Communication method and apparatus

Abstract

Embodiments of the present application provide a communication method and apparatus, which are used for improving the security of an NF service provider network element. The method comprises: an NRF network element receives a first request from a first network element, the first request being used for discovering a second network element, or the first request being used for acquiring an access token of the second network element; determining whether the first request comprises a first parameter of the first network element; and when the first request does not comprise the first parameter, rejecting the first request.

Description

Communication method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 28, 2023, with application number 202311291986.8 and application name “A Communication Method and Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0004] The 3rd Generation Partnership Project (3GPP) defines a service-based architecture (SBA) network, in which network function (NF) service consumers (NFc) can request services from NF service producers (NFp). To support this, 3GPP introduced a Network Repository Function (NRF) to provide services such as NF registration, maintenance, discovery, and authorization. For example, an NFc can request discovery of an NFp from an NRF and authorization to access an NFp.

[0005] However, how to improve the security of discovering or accessing NFp network elements still needs further research.

[0006] Summary of the Invention

[0007] Embodiments of the present application provide a communication method and apparatus for improving the security of discovering or accessing a NF.

[0008] In a first aspect, a communication method is provided, which can be implemented by an NRF network element. The method includes: the NRF network element receives a first request from a first network element, where the first request is used to discover a second network element, or the first request is used to obtain an access token of the second network element; determines whether the first request includes a first parameter of the first network element; and when the first request does not include the first parameter, rejects the first request.

[0009] In an embodiment of the present application, when the first request from the first network element does not include the first parameter, the first network element may be a network element that is maliciously attacked, and the NRF network element may reject the first request, that is, the first network element cannot discover the second network element through the NRF network element, or the first network element cannot obtain the access token of the second network element through the NRF network element, thereby reducing the probability of the first network element attacking the second network element and improving the security of the NF service provider network element.

[0010] In one possible implementation, the NRF network element may reject the first request by sending first indication information to the first network element, wherein the first indication information is used to indicate that the first request is rejected; or, the first indication information is used to indicate that the first parameter is missing from the first request; or, the first indication information is used to instruct the first network element to send the first parameter; or, the first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request. In one possible implementation, the first indication information includes information for indicating the first parameter.

[0011] In the above technical solution, the NRF network element can reject the first request by sending a first indication message to the first network element. The first indication message may include information for indicating the first parameter, so that the first network element can know the reason why the first request was rejected when receiving the first indication message. In this way, if the first network element is not a malicious attack network element, the first network element can send the first parameter to the NRF network element to implement the first request. If the first network element is a malicious attack network element, the first network element may not send the first parameter, which helps to improve the success rate of non-malicious attack network elements requesting the NRF network element to discover the second network element or requesting the NRF network element to obtain the access token of the second network element, and helps to reduce the probability of malicious attack network elements discovering the second network element or obtaining the access token of the second network element, thereby improving the security of the NF service provider network element.

[0012] In one possible implementation, after sending the first indication information to the first network element, the NRF network element may also receive a second request from the first network element, where the second request includes the first parameter of the first network element; wherein, when the first request is used to request the discovery of the second network element, the second request is used to request the discovery of the second network element, or, when the first request is used to request the acquisition of an access token for the second network element, the second request is used to request the acquisition of an access token for the second network element; and determine whether the first parameter included in the second request is the same as the first parameter included in the profile of the first network element.

[0013] In the above technical solution, when the NRF network element receives a second request from a first network element that carries the first parameter of the first network element, it can also verify the first parameter included in the second request through the first parameter in the configuration file of the first network element, which can prevent the first network element from being verified by the NRF network element through a false first parameter, and helps to improve the security of the NF service provider network element. For example, the second request is used to request the discovery of the second network element. When the NRF network element discovers the second network element through the first parameter included in the second request, if the first parameter carried by the first network element in the second request is a false first parameter, and the false first parameter just meets the second network element's requirements for the first parameter, the NRF network element may also pass the verification. However, the above technical solution can avoid this situation.

[0014] In one possible implementation, the NRF network element may further determine that the configuration file of the second network element includes the second indication information before determining whether the first request includes the first parameter of the first network element; wherein the second indication information is used to indicate that the request for discovering the second network element or the request for obtaining the access token of the second network element must include the first parameter, and / or, the second indication information is used to indicate verification of the first parameter in the request for discovering the second network element or the request for obtaining the access token of the second network element.

[0015] In the above technical solution, the NRF network element determines whether the first parameter is included in the first request when the configuration file of the second network element includes the second indication information, so that the discovery process or authorization process executed by the NRF network element meets the requirements of the service provider network element. And by forcibly requiring the request for discovering the second network element or the request for obtaining the access token of the second network element to carry the first parameter, even if the first network element sets the first parameter in the configuration file of the first network element stored in the NRF network element to be empty before sending the first request, it still cannot pass the verification of the NRF network element, which helps to improve the security of the NF service provider network element.

[0016] In a possible implementation manner, the second network element includes one or more network elements of the first type.

[0017] In the above technical solution, the first network element can request the NRF network element to discover multiple network elements, or the first network element can request access tokens of multiple network elements from the NRF network element, so that the first network element can select an optimal network element from the multiple network elements as the network element providing services for it.

[0018] In a possible implementation, determining that the configuration file of the second network element includes the second indication information includes: determining that the configuration file of at least one network element among one or more network elements included in the second network element includes the second indication information.

[0019] In the above technical solution, when the NRF network element determines that the configuration file of any one of the multiple network elements discovered includes the second indication information, it indicates that there is a security verification requirement and the NRF network element is required to perform a verification operation on the first parameter, which can further improve the security of the NF service provider network element.

[0020] In a possible implementation manner, the NRF network element may further receive a configuration file from the second network element.

[0021] In the above technical solution, when the network element joins the network, it will send a configuration file to the NRF network element to complete the registration. This process complies with the provisions of the existing protocol.

[0022] In a possible implementation manner, when the NRF network element determines that the first request includes the first parameter, it determines whether the first parameter included in the first request is the same as the first parameter included in the configuration file of the first network element.

[0023] In the above technical solution, when the NRF network element receives a second request carrying the first parameter of the first network element from the first network element, it can also verify the first parameter included in the second request through the first parameter in the configuration file of the first network element, which can avoid the first network element being verified by the NRF network element through a false first parameter, and help to improve the security of the NF service provider network element.

[0024] In a possible implementation manner, before sending the first request, the NRF network element may further receive a configuration file from the first network element.

[0025] In the above technical solution, when the first network element joins the network, it will send a configuration file to the NRF network element to complete the registration. This process complies with the provisions of the existing protocol.

[0026] In one possible implementation, the first parameter includes one or more of slice information, public land mobile network (PLMN) information, or standalone non-public network (SNPN) information. The parameters included in the aforementioned first parameter are only examples, and other parameters may also be used during actual implementation, which is not limited in this embodiment of the present application.

[0027] In a second aspect, a communication method is provided, which can be implemented by an NRF network element, and the method includes: the NRF network element receives a first request from a first network element, the first request is used to discover a second network element, or the first request is used to obtain an access token of the second network element; determines whether the first parameter of the first network element is included in the first request; when the first parameter is included in the first request, determines whether the first parameter is the same as the first parameter in the configuration file of the first network element.

[0028] In a possible implementation manner, before receiving the first request, the NRF network element may further receive a configuration file from the first network element.

[0029] In a possible implementation manner, when the first request does not include the first parameter, the NRF network element may further reject the first request.

[0030] In one possible embodiment, the NRF network element may reject the first request by sending a first indication message to the first network element, wherein the first indication message is used to indicate that the first request is rejected; or, the first indication message is used to indicate that the first parameter is missing in the first request; or, the first indication message is used to instruct the first network element to send the first parameter; or, the first indication message is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

[0031] In a possible implementation manner, the first indication information includes information used to indicate the first parameter.

[0032] In one possible implementation, after sending the first indication information to the first network element, the NRF network element may also receive a second request from the first network element, where the second request includes the first parameter of the first network element; wherein, when the first request is used to request the discovery of the second network element, the second request is used to request the discovery of the second network element, or, when the first request is used to request the acquisition of an access token for the second network element, the second request is used to request the acquisition of an access token for the second network element; and determine whether the first parameter included in the second request is the same as the first parameter included in the configuration file of the first network element.

[0033] In one possible implementation, the NRF network element may further determine that the configuration file of the second network element includes the second indication information before determining whether the first request includes the first parameter of the first network element; wherein the second indication information is used to indicate that the request for discovering the second network element or the request for obtaining the access token of the second network element must include the first parameter, and / or, the second indication information is used to indicate verification of the first parameter in the request for discovering the second network element or the request for obtaining the access token of the second network element.

[0034] In a possible implementation manner, the second network element includes one or more network elements of the first type.

[0035] In a possible implementation, determining that the configuration file of the second network element includes the second indication information includes: determining that the configuration file of at least one network element among one or more network elements included in the second network element includes the second indication information.

[0036] In a possible implementation manner, the NRF network element may further receive a configuration file from the second network element.

[0037] In a possible implementation, the first parameter includes one or more of slice information, PLMN information, or SNPN information.

[0038] On the third aspect, a communication method is provided, which can be implemented by a first network element. The method includes: the first network element generates a first request and sends the first request to the NRF network element, wherein the first request is used to request discovery of a second network element, or the first request is used to request acquisition of an access token of the second network element.

[0039] In one possible embodiment, the first network element receives first indication information from the NRF network element, and the first indication information is used to indicate that the first request is rejected; or, the first indication information is used to indicate that the first parameter is missing in the first request; or, the first indication information is used to instruct the first network element to send the first parameter; or, the first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

[0040] In a possible implementation manner, the first indication information includes information used to indicate the first parameter.

[0041] In one possible implementation, the first network element sends a second request to the NRF network element, and the second request includes the first parameter of the first network element; wherein, when the first request is used to request discovery of the second network element, the second request is used to request discovery of the second network element, or, when the first request is used to request acquisition of an access token of the second network element, the second request is used to request acquisition of an access token of the second network element.

[0042] In a possible implementation manner, before sending the first request to the NRF network element, the first network element may further send a configuration file to the NRF network element.

[0043] In a possible implementation, the first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

[0044] In a fourth aspect, a communication method is provided, which can be implemented by a first network element. The method includes: the first network element generates a first request and sends the first request to the NRF network element, the first request is used to request the discovery of a second network element, or the first request is used to request the acquisition of an access token of the second network element, and the first request includes a first parameter.

[0045] In a possible implementation manner, before sending the first request to the NRF network element, the first network element may further send a configuration file to the NRF network element.

[0046] In a possible implementation, the first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

[0047] In a fifth aspect, a communication system is provided, which includes an NF service consumer network element, an NRF network element and an NF service provider network element. The NF service consumer network element takes the first network element as an example, and the NF service provider network element takes the second network element as an example. The first network element is used to: send a first request to the NRF network element, and the first request is used to request to discover the second network element, or the first request is used to request to obtain an access token for the second network element; the NRF network element is used to: determine whether the first request includes a first parameter, and when the first request does not include the first parameter, reject the first request.

[0048] In one possible implementation, the NRF network element is specifically used to: reject the first request by sending a first indication message to the first network element; wherein the first indication message is used to indicate that the first request is rejected; or, the first indication message is used to indicate that the first parameter is missing in the first request; or, the first indication message is used to instruct the first network element to send the first parameter; or, the first indication message is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

[0049] In a possible implementation manner, the first indication information includes information used to indicate the first parameter.

[0050] In one possible embodiment, the first network element is further used to: send a second request to the NRF network element, the second request including the first parameter of the first network element; wherein, when the first request is used to request discovery of the second network element, the second request is used to request discovery of the second network element, or, when the first request is used to request acquisition of an access token for the second network element, the second request is used to request acquisition of an access token for the second network element; the NRF network element is further used to: determine whether the first parameter included in the second request is the same as the first parameter included in the configuration file of the first network element.

[0051] In one possible embodiment, before determining whether the first request includes the first parameter of the first network element, the NRF network element is further used to: determine that the configuration file of the second network element includes the second indication information; wherein the second indication information is used to indicate that the request for discovering the second network element or the request for obtaining the access token of the second network element must include the first parameter, and / or, the second indication information is used to indicate the verification of the first parameter in the request for discovering the second network element or the request for obtaining the access token of the second network element.

[0052] In a possible implementation manner, the second network element includes one or more network elements of the first type.

[0053] In a possible implementation, determining that the configuration file of the second network element includes the second indication information includes: determining that the configuration file of at least one network element among one or more network elements included in the second network element includes the second indication information.

[0054] In a possible implementation manner, the NRF network element is further configured to receive a configuration file from the second network element.

[0055] In a possible implementation manner, when determining that the first request includes the first parameter, the NRF network element is further configured to determine whether the first parameter included in the first request is the same as the first parameter in the configuration file of the first network element.

[0056] In a possible implementation manner, the first network element is further configured to send a configuration file to the NRF network element.

[0057] In a possible implementation, the first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

[0058] In a sixth aspect, the present application provides a communication device, which has the functions of implementing the first or second aspect mentioned above. For example, the communication device includes a module or unit or means corresponding to the operations involved in the first or second aspect mentioned above. The module or unit or means can be implemented through software, or through hardware, or the corresponding software implementation can be executed through hardware.

[0059] In one possible implementation, the communication device includes a processing unit and a communication unit. The communication unit can be used to send and receive signals to enable communication between the communication device and other devices; the processing unit can be used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations described in the first or second aspect above.

[0060] In one possible implementation, the communication device includes a processor, which may be coupled to a memory. The memory may store a computer program or instructions for implementing the functions described in the first or second aspect. The processor may execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements the method described in any possible implementation of the first or second aspect.

[0061] In one possible implementation, the communication device includes a processor and a memory, where the memory may store the necessary computer programs or instructions for implementing the functions described in the first or second aspect. The processor may execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements the method in any possible implementation of the first or second aspect.

[0062] In one possible implementation, the communication device includes a processor and an interface circuit, wherein the processor is configured to communicate with other devices through the interface circuit and execute the method in any possible implementation of the first aspect or the second aspect.

[0063] In the sixth aspect mentioned above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory and the processor can be set separately. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0064] In the seventh aspect, a communication device is provided, which has the functions of implementing the third or fourth aspect above. For example, the communication device includes a module or unit or means corresponding to the operations involved in the third or fourth aspect above. The module or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0065] In the seventh aspect, the relevant description of the communication device can refer to the relevant description of the communication device described in the sixth aspect, and will not be repeated here.

[0066] In an eighth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes a method in any possible implementation of the first or second aspect above.

[0067] In a ninth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes a method in any possible implementation of the third or fourth aspect.

[0068] In a tenth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in any possible implementation of the first aspect or the second aspect.

[0069] In an eleventh aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in any possible implementation of the third aspect or the fourth aspect.

[0070] In the twelfth aspect, the present application provides a chip, which includes a processor, and the processor is coupled to a memory, and is used to read and execute a software program stored in the memory to implement a method in any possible implementation of the first aspect or the second aspect above.

[0071] In a thirteenth aspect, the present application provides a chip, comprising a processor, wherein the processor is coupled to a memory and is configured to read and execute a software program stored in the memory to implement a method in any possible implementation of the third or fourth aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] FIG1 is a schematic diagram of a network architecture of a communication system applicable to an embodiment of the present application;

[0073] FIG2 is a schematic diagram of an application scenario applicable to an embodiment of the present application;

[0074] Figures 3 to 6 are flow charts of several communication methods provided in embodiments of the present application;

[0075] 7 to 9 are structural block diagrams of several communication devices provided in embodiments of the present application. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0077] In the embodiments of the present application, the number of nouns, unless otherwise specified, means "singular noun or plural noun", that is, "one or more". "At least one" means one or more, and "plural" means two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A or B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. For example, A / B means: A or B. "At least one of the following items" or "one or more of them" and other similar expressions refer to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c, or one or more of a, b, or c, means: a, b, c, a and b, a and c, b and c, or a and b and c. Each of a, b, and c can be single or multiple.

[0078] In the embodiments of this application, ordinal numbers such as "first" and "second" are used to distinguish multiple objects and are not used to limit the size, content, order, timing, priority, or importance of multiple objects. In addition, the numbering of the steps in the various embodiments described in the embodiments of this application is only for distinguishing different steps and is not used to limit the order of the steps.

[0079] Below, some terms or concepts in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0080] 1. A network element profile (NF profile) includes basic attribute information of a network element, such as instance identification (ID), network element type, and network element status.

[0081] 2. Access token: This information element (IE) is issued by the network storage function element to the NF service consumer and is used to verify the NF service consumer's authority to invoke the NF service provider's services. It contains information such as the subject, object, and authorization scope of the service invocation. In the following embodiments, the NF service consumer may be referred to as NFc, and the NF service provider as NFp.

[0082] As mentioned above, the network storage function network element can provide NF with services such as NF registration, maintenance, discovery, and authorization. However, the security of the current discovery and authorization process needs to be improved. In order to solve this technical problem, the communication method and device of the embodiment of the present application are provided. The technical solution of the embodiment of the present application can be applied to various communication systems, such as: the fourth generation (4G) communication system, the fifth generation (5G) communication system or other future evolution systems, or other various wireless communication systems using wireless access technology.

[0083] The following uses a 5G communication system as an example to describe the network architecture and the methods and apparatuses of the embodiments of the present application applied in the 5G communication system. It is understood that when the present application is applied to other evolved systems in the future, the names of the devices or network elements may change, and the present application does not limit this.

[0084] Please refer to Figure 1, which is a schematic diagram of a network architecture of a communication system applicable to an embodiment of the present application. The network architecture shown in Figure 1 may include user equipment (UE), an external data network (DN), and an operator network.

[0085] Among them, the operator network may include one or more of the following network elements: authentication server function (AUSF) network element, network exposure function (NEF) network element, policy control function (PCF) network element, unified data management (UDM) network element, unified data repository (UDR), network storage function (NRF) network element, application function (AF) network element, network slice selection function (NSSF) network element, access and mobility management function (AMF) network element, session management function (SMF) network element, (radio) access network (R)AN) or user plane function (UPF) network element, etc.

[0086] The operator network includes a radio access network and a core network. The UE accesses the core network through the (R)AN. The core network includes user plane network elements and control plane network elements. The user plane network elements of the core network include the UPF, and the control plane network elements of the core network include at least one of the following network elements: AUSF, AMF, SMF, NSSF, NEF, NRF, UDM, UDR, PCF, or AF.

[0087] User plane network elements (e.g., UPF) are primarily responsible for packet forwarding, quality of service (QoS) control, and billing statistics. Control plane network elements are primarily responsible for business process interaction and delivering packet forwarding policies and QoS control policies to the user plane. The core network control plane can adopt a service-based architecture. In this architecture, a control plane network element exposes services to other control plane network elements for invocation. Control plane network elements can interact with each other using service-based interfaces.

[0088] The functions of network elements in the core network are described as follows:

[0089] UPF supports all or part of the following functions: interconnecting protocol data unit (PDU) sessions with data networks, packet routing and forwarding (for example, supporting uplink classifier for forwarding traffic to the data network, supporting branching points to support multi-homed PDU sessions), or packet inspection.

[0090] The AMF manages UE access and mobility. It is responsible for maintaining UE status, managing UE reachability, forwarding non-mobility management (MM) and non-access-stratum (NAS) messages, and forwarding session management (SM) N2 messages.

[0091] The SMF, or UE Session Management, allocates and releases resources for UE sessions. These resources include session quality of service (QoS), session paths, and forwarding rules. The SMF is responsible for selecting or reselecting UPFs, allocating Internet Protocol (IP) addresses, and establishing, modifying, and releasing bearers.

[0092] NEF opens network functions to third parties in the form of northbound application programming interfaces (APIs).

[0093] NRF is used to maintain the configuration files of network element instances and their services, and provides service discovery (i.e., accepting NFc's service discovery requests and returning the corresponding NFp instance information to the requester) and authorization (i.e., issuing NFp's access token to NFc) services for NFc.

[0094] UDM, User Context Management, is responsible for managing the UE's subscription data and notifying the corresponding network elements when the subscription data is modified.

[0095] The UDR, a unified data repository, is responsible for storing and retrieving contract data, policy data, and public architecture data, enabling network elements such as the UDM, PCF, or NEF to access relevant data. The UDR can implement different data access authentication mechanisms for different types of data (such as contract data and policy data) to ensure data access security. The UDR should be able to return a failure response with an appropriate cause value for illegal service-based operations or data access requests.

[0096] PCF, User Policy Management, is used to generate and manage user, session, and QoS flow processing policies.

[0097] AF (Application Management) provides application layer services to the UE. When providing services to the UE, AF has requirements for QoS (policy) and charging policies, and needs to notify the network. In addition, AF also needs to feedback application-related information from the core network.

[0098] In Figure 1, Nnssf, Nnef, Nurf, Npcf, Nudm, Naf, Nausf, Namf, and Nsmf are service-oriented interfaces provided by the NSSF, NEF, NRF, PCF, UDM, AF, AUSF, AMF, and SMF, respectively, for invoking corresponding service-oriented operations. N1, N2, N3, N4, and N6 are interface serial numbers, and their meanings are as follows:

[0099] 1) N1: The interface between AMF and the terminal, which can be used to deliver non-access stratum (NAS) signaling (such as QoS rules from AMF) to the terminal.

[0100] 2) N2: The interface between AMF and access network equipment, which can be used to transmit radio bearer control information from the core network side to the access network equipment.

[0101] 3) N3: The interface between the access network equipment and UPF, mainly used to transmit uplink and downlink user plane data between the access network equipment and UPF.

[0102] 4) N4: The interface between SMF and UPF can be used to transmit information between the control plane and the user plane, including controlling the issuance of forwarding rules, QoS rules, traffic statistics rules, etc. for the user plane and reporting information on the user plane.

[0103] 5) N6: The interface between UPF and DN, used to transmit uplink and downlink user data flows between UPF and DN.

[0104] It should be understood that Figure 1 is only a simplified schematic diagram for ease of understanding. The network architecture may also include other network devices or other terminal devices, and the core network may also include other network elements, which are not drawn in Figure 1.

[0105] Please refer to Figure 2, which is a schematic diagram of an application scenario applicable to embodiments of the present application. This scenario includes NFc network elements, NRF network elements, and NFp network elements. There can be one or more NFcs, such as NFc-1 shown in Figure 2, and one or more NFp elements, such as NFp-1 and NFp-2 shown in Figure 2.

[0106] Taking the network architecture included in the application scenario of the embodiment of the present application as the network architecture shown in Figure 1 as an example, the NFc and NFp can be any network elements with a service call relationship as shown in Figure 1. For example, NFc-1 can be an AMF network element, an SMF network element, and an NSSF network element, and NFp-1 or NFp-2 can be a PCF network element, a UDM network element, an AUSF network element, an SMF network element, a UPF network element, a network storage network element, and an NSSF network element.

[0107] In the embodiment of the present application, when joining the network, the NFc-1 network element, the NFp-1 network element, and the NFp-2 network element may send a configuration file to the NRF network element to complete registration, and the NFc-1 network element may send a request to the NRF network element to discover the NFp network element or to request an access token for the NFp network element (NFp-1 network element). The NRF network element may discover the NFp network element based on the NFc request and send the configuration file of the discovered NFp network element (e.g., the NFp-2 network element) to the NFc-1 network element; or the NRF network element may send the access token of the NFp-1 network element to the NFc-1 network element based on the NFc-1 network element's request, and the NFc-1 network element may request the NFp-1 network element to provide it with services based on the access token.

[0108] An embodiment of the present application provides a communication method. See Figure 3 for a flowchart of the method. This method can be applied to the network architecture shown in Figure 1 or the scenario shown in Figure 2. If the method is applied to the scenario shown in Figure 2, the first network element described below may be the NFc network element in the scenario shown in Figure 2, the NRF network element described below may be the NRF network element in the scenario shown in Figure 2, and the second network element or other network elements other than the first network element and the NRF network element described below may be the NFp network element in the scenario shown in Figure 2.

[0109] S301: A first network element sends a first request to an NRF network element. Correspondingly, the NRF network element receives the first request from the first network element.

[0110] The NRF network element can provide registration, maintenance, discovery, and authorization services for other network elements. The other network element can be, for example, any network element other than the NRF network element in the network elements shown in Figure 1. The other network element can send a registration request (NF register request) to the NRF network element to complete the registration, and the NRF network element can provide maintenance, discovery, and authorization services for the registered network element.

[0111] Optionally, when a network element (for example, network element 1) is registering, the NF register request sent to the NRF network element may include a configuration file of network element 1, which may include basic attribute information of network element 1. The basic attribute information may include common IEs such as the instance ID and network element type of network element 1.

[0112] Alternatively, the configuration file of the network element 1 may further include subordinate information of the network element 1, which may include, for example, PLMN information (plmnList), SNPN information (snpnList), slice information (such as slice type sNssais) and slice type information (perPlmnSnssaiList) of the slice in each PLMN served by the network element 1. The mechanism of sNssais and perPlmnSnssaiList is allowed by default, that is, if the configuration file of the network element 1 does not contain sNssais and perPlmnSnssaiList, or the sNssais and perPlmnSnssaiList contained in the configuration file of the network element 1 are NULL, it indicates that the network element 1 can serve any type of slice.

[0113] Alternatively, the configuration file of the network element 1 may further include subordinate information that the network element that is allowed to access the network element 1 should have. The subordinate information that the network element that is allowed to access the network element 1 should have may include, for example, allowed PLMN (allowedPlmns), allowed SNPN (allowedSnpns), and allowed slice types (allowedNssais), etc. Referring to the example of NFc and NFp in FIG2 , the SMF network element can serve as both an NF service consumer and an NF service provider. Therefore, the configuration file of the SMF network element may include basic attribute information of the SMF network element, subordinate information of the SMF network element, and subordinate information of the network element that is allowed to access the SMF network element.

[0114] After the first network element and the second network element complete registration, the NRF network element can provide registration, maintenance, discovery, and authorization services for the first network element and the second network element. Taking the first network element as the NF service consumer and the second network element as the NF service provider as an example, the first network element can send a first request to the NRF network element to request the discovery of the second network element, or to request the acquisition of an access token for the second network element (which can also be understood as a request for access to the second network element). Requesting discovery or requesting access can be understood as a type of interaction between the first network element and the second network element. The present application can also be used for other types of interactions between the first network element and the second network element, such as requesting operations or requesting management. That is, the first request can be used to request operations or request management of the second network element. That is, the embodiments of the present application can also be used to improve the security of operating or managing NFs.

[0115] The second network element may include one or more network elements, the network element type of the one or more network elements being the same type (e.g., a first type), the first type being the network element type that the first network element wants to discover or access. Optionally, the one or more network elements provide the same service.

[0116] When the first request is used to request discovery of a second network element, the first request may be a service discovery request (NF discovery request). Optionally, the NF discovery request may further include query parameters for querying for second network elements that meet the conditions. The query parameters may include, for example, the network element type of the second network element, the sNssais served by the second network element, the PLMN served by the second network element, and / or the SNPN served by the second network element.

[0117] When the first request is used to request an access token for a second network element, the first request may be an access token get request, and the second network element is the network element that the first network element wants to access. Optionally, the access token get request may further include the instance ID of the first network element, the service name of the second network element, the network element type of the second network element, the instance ID of the second network element, the sNssais of the first network element service, and / or the sNssais of the second network element service.

[0118] S302: The NRF network element determines whether the first request includes the first parameter of the first network element.

[0119] At present, when the NRF network element provides discovery services or authorization services for NF service consumers, the security of the NF service provider network element is difficult to guarantee. For example, when the first request is an NF discovery request, when the NRF network element discovers the second network element based on the NF discovery request, it generally checks whether the sNssais in the configuration file of the discovered one or more (for example, N, where N is a positive integer) second network elements contains the peer slice information carried by the NF discovery request, wherein the peer slice information refers to the slice information of the second network element that the first network element expects to discover; or, when the NF discovery request includes the slice information of the first network element (requester-snssais), the NRF network element can also check whether the requester-snssais is included in the allowedNssais of the configuration files of the N second network elements. In this way, when the NF discovery request does not include requester-snssais, the NRF network element may not check whether the requester-snssais is included in the allowedNssais of the configuration files of the N second network elements. For example, when the NRF network element determines that the sNssais in the configuration file of a second network element (for example, network element 2) contains the peer slice information carried by the NF discovery request, it considers that network element 2 is the network element expected by the first network element, and the NRF network element may send the configuration file of network element 2 to the first network element. If the first network element is a malicious attack network element, the first network element can attack network element 2 based on the configuration file of network element 2.

[0120] When the first request is an access token get request, before the NRF network element issues an access token for the second network element to the first network element based on the access token get request, it may verify whether the requesterSnssaiList carried in the access token get request is the same as the sNssais in the configuration file of the first network element (for example, NFc profile-1); or, the NRF network element may also verify whether the requesterSnssaiList is included in the allowedNssais in the configuration file of the second network element (for example, NFp profile-1).

[0121] However, before sending the access token get request to the NRF network element, if the first network element sends an update request to the NRF network element and updates the sNssais and perPlmnSnssaiList in NFc profile-1 to NULL, the NRF network element may believe that the first network element is a network element that can serve any slice. In this way, if the access token get request does not include requesterSnssaiList, the NRF network element verifies whether the requesterSnssaiList carried in the access token get request is the same as the sNssais in NFc profile-1. Since sNssais and perPlmnSnssaiList in NFc profile-1 are NULL and the access token get request does not include requesterSnssaiList, the NRF network element may believe that the first network element can serve any type of slice and send the access token of the network element it wants to access to the first network element. If the first network element is a malicious attacking network element, the first network element can attack the second network element based on the access token.

[0122] Therefore, in order to improve the security of the second network element, when the NRF network element receives the first request from the first network element, it can verify whether the first request contains the first parameter of the first network element. The first parameter may, for example, include one or more of the slice information, PLMN information and SNPN information of the slice served by the first network element.

[0123] If the first parameter is not included in the first request, S303 can be executed. If the first parameter is included in the first request, S304 can be executed, or S304 may not be executed, but other subsequent operations may be performed. For example, if the first request is an NF discovery request, the NRF network element may check whether the first parameter is included in allowedNssais, allowedPlmns, or allowedSnpns in the configuration file of the second network element. If the first request is an access token get request, the NRF network element may check whether the requesterSnssaiList is included in allowedNssais in the configuration file of the second network element. Since S304 is an optional step, S304 is represented by a dotted line in the figure.

[0124] Optionally, before executing S302, the NRF network element may also determine whether the configuration file of the second network element includes second indication information, where the second indication information is used to indicate that the first parameter must be included in the NF discovery request or the access token get request, and the second indication information is, for example, slice-related parameters mandatorily, and / or, the second indication information is used to indicate verification of the first parameter in the NF discovery request or the access token get request.

[0125] If the configuration file of the second network element includes the second indication information, it indicates that the NRF network element is required to perform fine-grained authorization on the network element requesting the second network element to provide services or the network element wanting to discover the second network element, and the NRF network element may execute S302. Optionally, when the configuration file of the second network element includes the second indication information, it indicates that the network element requesting it to provide services or the network element wanting to discover the second network element cannot be a network element that can serve any slice. If the configuration file of the second network element does not include the second indication information, the NRF network element may not execute S302.

[0126] Optionally, if the information of the second network element carried by the NF discovery request or access token get request is the network element type of the second network element, the second network element requested by the NF discovery request or access token get request may include one or more network elements. Therefore, when the NRF network element determines that the configuration file of at least one of the one or more network elements includes the second indication information, it can execute S302.

[0127] S303: The NRF network element rejects the first request.

[0128] The NRF network element rejects the first request, which may be that the NRF does not respond to the first request, that is, the NRF network element does not send a response message to the first network element. Alternatively, the NRF network element may also send a response message to the first network element. The response message may, for example, include first indication information in the response message, and the first indication information is used to indicate that the first request is rejected; or, the first indication information is used to indicate that the first parameter is missing in the first request; or, the first indication information may also be directly used to instruct the first network element to send the first parameter; or, the first indication information may also be used to instruct the first network element to resend the first request and carry the first parameter in the resent first request. Alternatively, the NRF network element may also directly send the first indication information to the first network element.

[0129] Among them, the first indication information can be, for example, an error message, which includes the cause of the error. For example, the first indication information is: 400bad reuqest (error: invalid request, error description: incomplete slice information); for example, the first indication information can also be: 400bad reuqest (cause: MANDATORY_QUERY_PARAM_MISSING).

[0130] Optionally, the first indication information may further include information for indicating the first parameter. For example, when the first indication information is 400bad request (cause: MANDATORY_QUERY_PARAM_MISSING), the first indication information only indicates that the error cause is the lack of a necessary query parameter, but does not indicate what the necessary query parameter is. Therefore, the first indication information may further include information for indicating the first parameter, such as slice information.

[0131] In some embodiments, if the first network element needs to continue to request the discovery of the second network element, or needs to continue to request the access token of the second network element, the first network element may resend the first request (for example, send the second request) to the NRF network element, and the resent first request includes the first parameter of the first network element. Resending the first request means that if the first request sent in S301 is an NF discovery request, the resent first request is also an NF discovery request, and if the first request sent in S301 is an access token get request, the resent first request is also an access token get request. After receiving the first request resent by the first network element, the NRF network element may execute S304.

[0132] S304: The NRF network element determines whether the first parameter included in the first request is the same as the first parameter included in the configuration file of the first network element.

[0133] When the first parameter of the first network element is included in the first request, in order to avoid the first network element requesting the NRF network element to discover the second network element through a false first parameter, or requesting the NRF network element to issue an access token for the second network element, the NRF network element can verify the first parameter of the first network element included in the first request through the first parameter included in the configuration file of the first network element.

[0134] If the first parameter of the first network element included in the first request is the same as the first parameter included in the configuration file of the first network element, the NRF network element determines that verification of the first parameter passes.

[0135] After the NRF network element passes the verification of the first parameter, it can execute the process of discovering the second network element, or issue an access token of the second network element to the first network element, and send a response message to the first network element, and the response message includes the service discovery result, or includes the access token of the second network element. For example, when the first request is an NF discovery request, the response message sent by the NRF network element to the first network element includes the service discovery result, and the service discovery result is, for example, information such as the configuration file of the second network element, and the response message is, for example, 200OK (configuration file of the second network element). When the first request is an access token get request, the response message of the NRF network element to the first network element includes the access token of the second network element, and the response message is, for example, 200OK (access token of the second network element).

[0136] If the first parameter of the first network element included in the first request is different from the first parameter included in the configuration file of the first network element, the NRF network element determines that the verification of the first parameter has failed. For example, if the sNssais in the configuration file of the first network element is 1, and the sNssais of the first network element included in the first request is 3, the verification has failed. For another example, if the first network element sends an update request to the NRF network element before sending the first request to the NRF network element, setting the sNssais in the configuration file of the first network element to NULL, and the sNssais of the first network element included in the first request is 3, the verification has failed.

[0137] If the NRF network element fails to verify the first parameter, the NRF network element may not execute the process of discovering the second network element and send an error message to the first network element, or the NRF network element may refuse to issue an access token for the second network element to the first network element, which helps to improve the security of the second network element. For example, when the first request is an NF discovery request, the NRF network element may send a 4xx / 5xx (problem details) or 3xx to the first network element; when the first request is an access token get request, the NRF network element may send a 400 bad request (access token error) or 3xx to the first network element.

[0138] In the above technical solution, when the first request from the first network element does not include the first parameter, the NRF network element rejects the first request and does not send information such as the configuration file of the second network element that it expects to discover to the first network element, or does not send the access token of the second network element that it expects to access to the first network element, thereby reducing the probability of the first network element attacking the second network element and improving the security of the NF service provider network element. Moreover, when the first request from the first network element includes the first parameter, the first parameter included in the first request can be verified using the first parameter included in the configuration file of the first network element, thereby reducing the probability of the first network element being verified by the NRF network element by using a false first parameter, and reducing the probability of the first network element being verified by the NRF network element by modifying the information of the first parameter in its configuration file, thereby helping to improve the security of the NF service provider network element.

[0139] Three embodiments are introduced below with reference to FIG. 4 , FIG. 5 and FIG. 6 . These three embodiments are three examples of the communication method of the embodiment shown in FIG. 3 .

[0140] Please refer to Figure 4, which is a flow chart of an example of a communication method provided by the embodiment shown in Figure 3. This example takes a service discovery scenario as an example.

[0141] S401: The first network element and the second network element send an NF register request (NF register request) to the NRF network element to complete the registration.

[0142] The NF register request includes a configuration file. The contents included in the configuration files of the first network element and the second network element can refer to the contents included in the configuration file of the network element 1 in S301, and will not be repeated here.

[0143] S402: The first network element sends an NF discovery request to the NRF network element. Correspondingly, the NRF network element receives the NF discovery request from the first network element.

[0144] The NF discovery request may include query parameters. For a description of the query parameters, refer to the description of the query parameters in S301 and are not repeated here. For example, the query parameters may include a network element parameter indicating the network element to be discovered, such as the target network element type (target nf type). The target network element may be, for example, the second network element.

[0145] S403: The NRF network element determines whether the NF discovery request includes the first parameter of the first network element.

[0146] For the relevant description of the embodiments of the present application, reference can be made to the relevant description in S302 when the first request is an NF discovery request, which will not be repeated here. The first parameter may include one or more of the slice information, PLMN information and SNPN information of the slice served by the first network element. If the NRF network element determines that the first parameter of the first network element is included in the NF discovery request, S406 can be executed. If the NRF network element determines that the first parameter of the first network element is not included in the NF discovery request, S404 can be executed.

[0147] S404: The NRF network element sends first indication information to the first network element. Correspondingly, the first network element receives the first indication information from the NRF network element.

[0148] For the description of the first indication information, reference may be made to the description of the first indication information in S303. For example, the NRF network element may send a 400 bad request (cause: MANDATORY_QUERY_PARAM_MISSING) message to the first network element, carrying information about the first parameter.

[0149] After receiving the first indication information, if the first network element still needs to discover the second network element, it can execute S405. If the first network element is a malicious attacking network element, the first network element can also choose not to execute S405.

[0150] S405: The first network element resends the NF discovery request to the NRF network element. Correspondingly, the NRF network element receives the NF discovery request from the first network element.

[0151] When the first network element resends the NF discovery request according to the first indication information, the NF discovery request includes the first parameter of the first network element, such as requester-snssais, and the query parameter described in S402.

[0152] S406: The NRF network element determines whether the first parameter of the first network element included in the NF discovery request is the same as the first parameter included in the configuration file of the first network element.

[0153] If the first parameter of the first network element included in the NF discovery request is the same as the first parameter in the configuration file of the first network element, S407 may be executed. If the first parameter of the first network element included in the NF discovery request is different from the first parameter in the configuration file of the first network element, S409 may be executed.

[0154] S407: The NRF network element executes a process of discovering the second network element according to the NF discovery request.

[0155] Among them, the process of the NRF network element executing the discovery of the second network element is to check whether the sNssais in the configuration file of the second network element is included in the peer slice information carried by the NF discovery request, wherein the peer slice information refers to the slice information of the second network element that the first network element expects to discover; and, check whether the requester-snssais is included in the allowedNssais in the configuration file of the second network element.

[0156] S408: The NRF network element sends the configuration file of the second network element to the first network element.

[0157] S409: The NRF network element sends error information to the first network element.

[0158] In the above technical solution, when the first request from the first network element does not include the first parameter, the NRF network element may not execute the process of discovering the network element. Compared with the technical solution in which the first parameter is not found during the process of discovering the network element, the first network element can promptly obtain the reason why the second network element cannot be discovered, which helps to reduce the waiting time of the first network element.

[0159] Please refer to Figure 5, which is a flow chart of another example of the communication method provided by the embodiment shown in Figure 3. This example takes a service authorization scenario as an example.

[0160] S501: The first network element and the second network element send an NF register request (NF register request) to the NRF network element to complete the registration.

[0161] The NF register request includes a configuration file. The contents included in the configuration files of the first network element and the second network element can refer to the contents included in the configuration file of the network element 1 in S301, and will not be repeated here.

[0162] S502: The first network element sends an access token acquisition request to the NRF network element. Correspondingly, the NRF network element receives the access token acquisition request from the first network element.

[0163] The access token get request may include, for example, the instance ID of the first network element, the service name of the second network element, the network element type of the second network element, the instance ID of the second network element, the sNssais of the first network element service, and / or the sNssais of the second network element service, etc.

[0164] S503: The NRF network element determines whether the access token acquisition request includes the first parameter of the first network element.

[0165] For the relevant description of the embodiments of the present application, reference can be made to the relevant description in S302 when the first request is an access token get request, which will not be repeated here. The first parameter may include one or more of the slice information, PLMN information, and SNPN information of the slice served by the first network element. If the NRF network element determines that the access token get request includes the first parameter of the first network element, S506 may be executed. If the NRF network element determines that the access token get request does not include the first parameter of the first network element, S504 may be executed.

[0166] S504: The NRF network element sends first indication information to the first network element. Correspondingly, the first network element receives the first indication information from the NRF network element.

[0167] For the description of the first indication information, reference may be made to the description of the first indication information in S303. For example, the NRF network element may send a 400 bad request (error: invalid request, error description: incomplete slice information) to the first network element.

[0168] After receiving the first indication information, if the first network element still needs to obtain the access token of the second network element, it can execute S505. If the first network element is a malicious attacking network element, the first network element can also choose not to execute S505.

[0169] S505: The first network element resends the access token acquisition request to the NRF network element. Correspondingly, the NRF network element receives the access token acquisition request from the first network element.

[0170] When the first network element resends the access token get request according to the first indication information, the access token get request includes the first parameter of the first network element, such as requesterSnssaiList, and the access token get request also includes the content included in the access token get request described in S502.

[0171] S506: The NRF network element determines whether the first parameter of the first network element included in the access token acquisition request is the same as the first parameter included in the configuration file of the first network element.

[0172] If the first parameter of the first network element included in the access token get request is the same as the first parameter in the configuration file of the first network element, S507 may be executed. If the first parameter of the first network element included in the access token get request is different from the first parameter in the configuration file of the first network element, S509 may be executed.

[0173] S507: The NRF network element determines, based on the first parameter of the first network element, whether the first network element is a network element that the second network element is allowed to access.

[0174] Taking the first parameter of the first network element as sNssais as an example, if the sNssais of the first network element carried in the access token get request is 1, and the allowedNssais included in the configuration file of the second network element is 3, the NRF network element determines that the first network element cannot access the second network element, and S509 can be executed. If the sNssais of the first network element carried in the access token get request is 3, and the allowedNssais included in the configuration file of the second network element is 3, the NRF network element determines that the first network element can access the second network element, and S508 can be executed.

[0175] S508: The NRF network element sends the access token of the second network element to the first network element.

[0176] S509: The NRF network element sends error information to the first network element.

[0177] In the above technical solution, when the first request from the first network element does not include the first parameter, the NRF network element may not verify whether the first network element is a network element allowed to be accessed by the second network element, which helps to reduce the waiting time of the first network element.

[0178] Please refer to Figure 6, which is a flow chart of another example of the communication method provided by the embodiment shown in Figure 3. This example takes a service authorization scenario as an example.

[0179] S601: The first network element and the second network element send an NF register request (NF register request) to the NRF network element to complete the registration.

[0180] The relevant description of S601 can refer to the relevant description of S501, which will not be repeated here.

[0181] S602: The first network element sends an update request (NF update request) to the NRF network element. Correspondingly, the NRF network element receives the update request from the first network element.

[0182] For example, the update request is used to request that sNssais and perPlmnSnssaiList in the configuration file of the first network element be changed to NULL. Upon receiving the update request, the NRF network element changes sNssais and perPlmnSnssaiList in the configuration file of the first network element to NULL.

[0183] S603: The first network element sends an access token acquisition request to the NRF network element. Correspondingly, the NRF network element receives the access token acquisition request from the first network element.

[0184] S604: The NRF network element determines whether the access token acquisition request includes the first parameter of the first network element.

[0185] For the relevant description of the embodiments of the present application, reference can be made to the relevant description in S302 when the first request is an access token get request, which will not be repeated here. The first parameter may include one or more of the slice information, PLMN information, and SNPN information of the slice served by the first network element. If the NRF network element determines that the access token get request includes the first parameter of the first network element, S607 may be executed. If the NRF network element determines that the access token get request does not include the first parameter of the first network element, S605 may be executed.

[0186] S605: The NRF network element sends first indication information to the first network element. Correspondingly, the first network element receives the first indication information from the NRF network element.

[0187] For a description of the first indication information, refer to the description of the first indication information in S303. After receiving the first indication information, if the first network element still needs to obtain the access token of the second network element, it may execute S606. If the first network element is a malicious attacking network element, the first network element may choose not to execute S606.

[0188] S606: The first network element resends the access token acquisition request to the NRF network element. Correspondingly, the NRF network element receives the access token acquisition request from the first network element.

[0189] When the first network element resends the access token get request according to the first indication information, the access token get request includes the first parameter of the first network element, such as requesterSnssaiList, and the access token get request also includes the content included in the access token get request described in S603.

[0190] S607: The NRF network element determines whether the first parameter of the first network element included in the access token acquisition request is the same as the first parameter included in the configuration file of the first network element.

[0191] Since in S602, the NRF network element changed sNssais and perPlmnSnssaiList in the configuration file of the first network element to NULL, the NRF network element can determine that the first parameter of the first network element included in the access token get request is different from the first parameter in the configuration file of the first network element, and can execute S608.

[0192] S608: The NRF network element sends error information to the first network element.

[0193] If the NRF network element determines that the access token get request does not include the first parameter of the first network element, the error message may be, for example, 400bad request (error: invalid request, error description: incomplete slice information). If the NRF network element determines that the first parameter of the first network element included in the access token get request is different from the first parameter included in the configuration file of the first network element, the error message may be, for example, 400bad request (error: unauthorized client, error description: slice verification failed).

[0194] In the above technical solution, when the access token get request from the first network element includes the first parameter, the first parameter included in the access token get request can be verified by the first parameter included in the configuration file of the first network element, which can reduce the probability that the first network element is verified by the NRF network element by modifying the information of the first parameter in its configuration file.

[0195] The method provided by the embodiment of the present application is described in detail above with reference to Figures 3 to 6. The device provided by the embodiment of the present application is described below with reference to Figures 7 to 9.

[0196] Based on the same technical concept, referring to FIG7 , an embodiment of the present application provides a communication device 700 that can implement the functions of the NRF network element in the above method embodiment. The device can be an NRF network element or a device within an NRF network element. The above functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The device includes:

[0197] The communication module 701 is configured to receive a first request from a first network element, where the first request is used to discover a second network element, or the first request is used to obtain an access token of the second network element;

[0198] The processing module 702 is used to determine whether the first request includes the first parameter of the first network element; when the first request does not include the first parameter, reject the first request.

[0199] In one possible embodiment, the processing module 702 is specifically used to reject the first request in the following manner: sending a first indication information to the first network element through the communication module 701; wherein, the first indication information is used to indicate that the first request is rejected; or, the first indication information is used to indicate that the first parameter is missing in the first request; or, the first indication information is used to instruct the first network element to send the first parameter; or, the first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request; the first indication information includes information used to indicate the first parameter.

[0200] In one possible embodiment, the communication module 701 is also used to receive a second request from the first network element, the second request including the first parameter of the first network element; wherein, when the first request is used to request the discovery of the second network element, the second request is used to request the discovery of the second network element, or, when the first request is used to request the acquisition of an access token for the second network element, the second request is used to request the acquisition of an access token for the second network element; the processing module 702 is also used to determine whether the first parameter included in the second request is the same as the first parameter included in the configuration file of the first network element.

[0201] In one possible embodiment, the processing module 702 is also used to determine that the configuration file of the second network element includes the second indication information; wherein, the second indication information is used to indicate that the request for discovering the second network element or the request for obtaining the access token of the second network element must include the first parameter, and / or, the second indication information is used to indicate the verification of the first parameter in the request for discovering the second network element or the request for obtaining the access token of the second network element.

[0202] In a possible implementation manner, when the first request is used to request discovery of a second network element, the second network element includes one or more network elements whose network element type is a first type.

[0203] In a possible implementation, the processing module 702 is specifically configured to determine that, among one or more network elements included in the second network element, a configuration file of at least one network element includes the second indication information.

[0204] In a possible implementation, the communication module 701 is further configured to receive a configuration file from the second network element.

[0205] In a possible implementation, the processing module 702 is further configured to: when the first request includes the first parameter, determine whether the first parameter included in the first request is the same as the first parameter included in the configuration file of the first network element.

[0206] In a possible implementation, before receiving the first request, the communication module 701 is further configured to receive a configuration file from the first network element.

[0207] In a possible implementation, the first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

[0208] Based on the same technical concept, referring to FIG8 , an embodiment of the present application provides a communication device 800 , which can implement the functions of the first network element in the above method embodiment. The device can be the first network element or a device within the first network element. The above functions can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The device includes:

[0209] The processing module 801 is configured to generate a first request, where the first request is used to request discovery of a second network element, or the first request is used to request acquisition of an access token of the second network element;

[0210] The communication module 802 is configured to send the first request to the NRF network element.

[0211] In one possible embodiment, the communication module 802 is also used to receive a first indication message from an NRF network element, the first indication message being used to indicate that the first request is rejected; or, the first indication message being used to indicate that the first parameter is missing in the first request; or, the first indication message being used to indicate that the first network element sends the first parameter; or, the first indication message being used to indicate that the first network element resends the first request and carries the first parameter in the resent first request.

[0212] In a possible implementation manner, the first indication information includes information used to indicate the first parameter.

[0213] In one possible embodiment, the communication module 802 is also used to send a second request to the NRF network element, and the second request includes the first parameter of the first network element; wherein, when the first request is used to request to discover the second network element, the second request is used to request to discover the second network element, or, when the first request is used to request to obtain an access token for the second network element, the second request is used to request to obtain an access token for the second network element.

[0214] In a possible implementation, the communication module 802 may further send a configuration file to the NRF network element before sending the first request to the NRF network element.

[0215] In a possible implementation, the first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

[0216] Based on the same technical concept, referring to FIG9 , an embodiment of the present application further provides a communication device 900 , including:

[0217] at least one processor 901; and,

[0218] A memory 902 and a communication interface 903 communicatively connected to the at least one processor 901;

[0219] The memory 902 stores instructions that can be executed by the at least one processor 901, and the at least one processor 901 executes the method performed by any network element in the above method embodiment by executing the instructions stored in the memory 902.

[0220] The processor 901 and the memory 902 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0221] The specific connection medium between the processor 901, memory 902, and communication interface 903 is not limited in the embodiments of the present application. In Figure 9, the processor 901, memory 902, and communication interface 903 are connected via a bus 904. The bus is represented by a bold line in Figure 9. The connection between other components is only for illustrative purposes and is not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 9 only uses a single bold line, but this does not mean that there is only one bus or only one type of bus.

[0222] It should be understood that the processors mentioned in the embodiments of the present application can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor that is implemented by reading software code stored in a memory.

[0223] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0224] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0225] When the processor is a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, the memory (storage module) may be integrated into the processor.

[0226] It should be understood that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0227] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, including a program or instruction. When the program or instruction is run on a computer, the method performed by any network element in the above method embodiment is executed.

[0228] Based on the same technical concept, an embodiment of the present application also provides a chip, which is coupled to a memory and is used to read and execute program instructions stored in the memory to implement the method executed by any network element in the above method embodiment.

[0229] Based on the same technical concept, an embodiment of the present application also provides a computer program product, including instructions, which, when executed on a computer, enables the computer to execute the method executed by any network element in the above method embodiments.

[0230] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0231] The present application embodiment is described with reference to the flow chart and / or block diagram according to the method, device (system) and computer program product of the embodiment of the present application.It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of general-purpose computer, special-purpose computer, embedded processing machine or other programmable data processing equipment to produce a machine, so that the instruction executed by the processor of computer or other programmable data processing equipment produces the device for realizing the function specified in one flow chart flow chart or multiple flow charts and / or one block or multiple blocks of block diagram.

[0232] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0233] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations.

Claims

1. A communication method, characterized in that: Applied to a network storage function network element, the method comprises: Receiving a first request from a first network element, where the first request is used to request discovery of a second network element, or the first request is used to request acquisition of an access token of the second network element; Determining whether the first request includes a first parameter of the first network element; When the first request does not include the first parameter, the first request is rejected.

2. The method according to claim 1, characterized in that The rejecting the first request comprises: Sending first indication information to the first network element; wherein, The first indication information is used to indicate that the first request is rejected; or, The first indication information is used to indicate that the first parameter is missing in the first request; or, The first indication information is used to instruct the first network element to send the first parameter; or, The first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

3. The method according to claim 2, characterized in that The first indication information includes information used to indicate the first parameter.

4. The method according to claim 2 or 3, characterized in that The method further comprises: receiving a second request from the first network element, the second request including the first parameter of the first network element; wherein, when the first request is used to request discovery of the second network element, the second request is used to request discovery of the second network element, or, when the first request is used to request acquisition of an access token of the second network element, the second request is used to request acquisition of an access token of the second network element; Determine whether a first parameter included in the second request is the same as a first parameter included in a configuration file of the first network element.

5. The method according to any one of claims 1 to 4, characterized in that: Before determining whether the first request includes the first parameter of the first network element, the method further includes: Determining that a configuration file of the second network element includes the second indication information; The second indication information is used to indicate that the first parameter must be included in a request for discovering the second network element or a request for obtaining an access token for the second network element, and / or the second indication information is used to indicate verification of the first parameter in a request for discovering the second network element or a request for obtaining an access token for the second network element.

6. The method according to claim 5, characterized in that The second network element includes one or more network elements whose network element type is the first type.

7. The method according to claim 6, characterized in that The determining that the configuration file of the second network element includes the second indication information includes: It is determined that among the one or more network elements included in the second network element, a configuration file of at least one network element includes the second indication information.

8. The method according to any one of claims 5 to 7, characterized in that: The method further comprises: A configuration file is received from the second network element.

9. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: When the first request includes the first parameter, it is determined whether the first parameter included in the first request is the same as the first parameter included in the configuration file of the first network element.

10. The method according to any one of claims 1 to 9, characterized in that: Before receiving the first request, the method further includes: A configuration file is received from the first network element.

11. The method according to any one of claims 1 to 10, characterized in that: The first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

12. A communication method, characterized in that: Applied to a first network element, the method includes: The first network element generates a first request and sends the first request to the network storage function network element, where the first request is used to request discovery of a second network element, or the first request is used to request acquisition of an access token of the second network element, and the first request does not include a first parameter.

13. The method according to claim 12, characterized in that The method further comprises: Receiving first indication information from the network storage function network element; wherein, The first indication information is used to indicate that the first request is rejected; or, The first indication information is used to indicate that the first parameter is missing in the first request; or, The first indication information is used to instruct the first network element to send the first parameter; or, The first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

14. The method according to claim 13, characterized in that The first indication information includes information used to indicate the first parameter.

15. The method according to claim 13 or 14, characterized in that The method further comprises: Send a second request to the network storage function network element, the second request includes the first parameter of the first network element; wherein, when the first request is used to request to discover the second network element, the second request is used to request to discover the second network element, or, when the first request is used to request to obtain an access token for the second network element, the second request is used to request to obtain an access token for the second network element.

16. The method according to any one of claims 12 to 15, characterized in that: Before sending the first request, the method further includes: Send the configuration file of the first network element to the network storage function network element.

17. The method according to any one of claims 12 to 16, characterized in that: The first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

18. A communication method, characterized in that: Applied to a network storage function network element, the method comprises: Receiving a first request from a first network element, where the first request is used to discover a second network element, or the first request is used to obtain an access token of the second network element; Determining whether the first request includes a first parameter of the first network element; When the first request includes the first parameter, it is determined whether the first parameter is the same as the first parameter in the configuration file of the first network element.

19. The method according to claim 18, characterized in that The method further comprises: A configuration file is received from the first network element.

20. The method according to claim 18 or 19, characterized in that The method further comprises: When the first request does not include the first parameter, the first request is rejected.

21. The method of claim 20, wherein: The rejecting the first request comprises: Sending first indication information to the first network element; wherein, The first indication information is used to indicate that the first request is rejected; or, The first indication information is used to indicate that the first parameter is missing in the first request; or, The first indication information is used to instruct the first network element to send the first parameter; or, The first indication information is used to instruct the first network element to resend the first request and carry the first parameter in the resent first request.

22. The method according to claim 21, characterized in that The first indication information includes information used to indicate the first parameter.

23. The method according to claim 21 or 22, characterized in that The method further comprises: receiving a second request from the first network element, the second request including the first parameter of the first network element; wherein, when the first request is used to request discovery of the second network element, the second request is used to request discovery of the second network element, or, when the first request is used to request acquisition of an access token of the second network element, the second request is used to request acquisition of an access token of the second network element; Determine whether a first parameter included in the second request is the same as a first parameter included in a configuration file of the first network element.

24. The method according to any one of claims 20 to 23, characterized in that: Before determining whether the first request includes the first parameter of the first network element, the method further includes: Determining that a configuration file of the second network element includes the second indication information; The second indication information is used to indicate that the first parameter must be included in a request for discovering the second network element or a request for obtaining an access token for the second network element, and / or the second indication information is used to indicate verification of the first parameter in a request for discovering the second network element or a request for obtaining an access token for the second network element.

25. The method of claim 24, wherein: The second network element includes one or more network elements whose network element type is the first type.

26. The method of claim 25, wherein: The determining that the configuration file of the second network element includes the second indication information includes: It is determined that among the one or more network elements included in the second network element, a configuration file of at least one network element includes the second indication information.

27. The method according to any one of claims 24 to 26, characterized in that: The method further comprises: A configuration file is received from the second network element.

28. The method according to any one of claims 18 to 27, characterized in that The first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

29. A communication method, characterized in that: Applied to a first network element, the method includes: Generate a first request and send the first request to the network storage function network element, the first request is used to request to discover the second network element, or the first request is used to request to obtain an access token of the second network element, and the first request includes a first parameter.

30. The method of claim 29, wherein: Before sending the first request, the method further includes: Send the configuration file of the first network element to the network storage function network element.

31. The method according to claim 29 or 30, characterized in that The first parameter includes one or more of slice information, public land mobile network information, or independent non-public network information.

32. A communication system, characterized in that: It comprises a network storage function network element and a first network element, wherein the network storage function network element is used to execute the method according to any one of claims 1 to 11, and the first network element is used to execute the method according to any one of claims 12 to 17.

33. A communication system, characterized in that: It comprises a network storage function network element and a first network element, wherein the network storage function network element is used to execute the method according to any one of claims 18 to 28, and the first network element is used to execute the method according to any one of claims 29 to 31.

34. A communication device, characterized in that: include: One or more processors; the one or more memories store one or more computer programs, the one or more computer programs include instructions, when the instructions are executed by the one or more processors, the communication device performs the method as described in any one of claims 1 to 11, or the communication device performs the method as described in any one of claims 12 to 17, or the communication device performs the method as described in any one of claims 18 to 28, or the communication device performs the method as described in any one of claims 29 to 31.

35. A computer-readable storage medium, characterized in that: The method comprises a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 11, or enables the computer to execute the method according to any one of claims 12 to 17, or enables the computer to execute the method according to any one of claims 18 to 28, or enables the computer to execute the method according to any one of claims 29 to 31.

36. A computer program product, characterized in that When it runs on a computer, it enables the computer to execute the method as claimed in any one of claims 1 to 11, or enables the computer to execute the method as claimed in any one of claims 12 to 17, or enables the computer to execute the method as claimed in any one of claims 18 to 28, or enables the computer to execute the method as claimed in any one of claims 29 to 31.

37. A chip system, characterized in that: The method comprises: a processor, configured to call and run a computer program from a memory, so that the method according to any one of claims 1 to 11 is implemented, or the method according to any one of claims 12 to 17 is implemented, or the method according to any one of claims 18 to 28 is implemented, or the method according to any one of claims 29 to 31 is implemented.

38. A communication device, characterized in that: The device has the function of implementing the method as described in any one of claims 1 to 11, or the device has the function of implementing the method as described in any one of claims 12 to 17, or the device has the function of implementing the method as described in any one of claims 18 to 28, or the device has the function of implementing the method as described in any one of claims 29 to 31.

Images