Authorization method, network function, communication system and storage medium

Abstract

Embodiments of the present disclosure provide an authorization method, a first network function, a second network function, a third network function, a communication system and a storage medium. The method is executed by the first network function, and the method comprises: executing a first operation. The technical solution provided by the embodiments of the present disclosure can reduce redundant authorization.

Description

Authorization method, network function, communication system and storage medium Technical Field

[0001] The present disclosure relates to the field of communication technologies, and in particular to an authorization method, a first network function, a second network function, a third network function, a communication system, and a storage medium. Background Art

[0002] In the field of communications technology, in a SNAAPPY scenario or an RNAA scenario (a scenario requiring resource owner participation in authorization), an API (Application Programming Interface) caller needs to be authorized to request processing of resources of a specific terminal or user, resource owner, or subscriber.

[0003] Summary of the Invention

[0004] During the authorization process, there is a problem of redundant authorization.

[0005] Embodiments of the present disclosure provide an authorization method, a first network function, a second network function, a third network function, a communication system, and a storage medium.

[0006] According to a first aspect of an embodiment of the present disclosure, an authorization method is provided. The method is performed by a first network function, and the method includes:

[0007] Execute a first operation;

[0008] The first operation includes at least one of the following:

[0009] Skipping the first process, wherein the first network function requests the second network function to authorize the first application programming interface (API) caller to process the resources of the first resource owner, or the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner;

[0010] Sending first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller;

[0011] Sending second information to the third network function, where the second information is used to instruct the third network function not to perform the second process or indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner, or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0012] According to a second aspect of an embodiment of the present disclosure, an authorization method is provided. The method is performed by a second network function, and the method includes:

[0013] receiving first information sent by the first network function;

[0014] The first information is used to instruct the second network function to skip authorizing the first API caller.

[0015] According to a third aspect of an embodiment of the present disclosure, an authorization method is provided. The method is performed by a third network function, and the method includes:

[0016] receiving second information sent by the first network function;

[0017] The second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner or a process in which the third network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0018] According to a fourth aspect of an embodiment of the present disclosure, there is provided an authorization method, applied to a communication system, the method comprising:

[0019] The first network function sends the first information to the second network function and / or the first network function sends the second information to the third network function;

[0020] Among them, the first information is used to instruct the second network function to skip authorizing the first API caller; the second information is used to instruct the third network function not to execute the second process or indicate the authorization result related to the first application programming interface API caller; the second process is the process of the third network function requesting the second network function to authorize the first API caller to process the resources of the first resource owner or the process of the third network function requesting the second network function to send the privacy file or authorization information related to the first resource owner.

[0021] According to a fifth aspect of an embodiment of the present disclosure, a first network function is provided, where the first network function includes:

[0022] The processing module is configured to:

[0023] Execute a first operation;

[0024] The first operation includes at least one of the following:

[0025] Skipping the first process, wherein the first network function requests the second network function to authorize the first application programming interface (API) caller to process the resources of the first resource owner, or the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner;

[0026] Sending first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller;

[0027] Sending second information to the third network function, where the second information is used to instruct the third network function not to perform the second process or indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner, or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0028] According to a sixth aspect of an embodiment of the present disclosure, a second network function is provided, where the second network function includes:

[0029] The transceiver module is configured as follows:

[0030] receiving first information sent by the first network function;

[0031] According to a seventh aspect of an embodiment of the present disclosure, a third network function is provided, the third network function comprising:

[0032] The transceiver module is configured as follows:

[0033] receiving second information sent by the first network function;

[0034] The second information is information sent by the first API requester after being authorized to process the resources of the first resource owner; the second information is used to instruct the third network function not to execute the second process or indicate the authorization result related to the first application programming interface API caller; the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner or a process in which the third network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0035] According to an eighth aspect of an embodiment of the present disclosure, a communication system is provided, wherein the communication system includes a first network function, a second network function, and a third network function, the first network function being configured to implement the authorization method provided by the first aspect, the second network function being configured to implement the authorization method provided by the second aspect, and the third network function being configured to implement the authorization method provided by the third aspect.

[0036] According to a ninth aspect of an embodiment of the present disclosure, a first network function is provided, wherein the first network function includes:

[0037] one or more processors;

[0038] The processor is used to call instructions to enable the communication device to execute the authorization method provided by the first aspect.

[0039] According to a tenth aspect of an embodiment of the present disclosure, a second network function is provided, wherein the second network function includes:

[0040] one or more processors;

[0041] The processor is used to call instructions to enable the communication device to execute the authorization method provided by the second aspect.

[0042] According to an eleventh aspect of an embodiment of the present disclosure, a third network function is provided, wherein the third network function includes:

[0043] one or more processors;

[0044] The processor is used to call instructions to enable the communication device to execute the authorization method provided by the third aspect.

[0045] According to the twelfth aspect of an embodiment of the present disclosure, a storage medium is provided, wherein the storage medium stores instructions, and when the instructions are executed on a communication device, the communication device executes the authorization method provided by the first aspect, the second aspect, the third aspect or the fourth aspect.

[0046] The technical solution provided by the embodiments of the present disclosure can reduce the situation of redundant authorization.

[0047] It should be understood that the foregoing general description and the following detailed description are merely exemplary and explanatory and are not restrictive of the embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the description, serve to explain the principles of the embodiments of the present invention.

[0049] FIG1 is a schematic diagram showing an architecture of a communication system according to an exemplary embodiment;

[0050] FIG2a is a schematic flow chart showing an authorization method according to an exemplary embodiment;

[0051] FIG3a is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0052] FIG3 b is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0053] FIG4a is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0054] FIG4 b is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0055] FIG5a is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0056] FIG5 b is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0057] FIG6a is a schematic flow chart showing an authorization method according to an exemplary embodiment;

[0058] FIG7a is a schematic diagram showing a flow chart of an authorization method according to an exemplary embodiment;

[0059] FIG8a is a schematic structural diagram of a first network function according to an exemplary embodiment;

[0060] FIG8b is a schematic structural diagram of a second network function according to an exemplary embodiment;

[0061] FIG8c is a schematic structural diagram of a third network function according to an exemplary embodiment;

[0062] FIG9a is a schematic structural diagram of a UE according to an exemplary embodiment;

[0063] Fig. 9b is a schematic structural diagram of a communication device according to an exemplary embodiment. DETAILED DESCRIPTION

[0064] Embodiments of the present disclosure provide an authorization method, a first network function, a second network function, and a storage medium.

[0065] In a first aspect, an embodiment of the present disclosure provides an authorization method, where the method is performed by a first network function, and the method includes:

[0066] Execute a first operation;

[0067] The first operation includes at least one of the following:

[0068] Skipping the first process, wherein the first network function requests the second network function to authorize the first application programming interface (API) caller to process the resources of the first resource owner, or the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner;

[0069] Sending first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller;

[0070] Sending second information to the third network function, where the second information is used to instruct the third network function not to perform the second process or indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner, or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0071] In the above embodiment, you can choose not to execute the first process, send the first information to the second network function, and / or send the second information to the third network function. Compared with the situation where authorization, the first process, and the second process still need to be executed after authorization, you can choose not to execute authorization, thereby reducing redundant authorization.

[0072] With reference to some embodiments of the first aspect, in some embodiments, performing the first operation includes:

[0073] Determine that the first API caller is authorized to process the resources of the first resource owner, and perform the first operation.

[0074] In the above embodiment, after determining that the first API caller has been authorized to process the resources of the first resource owner, the first operation is performed. Compared with the situation where the first process and the second process still need to be performed after being authorized, the first process and / or the second process can be chosen not to be performed, thereby reducing redundant authorization.

[0075] In conjunction with some embodiments of the first aspect, in some embodiments, determining that the first API caller has been authorized to process the resources of the first resource owner includes:

[0076] It is determined that the first API caller has obtained authorization to process the resources of the first resource owner through the common API framework CAPIF.

[0077] In the above embodiment, the first operation can be performed after determining that the first API caller has obtained authorization to process the resources of the first resource owner through CAPIF. Compared with the situation where the first process and the second process still need to be executed after being authorized, the first process and / or the second process can be chosen not to be executed, thereby reducing redundant authorization.

[0078] In conjunction with some embodiments of the first aspect, in some embodiments, based on the acquired first token information, it is determined that the first API caller has been authorized to process the resources of the first resource owner;

[0079] The first token information includes identification information of the first resource owner and / or identification information of the first API caller.

[0080] In the above embodiment, it can be clearly determined based on the first token information that the first API caller has been authorized to process the resources of the first resource owner.

[0081] In conjunction with some embodiments of the first aspect, in some embodiments, skipping the first process includes:

[0082] It is determined that the first network function can directly trigger the second network function to authorize the first API to process the resources of the first resource owner, and the first process is skipped.

[0083] In the above embodiment, if it is determined that the first network function can directly trigger (without relying on other entities to trigger) the second network function to authorize the first API to process the resources of the first resource owner, the first process is skipped.

[0084] In conjunction with some embodiments of the first aspect, in some embodiments, sending the second information to the third network function includes:

[0085] Determine that the first network function needs to trigger the second network function through a third network function to authorize the first API to process the resources of the first resource owner, or that the first network function needs to trigger the second network function through a third network function to send a privacy file or authorization information related to the first resource owner to the third network function, and send the second information to the third network function.

[0086] In the above embodiment, when it is determined that the first network function needs to trigger the second network function through the third network function to authorize the first API to process the resources of the first resource owner or the first network function needs to trigger the second network function through the third network function to send the privacy file or authorization information related to the first resource owner to the third network function, the second information is sent to the third network function.

[0087] In conjunction with some embodiments of the first aspect, in some embodiments, the resources of the first resource owner include at least one of the following:

[0088] Location information;

[0089] service information;

[0090] Terminal routing policy URSP rules.

[0091] In a second aspect, an embodiment of the present disclosure provides an authorization method, which is performed by a third network function, and includes:

[0092] receiving first information sent by the first network function;

[0093] The first information is used to instruct the second network function to skip authorizing the first API caller.

[0094] In combination with some embodiments of the second aspect, the first information is information sent by the first network function after determining that the first API caller has been authorized to process the resources of the first resource owner.

[0095] In a third aspect, an embodiment of the present disclosure provides an authorization method, which is performed by a third network function, and includes:

[0096] receiving second information sent by the first network function;

[0097] The second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner or a process in which the third network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0098] In combination with some embodiments of the third aspect, in some embodiments, the second information is information sent by the first network function after determining that the first API caller has been authorized to process the resources of the first resource owner.

[0099] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes:

[0100] In response to receiving the second information, the second process is not performed.

[0101] In conjunction with some embodiments of the third aspect, in some embodiments, the method further includes:

[0102] Based on the authorization result, determine whether to execute the second process.

[0103] In conjunction with some embodiments of the third aspect, in some embodiments, the resources of the first resource owner include at least one of the following:

[0104] Location information;

[0105] service information;

[0106] Terminal routing policy URSP rules.

[0107] In a fourth aspect, an embodiment of the present disclosure provides an authorization method, applied to a communication system, the method comprising:

[0108] The first network function sends the first information to the second network function and / or the first network function sends the second information to the third network function;

[0109] Among them, the first information is used to instruct the second network function to skip authorizing the first API caller; the second information is used to instruct the third network function not to execute the second process or indicate the authorization result related to the first application programming interface API caller; the second process is the process of the third network function requesting the second network function to authorize the first API caller to process the resources of the first resource owner or the process of the third network function requesting the second network function to send privacy information and / or authorization information related to the first resource owner.

[0110] In a fifth aspect, an embodiment of the present disclosure provides a first network function, where the first network function includes:

[0111] The processing module is configured to:

[0112] Execute a first operation;

[0113] The first operation includes at least one of the following:

[0114] Skipping the first process, wherein the first network function requests the second network function to authorize the first application programming interface (API) caller to process the resources of the first resource owner, or the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner;

[0115] Sending first information to a second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller; sending second information to a third network function, where the second information is used to instruct the third network function not to perform a second process or indicate an authorization result related to the first application programming interface (API) caller; the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner, or a process in which the third network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0116] In a sixth aspect, an embodiment of the present disclosure provides a second network function, where the second network function includes:

[0117] The transceiver module is configured as follows:

[0118] receiving first information sent by the first network function;

[0119] The first information is used to instruct the second network function to skip authorizing the first API caller.

[0120] In a seventh aspect, an embodiment of the present disclosure provides a third network function, where the third network function includes:

[0121] The transceiver module is configured as follows:

[0122] receiving second information sent by the first network function;

[0123] The second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner or a process in which the third network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0124] In an eighth aspect, an embodiment of the present disclosure provides a communication system, wherein the communication system includes a first network function, a second network function, and a third network function, the first network function being configured to implement the authorization method described in the optional implementation manner of the first aspect, the second network function being configured to implement the authorization method described in the optional implementation manner of the second aspect, and the third network function being configured to implement the authorization method described in the optional implementation manner of the third aspect.

[0125] In a ninth aspect, an embodiment of the present disclosure provides a first network function, where the first network function includes:

[0126] one or more processors;

[0127] The processor is used to call instructions to enable the first network function to execute the authorization method described in the optional implementation manner of the first aspect.

[0128] In a tenth aspect, an embodiment of the present disclosure provides a second network function, where the second network function includes:

[0129] one or more processors;

[0130] The processor is used to call instructions to enable the second network function to execute the authorization method described in the optional implementation manner of the second aspect.

[0131] In an eleventh aspect, an embodiment of the present disclosure provides a third network function, wherein the third network function includes:

[0132] one or more processors;

[0133] The processor is used to call instructions to enable the third network function to execute the authorization method described in the optional implementation manner of the third aspect.

[0134] In the twelfth aspect, an embodiment of the present disclosure provides a storage medium, wherein the storage medium stores instructions, which, when the instructions are executed on a communication device, enable the communication device to execute the authorization method described in the optional implementation of the first aspect, the second aspect, the third aspect or the fourth aspect.

[0135] In a thirteenth aspect, an embodiment of the present disclosure provides a program product, which, when executed by a communication device, enables the communication device to execute the authorization method described in the optional implementation of the first aspect, the second aspect, the third aspect or the fourth aspect.

[0136] In a fourteenth aspect, an embodiment of the present disclosure provides a computer program, which, when executed on a computer, enables the computer to execute the authorization method described in the optional implementation of the first aspect, the second aspect, the third aspect, or the fourth aspect.

[0137] It is understandable that the first network function, the second network function, the third network function, the communication system, the storage medium, the program product, and the computer program are all used to perform the method provided in the embodiments of the present disclosure. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding methods and will not be repeated here.

[0138] The embodiments of the present disclosure provide an authorization method, a first network function, a second network function, a third network function, a communication system, and a storage medium. In some embodiments, the terms authorization method, information processing method, information transmission method, etc. can be used interchangeably.

[0139] The embodiments of the present disclosure are not exhaustive and are merely illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a certain embodiment can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment can be arbitrarily exchanged. In addition, the optional implementation methods in a certain embodiment can be arbitrarily combined; in addition, the embodiments can be arbitrarily combined. For example, some or all steps of different embodiments can be arbitrarily combined, and a certain embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0140] In each embodiment of the present disclosure, unless otherwise specified or provided for by logic, the terms and / or descriptions between the embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form a new embodiment based on their inherent logical relationships.

[0141] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

[0142] In the embodiments of the present disclosure, unless otherwise specified, elements expressed in the singular, such as "a", "an", "the", "above", "said", "the", "the", etc., may mean "one and only one", or "one or more", "at least one", etc. For example, when using articles such as "a", "an", "the" in English in translation, the noun following the article may be understood as a singular expression or a plural expression.

[0143] In the embodiments of the present disclosure, “plurality” refers to two or more.

[0144] In some embodiments, the terms "at least one," "one or more," "a plurality of," "multiple," etc. may be used interchangeably.

[0145] In some embodiments, descriptions such as "at least one of A and B," "A and / or B," "in one case A, in another case B," or "in one case A, in another case B" may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); and in some embodiments, A and B (both A and B are executed). The same applies when there are more branches such as A, B, and C.

[0146] In some embodiments, "A or B" and other descriptions may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). The above is also applicable when there are more branches such as A, B, C, etc.

[0147] The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects and do not constitute any restriction on the position, order, priority, quantity or content of the description objects. For the statement of the description object, please refer to the description in the context of the claims or embodiments, and no unnecessary restriction should be constituted due to the use of prefixes. For example, if the description object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields". "First" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the description object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of description objects is not limited by the ordinal number and can be one or more. Taking "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the description object is "device", then the "first device" and the "second device" can be the same device or different devices, and their types can be the same or different; for another example, if the description object is "information", then the "first information" and the "second information" can be the same information or different information, and their contents can be the same or different.

[0148] In some embodiments, “including A,” “comprising A,” “used to indicate A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0149] In some embodiments, terms such as "...", "determine...", "in the case of...", "at the time of...", "when...", "if...", "if...", etc. can be used interchangeably.

[0150] In some embodiments, terms such as "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not less than", and "above" can be replaced with each other, and terms such as "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", and "below" can be replaced with each other.

[0151] In some embodiments, devices, etc. can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as "device", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", and "subject" can be used interchangeably.

[0152] In some embodiments, "network" can be interpreted as devices included in the network (eg, access network equipment, core network equipment, etc.).

[0153] In some embodiments, the terms "access network device (AN device)", "radio access network device (RAN device)", "base station (BS)", "radio base station" "fixed station", "node", "access point", "transmission point (TP)", "reception point (RP)", "transmission / reception point (TRP)", "panel", "antenna panel", "antenna array", "cell", "macro cell", "small cell", "femto cell", "pico cell", "sector", "cell group", "serving cell", "carrier", "component carrier", "bandwidth part (BWP)" and the like may be used interchangeably.

[0154] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, etc. can be used interchangeably.

[0155] In some embodiments, the access network device, the core network device, or the network device can be replaced by a terminal. For example, the various embodiments of the present disclosure can also be applied to a structure in which the communication between the access network device, the core network device, or the network device and the terminal is replaced by communication between multiple terminals (for example, device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, it is also possible to set the structure in which the terminal has all or part of the functions of the access network device. In addition, Terms such as "uplink" and "downlink" can also be replaced with terms corresponding to communication between terminals (for example, "side"). For example, uplink channels, downlink channels, etc. can be replaced with side channels, and uplinks, downlinks, etc. can be replaced with side links.

[0156] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, the core network device, or the network device may have a structure that has all or part of the functions of the terminal.

[0157] In some embodiments, obtaining data, information, etc. may comply with the laws and regulations of the country where the data is obtained.

[0158] In some embodiments, data, information, etc. may be obtained with the user's consent.

[0159] In addition, each element, each row, or each column in the table of the embodiment of the present disclosure can be implemented as an independent embodiment, and the combination of any elements, any rows, and any columns can also be implemented as an independent embodiment.

[0160] FIG1 is a schematic diagram showing the architecture of a communication system according to an embodiment of the present disclosure.

[0161] As shown in Figure 1, the communication system 100 includes a first network function 101, a second network function 102, and a third network function 103. The network function can be a network element. Of course, the communication system 100 of the present disclosure can also include terminals and access network equipment, etc., which are not limited here.

[0162] In some embodiments, the first network function 101 may be a network exposure function (NEF) or an application programming interface (API) exposing function (AEF).

[0163] In some embodiments, the second network function may be Unified Data Management (UDM).

[0164] In some embodiments, the third network function may be a Gateway Mobile Location Center (GMLC) or a sensing function.

[0165] In some embodiments, the terminal includes, for example, a mobile phone, a wearable device, an Internet of Things device, a car with communication function, a smart car, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, and at least one of a wireless terminal device in a smart home, but is not limited thereto.

[0166] In some embodiments, the access network device may be, for example, a node or device that accesses a terminal to a wireless network. The access network device may include an evolved NodeB (eNB), a next generation evolved NodeB (ng-eNB), a next generation NodeB (gNB), a node B (NB), a home node B (HNB), a home evolved nodeB (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an open base station (Open RAN), a cloud base station (Cloud RAN), a base station in other communication systems, and at least one of an access node in a Wi-Fi system, but is not limited thereto.

[0167] In some embodiments, the technical solution of the present disclosure can be applied to the Open RAN architecture. In this case, the interfaces between or within the access network devices involved in the embodiments of the present disclosure can be transformed into internal interfaces of the Open RAN, and the processes and information interactions between these internal interfaces can be implemented through software or programs.

[0168] In some embodiments, the access network device can be composed of a centralized unit (CU) and a distributed unit (DU), where the CU can also be called a control unit. The CU-DU structure can be used to split the protocol layer of the access network device, with the functions of some protocol layers centrally controlled by the CU, and the functions of the remaining part or all of the protocol layers distributed in the DU, which is centrally controlled by the CU, but is not limited to this.

[0169] In some embodiments, the core network device may be a single device including a first network element, or may be a plurality of devices or a group of devices, each including a first network element. The network element may be virtual or physical. The core network may include, for example, at least one of an Evolved Packet Core (EPC), a 5G Core Network (5GCN), and a Next Generation Core (NGC).

[0170] It can be understood that the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.

[0171] The following embodiments of the present disclosure may be applied to the communication system 100 shown in Figure 1, or a portion thereof, but are not limited thereto. The entities shown in Figure 1 are illustrative only. The communication system may include all or part of the entities shown in Figure 1, or may include other entities outside of Figure 1. The number and form of the entities may be arbitrary. The connection relationship between the entities is illustrative only. The entities may be connected or disconnected, and the connection may be in any manner, including direct or indirect, wired or wireless.

[0172] The embodiments of the present disclosure can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G new radio (NR), future radio access (FRA), new radio access technology (RAT), new radio (NR), new radio access (NX), future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X), systems utilizing other communication methods, and next-generation systems based on and extending these methods. Furthermore, multiple systems may be combined (for example, a combination of LTE or LTE-A with 5G).

[0173] In some embodiments, in a SNAAPPY scenario or RNAA scenario, with the support of the Common API Framework (CAPIF), the NEF or AEF can directly authorize the application function (AF) or API caller to request processing of resources of a specific terminal or user through interaction with the resource owner.

[0174] In some embodiments, in order to authorize the AF to process resources of a specific user (e.g., service parameters such as location and routing parameters) via a specific resource owner, the NEF or AEF first authorizes the AF to request a specific service. Then, the NEF or AEF itself or another network function NF (e.g., GLMC) triggered by the NEF needs to send a request to the UDM to authorize the AF to create, update, or delete resources of the specific resource owner.

[0175] In some embodiments, for an NEF or AEF that supports SNAAPPY or RNAA, if AF authorization is triggered, both UDM-based authorization and SNAAPPY or RNAA-based authorization will occur, and there is no relevant mechanism to alleviate the redundant authorization problem.

[0176] FIG2a is an interactive diagram of an authorization method according to an embodiment of the present disclosure. As shown in FIG2a, the present disclosure embodiment relates to an authorization method for a communication system 100, the method comprising:

[0177] Step S2101: The first network function determines that the first API caller has been authorized to process the resources of the first resource owner.

[0178] In some embodiments, the first API caller (API invoker) may be one of the following: an application function (Application function), a terminal, an application running on the terminal (Application residing on the UE), or a client running on the terminal (client in the UE).

[0179] It should be noted that the difference between the client and the application is that the client is a program that is deeply integrated with the underlying terminal system. For example, the edge enabler client can enable the terminal to support edge computing functions.

[0180] In some embodiments, the first resource owner may be one of the following: an end user, a subscriber, or a terminal (UE).

[0181] In some embodiments, processing a resource includes at least one of: obtaining a resource, creating a resource, updating a resource, and deleting a resource.

[0182] In some embodiments, the first network function may authorize the first API caller to process the resources of the first resource owner by interacting with the first resource owner.

[0183] In some embodiments, the first network function sends a request message to the first resource owner and receives a response message sent by the first resource owner in response to the request message, wherein the response message may include first token information indicating that the first API caller is authorized to process resources of the first resource owner.

[0184] In some embodiments, the first token information may include identification information of the first resource owner and / or identification information of the first API caller.

[0185] In some embodiments, the identification information of the first resource owner may be at least one of the following:

[0186] The application layer identifier of the first resource owner;

[0187] Subscription Permanent Identifier (SUPI);

[0188] Generic Public Subscription Identifier (GPSI)

[0189] In some embodiments, the identifier of the first API caller includes at least one of the following:

[0190] Application ID;

[0191] Application function ID (or AF ID).

[0192] In some embodiments, based on the obtained first token information, the first network function determines that the first API caller is authorized to process the resources of the first resource owner.

[0193] In some embodiments, the first network function determines that the first API caller has obtained authorization to process the resources of the first resource owner through the common API framework CAPIF.

[0194] In some embodiments, the first network function determines, through CAPIF, that the first API caller is authorized.

[0195] Step S2102: The first network function performs a first operation.

[0196] In some embodiments, it is determined that the first API caller is authorized to process the resources of the first resource owner, and the first operation is performed.

[0197] In some embodiments, it is determined that the first API caller has obtained authorization to process the resources of the first resource owner through the common API framework CAPIF, and a first operation is performed.

[0198] In some embodiments, the first operation may be skipping or not executing the first process.

[0199] In some embodiments, the first process is a process in which the first network function requests the second network function to authorize the first application programming interface (API) caller to process resources of the first resource owner.

[0200] In some embodiments, the first process is a process in which the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner.

[0201] In some embodiments, the privacy information indicates the user's privacy preference, for example, unwillingness to disclose location information.

[0202] In some embodiments, the private information may also be a privacy profile.

[0203] In some embodiments, the authorization information may refer to authorization information that is not related to privacy. For example, the authorization information may be that the AF can modify the QoS of the terminal or the terminal routing policy (URSP) rule. Here, the modification of the QoS or URSP rule may be unrelated to privacy.

[0204] In some embodiments, after obtaining the privacy profile and / or authorization information, the first network function may determine whether to allow the first API caller to process the resources of the first resource owner based on the privacy information and / or authorization information. It should be noted that the privacy information referred to in this disclosure can be replaced by a privacy profile, and the two are interchangeable, and are not limited here.

[0205] In some embodiments, the first network function determines that the first network function can directly trigger the second network function to authorize the first API to process the resource of the first resource owner, skipping the first process.

[0206] In some embodiments, the first network function sends first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller.

[0207] In some embodiments, skipping authorization may be that the second network function (eg, UDM) skips authorizing the first API caller (API invoker) to modify the URSP rule (UE routing) of the first resource owner (eg, terminal).

[0208] In some embodiments, skipping authorization may involve a second network function (e.g., a UDM) skipping authorization for the first API invoker to process resources of the first resource owner. Exemplarily, the resources include location information and / or QoS information. In some embodiments, the first operation may include sending the second information to a third network function.

[0209] In some embodiments, the second information is used to instruct the third network function not to execute the second process.

[0210] In some embodiments, the second process is a process in which the third network function requests the second network function to authorize the first API caller to process the resources of the first resource owner.

[0211] In some embodiments, the second process is a process in which the third network function requests the second network function to send private file information and / or authorization information related to the first resource owner.

[0212] In some embodiments, the second information is used to indicate an authorization result related to the first application programming interface (API) caller.

[0213] In some embodiments, the authorization result may indicate that the first API caller has been authorized to process the resources of the first resource owner. It should be noted that after receiving the authorization result, the third network function may determine whether to execute or not execute the second process based on the authorization result.

[0214] In some embodiments, it is determined that the first network function needs to trigger the second network function through a third network function to authorize the first API to process the resource of the first resource owner, and the second information is sent to the third network function.

[0215] In some embodiments, it is determined that the first network function needs to trigger the second network function through a third network function to send privacy information and / or authorization information related to the first resource owner to the third network function, and the second information is sent to the third network function.

[0216] Step S2103: The second network function performs the second operation or the third network function performs the third operation.

[0217] In some embodiments, the second network function performs a second operation after receiving the first information.

[0218] In some embodiments, the second operation may be an operation to skip authorization.

[0219] In some embodiments, the third network function performs a third operation after receiving the second information.

[0220] In some embodiments, the third operation may be skipping or not executing the second process.

[0221] In some embodiments, in response to receiving the second information, the third network function does not perform the second process.

[0222] In some embodiments, the third operation may be to execute or perform the second process based on the authorization result.

[0223] In some embodiments, based on the authorization result, the third network function does not perform the second process.

[0224] In some embodiments, the term "information" can be interchangeable with terms such as "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "field", and "data".

[0225] In some embodiments, the term "send" can be interchangeable with terms such as "transmit", "report", and "transmit".

[0226] The information indication method involved in the embodiments of the present disclosure may include at least one of steps S2101 to S2103. For example, step S2101 may be implemented as an independent embodiment, step S2102 may be implemented as an independent embodiment, and step S2103 may be implemented as an independent embodiment. For example, step S2101 combined with step S2102 may be implemented as independent embodiments, but the present invention is not limited thereto.

[0227] Figure 3a is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 3a, the embodiment of the present disclosure relates to an authorization method, which is performed by a first network function, and the method includes:

[0228] Step S3101: Determine whether the first API caller has been authorized to process the resources of the first resource owner.

[0229] In some embodiments, the optional implementation of step S3101 can refer to the optional implementation of step S2101 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

[0230] Step S3102: Execute the first operation.

[0231] In some embodiments, the optional implementation of step S3102 can refer to the optional implementation of step S2102 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

[0232] The information indication method involved in the embodiment of the present disclosure may include at least one of step S3101 to step S3102. For example, step S3101 may be implemented as an independent embodiment, and step S3102 may be implemented as an independent embodiment, but is not limited thereto.

[0233] Figure 3b is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 3b, the embodiment of the present disclosure relates to an authorization method, which is performed by a first network function, and the method includes:

[0234] Step S3201: Execute the first operation.

[0235] In some embodiments, the first operation includes at least one of the following:

[0236] Skipping the first process, wherein the first network function requests the second network function to authorize the first application programming interface (API) caller to process the resources of the first resource owner, or the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner;

[0237] Sending second information to the third network function, where the second information is used to instruct the third network function not to perform the second process or indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner, or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0238] In some embodiments, the optional implementation of step S3201 can refer to the optional implementation of step S2102 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

[0239] In some embodiments, performing the first operation includes:

[0240] Determine that the first API caller is authorized to process the resources of the first resource owner, and perform the first operation.

[0241] In some embodiments, determining that the first API caller is authorized to process the resource of the first resource owner includes:

[0242] It is determined that the first API caller has obtained authorization to process the resources of the first resource owner through the common API framework CAPIF.

[0243] In some embodiments, determining that the first API caller is authorized to process the resource of the first resource owner includes:

[0244] Determining, based on the acquired first token information, that the first API caller is authorized to process the resources of the first resource owner;

[0245] The first token information includes identification information of the first resource owner and / or identification information of the first API caller.

[0246] In some embodiments, skipping the first process includes:

[0247] It is determined that the first network function can directly trigger the second network function to authorize the first API to process the resources of the first resource owner, and the first process is skipped.

[0248] In some embodiments, sending the second information to the third network function includes:

[0249] Determine that the first network function needs to trigger the second network function through a third network function to authorize the first API to process the resources of the first resource owner, or that the first network function needs to trigger the second network function through a third network function to send privacy information and / or authorization information related to the first resource owner to the third network function, and send the second information to the third network function.

[0250] In some embodiments, the resources of the first resource owner include at least one of the following:

[0251] Location information;

[0252] service information;

[0253] Terminal routing policy rule URSP.

[0254] Figure 4a is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 4a, the embodiment of the present disclosure relates to an authorization method, which is performed by a second network function, and the method includes:

[0255] Step S4101: Execute the second operation.

[0256] In some embodiments, the optional implementation of step S4101 can refer to the optional implementation of step S2103 in Figure 2a and other related parts in the embodiment involved in Figure 2a, which will not be repeated here.

[0257] Figure 4b is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 4b, the present disclosure embodiment relates to an authorization method, which is performed by a second network function, and the method includes:

[0258] Step S4201: Obtain first information.

[0259] In some embodiments, the first information is used to instruct the second network function to skip authorizing the first API caller.

[0260] In some embodiments, skipping authorization may be that the second network function (eg, UDM) skips authorizing the first API caller (API invoker) to modify the URSP rule (UE routing) of the first resource owner (eg, terminal).

[0261] In some embodiments, skipping authorization may be that the second network function (eg, UDM) skips authorizing the first API caller (API invoker) to process resources of the first resource owner. Exemplarily, the resources include location information and / or QoS information, etc.

[0262] In some embodiments, the second network function obtains the first information sent by the first network function, but is not limited thereto and may also receive the first information sent by other entities.

[0263] In some embodiments, the second network function obtains first information specified by the protocol.

[0264] In some embodiments, the second network function obtains the first information from an upper layer(s).

[0265] In some embodiments, the second network function performs processing to obtain the first information.

[0266] In some embodiments, step S4201 is omitted, and the third network function autonomously implements the function indicated by the first information, or the above function is default or by default.

[0267] In some embodiments, the optional implementation of step S4201 can refer to the optional implementation of step S2102 and step S2103 in Figure 2a, and other related parts in the embodiment involved in Figure 2a, which will not be repeated here.

[0268] In some embodiments, the first information is information sent by the first network function after determining that the first API caller is authorized to process the resources of the first resource owner.

[0269] Figure 5a is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 5a, the present disclosure embodiment relates to an authorization method, which is performed by a third network function, and the method includes:

[0270] Step S5101: Execute the second operation.

[0271] In some embodiments, the optional implementation of step S5101 can refer to the optional implementation of step S2103 in Figure 2a and other related parts of the embodiment involved in Figure 2a, which will not be repeated here.

[0272] Figure 5b is a flow chart of an authorization method according to an embodiment of the present disclosure. As shown in Figure 5b, the present disclosure embodiment relates to an authorization method, which is performed by a third network function, and the method includes:

[0273] Step S5201: Obtain second information.

[0274] In some embodiments, the second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0275] In some embodiments, the optional implementation of step S5201 can refer to the optional implementation of step S2102 and step S2103 in Figure 2a, and other related parts in the embodiment involved in Figure 2a, which will not be repeated here.

[0276] In some embodiments, the third network function obtains the second information sent by the first network function, but is not limited thereto and may also receive the second information sent by other entities.

[0277] In some embodiments, the third network function obtains second information specified by the protocol.

[0278] In some embodiments, the third network function obtains the second information from an upper layer(s).

[0279] In some embodiments, the third network function performs processing to obtain the second information.

[0280] In some embodiments, step S5201 is omitted, and the third network function autonomously implements the function indicated by the second information, or the above function is default or by default.

[0281] In some embodiments, the second information is information sent by the first network function after determining that the first API caller is authorized to process the resources of the first resource owner.

[0282] In some embodiments, the method further comprises:

[0283] Determine that the second information is received and do not execute the second process.

[0284] In some embodiments, the method further comprises:

[0285] Based on the authorization result, determine whether to execute the second process.

[0286] In some embodiments, the resources of the first resource owner include at least one of the following:

[0287] Location information;

[0288] service information;

[0289] Terminal routing policy rule URSP.

[0290] Figure 6a is an interactive diagram of an authorization method according to an embodiment of the present disclosure. As shown in Figure 6a, the present disclosure embodiment relates to an authorization method, which is used in a communication system 100 and includes one of the following steps:

[0291] Step S6101: The first network function sends first information to the second network function and / or the first network function sends second information to the third network function.

[0292] In some embodiments, the first information is used to instruct the second network function to skip authorizing the first API caller; the second information is used to instruct the third network function not to execute the second process or indicate the authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

[0293] Optional implementations of step S6101 can refer to the optional implementations of step S2101, step S2102 and step S2103 in Figure 2a, and other related parts in the embodiment involved in Figure 2a, which will not be repeated here.

[0294] In some embodiments, the above method may include the methods of the above-mentioned communication system side, first network function side, second network function side, etc., which will not be repeated here.

[0295] Figure 7a is an interactive diagram of an authorization method according to an embodiment of the present disclosure. As shown in Figure 6a, the embodiment of the present disclosure relates to an authorization method, which includes:

[0296] Step S7101: The NEF or AEF has determined that the API caller has been authorized by the CAPIF to utilize a specific service to process the resource owner's resources (e.g., location parameters, service parameters (routing parameters)). Specifically, the NEF or AEF confirms that the API caller has obtained the authorization by obtaining a valid authorization token of the API caller containing information related to the user (first API caller) or owner (first resource owner).

[0297] Step S7102a: Based on the token for the API caller, the NEF or AEF determines how to continue processing the request. If the NEF or AEF does not need to trigger another network function (NF) to obtain authorization from the UDM, the NEF or AEF skips the process of obtaining authorization from the UDM to continue processing the request or instructs the UDM to skip authorizing the API caller to process the resource owner's resources. After skipping the process or sending the instruction to the UDM, the NEF or AEF can directly send the request to the Unified Data Repository (UDR) so that the UDR can trigger the service specific information provisioning procedure. The instruction to the UDM to skip authorization can be an instruction to the UDM to skip authorizing the first API caller to modify the URSP rule (UE routing) of the first resource owner (e.g., terminal). The instruction to the UDM to skip authorization can also be an instruction to the UDM to skip authorizing the first API caller to process the resources of the first resource owner. Exemplarily, the resources include location information and / or QoS information, etc.

[0298] Step S7102b: Based on the token used for the API caller, the NEF or AEF determines how to continue processing the request. If the NEF needs to trigger another NF (for example, GMLC) to obtain authorization, the NEF or AEF should send an indicator (second information) to the NF that needs to be triggered. The indicator indicates that the NF does not need to perform UDM-based authorization. The UDM-based authorization can be that the NF obtains the privacy file or authorization information related to the resource owner from the UDM side, and confirms whether the API caller is allowed to process the resources of the resource owner based on the privacy file or authorization information. The UDM-based authorization can be that the NF sends an indication message to the UDM, and the indication message instructs the UDM to confirm whether the API caller is allowed to process the resources of the resource owner based on the privacy file or authorization information.

[0299] Step S7103: After receiving the indicator, the NF should continue processing the request by skipping obtaining authorization from the UDM.

[0300] In one embodiment, the authorization information stored in the UDM and CAPIF core functions are synchronized or identical.

[0301] The information indication method involved in the embodiments of the present disclosure may include at least one of steps S7101 to S7103. For example, step S7101 can be implemented as an independent embodiment, step S7102a can be implemented as an independent embodiment, step S7102b can be implemented as an independent embodiment, and step S7103 can be implemented as an independent embodiment. For example, step S7101 combined with step S7102a and step S7103 can be implemented as an independent embodiment, and step S7101 combined with step S7102b and step S7103 can be implemented as an independent embodiment, but the present invention is not limited thereto.

[0302] The embodiments of the present disclosure also provide an apparatus for implementing any of the above methods. For example, an apparatus is provided, comprising units or modules for implementing each step performed by a terminal in any of the above methods. For another example, another apparatus is provided, comprising units or modules for implementing each step performed by a network device (e.g., an access network device or a core network device) in any of the above methods.

[0303] It should be understood that the division of the various units or modules in the above devices is merely a division of logical functions. In actual implementation, they may be fully or partially integrated into a physical entity, or they may be physically separated. In addition, the units or modules in the device may be implemented in the form of a processor calling software: for example, the device includes a processor, the processor is connected to a memory, and the memory stores instructions. The processor calls the instructions stored in the memory to implement any of the above methods or implement the functions of the various units or modules of the above devices, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory within the device or a memory outside the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units or modules can be realized by designing the hardware circuits. The above-mentioned hardware circuits can be understood as one or more processors; for example, in one implementation, the above-mentioned hardware circuit is an application-specific integrated circuit (ASIC), which realizes the functions of some or all of the above units or modules by designing the logical relationship of the components in the circuit; for example, in another implementation, the above-mentioned hardware circuit can be realized by a programmable logic device (PLD). Taking a field programmable gate array (FPGA) as an example, it can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by configuring the configuration file, thereby realizing the functions of some or all of the above units or modules. All units or modules of the above devices can be realized in the form of software called by the processor, or in the form of hardware circuits, or in part by the form of software called by the processor, and the rest by hardware circuits.

[0304] In the embodiments of the present disclosure, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit. The logical relationship of the above-mentioned hardware circuit is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0305] Figure 8a is a schematic diagram of the structure of the first network function provided by an embodiment of the present disclosure. As shown in Figure 8a, the first network function 8100 includes: a transceiver module 8101 and a processing module 8102; the transceiver module 8101 is configured to send the second information; and the processing module 8102 is configured to perform the first operation. Optionally, the transceiver module 8101 is used to execute the steps related to information transmission performed by the first network function 8100 in any of the above authorization methods, which are not repeated here. Optionally, the processing module 8102 is used to execute the steps related to information processing performed by the first network function in any of the above authorization methods, which are not repeated here.

[0306] Figure 8b is a schematic diagram of the structure of the second network function provided in an embodiment of the present disclosure. As shown in Figure 8b, the second network function 8200 includes: a transceiver module 8201 and a processing module 8202; the transceiver module 8201 is configured to receive the first information; and the processing module 8202 is configured to perform the second operation. Optionally, the transceiver module 8201 is used to perform the steps related to information reception performed by the second network function 8200 in any of the above authorization methods, which are not further described here. Optionally, the processing module 8202 is used to perform the steps related to information processing performed by the second network function in any of the above authorization methods, which are not further described here.

[0307] Figure 8c is a schematic diagram of the structure of the third network function provided in an embodiment of the present disclosure. As shown in Figure 8c, the third network function 7300 includes: a transceiver module 7301 and a processing module 7302; the transceiver module 7301 is configured to receive the second information; and the processing module 7302 is configured to perform the third operation. Optionally, the transceiver module 7301 is configured to perform the steps related to information reception performed by the third network function 7300 in any of the above authorization methods, which are not further described here. Optionally, the processing module 7302 is configured to perform the steps related to information processing performed by the third network function in any of the above authorization methods, which are not further described here.

[0308] Figure 9a is a schematic diagram of the structure of a communication device 8100 provided in an embodiment of the present disclosure. Communication device 8100 can be a network device (e.g., an access network device or a core network device), a terminal (e.g., a user device), a chip, a chip system, or a processor that supports a network device in implementing any of the above methods, or a chip, a chip system, or a processor that supports a terminal in implementing any of the above information indication methods. Communication device 8100 can be used to implement the information indication method described in the above method embodiments. For details, please refer to the description of the above method embodiments.

[0309] As shown in Figure 9a, the communication device 8100 includes one or more processors 8101. The processor 8101 can be a general-purpose processor or a dedicated processor, for example, a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data, and the central processing unit can be used to control the communication device (such as a base station, baseband chip, terminal device, terminal device chip, DU or CU, etc.), execute programs, and process program data. The processor 8101 is used to call instructions to enable the communication device 8100 to execute any of the above communication methods.

[0310] In some embodiments, the communication device 8100 further includes one or more memories 8102 for storing instructions. Optionally, all or part of the memories 8102 may be located outside the communication device 8100.

[0311] In some embodiments, the communication device 8100 further includes one or more transceivers 8103. When the communication device 8100 includes one or more transceivers 8103, the communication steps such as sending and receiving in the above method are performed by the transceiver 8103, and the other steps are performed by the processor 8101.

[0312] In some embodiments, a transceiver may include a receiver and a transmitter, which may be separate or integrated. Optionally, the terms transceiver, transceiver unit, transceiver, and transceiver circuit may be used interchangeably; the terms transmitter, transmitting unit, transmitter, and transmitting circuit may be used interchangeably; and the terms receiver, receiving unit, receiver, and receiving circuit may be used interchangeably.

[0313] Optionally, the communication device 8100 further includes one or more interface circuits 8104, which are connected to the memory 8102. The interface circuits 8104 can be used to receive signals from the memory 8102 or other devices, and can be used to send signals to the memory 8102 or other devices. For example, the interface circuits 8104 can read instructions stored in the memory 8102 and send the instructions to the processor 8101.

[0314] The communication device 8100 described in the above embodiment may be a network device or a terminal, but the scope of the communication device 8100 described in the present disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG. 9a. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be: (1) an independent integrated circuit IC, or a chip, or a chip system or subsystem; (2) a collection of one or more ICs, optionally, the above IC collection may also include a storage component for storing data or programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, a terminal device, an intelligent terminal device, a cellular phone, a wireless device, a handheld device, a mobile unit, an in-vehicle device, a network device, a cloud device, an artificial intelligence device, etc.; (6) others, etc.

[0315] FIG9 b is a schematic diagram of the structure of the chip 8200 provided in an embodiment of the present disclosure. If the communication device 8100 can be a chip or a chip system, please refer to the schematic diagram of the structure of the chip 8200 shown in FIG9 b , but the present disclosure is not limited thereto.

[0316] The chip 8200 includes one or more processors 8201 , and the processor 8201 is used to call instructions so that the chip 8200 executes any of the above communication methods.

[0317] In some embodiments, chip 8200 further includes one or more interface circuits 8202, which are connected to memory 8203. Interface circuit 8202 can be used to receive signals from memory 8203 or other devices, and can be used to send signals to memory 8203 or other devices. For example, interface circuit 8202 can read instructions stored in memory 8203 and send the instructions to processor 8201. Optionally, the terms interface circuit, interface, transceiver pin, and transceiver are interchangeable.

[0318] In some embodiments, the chip 8200 further includes one or more memories 8203 for storing instructions. Alternatively, all or part of the memories 8203 may be outside the chip 8200.

[0319] The present disclosure also provides a storage medium having instructions stored thereon, which, when executed on the communication device 8100, causes the communication device 8100 to execute any of the above methods. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but may also be a transient storage medium.

[0320] The present disclosure further provides a program product, which, when executed by the communication device 8100, enables the communication device 8100 to perform any of the above communication methods. Optionally, the program product is a computer program product.

[0321] The present disclosure also provides a computer program, which, when executed on a computer, enables the computer to execute any one of the above communication methods.

[0322] Other embodiments of the present invention will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow from the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the invention being indicated by the following claims.

[0323] It should be understood that the present invention is not limited to the exact construction described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. An authorization method, characterized in that: The method is performed by a first network function, and the method includes: Execute a first operation; The first operation includes at least one of the following: Skipping a first process, wherein the first process is a process in which the first network function requests the second network function to authorize the first application programming interface API caller to process resources of the first resource owner or a process in which the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner; Sending first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller; Sending second information to the third network function, where the second information is used to instruct the third network function not to execute the second process or to indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

2. The method according to claim 1, characterized in that The performing of the first operation includes: Determine that the first API caller has been authorized to process the resources of the first resource owner, and perform the first operation.

3. The method according to claim 2, characterized in that The determining that the first API caller has been authorized to process the resources of the first resource owner includes: It is determined that the first API caller has obtained authorization to process the resources of the first resource owner through a common API framework CAPIF.

4. The method according to claim 2, characterized in that: The determining that the first API caller has been authorized to process the resources of the first resource owner includes: Based on the acquired first token information, determining that the first API caller has been authorized to process the resources of the first resource owner; The first token information includes identification information of the first resource owner and / or identification information of the first API caller.

5. The method according to claim 1, characterized in that: The skipping the first process comprises: It is determined that the first network function can directly trigger the second network function to authorize the first API to process the resources of the first resource owner, and the first process is skipped.

6. The method according to claim 1, characterized in that The sending the second information to the third network function includes: Determine that the first network function needs to trigger the second network function through a third network function to authorize the first API to process the resources of the first resource owner, or that the first network function needs to trigger the second network function through a third network function to send privacy information and / or authorization information related to the first resource owner to the third network function, and send the second information to the third network function.

7. The method according to any one of claims 1 to 6, characterized in that The resources of the first resource owner include at least one of the following: Location information; Service information; Terminal routing selection policy URSP rules.

8. An authorization method, characterized in that: The method is performed by a second network function, and the method includes: receiving first information sent by a first network function; The first information is used to instruct the second network function to skip authorizing the first API caller.

9. The method according to claim 8, characterized in that The first information is information sent by the first network function after determining that the first API caller has been authorized to process the resources of the first resource owner.

10. An authorization method, characterized in that: The method is performed by a third network function, and the method includes: receiving second information sent by the first network function; Among them, the second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

11. The method according to claim 10, characterized in that The second information is information sent by the first network function after determining that the first API caller has been authorized to process the resources of the first resource owner.

12. The method according to claim 10, characterized in that The method further comprises: Determine that the second information is received and do not execute the second process.

13. The method according to claim 10, characterized in that The method further comprises: Based on the authorization result, determine whether to execute the second process.

14. The method according to any one of claims 10 to 13, characterized in that: The resources of the first resource owner include at least one of the following: Location information; Service information; Terminal routing selection policy URSP rules.

15. An authorization method, characterized in that: Applied to a communication system, the method comprises: The first network function sends the first information to the second network function and / or the first network function sends the second information to the third network function; Among them, the first information is used to instruct the second network function to skip authorizing the first API caller; the second information is used to instruct the third network function not to execute the second process or indicate the authorization result related to the first API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

16. A first network function, characterized in that: The first network function includes: The processing module is configured as follows: Execute a first operation; The first operation includes at least one of the following: Skipping a first process, wherein the first process is a process in which the first network function requests the second network function to authorize the first application programming interface API caller to process resources of the first resource owner or a process in which the first network function requests the second network function to send privacy information and / or authorization information related to the first resource owner; Sending first information to the second network function, where the first information is used to instruct the second network function to skip authorizing the first API caller; Sending second information to the third network function, where the second information is used to instruct the third network function not to execute the second process or to indicate an authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

17. A second network function, characterized in that: The second network function includes: The transceiver module is configured as follows: receiving first information sent by a first network function; The first information is used to instruct the second network function to skip authorizing the first API caller.

18. A third network function, characterized in that: The third network function includes: The transceiver module is configured as follows: receiving second information sent by the first network function; Among them, the second information is used to instruct the third network function not to execute the second process or to indicate the authorization result related to the first application programming interface API caller; the second process is a process for the third network function to request the second network function to authorize the first API caller to process the resources of the first resource owner or a process for the third network function to request the second network function to send privacy information and / or authorization information related to the first resource owner.

19. A communication system, characterized in that: The communication system includes a first network function, a second network function and a third network function; the first network function is configured to implement the authorization method described in any one of claims 1 to 7, the second network function is configured to implement the authorization method described in any one of claims 8 to 9, and the third network function is configured to implement the authorization method described in any one of claims 10 to 14.

20. A first network function, characterized in that: The first network function includes: memory, including executable instructions; one or more processors; When the executable instructions are executed by the processor, the first network function executes the authorization method described in any one of claims 1 to 7.

21. A first network function, characterized in that: The second network function includes: memory, including executable instructions; one or more processors; When the executable instructions are executed by the processor, the second network function executes the authorization method described in any one of claims 8 to 9.

22. A third network device, characterized in that: The third network device comprises: memory, including executable instructions; one or more processors; When the executable instructions are executed by the processor, the third network device executes the authorization method according to any one of claims 10 to 14.

23. A storage medium, wherein: The storage medium stores instructions, and when the instructions are executed on the communication device, the communication device executes the authorization method described in any one of claims 1 to 7, 8 to 9, or claims 10 to 14.

Images