target subscription device parameter. The target subscription device parameter includes at least one of the following information:

[0286] The region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, the list of services that the target subscription device can support, and the dedicated registration parameters of the target subscription device type.

[0287] Exemplarily, the target subscription device parameters may include content as shown in Table 2 below.

[0288] Table 2 Contents of target subscription device parameters

[0289] S620: The first device writes the fourth information of the second device into the blockchain.

[0290] In one possible implementation, the first device writes the fourth information of the second device (the identifier of the second device and the target subscription device parameters) into the blockchain in the following data format:

[0291] The data initiator is the second device, the data recipient is the NRF application contract address, the data transaction type is the target subscription device of the second device, the timestamp is timestamp, the blockchain identifier is BC instance ID, the time limit is timeout, the data transaction content is the identifier of the second device and the target subscription device parameters, and the data signature is the private key signature of the second device.

[0292] Optionally, in S630, the first device sends response information to the second device.

[0293] Correspondingly, the second device receives the response information from the first device.

[0294] The response information is used to indicate that the fourth information of the second device has been written into the blockchain.

[0295] Optionally, when the first device discovers that the target subscription device parameter of the target subscription device has changed, the first device can notify the second device. The method 600 may further include S640-S650.

[0296] S640: The first device determines that a parameter of the target subscription device has changed.

[0297] In one possible implementation, when the target subscription device sends updated registration information to the first device, the first device determines that the parameters of the target subscription device have changed, and the first device writes the updated registration information of the target subscription device into the blockchain.

[0298] It should be noted that changes in the parameters of the target subscription device can be understood as changes in the relevant parameters of the target subscription device stored in the blockchain, such as updates to the relevant parameters of the target subscription device, or new parameters of the target subscription device, etc. This application is not limited to this.

[0299] S650: The first device sends notification information to the second device.

[0300] Correspondingly, the second device receives the notification information from the first device.

[0301] The notification information is used to indicate that parameters of a target subscription device subscribed by the second device have changed. The notification information includes an identifier of the target subscription parameter and information about the change or addition of the target subscription device.

[0302] In the above solution, based on the network architecture that uses blockchain technology to discover NF instances and their services in the network, this network architecture is used to subscribe and notify the target subscription devices of the NF without affecting authentication or security, making the management of the NF more secure and convenient.

[0303] It should be understood that the examples in Figures 2 to 6 of the embodiments of the present application are merely intended to facilitate understanding of the embodiments of the present application by those skilled in the art, and are not intended to limit the embodiments of the present application to the specific scenarios illustrated. Those skilled in the art can obviously make various equivalent modifications or variations based on the examples in Figures 2 to 6, and such modifications or variations also fall within the scope of the embodiments of the present application.

[0304] It can also be understood that some optional features in the various embodiments of the present application may not depend on other features in certain scenarios, and may also be combined with other features in certain scenarios, without limitation.

[0305] It can also be understood that the solutions in the various embodiments of the present application can be reasonably combined and used, and the explanations or descriptions of the various terms appearing in the embodiments can be referenced or explained with each other in the various embodiments, without limitation to this.

[0306] It can also be understood that the sizes of the various numerical serial numbers in the embodiments of the present application do not mean the order of execution, but are only distinguished for the convenience of description and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0307] It can also be understood that in the various embodiments of the present application, some message names are involved, such as information of the second device or registration information, etc. It should be understood that their naming does not limit the scope of protection of the embodiments of the present application.

[0308] It can also be understood that in each of the above-mentioned method embodiments, the methods and operations implemented by the first device can also be implemented by components that can be implemented by the first device (such as a chip or circuit); in addition, the methods and operations implemented by the second device can also be implemented by components that can be implemented by the second device (such as a chip or circuit), without limitation. Corresponding to the methods given in the above-mentioned method embodiments, the embodiments of the present application also provide corresponding devices, which include modules for executing the corresponding modules of the above-mentioned method embodiments. The module can be software, hardware, or a combination of software and hardware. It can be understood that the technical features described in the above-mentioned method embodiments are also applicable to the following device embodiments.

[0309] It should be understood that the first device and the second device may perform some or all of the steps in the above embodiments. These steps or operations are merely examples, and the embodiments of the present application may also perform other operations or variations of various operations. In addition, the various steps may be performed in a different order than those presented in the above embodiments, and it is possible that not all of the operations in the above embodiments need to be performed.

[0310] The NF management method provided in the embodiments of the present application is described in detail above with reference to Figures 2-6 . The communication device provided in the embodiments of the present application is described in detail below with reference to Figures 7-9 . It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for details not described in detail, reference can be made to the method embodiment above. For the sake of brevity, some details will be omitted.

[0311] Figure 7 is a schematic block diagram of a communication device provided in an embodiment of the present application. The device 700 includes a transceiver unit 710 and a processing unit 720. The transceiver unit 710 can be used to implement corresponding communication functions. The processing unit 720 can be used to process data. In other words, the transceiver unit 710 is used to perform operations related to receiving and sending, and the processing unit 720 is used to perform other operations besides receiving and sending. The transceiver unit 710 can also be referred to as a communication interface or a communication unit.

[0312] Optionally, the device 700 also includes a storage unit, which can be used to store instructions and / or data. The processing unit 720 can read the instructions and / or data in the storage unit so that the device implements the actions of different devices in the aforementioned method embodiments, for example, the actions of the first device, the second device or the network management device.

[0313] The device 700 can be used to execute the actions performed by the first device, the second device or the network management device in the above method embodiments. In this case, the device 700 can be the first device, the second device or the network management device, or a component of the first device, the second device or the network management device. The transceiver unit 710 is used to execute the transceiver-related operations of the first device, the second device or the network management device in the above method embodiments, and the processing unit 720 is used to execute the processing-related operations of the first device, the second device or the network management device in the above method embodiments.

[0314] In one possible implementation, the transceiver unit 710 is configured to receive information from the second device, and the processing unit 720 is configured to write the information from the second device into the blockchain.

[0315] In another possible implementation, the processing unit 720 is used to determine the information of the second device. The transceiver unit 710 is used to send the information of the communication device to the first device. It should also be understood that the device 700 here is embodied in the form of a functional unit. The term "unit" here can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merging logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the device 700 can be specifically the first device, the second device or the network management device in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the first device, the second device or the network management device in the above-mentioned method embodiments, or the device 700 can be specifically the first device, the second device or the network management device in the above-mentioned embodiment, and can be used to execute the various processes and / or steps corresponding to the first device, the second device or the network management device in the above-mentioned method embodiments. To avoid repetition, it will not be described here.

[0316] The apparatus 700 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the first device, the second device, or the network management device in the above-mentioned method, or the apparatus 700 of each of the above-mentioned solutions has the function of implementing the corresponding steps performed by the first device, the second device, or the network management device in the above-mentioned method. The functions can be implemented by hardware, or can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions; for example, the transceiver unit can be replaced by a transceiver (for example, the sending unit in the transceiver unit can be replaced by a transmitter, and the receiving unit in the transceiver unit can be replaced by a receiver), and other units, such as the processing unit, can be replaced by a processor, respectively performing the sending and receiving operations and related processing operations in each method embodiment.

[0317] In addition, the transceiver unit 710 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing unit may be a processing circuit.

[0318] It should be noted that the apparatus in FIG7 may be a network element or device in the aforementioned embodiment, or may be a chip or chip system, such as a system on chip (SoC). The transceiver unit may be an input / output circuit or a communication interface; the processing unit may be a processor, microprocessor, or integrated circuit integrated on the chip. This is not limited here.

[0319] As shown in Figure 8, an embodiment of the present application provides another communication device 800. The device 800 includes a processor 810, which is coupled to a memory 820. The memory 820 is used to store computer programs or instructions and / or data. The processor 810 is used to execute the computer programs or instructions stored in the memory 820, or read the data stored in the memory 820 to perform the methods in the above method embodiments. The device 800 also includes a transceiver 830, which is used to receive and / or transmit signals. For example, the processor 810 is used to control the transceiver 830 to receive and / or transmit signals.

[0320] Optionally, there are one or more processors 810 .

[0321] Optionally, there are one or more memories 820 .

[0322] Optionally, the memory 820 is integrated with the processor 810 or provided separately.

[0323] As a solution, the apparatus 800 is used to implement the operations performed by the first device, the second device or the network management device in each of the above method embodiments.

[0324] For example, the processor 810 is configured to execute a computer program or instruction stored in the memory 820 to implement the relevant operations of the first device in each of the above method embodiments, for example, the first device in any one of the embodiments shown in Figures 2 to 6, or the method of the first device in any one of the embodiments shown in Figures 2 to 6.

[0325] For example, the processor 810 is configured to execute the computer program or instructions stored in the memory 820 to implement the relevant operations of the second device in each of the above method embodiments. For example, the second device in any one of the embodiments shown in Figures 2, 3, 5, and 6, or the method of the second device in any one of the embodiments shown in Figures 2, 3, 5, and 6.

[0326] For example, the processor 810 is configured to execute computer programs or instructions stored in the memory 820 to implement the relevant operations of the network management device in the above embodiments, such as the network management device in FIG4 or the method of the network management device in FIG4.

[0327] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0328] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0329] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0330] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0331] As shown in FIG9 , an embodiment of the present application provides a chip system 900 . The chip system 900 (or also referred to as a processing system) includes a logic circuit 910 and an input / output interface 920 .

[0332] The logic circuit 910 may be a processing circuit in the chip system 900. The logic circuit 910 may be coupled to a storage unit and call instructions in the storage unit so that the chip system 900 can implement the methods and functions of the various embodiments of the present application. The input / output interface 920 may be an input / output circuit in the chip system 900, outputting information processed by the chip system 900 or inputting data or signaling information to be processed into the chip system 900 for processing.

[0333] As a solution, the chip system 900 is used to implement the operations performed by the first device, the second device or the network management device in the above various method embodiments.

[0334] For example, the logic circuit 910 is used to implement the processing-related operations performed by the first device in the above method embodiments, such as the processing-related operations performed by the first device in any one of the embodiments shown in Figures 2 to 6; the input / output interface 920 is used to implement the sending and / or receiving-related operations performed by the first device in the above method embodiments, such as the sending and / or receiving-related operations performed by the first device in any one of the embodiments shown in Figures 2 to 6.

[0335] For example, the logic circuit 910 is used to implement the processing-related operations performed by the second device in the above method embodiments, such as the processing-related operations performed by the second device in any one of the embodiments shown in Figures 2, 3, 5, and 6; the input / output interface 920 is used to implement the sending and / or receiving-related operations performed by the second device in the above method embodiments, such as the sending and / or receiving-related operations performed by the second device in any one of the embodiments shown in Figures 2, 3, 5, and 6.

[0336] For example, the logic circuit 910 is used to implement the processing-related operations performed by the network management device in the above method embodiment, such as the processing-related operations performed by the network management device in Figure 4; the input / output interface 920 is used to implement the sending and / or receiving-related operations performed by the network management device in the above method embodiment, such as the sending and / or receiving-related operations performed by the network management device in Figure 4.

[0337] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions for implementing the methods executed by the first device, the second device or the network management device in the above-mentioned method embodiments.

[0338] For example, when the computer program is executed by a computer, the computer can implement the method performed by the first device, the second device or the network management device in each embodiment of the above method.

[0339] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed by a computer, implement the methods performed by the first device, the second device, or the network management device in the above-mentioned method embodiments.

[0340] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0341] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0342] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium includes, but is not limited to, various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0343] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network function management method, characterized in that: include: A first device receives information from a second device, where the first device is a device in a blockchain, the second device is a network function entity, and the first device is used to automatically manage the second device using a smart contract; The first device writes the information of the second device into the blockchain.

2. The method according to claim 1, characterized in that The information of the second device includes registration information and signature information, wherein the signature information is a signature of the information of the second device using a private key of the second device, and the information of the second device is used to register the second device. The method further includes: The first device verifies the signature information using the acquired public key of the second device; The first device writes the information of the second device into the blockchain, including: When the first device successfully verifies the signature information, the first device writes the registration information into the blockchain, where the registration information includes the region to which the second device belongs, the identifier of the blockchain, the identifier of the second device, the type of the second device, the status of the second device, and at least one of the following information: the full address domain name of the second device, the address of the second device, the operator to which the second device belongs, the services that the second device can support, and special registration parameters for the second device type.

3. The method according to claim 1, characterized in that The information of the second device includes a public key of the second device, an identifier of the second device, and a measurement reference value of the second device; The first device receiving information of the second device includes: The first device receives information about the second device from a network management device, where the information about the second device is used to open an account for the second device.

4. The method according to claim 1, characterized in that The information of the second device includes query information, and the information of the second device is used to discover a target device of the second device. The method further includes: The first device queries the target device according to the query information; The first device sends the address of the target device and the public key of the target device; The query information includes at least one of the following information: The region to which the device belongs, the identifier of the blockchain, the type of the device, the address of the device, the operator to which the device belongs, the names of services that the device can support, and the dedicated filtering parameters of the device.

5. The method according to claim 1, characterized in that The information of the second device includes an identifier of the second device and a target subscription device parameter, and the information of the second device is used to subscribe to a target subscription device of the second device, wherein the target subscription device parameter includes at least one of the following information: The region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, the list of services that the target subscription device can support, and the dedicated registration parameters of the target subscription device type.

6. The method according to claim 5, characterized in that When the first device determines that the target subscription device parameter changes, the method further includes: The first device sends notification information, where the notification information is used to indicate that a parameter of the target subscription device has changed, and the notification information includes an identifier of the target subscription device and a changed field in the parameter of the target subscription device.

7. The method according to any one of claims 1 to 6, characterized in that The first device writes information of the second device into the blockchain, including: The first device writes the information of the second device into the blockchain in the following data format: data initiator, data recipient, data transaction type, timestamp, identifier of the blockchain, timeliness, data transaction content, and data signature; The data transaction type includes any of the following: Opening an account for the second device, registering the second device, discovering a target device for the second device, subscribing and notifying a target subscribing device of the second device, and remote certification of the second device.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: The first device sends response information, where the response information is used to indicate that the first device has successfully received the information of the second device, or is used to indicate that the information of the second device has been written into the blockchain.

9. A network function management method, characterized in that: include: The second device determines information of the second device; The second device sends information of the second device to the first device, the first device is a device in the blockchain, the second device is a network function entity, and the first device is used to automatically manage the second device using a smart contract.

10. The method according to claim 9, characterized in that The information of the second device includes registration information and signature information, and the information of the second device is used to register the second device, wherein the signature information is a signature of the information of the second device using the private key of the second device, and the registration information includes the region to which the second device belongs, the identifier of the blockchain, the identifier of the second device, the type of the second device, the status of the second device, and at least one of the following information: The full address domain name of the second device, the address of the second device, the operator to which the second device belongs, the services that the second device can support, and the dedicated registration parameters of the second device type.

11. The method according to claim 9, characterized in that The information of the second device includes query information, and the information of the second device is used to discover a target device of the second device. The query information includes at least one of the following information: The region to which the device belongs, the identifier of the blockchain, the type of the device, the address of the device, the operator to which the device belongs, the names of services that the device can support, and the dedicated filtering parameters of the device; The response information includes the address of the device and the public key of the device.

12. The method according to claim 9, characterized in that The information of the second device includes an identifier of the second device and a target subscription device parameter, and the information of the second device is used to subscribe to a target subscription device of the second device, wherein the target subscription device parameter includes at least one of the following information: The region to which the target subscription device belongs, the identifier of the blockchain, the type of the target subscription device, the address of the target subscription device, the operator to which the target subscription device belongs, the list of services that the target subscription device can support, and the dedicated registration parameters of the target subscription device type.

13. The method according to claim 12, characterized in that The method further comprises: The second device receives notification information from the first device, where the notification information is used to indicate that a parameter of the target subscription device has changed, and the notification information includes an identifier of the target subscription device and a changed field in the parameter of the target subscription device.

14. The method according to any one of claims 9 to 13, characterized in that The method further comprises: The second device receives response information, where the response information is used to indicate that the first device has successfully received the information of the second device, or is used to indicate that the information of the second device has been written into the blockchain.

15. A communication system, characterized in that: The method comprises a first device and a second device, wherein the first device is used to execute the method according to any one of claims 1 to 8, and the second device is used to execute the method according to any one of claims 9 to 14.

16. A communication device, characterized in that: include: A processor, configured to execute a computer program stored in a memory, so that the communication device executes the method according to any one of claims 1 to 14.

17. A computer-readable storage medium, characterized in that: A computer program or instruction is stored thereon, wherein when the computer program or instruction is executed by a processor, the method as claimed in any one of claims 1 to 14 is executed.

18. A computer program product comprising instructions which, when executed on a computer, cause the method as claimed in any one of claims 1 to 14 to be performed.

19. A chip system, characterized in that: include: A processor, used to call and run a computer program or instruction from a memory, so that a communication device equipped with the chip system implements the method as described in any one of claims 1 to 14.

Images