Communication method and apparatus

Abstract

The present application relates to the technical field of communications, and provides a communication method and apparatus, for use in achieving service authorization of a vertical federated learning (VFL) server for an application function (AF) outside a network where the VFL server is located. In the method, when a VFL server requests an AF outside a network where the VFL server is located to join a VFL group, an NEF can verify the VFL server by means of an access token, that is, verify whether the VFL server is authorized to access a VFL service provided by the AF, and when the verification is successful, trigger the AF to join the VFL group. In this way, the service authorization of the VFL server can be achieved for the AF outside the network where the VFL server is located.

Description

Communication method and device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on April 3, 2024, with application number 202410407981.5 and application name “Communication Method and Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and in particular to a communication method and device. Background Art

[0003] Federated learning (FL) is a distributed machine learning approach in which multiple participants exchange model parameters through secure mechanisms, without interacting or sharing original training data, to achieve collaborative training. These participants can form a federated group to conduct machine learning training. This federated group includes an FL server and FL clients. The FL server is responsible for establishing the federated group, selecting appropriate FL clients to join, distributing models, setting training parameters, and merging data to produce the final training results. FL clients can join the federated group to contribute, such as training models.

[0004] Before requesting an FL client to join a group, the FL server must confirm its authorization scope—that is, whether the FL server is authorized to participate in the services provided by the FL client. However, currently, only service authorization methods exist for horizontal federated learning (HFL) servers, not for vertical federated learning (VFL) servers. Therefore, implementing VFL server service authorization is an urgent problem. Summary of the Invention

[0005] The embodiments of the present application provide a communication method and apparatus for implementing service authorization of a VFL server for an application function AF located outside a network where the VFL server is located.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, a communication method is provided. The method includes: when a first VFL server needs to perform model training, the first VFL server obtains information indicating a first application function AF, the first AF being the AF that the first VFL server requests to participate in a VFL group, the VFL group including a VFL client and a VFL server for participating in model training, the first AF not being a network element in the network where the first VFL server is located, and the first AF having VFL client capabilities; the first VFL server obtains an access token, the access token being used to indicate that the first VFL server is authorized to access services provided by the first AF; the first VFL server sends a service request message to a network function exposure function entity NEF, the service request message including information indicating the first AF and the access token; the NEF receives the service request message from the first VFL server; in response to the service request message, the NEF verifies the access token, and if the access token verification passes, triggers the first AF to join the VFL group based on the information indicating the first AF.

[0008] Based on the method of the first aspect, it can be seen that when a VFL server (such as a first VFL server) requests an AF (such as a first AF) located outside the network where the VFL server is located to join a VFL group, the NEF can verify the VFL server through an access token, that is, verify whether the VFL server is authorized to access the VFL service provided by the AF, and if the verification is successful, trigger the AF to join the VFL group. In this way, service authorization of the VFL server can be implemented for AFs located outside the network where the VFL server is located. It can also enable AFs located outside the network where the VFL server is located to join the VFL group, thereby enriching the data sources in the VFL group. In addition, by having the NEF verify the VFL server, VFL services can be provided in scenarios where the security needs of AFs outside the network are met.

[0009] In one possible design, the information indicating the first AF is an identifier of the first AF. The identifier of the first AF may be an ID of the first AF. It is understood that the information indicating the first AF may also be other types of information, such as attribute information of the first AF. This information may be flexibly configured based on actual circumstances and is not limited thereto.

[0010] Optionally, the identifier of the first AF is used to identify the first AF within the network where the first VFL server resides. In other words, the identifier of the first AF is an internal identifier, i.e., it identifies the first AF within the network where the first VFL server resides. It will be appreciated that the first AF may have an identifier outside the network that is different from that within the network. This improves the security of data within the network.

[0011] In one possible design, before the first VFL server obtains information indicating the first AF, the method described in the first aspect further includes: the NEF registering the vertical federation capability of the first AF with the network storage function (NRF), the vertical federation capability of the first AF being used to indicate that the first AF has VFL client capabilities; the first VFL server obtaining an access token, including: the first VFL server sending an access token request message to the NRF, the access token request message requesting a token indicating that the first VFL server is authorized to access services provided by the first AF; the NRF receiving the access token request message from the first VFL server; in response to the access token request message, the NRF performing an authorization check on the first VFL server based on the access token request message and the registered vertical federation capability of the first AF; if the authorization check on the first VFL server is successful, the NRF sending the access token to the first VFL server; and the first VFL server receiving the access token from the NRF. In other words, the vertical federation capability of the first AF can be registered in advance in the NRF, such as by registering the vertical federation capability of the first AF in an NEF configuration file, so that the NRF can perform an authorization check on the VFL server requesting the access token based on the registered vertical federation capability of the first AF.

[0012] Optionally, before the NEF registers the vertical federation capabilities of the first AF with the NRF, the method described in the first aspect further includes: the first AF triggering the NEF to register the vertical federation capabilities of the first AF and first vertical federation-related parameters of the first AF; the NEF registering the vertical federation capabilities of the first AF with the NRF includes: in response to the first AF triggering the NEF to register the vertical federation capabilities of the first AF and the first vertical federation-related parameters, the NEF registering the vertical federation capabilities of the first AF and the first vertical federation-related parameters with the NRF; and the NRF performing an authorization verification on the first VFL server based on the access token request message and the registered vertical federation capabilities of the first AF, including: the NRF performing an authorization verification on the first VFL server based on the access token request message, the registered vertical federation capabilities of the first AF, and the first vertical federation-related parameters. In other words, the first AF can proactively initiate the registration of its vertical federation capabilities and first vertical federation-related parameters. For example, the first AF can initiate a request to register its vertical federation capabilities and first vertical federation-related parameters when it goes online; or the first AF can initiate a request to register its latest vertical federation capabilities and first vertical federation-related parameters when its vertical federation capabilities and first vertical federation-related parameters are updated. In this way, the vertical federation capability of the first AF and the first vertical federation related parameters can be registered in time, thereby achieving dynamic matching of the vertical federation capability of the AF.

[0013] Furthermore, the first AF triggers the NEF to register the first AF's vertical federation capabilities and first vertical federation-related parameters, including: the first AF sends a subscription message to the NEF, the subscription message being used to request registration of the first AF's vertical federation capabilities and first vertical federation-related parameters; in response to the first AF triggering the NEF to register the first AF's vertical federation capabilities and first vertical federation-related parameters, the NEF registers the first AF's vertical federation capabilities and first vertical federation-related parameters with the NRF, including: the NEF sends a network function NF configuration file update request message to the NRF based on the subscription message, the NF configuration file update request message including the first AF's vertical federation capabilities and first vertical federation-related parameters; the NRF receives the NF configuration file update request message from the NEF; and the NRF registers the first AF's vertical federation capabilities and first vertical federation-related parameters based on the NF configuration file update request message. In other words, the first AF can trigger registration of its vertical federation capabilities and first vertical federation-related parameters by sending a subscription message. In this way, a unified service-based interface can be used, allowing different AFs (such as AFs from different enterprises) to connect to the NEF to register their vertical federation capabilities.

[0014] Furthermore, the first vertical federation related parameters include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

[0015] The first analysis identifier can be used to indicate the analysis services supported by the first AF, that is, the analysis services in which the first AF can participate. The first interoperability identifier can be used to indicate the network elements (or network function NF instances) with which the first AF can interact, that is, the first interoperability identifier can indicate the range of network elements (or NF instances) that can interact with the first AF. Secure sample alignment can be understood as aligning at least one data attribute (or data feature) used to train the model, and the inclusion of secure sample alignment in the first vertical federation-related parameters can indicate that the first AF requires the VFL server to have secure sample alignment capabilities. End-to-end secure transmission can be understood as supporting encrypted communication between the VFL server and the VFL client, and the inclusion of end-to-end secure transmission in the first vertical federation-related parameters can indicate that the first AF requires the VFL server to have end-to-end secure transmission capabilities. Authorization time can be used to indicate the time range in which the first AF can join the vertical federation VFL. Model usage scope can be used to indicate the range of usage within which the first AF allows the VFL server to use the model in which the first AF participated in training. Long-term storage of intermediate model parameters can be used to indicate that the first AF allows the VFL server to store intermediate model data for a long period of time. The anonymization process can be used to instruct the vertical federation participants (VFL client and VFL server) to anonymize the data used to train the model. The scope of the terminal served can be used to indicate the scope of the terminal served by the first AF.

[0016] It can be understood that the first vertical federation-related parameters represent the security requirements or security requirements of the first AF for joining the VFL group. The first vertical federation-related parameters can also be understood as the requirements of the first AF for the VFL server. The first AF can join the VFL group only when the first vertical federation-related parameters are met. In this case, the security requirements of the AF outside the network are met.

[0017] In a possible design scheme, the NEF triggers the first AF to join the VFL group based on the information used to indicate the first AF, including: the NEF sends a VFL group joining request message to the first AF based on the information used to indicate the first AF; the first AF receives the VFL group joining request message from the NEF; in response to the VFL group joining request message, the first AF sends a VFL group joining response message to the NEF, where the VFL group response message is used to indicate that the first AF joins the VFL group; the NEF receives the VFL group joining response message from the first AF; in response to the VFL group response message, the NEF sends a service response message to the first VFL server, where the service response message is used to indicate that the first AF joins the VFL group; and the first VFL server receives the service response message from the NEF.

[0018] In one possible design, the access token includes an identifier of a first AF and a first analysis identifier; the service request message includes a second analysis identifier, which is used to indicate the analysis service corresponding to the model training; the NEF verifies the access token, including: the NEF determines whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message; the NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; if the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, and if the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF verifies the access token successfully; otherwise, the NEF fails to verify the access token. By confirming whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, the security of the verification can be further improved.

[0019] In one possible design, the access token includes an identifier of a first AF and a first analysis identifier; the service request message includes a second analysis identifier, and the second analysis identifier is used to indicate the analysis service corresponding to the model training; the NEF verifies the access token, including: the NEF verifies the signature of the access token; the NEF determines whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message; the NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; if the NEF verifies the signature of the access token successfully, the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF verifies the access token successfully; otherwise, the NEF fails to verify the access token. By confirming whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, the security of the verification can be further improved.

[0020] In a second aspect, a communication method is provided. The method includes: a NEF receiving a service request message from a first VFL server, the service request message including information indicating a first AF and an access token, the first AF being the AF that the first VFL server requests to join a VFL group, the VFL group including a VFL client and a VFL server for participating in model training, the first AF not being a network element in a network where the first VFL server is located, the first AF having VFL client capabilities, and the access token indicating that the first VFL server is authorized to access services provided by the first AF; and in response to the service request message, the NEF verifying the access token and, if the access token passes verification, triggering the first AF to join the VFL group based on the information indicating the first AF.

[0021] In a possible design solution, the information used to indicate the first AF is an identifier of the first AF.

[0022] Optionally, the identifier of the first AF is used to indicate the first AF in the network.

[0023] In a possible design scheme, before the NEF receives the service request message from the first VFL server, the method described in the second aspect also includes: the NEF registers the vertical federation capability of the first AF with the NRF, and the vertical federation capability of the first AF is used to indicate that the first AF has the VFL client capability.

[0024] Optionally, the NEF registers the vertical federation capability of the first AF with the NRF, including: when the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF, the NEF registers the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF with the NRF.

[0025] Furthermore, when the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF, the NEF registers the vertical federation capability of the first AF and the first vertical federation-related parameters with the NRF, including: the NEF receives a subscription message from the AF, and the subscription message is used to request registration of the vertical federation capability of the first AF and the first vertical federation-related parameters; the NEF sends a network function NF configuration file update request message to the NRF based on the subscription message, and the NF configuration file update request message includes the vertical federation capability of the first AF and the first vertical federation-related parameters.

[0026] Furthermore, the first vertical federation related parameters include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

[0027] In a possible design scheme, the NEF triggers the first AF to join the VFL group based on the information used to indicate the first AF, including: the NEF sends a join VFL group request message to the first AF based on the information used to indicate the first AF; the NEF receives a join VFL group response message from the first AF; in response to the join VFL group response message, the NEF sends a service response message to the first VFL server, where the service response message is used to indicate that the first AF joins the VFL group.

[0028] In one possible design scheme, the access token includes an identifier of a first AF and a first analysis identifier; the service request message includes a second analysis identifier, and the second analysis identifier is used to indicate the analysis business corresponding to the model training; the NEF verifies the access token, including: the NEF determines whether the identifier of the first AF in the access token matches the information used to indicate the first AF in the service request message; the NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; if the identifier of the first AF in the access token matches the information used to indicate the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF passes the verification of the access token; otherwise, the NEF fails to verify the access token.

[0029] In one possible design scheme, the access token includes the identifier of the first AF and the first analysis identifier; the service request message includes the second analysis identifier, and the second analysis identifier is used to indicate the analysis business corresponding to the model training; the NEF verifies the access token, including: the NEF verifies the signature of the access token; the NEF determines whether the identifier of the first AF in the access token matches the information used to indicate the first AF in the service request message; the NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; if the NEF passes the signature verification of the access token, the identifier of the first AF in the access token matches the information used to indicate the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF passes the verification of the access token; otherwise, the NEF fails to verify the access token.

[0030] In addition, the technical effects of the method described in the second aspect can also refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0031] In a third aspect, a communication method is provided. The method includes: when a first vertical federated learning (VFL) server needs to perform model training, the first VFL server obtains information indicating a first application function (AF), the first AF is the AF that the first VFL server requests to participate in a VFL group, the VFL group includes a VFL client and a VFL server for participating in model training, the first AF is not a network element in the network where the first VFL server is located, and the first AF has the capability of a VFL client; the first VFL server obtains an access token, the access token is used to indicate that the first VFL server is authorized to access services provided by the first AF; the first VFL server sends a service request message to a network function exposure function entity (NEF), the service request message includes information indicating the first AF and the access token; the first VFL server receives a service response message from the NEF, the service response message is used to instruct the first AF to join the VFL group.

[0032] In a possible design solution, the information used to indicate the first AF is an identifier of the first AF.

[0033] In a possible design solution, the identifier of the first AF is used to indicate the first AF in the network.

[0034] In addition, the technical effects of the method described in the third aspect can also refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0035] In a fourth aspect, a communication method is provided. The method includes: a first AF receiving a VFL group join request message from an NEF, where the VFL group join request message is used to request the first AF to join a VFL group, where the VFL group includes a VFL client and a VFL server for participating in model training, the first AF is not a network element in a network where the first VFL server is located, and the first AF has VFL client capabilities; and in response to the VFL group join request message, the first AF sending a VFL group join response message to the NEF, where the VFL group response message is used to instruct the first AF to join the VFL group.

[0036] In a possible design scheme, before the first AF receives a request message to join the vertical federated learning VFL group from the network function open function entity NEF, the method described in the fourth aspect also includes: the first AF triggers the NEF to register the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF.

[0037] Optionally, the first AF triggers the NEF to register the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF, including: the first AF sends a subscription message to the NEF, where the subscription message is used to request registration of the vertical federation capability of the first AF and the first vertical federation related parameters.

[0038] In addition, the technical effects of the method described in the fourth aspect can also refer to the technical effects of the method described in the first aspect, and will not be repeated here.

[0039] In a fifth aspect, a communication method is provided. The method includes: when a first VFL server needs to perform model training, the first VFL server obtains information of a first AF list, the information of the first AF list corresponds to an AF that the first VFL server requests to participate in a VFL group, the VFL group includes a VFL client and a VFL server for participating in model training, each AF in the at least one AF corresponding to the information of the first AF list is not a network element in the network where the first VFL server is located, and each AF in the at least one AF corresponding to the information of the first AF list has the capability of a VFL client; the first VFL server obtains an access token, the access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information of the first AF list; the first VFL sends a service request message to an NEF, the service request message including the information of the first AF list and the access token; the NEF receives the service request message from the first VFL server; in response to the service request message, the NEF verifies the access token, and if the access token verification passes, triggers, based on the information of the first AF list, to add the at least one AF corresponding to the information of the first AF list to the VFL group.

[0040] Based on the method of the fifth aspect, it can be seen that when a VFL server (such as a first VFL server) requests an AF (such as at least one AF in the first AF list) located outside the network where the VFL server is located to join the VFL group, the NEF can verify the VFL server through the access token, that is, verify whether the VFL server is authorized to access the VFL service provided by the AF, and if the verification is successful, trigger the AF to join the VFL group. In this way, the service authorization of the VFL server can be implemented for the AF located outside the network where the VFL server is located. And the AF located outside the network where the VFL server is located can be added to the VFL group, thereby enriching the data sources in the VFL group. In addition, by verifying the VFL server through the NEF, the VFL service can be carried out in a scenario where the security requirements of the AF outside the network are met.

[0041] In one possible design, the information in the first AF list is the enterprise identifier corresponding to the first AF list. In this case, the first AF list may include all AFs belonging to the enterprise indicated by the enterprise identifier. It is understood that the information in the first AF list may also include other types of information, such as region information, terminal information, etc., and can be flexibly configured based on actual circumstances without limitation.

[0042] Optionally, the enterprise identifier corresponding to the first AF list is used to indicate the first AF list within the network. In other words, the enterprise identifier corresponding to the first AF list is an internal identifier, i.e., it identifies the first AF list within the network where the first VFL server resides. It is understood that the first AF list may have different indication information outside the network than within the network. This improves the security of data within the network.

[0043] In a possible design scheme, before the first VFL server obtains the information of the first AF list, the method described in the fifth aspect also includes: the NEF registers the vertical federation capability corresponding to the information of the second AF list with the NRF, the information of the second AF list includes the information of the first AF list, and the vertical federation capability corresponding to the information of the second AF list is used to indicate that each AF in at least one AF corresponding to the information of the second AF list has the capability of the VFL client; the first VFL server obtains an access token, including: the first VFL server sends an access token request message to the NRF, the access token request message requests a token used to indicate that the first VFL server is authorized to access the services provided by each AF corresponding to the information of the first AF list; the NRF receives the access token request message from the first VFL server; in response to the access token request message, the NRF performs authorization verification on the first VFL server according to the access token request message and the vertical federation capability corresponding to the registered information of the first AF list; if the authorization verification of the first VFL server is passed, the NRF sends the access token to the first VFL server; the first VFL server receives the access token from the NRF. That is, the vertical federation capability corresponding to the second AF list information can be registered in advance in the NRF, so that the NRF can perform authorization verification on the VFL server requesting the access token based on the vertical federation capability corresponding to the registered first AF list information.

[0044] Optionally, the NEF registers the vertical federation capability corresponding to the information of the second AF list with the NRF, including: the NEF registers the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list with the NRF, the vertical federation-related parameters corresponding to the information of the second AF list include the vertical federation-related parameters corresponding to the information of the first AF list, the vertical federation-related parameters corresponding to the information of the first AF list are used to indicate the capability that each AF in at least one AF corresponding to the information of the first AF list requires the VFL server to have in the VFL; the NRF performs authorization verification on the first VFL server based on the access token request message and the vertical federation capability corresponding to the registered information of the first AF list, including: the NRF performs authorization verification on the first VFL server based on the access token request message, the vertical federation capability corresponding to the registered information of the first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list. It is understandable that when the information of the second AF list has the corresponding vertical federation-related parameters, the NEF may further register the vertical federation-related parameters corresponding to the information of the second AF list.

[0045] Furthermore, NEF registers the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list with NRF, including: NEF sends a registration request message to NRF, and the registration request message includes at least one of the following: information of the second AF list, vertical federation capability corresponding to the information of the second AF list, or vertical federation-related parameters corresponding to the information of the second AF list; NRF receives the registration request message from NEF; after successfully registering the vertical federation capability corresponding to the information of the second AF list, NRF sends a registration response message to NEF. In other words, NEF can pre-register the vertical federation capability and vertical federation-related parameters corresponding to the information of the second AF list by reusing the registration request message. In this way, the difficulty of implementation can be reduced. Of course, NEF can also register the vertical federation capability and vertical federation-related parameters corresponding to the information of the second AF list through other messages, such as newly defined messages. The specific information can be flexibly set according to actual conditions without limitation.

[0046] Furthermore, the information of the second AF list includes at least one corporate identifier. It is understood that the second AF list may include at least one AF sublist, such as the first AF list described above may be an AF sublist within the second AF list. In this case, the AF sublist may be indicated by the corporate identifier, i.e., the information of the second AF list may include at least one corporate identifier.

[0047] Furthermore, the vertical federation-related parameters corresponding to the information of the first AF list include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

[0048] The first analysis identifier can be used to indicate the analysis services supported by the AFs in the first AF list, that is, the analysis services that the AF can participate in. The first interoperability identifier can be used to indicate the network elements (or network function NF instances) that the AFs in the first AF list can interact with, that is, the first interoperability identifier can indicate the range of network elements (or NF instances) that can interact with the AF. Secure sample alignment can be understood as aligning at least one data attribute (or data feature) used to train the model, and the inclusion of secure sample alignment in the first vertical federation-related parameters can indicate that the AFs in the first AF list require the VFL server to have secure sample alignment capabilities. End-to-end secure transmission can be understood as supporting encrypted communication between the VFL server and the VFL client, and the inclusion of end-to-end secure transmission in the first vertical federation-related parameters can indicate that the AFs in the first AF list require the VFL server to have end-to-end secure transmission capabilities. The authorization time can be used to indicate the time range within which the AFs in the first AF list can join the vertical federation VFL. The model usage scope can be used to indicate the range of usage of the model that the AFs in the first AF list allow the VFL server to participate in training using the AF. Long-term storage of intermediate model parameters can be used to indicate that the AF in the first AF list requires long-term storage of model data. Anonymization processing can be used to indicate anonymization of the data used to train the model. Served terminal range can be used to indicate the range of terminals served by the AF in the first AF list.

[0049] It can be understood that the vertical federation-related parameters corresponding to the first AF list information represent the security requirements or security requirements of the AF corresponding to the first AF list information for joining the VFL group. The vertical federation-related parameters can also be understood as the requirements of the AF corresponding to the first AF list information on the VFL server. Only when the vertical federation-related parameters are met can the AF join the VFL group. In this case, the security requirements of the AF outside the network are met.

[0050] In a possible design scheme, the NEF triggers, based on information in the first AF list, at least one AF corresponding to the information in the first AF list to join the VFL group, including: the NEF determines, based on the information in the first AF list, the first AF participating in the VFL group; the NEF sends a VFL group joining request message to the first AF; the first AF receives the VFL group joining request message from the NEF; in response to the VFL group joining request message, the first AF sends a VFL group joining response message to the NEF, where the VFL group response message is used to instruct the first AF to join the VFL group; the NEF receives the VFL group joining response message from the first AF; in response to the VFL group response message, the NEF sends a service response message to the first VFL server, where the service response message is used to instruct the first AF to join the VFL group; and the first VFL server receives the service response message from the NEF.

[0051] In a sixth aspect, a communication method is provided. The method includes: a network function exposure function entity NEF receives a service request message from a first vertical federated learning VFL server, the service request message includes information of a first AF list and an access token, the first VFL server corresponding to the information of the first AF list requests AFs participating in a VFL group, the VFL group includes VFL clients and VFL servers for participating in model training, each AF in at least one AF corresponding to the information of the first AF list is not a network element in the network where the first VFL server is located, each AF in at least one AF corresponding to the information of the first AF list has the capability of a VFL client, and the access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information of the first AF list; in response to the service request message, the NEF verifies the access token, and if the access token verification passes, triggers the addition of at least one AF corresponding to the information of the first AF list to the VFL group according to the information of the first AF list.

[0052] In a possible design solution, the information of the first AF list is the enterprise identifier corresponding to the first AF list.

[0053] Optionally, the enterprise identifier corresponding to the first AF list is used to indicate the first AF list in the network.

[0054] In one possible design scheme, before the NEF receives the service request message from the first VFL server, the method described in the sixth aspect also includes: the NEF registers the vertical federation capability corresponding to the information of the second AF list to the network storage function NRF, the information of the second AF list includes the information of the first AF list, and the vertical federation capability corresponding to the information of the second AF list is used to indicate that each AF in at least one AF corresponding to the information of the second AF list has the capability of the VFL client.

[0055] Optionally, the NEF registers the vertical federation capability corresponding to the information of the second AF list with the NRF, including: the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list registered by the NRF with the NRF, the vertical federation-related parameters corresponding to the information of the second AF list include the vertical federation-related parameters corresponding to the information of the first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list are used to indicate the capability that each AF in at least one AF corresponding to the information of the first AF list requires the VFL server to have in the VFL.

[0056] Furthermore, the NEF registers the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list to the NRF, including: the NEF sends a registration request message to the NRF, and the registration request message includes at least one of the following: the information of the second AF list, the vertical federation capability corresponding to the information of the second AF list, or the vertical federation-related parameters corresponding to the information of the second AF list.

[0057] Furthermore, the information of the second AF list includes at least one enterprise identification.

[0058] Furthermore, the vertical federation-related parameters corresponding to the information of the first AF list include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

[0059] In a possible design scheme, the NEF triggers at least one AF in the first AF list to join the VFL group based on information in the first AF list, including: the NEF determines the first AF participating in the VFL group based on the information in the first AF list; the NEF sends a join VFL group request message to the first AF; the NEF receives a join VFL group response message from the first AF, where the join VFL group response message is used to instruct the first AF to join the VFL group; in response to the join VFL group response message, the NEF sends a service response message to the first VFL server, where the service response message is used to instruct the first AF to join the VFL group.

[0060] In addition, the technical effects of the method of the sixth aspect can also refer to the technical effects of the method of the fifth aspect, and will not be repeated here.

[0061] In a seventh aspect, a communication method is provided. The method includes: when a first VFL server needs to perform model training, the first VFL server obtains information of a first AF list, the information of the first AF list corresponds to the AF that the first VFL server requests to participate in the VFL group, the VFL group includes a VFL client and a VFL server for participating in the model training, each AF in at least one AF corresponding to the information of the first AF list is not a network element in the network where the first VFL server is located, and each AF in at least one AF corresponding to the information of the first AF list has the capability of a VFL client; the first VFL server obtains an access token, the access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information of the first AF list; the first VFL sends a service request message to a network function exposure function entity NEF, the service request message including the information of the first AF list and the access token; the first VFL server receives a service response message from the NEF, the service response message is used to instruct the first AF to join the VFL group.

[0062] In a possible design solution, the information of the first AF list is the enterprise identifier corresponding to the first AF list.

[0063] Optionally, the enterprise identifier corresponding to the first AF list is used to indicate the first AF list in the network.

[0064] In addition, the technical effects of the method described in the seventh aspect can also refer to the technical effects of the method described in the fifth aspect, and will not be repeated here.

[0065] In an eighth aspect, a communication method is provided. The method includes: a first AF receiving a VFL group join request message from an NEF, where the VFL group join request message is used to request the first AF to join a VFL group, where the VFL group includes a VFL client and a VFL server for participating in model training, and the first AF has VFL client capabilities; and in response to the VFL group join request message, the first AF sending a VFL group join response message to the NEF, where the VFL group response message is used to instruct the first AF to join the VFL group.

[0066] In addition, the technical effects of the method described in the eighth aspect can also refer to the technical effects of the method described in the fifth aspect, and will not be repeated here.

[0067] In a ninth aspect, a communication device is provided. The device includes a module for executing the method described in any of aspects 2 to 4, and aspects 6 to 8, such as a transceiver module and a processing module. The transceiver module can be used to implement the device's message sending and receiving functions. The processing module can be used to implement the device's functions other than message sending and receiving.

[0068] Optionally, the transceiver module may include a sending module and a receiving module, wherein the sending module is used to implement the sending function of the communication device described in the ninth aspect, and the receiving module is used to implement the receiving function of the communication device described in the ninth aspect.

[0069] Optionally, the communication device described in aspect 9 may further include a storage module storing a program or instruction. When the processing module executes the program or instruction, the communication device may execute the communication method described in any one of aspects 2 to 4 and aspects 6 to 8 above.

[0070] It should be noted that the communication device described in the ninth aspect can be a network device, such as a VFL server, or NEF, etc., or it can be a chip (system) or other parts or components that can be set in the network device, or it can be a device that includes the network device. This application does not limit this.

[0071] In addition, the technical effects of the communication device described in the ninth aspect can refer to the technical effects of the communication method described in any one of the second to fourth aspects and the sixth to eighth aspects above, and will not be repeated here.

[0072] In a tenth aspect, a communication device is provided, comprising: a processor configured to execute the communication method described in any one of the second to fourth and sixth to eighth aspects.

[0073] In one possible design solution, the communication device described in the tenth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the tenth aspect to communicate with other communication devices.

[0074] In one possible design, the communication device described in aspect 10 may further include a memory. The memory may be integrated with the processor or provided separately. The memory may be used to store computer programs and / or data involved in the communication method described in any of aspects 2 to 4 and aspects 6 to 8 above.

[0075] In the present application, the communication device described in the tenth aspect can be a network device, such as a VFL server, or NEF, etc., or a chip (system) or other parts or components that can be set in the network device, or a device that includes the network device.

[0076] In addition, the technical effects of the communication device described in the tenth aspect can refer to the technical effects of the communication method described in any one of the second to fourth aspects and the sixth to eighth aspects above, and will not be repeated here.

[0077] In an eleventh aspect, a communication device is provided. The communication device includes: a processor coupled to a memory, the processor configured to execute a computer program stored in the memory, so that the communication device performs the communication method described in any one of the second to fourth aspects and the eleventh to eighth aspects.

[0078] In one possible design solution, the communication device described in the eleventh aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in the eleventh aspect to communicate with other communication devices.

[0079] In the present application, the communication device described in the eleventh aspect can be a network device, such as a VFL server, or NEF, etc., or a chip (system) or other parts or components that can be set in the network device, or a device that includes the network device.

[0080] In addition, the technical effects of the communication device described in the eleventh aspect can refer to the technical effects of the communication method described in any of the second to fourth aspects and the eleventh to eighth aspects above, and will not be repeated here.

[0081] In the twelfth aspect, a communication device is provided, comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the communication device executes the communication method described in any one of the above-mentioned aspects from the second to the fourth and the sixth to the eighth.

[0082] In one possible design solution, the communication device described in aspect 12 may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in aspect 12 to communicate with other communication devices.

[0083] In the present application, the communication device described in the twelfth aspect can be a network device, such as a VFL server, or NEF, etc., or a chip (system) or other parts or components that can be set in the network device, or a device that includes the network device.

[0084] In addition, the technical effects of the communication device described in the twelfth aspect can refer to the technical effects of the communication method described in any one of the second to fourth aspects and the sixth to eighth aspects above, and will not be repeated here.

[0085] In the thirteenth aspect, a communication device is provided, comprising: a processor; the processor is used to couple with a memory, and after reading a computer program in the memory, execute the communication method as described in any one of the second to fourth aspects and the sixth to thirteenth aspects according to the computer program.

[0086] In one possible design solution, the communication device described in aspect 13 may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the communication device described in aspect 13 to communicate with other communication devices.

[0087] In the present application, the communication device described in the thirteenth aspect can be a network device, such as a VFL server, or NEF, etc., or a chip (system) or other parts or components that can be set in the network device, or a device that includes the network device.

[0088] In addition, the technical effects of the communication device described in the thirteenth aspect can refer to the technical effects of the communication method described in any one of the second to fourth aspects and the sixth to thirteenth aspects above, and will not be repeated here.

[0089] In a fourteenth aspect, a communication chip is provided, in which instructions are stored. When the chip runs on a communication device, the method described in any one of the implementation methods of the second to fourth aspects and the sixth to eighth aspects is implemented.

[0090] In the fifteenth aspect, a communication chip is provided, comprising: a logic circuit and a communication interface, the logic circuit being used to execute computer instructions, the communication interface being used for the communication chip to communicate with other devices or chips, and when the logic circuit executes the computer instructions, the method described in any one of the implementation methods of the second to fourth aspects and the sixth to eighth aspects above is implemented.

[0091] In a sixteenth aspect, a communication system is provided, comprising: a NEF for executing the method according to the second aspect, and a first VFL server for executing the method according to the third aspect; or one or more devices for executing the method according to the first aspect.

[0092] In a seventeenth aspect, a communication system is provided, comprising: a NEF for executing the method according to the sixth aspect, and a first VFL server for executing the method according to the seventh aspect; or one or more devices for executing the method according to the fifth aspect.

[0093] In the eighteenth aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are run on a computer, the computer executes the communication method described in any one of the above-mentioned aspects from the second to the fourth and the sixth to the thirteenth aspects.

[0094] In the nineteenth aspect, a computer program product is provided, comprising a computer program or instructions, which, when executed on a computer, enables the computer to execute the communication method described in any one of the second to fourth aspects and the sixth to thirteenth aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] FIG1 is a schematic diagram of the architecture of a fifth-generation mobile communication system 5GS provided in an embodiment of the present application;

[0096] FIG2 is a schematic diagram of a network function NF registration process provided in an embodiment of the present application;

[0097] FIG3 is a schematic diagram of the NF service discovery process provided in an embodiment of the present application;

[0098] FIG4 is a schematic diagram of the NF service authorization process provided in an embodiment of the present application;

[0099] FIG5 is a schematic diagram of a horizontal federation authorization process for a network data analysis function NWDAF according to an embodiment of the present application;

[0100] FIG6 is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application;

[0101] FIG7 is a flow chart of a communication method according to an embodiment of the present application;

[0102] FIG8 is a second flow chart of a communication method according to an embodiment of the present application;

[0103] FIG9 is a third flow chart of the communication method provided in an embodiment of the present application;

[0104] FIG10 is a fourth flow chart of a communication method according to an embodiment of the present application;

[0105] FIG11 is a fifth flow chart of a communication method according to an embodiment of the present application;

[0106] FIG12 is a sixth flow chart of a communication method according to an embodiment of the present application;

[0107] FIG13 is a first structural diagram of a communication device provided in an embodiment of the present application;

[0108] FIG14 is a second structural diagram of the communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0109] For ease of understanding, the technical terms involved in the embodiments of this application are first introduced below.

[0110] 1. Fifth-generation (5G) mobile communication system (abbreviated as 5G system (5G system, 5GS))

[0111] Figure 1 is a schematic diagram of the 5GS architecture. As shown in Figure 1, 5GS includes: an access network (AN) and a core network (CN), and may also include: terminal equipment.

[0112] The terminal device may be a terminal device with transceiver functions, or a chip or chip system that can be provided in the terminal device. The terminal device may also be referred to as user equipment (UE), access terminal, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a vehicle-mounted terminal, a road side unit (RSU) with terminal function, etc. The terminal device of the present application may also be an onboard module, onboard module, onboard component, onboard chip or onboard unit built into the vehicle as one or more components or units. The embodiments of the present application do not limit the type or category of the terminal device.

[0113] The AN is used to implement access-related functions. It can provide network access for authorized users in a specific area and determine transmission links of varying quality to transmit user data based on user level and service requirements. The AN forwards control signals and user data between terminals and the CN. The AN may include access network equipment, also known as radio access network (RAN) equipment. The CN is primarily responsible for maintaining mobile network subscription data and providing terminal devices with functions such as session management, mobility management, policy management, and security authentication. CN mainly includes the following: user plane function (UPF), authentication server function (AUSF), access and mobility management function (AMF), session management function (SMF), network slice selection function (NSSF), network exposure function (NEF), network repository function (NRF), policy control function (PCF), unified data management (UDM), unified data repository (UDR), application function (AF), network data analytics function (NWDAF), and analytics data repository function (ADRF).

[0114] As shown in Figure 1, the UE accesses the 5G network through the RAN equipment. The UE communicates with the AMF through the N1 interface (referred to as N1); the RAN communicates with the AMF through the N2 interface (referred to as N2); the RAN communicates with the UPF through the N3 interface (referred to as N3); the SMF communicates with the UPF through the N4 interface (referred to as N4), and the UPF accesses the data network (DN) through the N6 interface (referred to as N6). In addition, the control plane functions shown in Figure 1, such as AUSF, AMF, SMF, NSSF, NEF, NRF, PCF, UDM, UDR, AF, and NWDAF, interact using service-based interfaces. For example, the service-oriented interface provided by AUSF to the outside world includes Nausf; the service-oriented interface provided by AMF to the outside world includes Namf; the service-oriented interface provided by SMF to the outside world includes Nsmf; the service-oriented interface provided by NSSF to the outside world includes Nnssf; the service-oriented interface provided by NEF to the outside world includes Nnef; the service-oriented interface provided by NRF to the outside world includes Nnrf; the service-oriented interface provided by PCF to the outside world includes Npcf; the service-oriented interface provided by UDM to the outside world includes Nudm; the service-oriented interface provided by UDR to the outside world includes Nudr; the service-oriented interface provided by AF to the outside world includes Naf; the service-oriented interface provided by NWDAF to the outside world includes Nnwdaf.

[0115] RAN equipment can be equipment that provides access to terminal equipment. For example, the RAN equipment may include: a next-generation mobile communication system, such as an access network device of 6G, such as a 6G base station, or in the next-generation mobile communication system, the network equipment may also have other naming methods, which are all included in the protection scope of the embodiments of this application, and this application does not impose any restrictions on this. Alternatively, the RAN equipment may also include 5G, such as a gNB in ​​a new radio (NR) system, or one or a group of (including multiple antenna panels) antenna panels of a base station in 5G, or a network node constituting a gNB, a transmission point (TRP or transmission point, TP) or a transmission measurement function (TMF), such as a baseband unit (building base band unit, BBU), or a centralized unit (CU) or a distributed unit (DU), an RSU with base station function, or a wired access gateway, or a 5G core network. Alternatively, RAN devices may also include access points (APs) in wireless fidelity (WiFi) systems, wireless relay nodes, wireless backhaul nodes, various forms of macro base stations, micro base stations (also known as small stations), relay stations, access points, wearable devices, vehicle-mounted devices, and the like.

[0116] UPF is mainly responsible for user data processing (forwarding, receiving, billing, etc.).

[0117] AUSF is mainly used to perform security authentication of terminal devices.

[0118] AMF is mainly used for mobility management in mobile networks, such as user location update, user network registration, and user handover.

[0119] The SMF is primarily used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include allocating Internet Protocol (IP) addresses to users and selecting the UPF that provides packet forwarding capabilities.

[0120] PCF primarily supports providing a unified policy framework to control network behavior, providing policy rules to the control layer network functions, and is responsible for obtaining user subscription information related to policy decisions. PCF can provide policies to AMF and SMF, such as quality of service (QoS) policies and slice selection policies.

[0121] NSSF is mainly used to select network slices for terminal devices.

[0122] NEF is a control plane function provided by the operator. It mainly enables third parties to use the services provided by the network. It supports the network to open its capabilities, event and data analysis, the transmission of security configuration information from external applications to the public land mobile network (PLMN), and the conversion of interactive information within and outside the PLMN. For example, NEF can expose some capabilities of the 5G network to third-party applications through the application program interface (API). Third-party applications can obtain some capabilities of the 5G network by calling the API provided by NEF through AF, allowing third-party applications to control certain behaviors of the 5G network and terminal devices.

[0123] NRF is a control plane function provided by operators, which can be used to maintain real-time information of network functions and services in the network.

[0124] UDM is mainly used to store user data, such as contract data, authentication / authorization data, etc.

[0125] UDR is mainly used to store structured data, including contract data and policy data, externally exposed structured data, and application-related data.

[0126] The AF mainly provides corresponding services by interacting with the CN, such as providing roaming UE with visited network selection information, guiding the routing of data flows, and accessing the NEF.

[0127] NWDAF is a control plane function provided by the operator, with functions such as data collection, model training, data analysis, and model reasoning. The NWDAF network element containing the analytics logical function (AnLF) can be used to infer and derive analysis information and expose analysis services, where analysis can refer to statistical information and / or predictions generated or provided based on the request of the analysis consumer. The NWDAF network element containing the model training logical function (MTLF) can be used to train machine learning (ML) models or artificial intelligence (AI) models and expose new training services, such as providing trained AI models or ML models to AnLF.

[0128] For the convenience of explanation, in the embodiments of the present application, network functions (such as NEF, SMF, etc.) are collectively referred to as / abbreviated as NFs, that is, the NFs described later in the embodiments of the present application can be replaced with any network function. In addition, in the embodiments of the present application, terminal devices are referred to as UEs, that is, the UEs described later in the embodiments of the present application can be replaced with terminal devices. Figure 1 only schematically illustrates some network functions, and the NFs described later are not limited to the network functions shown in Figure 1.

[0129] It should be understood that the above naming is defined only to facilitate the distinction between different functions and should not constitute any limitation to this application. This application does not exclude the possibility of adopting other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may continue to use the terminology used in 5G, or may adopt other names.

[0130] 2. Network Functions (NF) Registration Process

[0131] In order for NRF to correctly maintain information about available NF instances and the services they support, each NF instance can notify NRF of the list of NF services it supports, so that NRF can establish an NF profile for each NF instance. This process of notifying NRF of the list of NF services supported by the NF instance and the information about the NF instance is the NF service registration process. The registration process of the NF instance with NRF can also include the capabilities and configuration information at the time of instantiation. It is understood that the NF instance can also update or delete relevant parameters of the NF service (for example, delete the endpoint information of the notification).

[0132] For example, as shown in FIG2 , when an NF service producer (NFp) goes online, it may register its NF profile with the NRF.

[0133] S201: NFp sends a registration request message to NRF. Correspondingly, NRF receives the registration request message from NFp.

[0134] The Registration Request message is used to request registration of the NF profile of NFp.

[0135] S202: The NRF stores the NF configuration file, which is the file carried in the registration request message.

[0136] S203: NRF sends a registration response message to NFp. Correspondingly, NFp receives the registration response message from NRF.

[0137] The NRF stores the NF configuration file of the NFp and can send a registration response message to the NFp to notify the NFp that the registration is completed.

[0138] 3.NF Service Discovery Process

[0139] The control plane NF in the 5G core network can expose its capabilities through its service-oriented interfaces. This NF's services can be discovered by other NFs in the core network, and NF instances can be provided to provide the services required by the NF. NF service discovery is implemented through the NRF discovery function. For example, an NF service consumer (NFc) sends a service discovery request to the NRF, including its own information and the desired NFp service information. The NRF determines the service discovery result based on the NFc and NFp configuration files, as well as local service discovery policies, and returns the service discovery result to the NFc.

[0140] For example, as shown in Figure 3, when NFc needs to perform service discovery, it can request service discovery from NRF. The specific process is as follows:

[0141] S301: NFc sends an NF discovery request message to NRF. Correspondingly, NRF receives the NF discovery request message from NFc.

[0142] The NF discovery request message may include relevant information about the services required by the NFc.

[0143] S302, NRF authorizes NF service discovery.

[0144] After receiving the NF discovery request message, the NRF can perform service discovery based on the information carried in the NF discovery request message.

[0145] S303: NRF sends an NF discovery response message to NFc. Correspondingly, NFc receives the NF discovery response message from NRF.

[0146] After completing service discovery, NRF can send the service discovery result (such as the NF instance that can provide the service) to NFc through an NF discovery response message.

[0147] 4.NF Service Authorization Process

[0148] The NRF can provide service authorization capabilities to the NFc. NFcs authorized by the NRF will receive an access token (except for static authorization). The NFp verifies the access token to determine the NFc's authorization information. NF service authorization ensures that the NFc is authorized to access the NF services provided by the NFp. NF service authorization can be performed based on information such as NF policy information, operator policy information, and inter-operator agreements. It is understood that service authorization information is a component of the NFp's NF profile, which includes the NF types that are permitted to use the NF services of the service producer.

[0149] For example, as shown in Figure 4, before NFc needs to request a service from NFp, it obtains the corresponding access token from NRF, so that NFp can verify the access token to determine the authorization information of NFc. The specific process is as follows:

[0150] S401: NFc sends an access token request message to NRF. Correspondingly, NRF receives the access token request message from NFc.

[0151] S402: NRF confirms that NFc is authorized. When NFc is authorized, an access token is generated.

[0152] S403: NRF sends an access token response message to NFc. Correspondingly, NFc receives the access token response message from NRF.

[0153] The access token response message includes the access token generated by the NRF.

[0154] 5. Horizontal Federation Authorization Process for Network Data Analytics Function (NWDAF)

[0155] Figure 5 illustrates the authorization process for NRF to NWDAF (i.e., HFL server) in horizontal federated learning. NWDAF#1, which includes the MTLF, is the FL server, and NWDAF#2, which also includes the MTLF, is the FL client. The following details the authorization process for NWDAF#1 in horizontal federation.

[0156] S501a, NWDAF#1 sends a registration request message #1a to NRF. Correspondingly, NRF receives the registration request message #1a from NWDAF#1.

[0157] Registration Request Message #1a includes NWDAF#1's capabilities, a list of supported services, NWDAF#1's own information, FL Capability #1a (i.e., FL server), and Analysis ID #1a. FL Capability #1a indicates that NWDAF#1 functions as an FL server, and Analysis ID #1a indicates the analysis services supported by NWDAF#1.

[0158] S501b, NWDAF#2 sends a registration request message #1b to NRF. Correspondingly, NRF receives the registration request message #1b from NWDAF#2.

[0159] Registration request message #1b includes NWDAF#2's capabilities, a list of supported services, NWDAF#2's own information, FL capabilities #1b (i.e., FL client), analysis ID #1b, and interoperability indicator #1b. FL capabilities #1b indicates that NWDAF#2 functions as an FL client; analysis ID #1b indicates the analysis services supported by NWDAF#2; and interoperability indicator #1b indicates the scope of authorized federated learning for the FL client.

[0160] S502, NWDAF#1 and NRF perform service discovery.

[0161] NWDAF#1 sends a discovery request message to the NRF and receives a response from the NRF containing information of the NWDAF acting as an FL client.

[0162] S503: NWDAF#1 sends an access token request message to NRF. Correspondingly, NRF receives the access token request message from NWDAF#1.

[0163] The access token request message includes analysis ID#1c, which is used to indicate a specific federated learning task.

[0164] S504: NRF authorizes the FL client based on its registered information. If authorization is successful, an access token is generated.

[0165] The NRF performs authorization based on the NF profiles of the FL server (i.e., NWDAF#1) and the FL server (i.e., NWDAF#2). If the NWDAF's enterprise identity is within the scope indicated by the FL client's interoperability identity #1b, the authorization is successful, and the NRF generates an access token containing analysis ID #1c.

[0166] S505a: If the NRF is authorized, the NRF sends an access token to NWDAF#1. In response, NWDAF#1 receives the access token from the NRF.

[0167] S505b: When the NRF fails in authorization, the NRF sends a rejection message to the NWDAF#1. Correspondingly, the NWDAF#1 receives the rejection message from the NRF.

[0168] S506: When the NRF is authorized, NWDAF#1 sends a service request message to NWDAF#2. Correspondingly, NWDAF#2 receives the service request message from NWDAF#1.

[0169] The service request message is used to request NWDAF#2 to join the FL group. The service request message includes information such as access token and analysis ID#1c.

[0170] S507, NWDAF#2 verifies the access token.

[0171] S508a: When NWDAF#2 successfully verifies the access token, NWDAF#2 sends a success response to NWDAF#1. Correspondingly, NWDAF#1 receives the success response from NWDAF#2.

[0172] S508b: If NWDAF#2 fails to verify the access token, NWDAF#2 sends a failure response to NWDAF#1. Correspondingly, NWDAF#1 receives the failure response from NWDAF#2.

[0173] S509: When NWDAF#2 sends a successful response, NWDAF#1 starts the federated learning process.

[0174] The above-mentioned federated learning process may include negotiating parameters, distributing models, starting training, collecting training results, etc.

[0175] As can be seen, before requesting an FL client to join a group, the FL server needs to confirm its authorized scope, specifically whether it is authorized to access the services provided by the FL client. It's understandable that if the FL server isn't authorized for services, it could potentially be malicious. In this case, a malicious FL server could potentially cause privacy leaks, label inference attacks, and other issues. However, currently, only service authorization methods exist for HFL servers, not for VFL servers. Furthermore, for VFL, the VFL server can interact with the AF (i.e., the VFL client), such as collecting data from UE applications as input for analysis. The AF can be located within or outside the VFL server's network. For AFs within the VFL server's network, the VFL server's service authorization process can be configured as described in "5. NWD AF Authorization Process." Currently, there's no VFL server service authorization process for AFs outside the VFL server's network. Therefore, implementing VFL server service authorization for AFs outside the VFL server's network is a pressing issue.

[0176] In response to the above technical problems, the embodiments of the present application propose the following technical solution to implement service authorization of the VFL server for AFs located outside the network where the VFL server is located.

[0177] The technical solution in this application will be described below with reference to the accompanying drawings.

[0178] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as 4th generation (4G) mobile communication systems, such as long term evolution (LTE) systems, fifth generation (5G) mobile communication systems, such as new radio (NR) systems, and communication systems evolved after 5G, such as sixth generation (6G) mobile communication systems. They can also be applied to wireless fidelity (WiFi) systems, vehicle to everything (V2X) communication systems, device-to-device (D2D) communication systems, Internet of Vehicles communication systems, machine type communication (MTC), Internet of Things (IoT) communication systems, and the like.

[0179] This application will present various aspects, embodiments, or features in the context of systems that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the figures. Furthermore, combinations of these aspects may also be used.

[0180] Additionally, in the embodiments of this application, words such as "exemplary" and "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of the word "exemplary" is intended to present concepts in a concrete manner.

[0181] In the embodiments of the present application, "information", "signal", "message", "channel" and "signaling" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are matched. In addition, the " / " mentioned in this application can be used to express an "or" relationship.

[0182] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field will know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0183] To facilitate understanding of the embodiments of the present application, a communication system applicable to the embodiments of the present application is first described in detail using the communication system shown in Figure 6 as an example. For example, Figure 6 is a schematic diagram of the architecture of a communication system applicable to the communication method provided in the embodiments of the present application.

[0184] As shown in FIG6 , the communication system includes: a VFL server and a NEF.

[0185] Optionally, the communication system may further include at least one of the following: NRF, or AF.

[0186] The VFL server can be an NWDAF that includes MTLF. For details, please refer to the relevant introduction in the aforementioned "1.5GS" and will not be repeated here. It is understood that the NWDAF mentioned in the embodiments of this application, unless otherwise specified, refers to the NWDAF that includes MTLF. In addition, the VFL server can also be other network elements with VFL server capabilities. The specific configuration can be flexibly determined according to actual circumstances and is not limited.

[0187] For details about NRF, NEF and AF, please refer to the relevant introduction in the aforementioned "1.5GS" and will not be repeated here.

[0188] It can be understood that the above-mentioned VFL server, NRF and NEF are located within the PLMN, and the above-mentioned AF is located outside the PLMN. It should be understood that in the communication system, the part operated by the operator can be called PLMN, or it can be called operator network, etc. PLMN is a network established and operated by the government or its approved operators for the purpose of providing land mobile communication services to the public. It is mainly a public network where mobile network operators (MNOs) provide mobile broadband access services to users. The PLMN described in the embodiment of the present application can specifically be a network that meets the requirements of the 3rd Generation Partnership Project (3GPP) standards, referred to as a 3GPP network. 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication (4th-generation, 4G) networks, and other future communication systems, such as sixth-generation mobile communication (6th-generation, 6G) networks. Please continue to refer to Figure 1. The 5G network architecture shown in Figure 1 may include a terminal device part, a data network (DN) part, and an operator network PLMN part. The operator network PLMN part may include but is not limited to a (radio) access network ((R)AN) and a core network (CN).

[0189] In the above-mentioned communication system, when the VFL server requests an AF located outside the network to join the VFL group, it can obtain a token for requesting that the VFL server be authorized to access the services provided by the AF, and send a service request message carrying the access token and information indicating the AF to the NEF. This enables the NEF to verify the VFL server, that is, to verify whether the VFL server is authorized to access the services provided by the AF. If the verification is successful, the NEF allows the VFL server to request the AF to join the VFL group and triggers the AF to join the VFL group. In this way, the AF located outside the network can be joined to the VFL group, which can enrich the data sources in the VFL group. Moreover, by having the NEF verify the VFL server, the VFL service can be carried out in a scenario where the security requirements of the AF outside the network are met.

[0190] For ease of understanding, the interaction process between the above VFL server, NRF, NEF and AF will be specifically described below with reference to Figures 7, 9, 11 and 12 through a method embodiment. The communication method provided in the embodiment of the present application can be applied to the above communication system and is described in detail below.

[0191] Scenario 1:

[0192] For example, FIG7 is a flowchart of the communication method provided in an embodiment of the present application. In scenario 1, AF#1 (the above-mentioned AF) located outside the network (PLMN) can subscribe to the vertical federation capability from NEF#1 (the above-mentioned NEF). At this time, NEF#1 can update the NF configuration file registered with the NRF so that the NF configuration file includes the latest vertical federation capability of the AF#1 and other information, that is, registers the vertical federation capability related to the AF#1. When the NWDAF (the above-mentioned VFL server) starts the vertical federation task, the NRF can provide the AF#1 as a vertical federated learning (VFL) client to the NWDAF and authorize the NWDAF.

[0193] Specifically, as shown in FIG7 , the process of the communication method is as follows:

[0194] S701: NWDAF sends a registration request message #1 to NRF. Correspondingly, NRF receives the registration request message #1 from NWDAF.

[0195] Registration Request Message #1 can be used to request that the NWDAF's NF profile be registered with the NRF. This message can be an Nnrf_NFManagement_NFRegister_request message. Registration Request Message #1 can include the NWDAF's NF profile, such as "NWDAF profile." It is understood that the NF profile in the embodiments of this application can also be replaced with other names, such as configuration parameters and configuration information, without limitation.

[0196] The NWDAF NF profile can be used to indicate the NWDAF's vertical federation capabilities. The NF profile can include vertical federation capability (VFL server) #1. Vertical federation capability #1 can be used to indicate that the NWDAF functions as a VFL server, or in other words, that the NWDAF has VFL server capabilities, such as establishing federation groups, selecting appropriate VFL clients, and distributing models.

[0197] Optionally, the NF profile of the NWDAF may also be used to indicate configuration information of the NWDAF. In this case, the NF profile may further include at least one of the following: secure sample alignment, end-to-end secure transmission, served UE scope #1, anonymization, at least one analytics ID #1, or at least one interoperability indicator #1.

[0198] Secure sample alignment can be understood as aligning at least one data attribute (or data feature) used to train the model. It's understood that for vertical federated learning, the overlap in data attributes used to train the model is minimal. Before model training begins, the VFL server and VFL client can align at least one attribute to determine the full range of data available for model training. For example, client #a1 has user #A's height and weight, and client #a2 has user #A's age and skin color. In this case, the VFL server and VFL client need to align this user attribute. This means that the data held by both client #a1 and client #a2 is user #A's data, and the data used by the VFL server to train the model is user #A's data. At this point, it can be determined that all the data from client #a1 and client #a2 can be used. It's understood that this is merely an example; the attributes of the data used for alignment can vary in different situations and can be flexibly set based on actual circumstances without limitation. It's understood that including secure sample alignment in the NF configuration file indicates that NWDAF supports secure sample alignment, meaning that NWDAF has the capability for secure sample alignment.

[0199] End-to-end secure transport can be understood as NWDAF supporting encrypted communication with VFL clients. This means that NWDAF and VFL clients can negotiate keys, establish secure links, and transmit data and models in ciphertext. Including end-to-end secure transport in the NF profile indicates that NWDAF supports end-to-end secure transport, meaning that NWDAF has end-to-end secure transport capabilities.

[0200] Service UE scope #1 can be used to indicate the scope of UEs served by NWDAF. The scope of UEs served by NWDAF can be determined based on actual conditions. For example, the scope of UEs served by NWDAF can be determined based on the location where NWDAF is deployed. For example, the scope of UEs served by NWDAF can include all UEs in area #1 where NWDAF is deployed.

[0201] Analysis identifier #1 can be used to indicate the analysis business (or called analysis service) supported by NWDAF, such as analysis identifier #1 can be used to indicate the business of predicting the network quality of terminal equipment supported by NWDAF. For the analysis business supported by NWDAF, NWDAF can train a model and complete the analysis business through the model. It can be understood that one analysis identifier #1 can usually indicate one analysis business. That is to say, when the NF configuration file of NWDAF includes multiple analysis identifiers #1, these multiple analysis identifiers #1 can respectively indicate different analysis businesses supported by NWDAF. It can also be understood that if NWDAF has not registered at least one analysis identifier #1, it can indicate that NWDAF can support the analysis business corresponding to any analysis identifier.

[0202] Interoperability identification #1 can be used to indicate the range of network elements (or NF instances) that the NWDAF can interact with, or in other words, interoperability identification #1 can indicate the range of network elements that can interact with the NWDAF. Interoperability identification #1 can include at least one information indicating a network element, such as a network element ID, to indicate the range of network elements that can interact with the NWDAF. For example, interoperability identification #1 can include AF#a1, AF#a2, and AF#a3, then the NWDAF can interact with AF#a1, AF#a2, and AF#a3. Interoperability identification #1 can also include an enterprise list, which can indicate the enterprises to which the network elements that can interact with the NWDAF belong. For example, interoperability identification #1 can include enterprise #a1, enterprise #a2, and enterprise #a3, that is, the NWDAF can interact with network elements belonging to enterprise #a1, enterprise #a2, and enterprise #a3. Interoperability identification #1 can also be other information used to indicate network elements, without limitation. It can be understood that the "interoperability identifier" and "enterprise" in the embodiments of the present application are merely exemplary expressions, and the "interoperability identifier" can also be replaced by any other expressions, such as "interoperability indication", "model interoperability identifier", etc., and the "enterprise" can also be replaced by any other expressions, such as "manufacturer", "manufacturer", "company", etc., without limitation.

[0203] It can be understood that NWDAF can correspond to an interoperability identifier #1. In this case, the interoperability identifier #1 can indicate the range of network elements that NWDAF can interact with. That is to say, no matter which analysis service NWDAF supports, the range of network elements that NWDAF can interact with is fixed. NWDAF can also correspond to multiple interoperability identifiers #1. In this case, these multiple interoperability identifiers #1 can respectively have a corresponding relationship with multiple analysis identifiers #1. In other words, for different analysis services of NWDAF, the range of network elements that NWDAF can interact with can be different.

[0204] For example, as shown in Table 1 below, multiple interoperability identifiers #1 of NWDAF correspond to multiple analysis identifiers #1 of NWDAF, and multiple analysis identifiers #1 correspond to different analysis services. Specifically, interoperability identifier #b1 corresponds to analysis identifier #b1, and analysis identifier #b1 corresponds to analysis service #b1; interoperability identifier #b2 corresponds to analysis identifier #b2, and analysis identifier #b2 corresponds to analysis service #b2. At this time, interoperability identifier #b1 can indicate the range of network elements that NWDAF can interact with when NWDAF executes analysis service #b1; interoperability identifier #b2 can indicate the range of network elements that NWDAF can interact with when NWDAF executes analysis service #b2.

[0205] Table 1

[0206] Of course, when the interactive network elements that NWDAF executes multiple analysis services are the same, the scope of the interactive network elements of these multiple analysis services can also be indicated by an interoperability identifier. For example, as shown in Table 2 below, interoperability identifier #c1 corresponds to analysis identifier #c1 and analysis identifier #c2, analysis identifier #c1 corresponds to analysis service #c1, and analysis identifier #c2 corresponds to analysis service #c2; interoperability identifier #c3 corresponds to analysis identifier #c3, and analysis identifier #c3 corresponds to analysis service #c3. At this time, interoperability identifier #c1 can indicate the scope of network elements that NWDAF can interact with when NWDAF executes analysis service #c1 and analysis service #c2; interoperability identifier #c3 can indicate the scope of network elements that NWDAF can interact with when NWDAF executes analysis service #c3.

[0207] Table 2

[0208] In the embodiment of the present application, the NWDAF can register its NF configuration file with the NRF when it goes online, so that the NRF can maintain information such as services supported by the NWDAF. It is understood that after receiving the registration request message #1, the NRF can store the NWDAF and the NWDAF's NF configuration file.

[0209] S702: NEF#1 sends a registration request message #2 to NRF. In response, NRF receives the registration request message #2 from NEF#1.

[0210] The registration request message #2 may be used to request that the NF profile of NEF#1 be registered with the NRF, and may be a Nnrf_NFManagement_NFRegister_request message. The registration request message #2 may include the NF profile of NEF#1, such as NEF#1profile.

[0211] The NF configuration file of NEF#1 can be used to indicate information about the services that NEF#1 can provide and configuration information about NEF#1. The NEF#1 configuration file may include a list of services supported by NEF#1, information related to NEF#1, and information related to the AF associated with NEF#1 (such as basic information such as public data that the AF associated with NEF#1 can provide). For details, please refer to the existing technology and will not be repeated here. It should be understood that the information related to the AF associated with NEF#1 does not include parameters related to the AF's vertical federation capabilities.

[0212] In the embodiment of the present application, NEF can register its NF configuration file with NRF when it goes online, so that NRF can maintain information such as services supported by NEF. It can be understood that after receiving the registration request message #2, NRF can store NEF and NEF's NF configuration file.

[0213] In addition, the order between S701 and S702 is not limited, that is, S701 and S702 can be performed simultaneously or in a certain order, for example: perform S701 first, then S702; or, perform S702 first, then S701. The specific order can be flexibly set according to actual conditions without any restrictions.

[0214] S703, AF#1 sends a subscription message #1 to NEF#1. Correspondingly, NEF#1 receives the subscription message #1 from AF#1.

[0215] Subscription message #1 can be used to report AF#1's vertical federation capabilities and vertical federation-related parameters (or vertical federation-related capabilities) to NEF#1. This can also be understood as AF#1's desire to participate in vertical federation learning. Subscription message #1 can also include vertical federation capabilities (VFL client) #2 and at least one interoperability identifier #2.

[0216] Vertical federation capability #2 can be used to indicate that AF#1 functions as a VFL client, or in other words, that AF#1 possesses VFL client capabilities, such as the ability to perform model training. Interoperability identifier #2 can be used to indicate the scope of network elements (or NF instances) with which AF#1 can interact. In other words, interoperability identifier #2 can indicate the scope of network elements with which AF#1 can interact. It is understood that AF#1 can correspond to one interoperability identifier #2. In this case, the interoperability identifier #2 can indicate the scope of network elements with which AF#1 can interact. In other words, regardless of the analysis service in which AF#1 can participate, the scope of network elements with which AF#1 can interact is fixed. AF#1 can also correspond to multiple interoperability identifiers #2. In this case, these multiple interoperability identifiers #2 can each correspond to multiple analysis identifiers #2 (described below). In other words, the scope of network elements with which AF#1 can interact can vary for different analysis services supported by AF#1. In addition, the interoperability identifier #2 is similar to the aforementioned interoperability identifier #1. You can refer to the relevant introduction of the interoperability identifier #1 in "S701" for understanding, and will not be repeated here.

[0217] Optionally, AF#1 may also have other vertical federation-related parameters, that is, the subscription message #1 may also include at least one of the following: at least one analysis identifier #2, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or UE scope of service #2.

[0218] Among them, analysis identifier #2 can be used to indicate the analysis service supported by AF#1, or the analysis service that AF#1 can participate in, that is, AF#1 can participate in the model training process corresponding to the analysis service. For example, analysis identifier #2 can indicate the service of predicting the communication quality of terminal equipment in which AF#1 can participate. It can be understood that one analysis identifier #2 can usually indicate one analysis service. When AF#1 corresponds to multiple analysis identifiers #2, these multiple analysis identifiers #2 can respectively indicate different analysis services supported by AF#1, that is, AF#1 can participate in different analysis services of vertical federation training. In addition, the analysis identifier #2 is similar to the aforementioned analysis identifier #1, and can be understood by referring to the relevant introduction of analysis identifier #1 in "S701", which will not be repeated here.

[0219] For the security sample alignment and end-to-end secure transmission, please refer to the relevant introduction in the aforementioned "S701" and will not be repeated here. It can be understood that security sample alignment and end-to-end secure transmission can represent the capabilities that AF#1 requires the VFL server to have, and the conditions that need to be met during the vertical federated learning process. For example, NWDAF selects AF#1 to join the VFL group. At this time, NWDAF needs to support security sample alignment and end-to-end secure transmission, that is, NWDAF has the capabilities of security sample alignment and end-to-end secure transmission, and this vertical federated learning supports security sample alignment and end-to-end secure transmission.

[0220] The authorization time can be used to indicate the time range in which AF#1 can join vertical federated learning, that is, the time in which AF#1 can perform vertical federated learning. For example, if the authorization time is 11:00-16:10, it means that AF#1 can join the VFL group within the time range of 11:00-16:10.

[0221] The model usage scope can be used to indicate the scope of use of the model trained by AF#1 by the VFL server, such as whether the model trained by AF#1 can be used for local prediction or for further model training. It is understood that the model usage scope can be used to limit the scope of use of AF#1's data. For example, if AF#1 no longer uses the model it trained, AF#1's data can no longer be used for model training. This AF#1 data can include data obtained by AF#1 about the UEs it serves.

[0222] Long-term storage of intermediate model parameters can be used to instruct AF#1 to allow the VFL server to store the intermediate model data for a long time. The model data can be various data generated during the model training process, such as the input data and output data of the model.

[0223] Anonymization can be used to instruct the vertical federation participants (VFL client and VFL server) to anonymize the data used for model training, for example, by removing the UE name from the data used for model training. It is understood that including the anonymization information in Subscription Message #1 can indicate to AF #1 that the data used for model training must be anonymized.

[0224] Service UE range #2 can be used to indicate the range of UEs served by AF#1. For example, the range of UEs served by AF#1 can include the UE where AF#1 is located and the UE from which AF#1 can obtain data. The specific settings can be made according to actual conditions without any restrictions.

[0225] In an embodiment of the present application, AF#1 can send a subscription message #1 to NEF#1 when it goes online or when AF#1 updates its vertical federation related parameters, so that NEF#1 can register AF#1's vertical federation capabilities and vertical federation related parameters with NRF based on the subscription message #1.

[0226] It can be understood that AF#1 updating its vertical federation-related parameters can be understood as AF#1 having already sent a subscription message, such as subscription message #2, to NEF#1 before sending the aforementioned subscription message #1. In this case, after updating its vertical federation-related parameters, AF#1 can send another subscription message, namely subscription message #1, to NEF#1 to indicate AF#1's latest vertical federation-related parameters. Alternatively, after updating its vertical federation-related parameters, AF#1 can send a subscription update message to NEF#1 to indicate AF#1's updated vertical federation-related parameters.

[0227] For example, when AF#d1 goes online, it sends a subscription message #d1 to NEF#d1. The subscription message #d1 includes: AF#d1's vertical federation capability #2, analysis identifier #d1, analysis identifier #d2, interoperability identifier #d1, interoperability identifier #d2, and authorization time #d1. After a period of time, AF#d1 updates its vertical federation-related parameters, that is, updates the authorization time to authorization time #d2, and adds the requirement for security sample alignment. At this time, AF#d1 can send a subscription message to NEF#d1 again, such as subscription message #d2. The subscription message #d2 includes: AF#d1's vertical federation capability #2, analysis identifier #d1, analysis identifier #d2, interoperability identifier #d1, interoperability identifier #d2, authorization time #d2, and security sample alignment. Alternatively, at this time, AF#d1 can send a subscription update message to NEF#d1, and the subscription update message includes authorization time #d2 and security sample alignment.

[0228] S704, NEF#1 sends an NF configuration file update request message to NRF. Correspondingly, NRF receives the NF configuration file update request message from NEF#1.

[0229] The NF Profile Update Request message can be used to add or update the vertical federation capabilities and vertical federation-related parameters of AF#1 associated with NEF#1. Specifically, when AF#1 comes online, NEF#1 can use the NF Profile Update Request message to add AF#1's vertical federation capabilities and vertical federation-related parameters. When AF#1 updates its vertical federation-related capabilities, NEF#1 can use the NF Profile Update Request message to update AF#1's vertical federation capabilities and / or vertical federation-related parameters.

[0230] The NF profile update request message of NEF#1 may include the AF#1 identifier (ID) and the vertical federation parameters of AF#1 (i.e., the vertical federation capability and / or vertical federation capability-related parameters of AF#1). The vertical federation parameters of AF#1 may include the parameters sent by AF#1 to NEF#1 through the above-mentioned subscription message #1. For example, if the subscription message #1 includes: the vertical federation capability #2, analysis identifier #2, and interoperability identifier #2 of AF#1, then the vertical federation parameters of AF#1 may include the vertical federation capability #2, analysis identifier #2, and interoperability identifier #2 of AF#1. For another example, if the subscription message #1 includes: the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, and authorization time of AF#1, then the vertical federation parameters of AF#1 may include the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, and authorization time of AF#1. That is, NEF#1 does not need to process the vertical federation parameters of AF#1 in subscription message#1, that is, NEF#1 can forward the vertical federation parameters of AF#1 to NRF through the NF configuration file update request message.

[0231] Optionally, the NF configuration file update request message of NEF#1 may further include information indicating NEF#1, such as an instance ID of NEF#1. In this way, upon receiving the NF configuration file update request message, the NRF can query the NF configuration file of NEF#1 based on the information indicating NEF#1, thereby adding or updating the vertical federation capability and / or vertical federation-related parameters of AF#1 associated with NEF#1 in the configuration file.

[0232] It is understood that when AF#1 sends a subscription update request message to NEF#1, the NF profile update request message sent by NEF#1 to the NRF may include information indicating AF#1's updated vertical federation capabilities and / or vertical federation-related parameters. This means that it is not necessary to include all of AF#1's latest vertical federation-related parameters and vertical federation capabilities. For example, if AF#1 updates its authorization time and adds anonymization, the information indicating AF#1's updated vertical federation-related parameters may include AF#1's latest authorization time and anonymization.

[0233] S705: NRF sends an NF configuration file update response message to NEF#1. Correspondingly, NEF#1 receives the NF configuration file update response message from NRF.

[0234] The NF profile update response message may be used to indicate that the NRF has updated the NF profile of NEF#1, that is, the relevant capabilities of the vertical federation of AF#1 have been registered with the NRF.

[0235] After receiving the NF configuration file update request message, the NRF can store the parameters carried in the NF configuration file update request message. Exemplarily, the NRF can determine whether the AF#1 identifier exists in the NF configuration file of NEF#1 based on the AF#1 identifier in the NF configuration file update request message. If the AF#1 identifier does not exist in the NF configuration file of NEF#1, it means that before the NRF receives the NF configuration file update request message, the vertical federation capability and vertical federation-related parameters of AF#1 have not been registered to the NRF. At this time, the NRF can add the AF#1 identifier and the vertical federation capability and vertical federation-related parameters of AF#1 to the NF configuration file of NEF#1, thereby completing the registration of the vertical federation capability and vertical federation-related parameters of AF#1. If the AF#1 identifier exists in the NF configuration file of NEF#1, it means that before the NRF receives the NF configuration file update request message, the NRF has registered the vertical federation capability and vertical federation related parameters of AF#1. At this time, the NRF can replace the vertical federation capability and vertical federation related parameters corresponding to the stored AF#1 identifier with the latest vertical federation capability and vertical federation related parameters corresponding to the AF#1 identifier, that is, the latest vertical federation capability and vertical federation related parameters of AF#1 carried in the NF configuration file update request message; or, the NRF can compare the vertical federation capability and vertical federation related parameters corresponding to the stored AF#1 identifier with the vertical federation capability and vertical federation related parameters of AF#1 carried in the NF configuration file update request message, determine the updated parameters of AF#1, and update the parameters in the stored vertical federation capability and vertical federation related parameters corresponding to the AF#1 identifier.

[0236] For example, the NF profile update request message includes AF#1ID, as well as the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment, and end-to-end secure transmission corresponding to AF#1. If AF#1ID does not exist in the NF profile of NEF#1 in the NRF, the NRF can store AF#1ID, as well as the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment, and end-to-end secure transmission corresponding to AF#1, thereby completing the registration of the vertical federation capability and vertical federation-related parameters of AF#1.

[0237] For another example, the NF configuration file update request message includes AF#1ID, as well as the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment and end-to-end secure transmission corresponding to AF#1 (recorded as the latest parameters). The vertical federation capability #2 and vertical federation-related parameters corresponding to the AF#1 identifier stored in the NRF (recorded as previous parameters) include analysis identifier #2 and interoperability identifier #2. At this time, the NRF can replace the previous parameters with the latest parameters; or, the NRF can compare the latest parameters with the previous parameters to determine that the updated parameters are security sample alignment and end-to-end secure transmission, and add security sample alignment and end-to-end secure transmission to the vertical federation-related parameters corresponding to the AF#1ID.

[0238] It can be understood that when AF#1 sends a subscription update request message to NEF#1, the NF configuration file update request message sent by NEF#1 to the NRF may include information for indicating the vertical federation capabilities and / or vertical federation-related parameters updated by AF#1. In this case, the NRF can directly use this information to update the vertical federation capabilities and / or vertical federation-related parameters of AF#1. It can also be understood that at this time, NEF#1 can carry an indication information #1 in the NF configuration file update request message, and the indication information #1 can be used to indicate that the NF configuration file update request message carries information for indicating the vertical federation capabilities and / or vertical federation-related parameters updated by AF#1. In this way, it is convenient for the NRF to subsequently update the capabilities and / or vertical federation-related parameters of AF#1 according to the indication information, without having to determine whether the AF#1 identifier exists in the NF configuration file of NEF#1 to determine whether to update the capabilities and / or vertical federation-related parameters of AF#1, thereby reducing the processing overhead of the NRF.

[0239] After completing the update of the NF configuration file of NEF#1, NRF may send an NF configuration file update response message to NEF#1 to notify NEF#1 that the update of its NF configuration file has been completed.

[0240] S706: NEF#1 sends the subscription result to AF#1. Correspondingly, AF#1 receives the subscription result from NEF#1.

[0241] After receiving the above NF profile update response message, NEF#1 can send a subscription result to AF#1 according to the NF profile update response message to notify AF#1 that the registration of AF#1's vertical federation capability and vertical federation related parameters has been completed.

[0242] S707: NWDAF sends a discovery request message to NRF. Correspondingly, NRF receives the discovery request message from NWDAF.

[0243] The discovery request message can be used to request the discovery of services available in the network, which can be a Nnrf_NFDiscovery_Request message. The discovery request message may include analysis identifier #3. The analysis identifier #3 can be used to indicate a specific analysis service (recorded as analysis service #3), and the NWDAF is ready to train a model that can be used for the analysis service #3. Carrying analysis identifier #3 in the discovery request message can request the discovery of services in the network that can be used to support analysis service #3 corresponding to analysis identifier #3. That is, carrying analysis identifier #3 in the discovery request message can request NRF to determine the NF instance that can provide services for analysis service #3 based on analysis identifier #3, that is, request NRF to select a suitable NF instance for NWDAF based on analysis identifier #3. It can be understood that analysis identifier #3 is one of the at least one analysis identifier #1 mentioned above, that is, analysis identifier #3 belongs to the at least one analysis identifier #1 mentioned above, for example: the at least one analysis identifier #1 mentioned above includes analysis identifier #f1, analysis identifier #f2 and analysis identifier #f3, and analysis identifier #3 can be analysis identifier #f3; for example: the at least one analysis identifier #1 mentioned above is analysis identifier #f11, then analysis identifier #3 is analysis identifier #f11.

[0244] Optionally, the discovery request message may also include at least one of the following: attribute identification, secure sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, training UE scope, or indication information #2.

[0245] The attribute identifier can be used to indicate a certain attribute of the NWDAF. This attribute can be used to determine the NF instance that can provide the service based on the attribute when the NRF performs a service discovery operation. That is, it can be used to determine whether the NWDAF is within the range of network elements that the NF instance can interact with based on the attribute. For example, the attribute identifier can be a company identifier (vendor ID). When the NRF performs service discovery based on the attribute identifier, it can determine whether the company identifier belongs to the interoperability identifier registered by the NF instance, such as whether it belongs to at least one interoperability identifier #2 registered by AF#1 mentioned above. If the company identifier belongs to the interoperability identifier registered by the NF instance, it means that the NWDAF is within the range of network elements that the NF instance can interact with. It can be understood that in this example, the interoperability identifier registered by the NF instance can include a list of companies. In addition, the attribute identifier can also be other identifiers, such as a network element identifier, a location identifier, etc., which can be flexibly set according to actual conditions without limitation.

[0246] Security sample alignment can be understood as aligning at least one data attribute (or data feature) used to train the model. Carrying this information in the discovery request message indicates that NWDAF has enabled security sample alignment during the model training process for analysis service #3. Security sample alignment can be described in detail in "S701" above and will not be further elaborated here.

[0247] End-to-end secure transmission can be understood as requiring encrypted communication between the NWDAF and the VFL client. Including this information in the discovery request message indicates that the NWDAF has enabled end-to-end secure transmission during the model training process for analysis service #3. For details on end-to-end secure transmission, refer to the aforementioned "S701" and will not be repeated here.

[0248] The model usage scope can be used to indicate the scope of NWDAF's use of the model. Carrying the model usage scope parameter in the discovery request message can indicate the scope of NWDAF's use of the model after the model training corresponding to analysis service #3 is completed, such as using the model for local prediction.

[0249] Long-term storage of intermediate model parameters can be used to instruct NWDAF to store data generated during model training, such as input and output data, for a long period of time. Carrying this parameter in the discovery request message instructs NWDAF to store data generated during model training for a long period of time when analyzing the model training corresponding to service #3.

[0250] Anonymization can be used to indicate that NWDAF can anonymize data. Carrying anonymization information in the discovery request message can indicate that during the model training process of analysis service #3, NWDAF can anonymize the data during the training process.

[0251] The trained UE range can be used to indicate the range of UEs that need to participate in model training. It can be understood that the parameter "trained UE range" carried in the discovery request message can indicate the range of UEs that need to participate in model training in the model training of analysis service #3. It can be understood that the trained UE range belongs to the UE range of NWDAF service, that is, the UE range #1 of the above service. In this way, it can be ensured that the UEs participating in model training are all UEs that can be trained by NWDAF, thereby avoiding model training failure.

[0252] Indication information #2 can be used to indicate the type of NF providing the service, which can be an AF or an AF located outside the network (PLMN). In other words, carrying indication information #2 in the discovery request message can indicate the type of network element serving the NWDAF determined by the NRF through service discovery.

[0253] It can be understood that the above parameters can represent the capabilities used by NWDAF in the model training process corresponding to the analysis business #3. Among them, some capabilities may be capabilities that NWDAF registers with NRF, such as secure sample alignment, end-to-end secure transmission, etc.; some capabilities may be capabilities determined according to specific analysis businesses, such as the scope of use of the model, long-term intermediate model parameters, etc., that is, NWDAF does not need to register with NRF in advance for this part of the capabilities. In addition, the parameters carried in the discovery request message can be flexibly set according to actual conditions. And the discovery request message can also carry other parameters without restriction.

[0254] In an embodiment of the present application, when NWDAF starts a new vertical federation task, or when NWDAF needs to add a VFL client to an existing vertical federation task, it can send a discovery request to NRF to request NRF to provide a VFL client that can participate in the vertical federation task, that is, a VFL client that can provide services.

[0255] S708: The NRF sends a discovery response message to the NWDAF. Correspondingly, the NWDAF receives the discovery response message from the NRF.

[0256] After receiving the discovery request message, the NRF can determine the NF instance that can provide services to the NWDAF based on the parameters carried in the discovery request message and send the information of the selected NF instance to the NWDAF. The number of NF instances can be one or more, and the specific number can be determined based on actual conditions. Furthermore, when there are multiple NF instances, these NF instances can be different, such as network elements of different types. For example, these multiple NF instances can include AFs, base stations, etc.

[0257] Exemplarily, the NRF may select a suitable NF instance as the VFL client based on the parameters carried in the discovery request message and the vertical federation capabilities and vertical federation-related parameters of each NF instance registered with the NRF, and send the identifier of the selected NF instance to the NWDAF. It is understood that when selecting a suitable NF instance, the NRF may determine whether the parameters carried in the discovery request message meet the requirements of the vertical federation-related capabilities of each NF instance, that is, whether the vertical federation-related parameters of the NF instance belong to the parameters carried in the discovery request message.

[0258] For example, the discovery request message includes analysis identifier #g1. The NRF stores the vertical federation-related parameters for NF instance #g1, NF instance #g2, and NF instance #g3. The vertical federation-related parameters for NF instance #g1 include analysis identifier #g1; the vertical federation-related parameters for NF instance #g2 include analysis identifier #g2 and analysis identifier #g3; and the vertical federation-related parameters for NF instance #g2 include analysis identifier #g1, analysis identifier #g2, and analysis identifier #g3. It can be seen that NF instance #g1 and NF instance #g3 can participate in the analysis service corresponding to analysis identifier #g1, while NF instance #g2 cannot participate in the analysis service corresponding to analysis identifier #g1. Therefore, the NF instances that can serve as VFL clients are NF instance #g1 and NF instance #g3. At this point, the NRF can send NF instance #g1 and NF instance #g3 to the NWDAF, for example, by sending the NF instance #g1 ID and NF instance #g3 ID to the NWDAF.

[0259] For another example, the discovery request message includes analysis identifier #g1, enterprise identifier #g1, secure sample alignment, and end-to-end secure transmission. The NRF stores the vertical federation-related parameters for NF instances #g1, #g2, and #g3. The vertical federation-related parameters for NF instance #g1 include analysis identifier #g1 and enterprise identifier #g1; the vertical federation-related parameters for NF instance #g2 include analysis identifier #g1, enterprise identifier #g1, secure sample alignment, and end-to-end secure transmission; and the vertical federation-related parameters for NF instance #g3 include analysis identifier #g1, enterprise identifier #g1, secure sample alignment, end-to-end secure transmission, and anonymization. It can be seen that the discovery request message does not include anonymization, meaning that the NWDAF (i.e., the VFL server) does not support anonymization at this time, or in other words, anonymization is not enabled in this vertical federated learning. Therefore, the NF instances that can serve as VFL clients are NF instances #g1 and #g2. At this point, the NRF can send NF instances #g1 and #g2 to the NWDAF.

[0260] It will be appreciated that in this embodiment of the present application, the NF instance selected by the NRF includes AF#1, which is located outside the network. That is, when the NRF selects a single NF instance, the NF instance is AF#1; when the NRF selects multiple NF instances, the NF instances include AF#1. Furthermore, the NRF can send the NEF#1 identifier, or both the NEF#1 identifier and the AF#1 identifier, to the NWDAF, so that the NWDAF can subsequently request AF#1 to participate in the vertical federation group based on the identifier sent by the NRF.

[0261] It is also understood that when the discovery request message includes indication information #2, the NRF can select a NF instance of the corresponding NF type based on indication information #2 and provide it to the NWDAF. For example, when indication information #2 indicates that the NF instance type is AF, the NRF can select a suitable AF as the VFL client based on the parameters carried in the discovery request message and the vertical federation-related parameters of each AF registered by the NRF, and indicate the selected AF to the NWDAF. It is also understood that if the selected AF is located within the network, the NRF can send the selected AF's identifier to the NWDAF; if the selected AF is located outside the network, the NRF can send the selected AF's identifier and the identifier of the NEF serving the AF to the NWDAF. For another example, when indication information #2 indicates that the NF instance type is AF located outside the network, the NRF can select a suitable AF as the VFL client based on the parameters carried in the discovery request message and the vertical federation-related parameters of the AF in the NF profiles of each NEF registered by the NRF, and indicate the selected AF to the NWDAF. In this case, the NRF may send the identifier of the selected AF and the identifier of the NEF serving the AF to the NWDAF.

[0262] In addition, if NRF fails to determine the AF that can provide the service based on the parameters sent by NWDAF, NRF can send information that the AF was not found to NWDAF, so that NWDAF can perform subsequent processing based on the information, such as updating the parameters in the discovery request message and re-requesting service discovery.

[0263] S709: NWDAF sends an access token request message to NRF. Correspondingly, NRF receives the access token request message from NWDAF.

[0264] The access token request message can request a token used to indicate that the NWDAF is authorized to access the services provided by AF#1, that is, an access token. The access token can be used to indicate that the NWDAF is authorized to access the services provided by AF#1. The access token request message may include an AF#1 identifier, an NEF#1 identifier, and an analysis identifier #3. Among them, the AF#1 identifier can be used to indicate that the NWDAF expects the VFL client to participate in vertical federated learning, that is, AF#1. The NEF#1 identifier can indicate the NEF that provides services for AF#1, that is, NEF#1. For the analysis identifier #3, please refer to the relevant introduction in "S707" and will not be repeated here. It can be understood that carrying the AF#1 identifier, the NEF#1 identifier, and the analysis identifier #3 in the access token request message can enable the NRF to perform authorization verification based on the vertical federation authorization information corresponding to AF#1 and the analysis service #3, that is, to determine whether the AF#1 is an AF that the NWDAF can access, that is, whether it can be authorized.

[0265] Optionally, the access token request message may also include at least one of the following: interoperability indication #3, security sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or trained UE scope. These may indicate the security capability parameters of vertical federated learning. For details, please refer to the relevant introduction in the aforementioned "S707" and will not be repeated here. It can be understood that the above-mentioned security capability parameters included in the access token request message may be the same as the security capability parameters included in the discovery request message, or the security capability parameters included in the access token request message may be less than the security capability parameters included in the discovery request message. It can be flexibly set according to actual conditions without restriction. By carrying security capability parameters in the access token request message, the NRF can further perform authorization verification based on these security capability parameters, that is, verify whether the NWDAF and AF meet these security capability parameters, thereby improving the security of authorization.

[0266] In an embodiment of the present application, after receiving the discovery response message, NWDAF can determine the VFL client used for this vertical federated learning, such as AF#1, based on the NF instance provided in the discovery response message. Exemplarily, when the discovery response message indicates an AF, NWDAF can select the AF as the VFL client, that is, the AF is AF#1 at this time; when the discovery response message indicates multiple AFs, NWDAF can select at least one AF from the multiple AFs as the VFL client based on local policies, such as the preset AF usage priority, such as selecting AF#1 and AF#2 as VFL clients. After selecting AF#1 that it wishes to participate in vertical federated learning, NWDAF can request an access token corresponding to AF#1 from NRF.

[0267] S710 , the NRF performs authorization verification according to the access token request message.

[0268] After receiving the access token request message, the NRF can verify the authenticity of the data sent by the NWDAF based on the information carried in the access token request message, and check whether the AF is within the range accessible to the NWDAF.

[0269] Exemplarily, NRF can obtain the NF profile registered by NWDAF, and compare the other parameters in the access token except the AF#1 identifier and the NEF#1 identifier with the information of the vertical federation authorization scope of NWDAF in the NF profile registered by NWDAF (i.e., the information of the vertical federation capability registered by NWDAF in the aforementioned S701, or the information of the vertical federation capability and vertical federation-related parameters registered by NWDAF), so as to verify whether the parameters sent by NWDAF in the access token request message are authentic.

[0270] NRF can also find the NF configuration file registered by NEF#1 based on the NEF#1 identifier in the access token request message, and obtain information about the vertical federation authorization scope of AF#1 from the NF configuration file based on the AF#1 identifier, such as the vertical federation capabilities and vertical federation related parameters reported by AF#1 in S703 above. After NRF obtains the information about the vertical federation authorization scope of AF#1, it can compare other parameters in the access token except the AF#1 identifier and the NEF#1 identifier with the information about the vertical federation authorization scope of AF#1 to verify whether the other parameters meet the vertical federation related parameters reported by AF#1. Through these two verification operations, NRF can determine whether NWDAF can access AF#1, and use this as a basis to determine whether to send an access token to NWDAF.

[0271] For example, the access token request message #h1 includes the AF#h1 ID, the NEF#h1 ID, the analysis ID#h1, and the security pattern alignment. After receiving this access token request message #h1, the NRF can search for the NF profile #h1 registered with the NWDAF to determine whether the analysis ID#h1 is an analysis identifier in the NF profile #h1 and whether the security pattern alignment capability is registered in the NF profile #h1. Furthermore, the NRF can search for the NF profile #h2 registered with the NEF#h1 based on the NEF#h1 ID and retrieve information about the vertical federation authorization scope of AF#h1 from the NF profile #h2 based on the AF#h1 ID. After obtaining information about the vertical federation authorization scope of AF#h1, the NRF can determine whether the analysis ID#h1 and security pattern alignment are within the vertical federation authorization scope of AF#h1. If the analysis ID#h1 and security pattern alignment are within the NF profile #h1 and the analysis ID#h1 and security pattern alignment are within the vertical federation authorization scope of AF#h1, the NWDAF can determine that it can access AF#h1. That is, at this time, the NRF may generate an access token for accessing AF#h1 (described in S711 below).

[0272] S711: The NRF sends an access token response message to the NWDAF. Correspondingly, the NWDAF receives the access token response message from the NRF.

[0273] The access token response message can be used to indicate the access token. The information included in the access token is related to the network element that subsequently verifies the access token. The network element that subsequently verifies the access token can be NEF#1 or AF#1, which is explained below in different cases.

[0274] Case 1.1: The network element that subsequently verifies the access token is NEF#1.

[0275] In this case, the access token may include the NEF#1 identifier and the analysis identifier #3. The NEF#1 identifier may be used to indicate the NEF that validates the access token, namely, NEF#1. The NEF#1 identifier is determined by the NWDAF when it selects AF#1 as the VFL client. For details about analysis identifier #3, refer to "S706" and are not further described here.

[0276] Optionally, the access token may also include at least one of the following parameters: AF#1 identifier, secure sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or trained UE scope. For details, please refer to the aforementioned related introduction and will not be repeated here. It can be understood that the above parameters carried in the access token can be determined through the access token request message, that is, the NRF can set the parameters in the access token request message in the access token, for example: the access token request message includes: AF#1 identifier, interoperability indication #3, secure sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, and trained UE scope. The access token may include all of these parameters, or may include some of these parameters, such as AF#1 identifier, interoperability indication #3, secure sample alignment, end-to-end secure transmission, and model usage scope. By including these parameters in the access token, NEF#1 can directly obtain these parameters when verifying the access token and forward them to AF#1. This eliminates the need for NWDAF to send these parameters to AF#1, thus reducing NWDAF communication overhead. Alternatively, NEF#1 can perform further verification of these parameters (described below) to improve authorization security.

[0277] Case 1.2: The network element that subsequently verifies the access token is AF#1.

[0278] In this case, the access token may include AF#1 and analysis identifier #3. AF#1 identifies the AF that validates the access token, namely AF#1. AF#1 is determined by the NWDAF when it selects AF#1 as the VFL client. For details about analysis identifier #3, refer to "S707" and are not detailed here.

[0279] Optionally, the access token may also include at least one of the following parameters: NEF#1 identification, secure sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or training UE range. For details, please refer to the above related introduction and will not be repeated here. It is understood that the various parameters that the access token in case 1.2 can also carry are similar to the various parameters that the access token can also carry in case 1.1. For reference, you can understand them and will not repeat them here.

[0280] The above content describes the access token generated after the NRF authorizes the NWDAF. It is understood that if the NRF authorization verification fails in S710, then in S711, the NRF does not send the access token to the NWDAF, but instead sends a message to the NWDAF rejecting the access token to notify the NWDAF that the authorization verification for AF#1 has failed.

[0281] After obtaining the access token, the NWDAF can use it to request the AF to join the VFL group. The processes for NWDAF requesting the AF to join the VFL group differ for scenarios 1.1 and 1.2. The following describes the process for scenario 1.1, S712a-S716a, and then the process for scenario 1.2, S712b-S716b.

[0282] S712a, NWDAF sends a service request message to NEF#1. Correspondingly, NEF#1 receives the service request message from NWDAF.

[0283] The service request message can be used to request that AF#1 join the VFL group. The service request message includes the AF#1 identifier and an access token. For details, refer to the previous description and are not repeated here. It is understood that the AF#1 identifier included in the service request message indicates that the AF requesting to join the VFL group is AF#1.

[0284] Optionally, the service request message may also include at least one of the following: analysis identifier #3, or relevant parameters of VFL. The analysis identifier #3 can refer to the aforementioned relevant introduction and will not be repeated here. The relevant parameters of VFL can indicate the business parameters of the analysis business corresponding to the analysis identifier #3, such as: training accuracy, model scale, etc., which can be flexibly set according to actual conditions without restriction. It can be understood that carrying analysis identifier #3 in the service request message can enable NEF#1 to verify whether the analysis identifier in the access token is consistent with the analysis identifier in the service request message during the verification of the access token, so as to improve security. In addition, if the relevant parameters of VFL are not carried in the service request message, the relevant parameters of VFL can be sent to AF#1 before model training.

[0285] After obtaining the access token, NWDAF may send a service request message to NEF#1 to request AF#1 to join the VFL group.

[0286] S713a, NEF#1 verifies the access token.

[0287] After receiving the service request message, NEF#1 can verify the signature of the access token. The specific verification method can refer to the existing technology and will not be repeated here.

[0288] It will be appreciated that when the access token includes an AF identifier, NEF#1 can, after verifying the access token's signature, obtain the AF identifier in the access token, i.e., AF#1, and verify whether the AF identifier in the access token is consistent with the AF identifier in the service request message. If they are consistent, verification is successful. Furthermore, when the service request message includes an analysis identifier, NEF#1 can, after verifying the access token's signature, obtain the analysis identifier in the access token, i.e., analysis identifier #3, and verify whether the analysis identifier in the access token is consistent with the analysis identifier in the service request message. If they are consistent, verification is successful.

[0289] It can be understood that NEF#1's successful access token verification indicates that the scope of the service requested by NWDAF is authorized by AF#1, that is, the service meets AF#1's security requirements. After NEF#1 passes the verification, it can send a Join VFL Group Request message (described below) to AF#1. Furthermore, if the access token includes other information, such as security sample alignment and end-to-end secure transmission, NEF#1 can also carry this information in the Join VFL Group Request message and send it to AF#1.

[0290] Furthermore, after successfully verifying the access token, NEF#1 can generate a new token (denoted as Token#1). This Token#1 can be used for verification by AF#1. If AF#1 successfully verifies the token, it indicates that the NWDAF is authorized to access the services provided by AF#1. Token#1 can include the AF#1 identifier and analysis identifier #3, further enhancing security. It is understood that Token#1 can also be referred to as an access token or other names, without limitation.

[0291] S714a, NEF#1 sends a VFL group joining request message to AF#1. Correspondingly, AF#1 receives the VFL group joining request message from NEF#1.

[0292] The VFL Group Request message can be used to request AF#1 to join a VFL group. The VFL Group Request message can include Analysis ID #3. For details, refer to the above description and are not further described here. Carrying Analysis ID #3 in the VFL Group Request message indicates that the VFL group AF#1 is being requested to join is the group for the analysis service corresponding to Analysis ID #3.

[0293] In addition, the VFL group request message may also include at least one of the following: VFL related parameters, token #1, or other parameters that can indicate the security capabilities of the VFL process, such as security sample alignment, etc., which can be set according to actual conditions without restriction.

[0294] S715a, AF#1 sends a VFL group joining response message to NEF#1. Correspondingly, NEF#1 receives the VFL group joining response message from AF#1.

[0295] After receiving the VFL Group Request message, AF#1 can decide whether to join the VFL group based on the VFL Group Request message, AF#1's local policy, and / or verification of the token carried in the Join VFL Group Response message (such as Token#1 described above). For example, if AF#1's current load exceeds a threshold or verification of the token carried in the Group Response message fails, AF#1 decides not to join the VFL group. Alternatively, if AF#1's current capabilities meet all requirements, AF#1 decides to join the VFL group.

[0296] After deciding to join the VFL group, AF#1 may send a VFL group response message to NEF#1 to indicate its decision to join the VFL group.

[0297] S716a, NEF#1 sends a service response message to NWDAF. Correspondingly, NWDAF receives the service response message from NEF#1.

[0298] After receiving the VFL group response message, NEF#1 can send information about AF#1's decision to join the VFL group to NWDAF via a service response message. After receiving the service response message, NWDAF can initiate vertical federated learning and interact with AF#1. For example, it can send VFL parameters such as training accuracy and model size to AF#1, or send models to AF#1.

[0299] It is understandable that if NEF#1 receives information that AF#1 decides not to join the VFL group, NEF#1 can send this information to NWDAF so that NWDAF can perform subsequent operations based on the current situation, such as requesting another AF to join the VFL group.

[0300] S712b: NWDAF sends a service request message #1 to NEF#1. Correspondingly, NEF#1 receives the service request message #1 from NWDAF.

[0301] Service Request Message #1 can be used to request AF#1 to join the VFL group. Service Request Message #1 includes the AF#1 identifier and access token. For details, refer to the previous description and are not repeated here. The service request message can include the AF#1 identifier and access token. For details, refer to the previous description and are not repeated here.

[0302] Optionally, the service request message #1 may further include at least one of the following: NEF#1 identifier, analysis identifier #3, or related parameters of VFL. For details, please refer to the relevant introduction of the service request message in the aforementioned "S712a".

[0303] After obtaining the access token, NWDAF may send a service request message to NEF#1 to request AF#1 to join the VFL group.

[0304] S713b, NEF#1 sends a service request message #2 to AF#1. Correspondingly, AF#1 receives the service request message #2 from NEF#1.

[0305] Service request message #2 may be used to request AF#1 to join the VFL group. Service request message #2 may include an access token. For details, please refer to the above related introduction and will not be repeated here.

[0306] Optionally, service request message #2 may further include at least one of the following: an NEF#1 identifier, analysis identifier #3, or VFL-related parameters. The details are described above and are not further described here. It is understood that NEF#1 may send all parameters included in service request message #1 to AF#1 via service request message #1, or may send other information in service request message #1 except for the AF#1 identifier to AF#1. The specific configuration may be based on actual circumstances and is not limited.

[0307] S714b, AF#1 verifies the access token.

[0308] After receiving the service request message #2, AF#1 can verify the signature of the access token. The specific verification method can refer to the existing technology and will not be repeated here.

[0309] It will be appreciated that when the access token includes an NEF identifier, AF#1 can, after verifying the access token's signature, obtain the NEF identifier in the access token, namely, NEF#1, and verify whether the NEF identifier in the access token is consistent with the NEF identifier in service request message #2. If they are consistent, verification is successful. When service request message #2 includes an analysis identifier, NEF#1 can, after verifying the access token's signature, obtain the analysis identifier in the access token, namely, analysis identifier #3, and verify whether the analysis identifier in the access token is consistent with the analysis identifier in service request message #2. If they are consistent, verification is successful.

[0310] In addition, when the service request message #2 also includes relevant parameters of the VFL, AF#1 can determine the relevant information of this model training based on the relevant parameters of the VFL.

[0311] S715b, AF#1 sends a join service response message #2 to NEF#1. Correspondingly, NEF#1 receives the join service response message #2 from AF#1.

[0312] After verifying the access token, AF#1 can decide whether to join the VFL group based on local policy. For example, if AF#1's current load exceeds the threshold, AF#1 will decide not to join the VFL group. Alternatively, if AF#1's current capabilities meet the requirements, AF#1 will decide to join the VFL group.

[0313] After deciding to join the VFL group, AF#1 may send a service response message #2 to NEF#1 to indicate its decision to join the VFL group.

[0314] S716b, NEF#1 sends a service response message #1 to NWDAF. Correspondingly, NWDAF receives the service response message #1 from NEF#1.

[0315] After receiving service response message #2, NEF#1 can send information about AF#1's decision to join the VFL group to NWDAF via service response message #1. After receiving service response message #1, NWDAF can initiate vertical federated learning and interact with AF#1, for example, sending VFL parameters such as training accuracy and model size to AF#1, or sending models to AF#1.

[0316] In summary, according to the introduction of scenario 1, when an AF located outside the network where the VFL server (i.e., NWDAF) is located has vertical federation capabilities, it can register its capabilities through NEF. When the VFL server requests the AF to join the VFL group, NEF can verify the VFL server through the access token, that is, verify whether the VFL server is authorized to access the VFL service provided by the AF, and trigger the AF to join the VFL group if the verification is successful. In this way, the service authorization of the VFL server can be implemented for the AF located outside the network where the VFL server is located. And the AF located outside the network where the VFL server is located can be added to the VFL group, thereby enriching the data sources in the VFL group. In addition, by verifying the VFL server through NEF, VFL services can be carried out in scenarios where the security needs of AFs outside the network are met.

[0317] The above describes in detail the process of the communication method provided by the embodiment of the present application in conjunction with Figure 7. The following describes the overall process of the communication method in conjunction with Figure 8.

[0318] For example, FIG8 is a second flow chart of the communication method. The communication method primarily involves interactions between a first VFL server (the VFL server in FIG6 ), an NRF, a NEF, and a first AF (the AF in FIG6 ). The first VFL server can be understood as the NWDAF in the aforementioned scenario 1, the NEF can be understood as NEF#1 in the aforementioned scenario 1, and the first AF can be understood as AF#1 in the aforementioned scenario 1.

[0319] As shown in Figure 8, the process of the communication method is as follows:

[0320] S801: When a first VFL server needs to perform model training, the first VFL server obtains information indicating a first AF.

[0321] The need for the first VFL server to perform model training can be understood as the need for the first VFL server to perform an analysis service. In other words, the first VFL server needs to train a model for the analysis service, that is, complete the analysis service through the model.

[0322] The first AF is the AF that the first VFL server requests to participate in the VFL group, and the first AF has VFL client capabilities. The first AF is not a network element in the network (PLMN) where the first VFL server is located, that is, the first AF is a network element outside the network. The aforementioned VFL group includes VFL clients and VFL servers for participating in model training. It is understood that the VFL server in the VFL group can be the first VFL server.

[0323] The information used to indicate the first AF may be the identifier of the first AF or other information. The identifier of the first AF may be used to indicate the first AF in the network where the first VFL server is located. That is, the identifier of the first AF may be an internal identifier, i.e., an identifier for the first AF in the network where the first VFL server is located. It is understandable that the first AF may have an identifier outside the network that is different from that inside the network. And the NEF may convert the internal and external identifiers of the first AF, for example: when the NEF sends the information sent by the first AF to the network element in the network, the NEF may convert the external identifier of the first AF carried in the information into the internal identifier of the first AF, or, when the NEF sends the information sent by the network element in the network to the first AF, the NEF may convert the internal identifier of the first AF carried in the information into the external identifier of the first AF. In this way, the security of the data in the network can be improved.

[0324] The first VFL server obtains the information for indicating the first AF, which can be understood as the first VFL server obtaining the AF that it requests to participate in the VFL group. It can be understood that the first VFL server can obtain the information for indicating the first AF from other network elements, that is, other network elements can instruct the first VFL server to request the AF to participate in the VFL group, such as the NRF instructing the first VFL server to request the AF to participate in the VFL group. The first VFL server can also determine the AF that it requests to participate in the VFL group by itself, such as the NRF can provide the first VFL server with at least one AF that can participate in the VFL group through service request discovery. The first VFL server can determine the AF that it requests to participate in the VFL group based on the at least one AF. For details, please refer to the relevant introduction in S707 and S708 above, which will not be repeated here.

[0325] In one possible design scheme, before the first VFL server obtains information indicating the first AF (i.e., S801), the above communication method may also include: the NEF registers the vertical federation capability of the first AF to the NRF, and the vertical federation capability of the first AF is used to indicate that the first AF has the capability of the VFL client.

[0326] It can be understood that the specific implementation of the NEF registering the vertical federation capability of the first AF with the NRF can refer to the relevant introduction in the above S703-S706, which will not be repeated here.

[0327] Optionally, before the NEF registers the vertical federation capability of the first AF with the NRF, the communication method may further include: the first AF triggers the NEF to register the vertical federation capability of the first AF and first vertical federation-related parameters of the first AF; the NEF registering the vertical federation capability of the first AF with the NRF may specifically include: in response to the first AF triggering the NEF to register the vertical federation capability of the first AF and the first vertical federation-related parameters, the NEF registering the vertical federation capability of the first AF and the first vertical federation-related parameters with the NRF. That is, when the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF, the NEF registers the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF with the NRF.

[0328] Among them, the first vertical federation related parameters include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, security sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of the terminal served. For details, please refer to the relevant introduction in S703 above, which will not be repeated here. It can be understood that the first analysis identifier corresponds to the analysis identifier #2 in S703, the first interoperability identifier corresponds to the interoperability identifier #2 in S703, and the scope of the terminal served corresponds to the UE scope #2 of the service in S703.

[0329] In addition, for the specific implementation of the first AF triggering the NEF to register the vertical federation capability of the first AF and the first vertical federation related parameters, reference may be made to the relevant introduction in S703 to S706 above, which will not be repeated here.

[0330] Furthermore, the above-mentioned first AF triggers the NEF to register the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF can specifically include: the first AF sends a subscription message to the NEF, and the subscription message is used to request the registration of the vertical federation capability and the first vertical federation-related parameters of the first AF; in response to the first AF triggering the NEF to register the vertical federation capability and the first vertical federation-related parameters of the first AF, the NEF registers the vertical federation capability and the first vertical federation-related parameters of the first AF with the NRF, including: the NEF sends an NF configuration file update request message to the NRF according to the subscription message, and the NF configuration file update request message includes the vertical federation capability and the first vertical federation-related parameters of the first AF; the NRF receives the NF configuration file update request message from the NEF; the NRF registers the vertical federation capability and the first vertical federation-related parameters of the first AF according to the NF configuration file update request message.

[0331] That is, when the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF, the registration of the vertical federation capability of the first AF and the first vertical federation-related parameters of the first AF by the NEF to the NRF can specifically include: the NEF receives a subscription message from the AF, and the subscription message is used to request registration of the vertical federation capability of the first AF and the first vertical federation-related parameters; the NEF sends a network function NF configuration file update request message to the NRF based on the subscription message, and the NF configuration file update request message includes the vertical federation capability of the first AF and the first vertical federation-related parameters.

[0332] It can be understood that the specific implementation of the first AF triggering the NEF to register the vertical federation capability of the first AF and the first vertical federation related parameters can refer to the relevant introduction in the above S703-S706, which will not be repeated here.

[0333] It can also be understood that the NEF can proactively register the vertical federation capability of the first AF, or the vertical federation capability of the first AF and related parameters of the first vertical federation, with the NRF. For example, the vertical federation capability of the first AF and / or related parameters of the first vertical federation can be pre-set in the NEF. When the NEF goes online, it can register the vertical federation capability of the first AF and / or the vertical federation capability of the first AF and related parameters of the first vertical federation with the NRF based on the pre-set vertical federation capability of the first AF and / or related parameters of the first vertical federation. Of course, the registration of the vertical federation capability of the first AF and related parameters of the first vertical federation can also be triggered by other network elements. The specific configuration can be flexibly set according to actual conditions and is not limited.

[0334] S802: The first VFL server obtains an access token.

[0335] The access token is used to indicate that the first VFL server is authorized to access the service provided by the first AF.

[0336] In a possible design scheme, when NEF registers the vertical federation capability of the first AF with NRF, the first VFL server obtains the access token, which can specifically include: the first VFL server sends an access token request message to the NRF, and the access token request message requests a token used to indicate that the first VFL server is authorized to access the services provided by the first AF; the NRF receives the access token request message from the first VFL server; in response to the access token request message, the NRF performs authorization verification on the first VFL server based on the access token request message and the registered vertical federation capability of the first AF; if the authorization verification of the first VFL server is successful, the NRF sends the access token to the first VFL server; the first VFL server receives the access token from the NRF.

[0337] It is understood that the specific implementation of the first VFL server obtaining the access token can refer to the relevant description in S709-S711 above and will not be repeated here. In addition, the first VFL can also obtain the access token from other network elements or perform other methods to obtain the access token. The specific configuration can be flexibly set according to the actual situation and is not limited.

[0338] Optionally, when the NEF registers the vertical federation capability of the first AF and the first vertical federation related parameters with the NRF, the above-mentioned NRF performs authorization verification on the first VFL server based on the access token request message and the registered vertical federation capability of the first AF, which can specifically include: the NRF performs authorization verification on the first VFL server based on the access token request message, the registered vertical federation capability of the first AF and the first vertical federation related parameters.

[0339] It can be understood that the specific implementation of the NRF performing authorization verification on the first VFL server based on the access token request message, the registered vertical federation capability of the first AF and the first vertical federation related parameters can refer to the relevant introduction in the above S710 and will not be repeated here.

[0340] S803: The first VFL server sends a service request message to the NEF. Correspondingly, the NEF receives the service request message from the first VFL server.

[0341] The service request message includes information indicating the first AF and an access token.

[0342] It can be understood that the specific implementation of the first VFL server sending the service request message to the NEF can refer to the relevant introduction in the above S712a, which will not be repeated here.

[0343] S804: In response to the service request message, the NEF verifies the access token.

[0344] In one possible design, an access token includes an identifier of a first AF and a first analysis identifier; a service request message includes a second analysis identifier, the second analysis identifier being used to indicate the analysis service corresponding to model training; and the NEF verifies the access token, including: determining whether the identifier of the first AF in the access token matches information indicating the first AF in the service request message; and determining whether the first analysis identifier in the access token matches the second analysis identifier in the service request message. If the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF verifies the access token successfully; otherwise, the NEF fails to verify the access token. That is, if the identifier of the first AF in the access token does not match the information indicating the first AF in the service request message, and / or the first analysis identifier in the access token does not match the second analysis identifier in the service request message, the NEF fails to verify the access token. By confirming whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, the security of the verification can be further improved.

[0345] In another possible design, the access token includes an identifier of a first AF and a first analysis identifier; the service request message includes a second analysis identifier, the second analysis identifier being used to indicate an analysis service corresponding to model training; the NEF verifies the access token, including: the NEF verifies the signature of the access token; the NEF determines whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message; the NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; if the NEF verifies the signature of the access token successfully, the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF verifies the access token successfully; otherwise, the NEF verifies the access token unsuccessfully. That is, if the NEF fails to verify the signature of the access token, or the identifier of the first AF in the access token does not match the information indicating the first AF in the service request message, or the first analysis identifier in the access token does not match the second analysis identifier in the service request message, the NEF verifies the access token unsuccessfully. By confirming whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, the security of the verification can be further improved.

[0346] It is understandable that the specific implementation of NEF verifying the access token can refer to the relevant introduction in S713a, which will not be repeated here.

[0347] S805 : When the NEF passes the verification of the access token, the NEF triggers adding the first AF to the VFL group according to the information indicating the first AF.

[0348] The NEF triggering the first AF to join the VFL group according to the information used to indicate the first AF can specifically include: the NEF sending a join VFL group request message to the first AF according to the information used to indicate the first AF; the first AF receiving the join VFL group request message from the NEF; in response to the join VFL group request message, the first AF sending a join VFL group response message to the NEF, where the VFL group response message is used to indicate that the first AF joins the VFL group; the NEF receives the join VFL group response message from the first AF; in response to the join VFL group response message, the NEF sending a service response message to the first VFL server, where the service response message is used to indicate that the first AF joins the VFL group; and the first VFL server receives the service response message from the NEF.

[0349] It can be understood that the specific implementation of the NEF triggering the first AF to add the first AF to the VFL group according to the information used to indicate the first AF can refer to the relevant introduction in S714a-S716a, which will not be repeated here.

[0350] In summary, in this embodiment of the present application, when a VFL server requests an AF located outside the VFL server's network to join a VFL group, the NEF can verify the VFL server using an access token, specifically whether the VFL server is authorized to access the VFL services provided by the AF. If verification is successful, the NEF triggers the AF's addition to the VFL group. This allows the VFL server to authorize services for AFs located outside the VFL server's network. Furthermore, it enables AFs located outside the VFL server's network to join the VFL group, thereby enriching the data sources within the VFL group. Furthermore, by having the NEF verify the VFL server, VFL services can be provided while meeting the security requirements of AFs located outside the network.

[0351] Scenario 2:

[0352] For example, FIG9 is a flow chart of the communication method provided in an embodiment of the present application. In scenario 2, NEF#1 (the aforementioned NEF) can register the relevant capabilities of the VFL of the AF it serves when registering with the NRF. When the NWDAF (the aforementioned VFL server) starts a vertical federation task, the NRF can determine the AF that can provide services to the NWDAF, such as AF#1 (the aforementioned AF), based on the relevant capabilities of the vertical federation of the AF registered by the NEF, and authorize the NWDAF.

[0353] Specifically, as shown in FIG9 , the process of the communication method is as follows:

[0354] S901: NWDAF sends a registration request message #1 to NRF. Correspondingly, NRF receives the registration request message #1 from NWDAF.

[0355] The specific implementation of S901 can refer to the related introduction of the aforementioned "S701", which will not be repeated here.

[0356] S902: NEF#1 sends a registration request message #2 to NRF. In response, NRF receives the registration request message #2 from NEF#1.

[0357] Registration Request Message #2 can be used to request that the NF profile, AF range #1, and at least one interoperability identifier #2 of NEF #1 be registered with the NRF. For details, please refer to the relevant description in "S702" above and will not be repeated here. The Registration Request Message may include the NF profile, AF range #1, and at least one interoperability identifier #2.

[0358] For the NF configuration file of NEF#1, please refer to the relevant introduction in the aforementioned "S702", which will not be repeated here.

[0359] AF range #1 can be used to indicate at least one AF served by NEF #1 and having vertical federation capability (VFL client). That is to say, each AF in AF range #1 is an AF served by NEF #1, and each AF in AF range #1 has the capability of a VFL client, such as being able to perform model training. AF range #1 can include at least one AF. Alternatively, AF range #1 can include at least one AF sub-range #1, for example: AF range #1 can include AF sub-range #1a, AF sub-range #1b, and AF sub-range #1c. There can be multiple types of information used to indicate AF sub-range #1, such as enterprise identification, location information, and UE identification. AF sub-range #1 can include at least one AF. It can be understood that when AF range #1 includes one AF sub-range #1, the AF range #1 is the AF sub-range #1.

[0360] AF range #1 can be determined by different information. Exemplarily, AF range #1 can be determined by an enterprise, such as by indicating AF sub-range #1 by an enterprise logo, thereby indicating AF range #1. For example, AF range #1 can be indicated by enterprise #a1, enterprise #a2, and enterprise #a3, that is, AF range #1 can include AF belonging to enterprise #a1, AF belonging to enterprise #a2, and AF belonging to enterprise #a3. It can be understood that "enterprise" in the embodiment of the present application is only an exemplary expression, and "enterprise" can also be replaced by any other expression, such as "manufacturer", "manufacturer", "company", etc., without limitation. AF range #1 can also be determined by the location where NEF #1 is deployed, such as by indicating AF sub-range #1 by the location information where NEF #1 is deployed, thereby indicating AF range #1. For example, AF range #1 can be indicated by area #a1 and area #a2, that is, AF range #1 can include AF located in area #a1, and AF located in area #a2. AF range #1 can also be determined based on the UE. For example, AF subrange #1 can be indicated by a UE identifier, thereby indicating AF range #1. For example, AF range #1 can be indicated by UE#a1 ID and UE#a2 ID, that is, AF range #1 can include AFs that can provide services to UE#a1 and AFs that can provide services to UE#a2. It will be understood that the information used to indicate AF range #1 and / or AF subrange #1 can be flexibly configured based on actual circumstances and is not limited to the above-mentioned situations.

[0361] It is understood that AF range #1 can be pre-configured in NEF #1. For example, when AF range #1 can be determined by an enterprise, NEF #1 can pre-arrange with each enterprise the corresponding AF range, i.e., AF sub-range #1. The specific range can be flexibly set according to the actual situation without limitation. In addition, the "AF range" and "AF sub-range" in the embodiments of the present application are merely exemplary expressions, and "AF range" can also be replaced by any other expression, such as "AF set", "AF list", "AF service range", etc., and "AF sub-range" can also be replaced by any other expression, such as "AF sub-set", "AF sub-list", "AF sub-service range", etc., without limitation.

[0362] Interoperability identifier #2 can be used to indicate the range of network elements (or NF instances) with which the AF can interact within a certain range, which can be AF range #1 or AF sub-range #1. Detailed description is given below.

[0363] In one possible implementation, interoperability identifier #2 can be used to indicate the range of network elements (or NF instances) with which each AF in AF range #1 can interact, or in other words, interoperability identifier #2 can indicate the range of network elements that can interact with each AF in AF range #1. In this case, for any AF in AF range #1, regardless of which AF sub-range #1 the AF is located in and which analysis service (described below) the AF can participate in, the range of network elements with which the AF can interact is fixed. It can be understood that in this case, registration request message #2 can include an interoperability identifier #2.

[0364] For example, if AF range #b1 includes AF sub-range #b1, AF sub-range #b2, and AF sub-range #b3, and AF range #b1 corresponds to interoperability identifier #b2, then registration request message #2 may include interoperability identifier #b2, indicating that the range of network elements that can interact with each AF included in AF range #b1 is the range indicated by interoperability identifier #b2. In other words, the range of network elements that can interact with each AF included in AF sub-range #b1, AF sub-range #b2, and AF sub-range #b3 is the range indicated by interoperability identifier #b2.

[0365] In another possible implementation, interoperability identifier #2 can be used to indicate the range of network elements (or NF instances) with which each AF in AF sub-range #1 can interact, or in other words, interoperability identifier #2 can indicate the range of network elements that can interact with each AF in AF sub-range #1. In this case, for any AF in AF sub-range #1, no matter which analysis service the AF can participate in, the range of network elements with which the AF can interact is fixed. It can be understood that in this case, the registration request message #2 can include at least one interoperability identifier #2. And the number of interoperability identifiers #2 can be the same as the number of AF sub-range #1.

[0366] For example, AF range #b11 includes AF sub-range #b11, AF sub-range #b22, and AF sub-range #b33, AF sub-range #b11 corresponds to interoperability identifier #b21, AF sub-range #b22 corresponds to interoperability identifier #b22, and AF sub-range #b33 corresponds to interoperability identifier #b23, that is, AF range #b11 corresponds to interoperability identifier #b21, interoperability identifier #b22, and interoperability identifier #b23. In this case, registration request message #2 may include interoperability identifier #b21, interoperability identifier #b22, and interoperability identifier #b23, which may indicate that the range of network elements that can interact with each AF included in AF sub-range #b11 is the range indicated by interoperability identifier #b21, the range of network elements that can interact with each AF included in AF sub-range #b22 is the range indicated by interoperability identifier #b22, and the range of network elements that can interact with each AF included in AF sub-range #b33 is the range indicated by interoperability identifier #b23.

[0367] It can be understood that interoperability identifier #2 is similar to the aforementioned interoperability identifier #1. You can refer to the relevant introduction of interoperability identifier #1 in "S701" for understanding, and will not be repeated here. In addition, interoperability identifier #2 can also have a corresponding relationship with analysis service #2 (described below), that is, one analysis service #2 can correspond to at least one interoperability identifier #2, that is, for different analysis services supported by AF, the range of network elements that the AF can interact with can be different, as described below.

[0368] Optionally, the registration request message #2 may also include at least one of the following items: at least one analysis identifier #2, security sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or service UE scope #2. For the specific parameters, please refer to the relevant introduction of the aforementioned "S703" and will not be repeated here.

[0369] Analysis identifier #2 can be the analysis identifier corresponding to AF range #1. Analysis identifier #2 can be used to indicate the analysis services supported by the AF included in AF range #1, or in other words, analysis identifier #2 can be used to indicate the analysis services that the AF included in AF range #1 can participate in. It can be understood that AF range #1 and the analysis identifier #2 have a corresponding relationship, that is, each AF sub-range #1 in at least one AF sub-range #1 included in AF range #1 can correspond to one or more analysis identifiers #2. It can also be understood that one analysis identifier #2 usually corresponds to one analysis service. When each AF sub-range #1 in at least one AF sub-range #1 included in AF range #1 corresponds to multiple analysis identifiers #2, these multiple analysis identifiers #2 can respectively indicate different analysis services supported by each AF in the AF sub-range #1, that is, each AF in the AF sub-range #1 can participate in different analysis services of vertical federated training. For example, AF range #1 includes two AF sub-ranges #1, and these two AF sub-ranges #1 are indicated by enterprise #b1 and enterprise #b2 respectively; enterprise #b1 corresponds to one analysis identifier #b1, which means that the AF belonging to enterprise #b1 can participate in the analysis business corresponding to the analysis identifier #b1; enterprise #b2 corresponds to two analysis identifiers #b2, which means that the AF belonging to enterprise #b2 can participate in two different analysis businesses corresponding to these two analysis identifiers #b2.

[0370] It can be understood that for AF sub-range #1 in AF range #1, the registration request message #2 can also carry the vertical federation-related capability parameters corresponding to the AF in the AF sub-range #1, such as secure sample alignment, end-to-end secure transmission, etc. In this case, each AF in the AF sub-range #1 has the vertical federation-related capabilities indicated by the vertical federation-related parameters. In other words, for the AF in AF sub-range #1, when there are multiple analysis identifiers #2 corresponding to the AF in the AF sub-range #1, each analysis identifier #2 can correspond to the same vertical federation-related parameters, that is, the AF in the AF sub-range #1 has the same vertical federation-related capabilities for each analysis business that it can participate in. Continuing with the above example, enterprise #b1 can correspond to secure sample alignment, end-to-end secure transmission, and authorization time, that is, the AF belonging to enterprise #b1 can also require the NWDAF to have the capabilities of secure sample alignment and end-to-end secure transmission, as well as indicate the time range in which it can join vertical federation learning; enterprise #b2 can correspond to the model usage scope and anonymization processing, that is, the AF belonging to enterprise #b2 can also require the usage scope of the model it participates in, and anonymize the data used to train the model.

[0371] It can also be understood that the above content introduces setting the vertical federation capability-related parameters with the AF sub-range #1 as the granularity. For the AF in the AF sub-range #1, the vertical federation capability-related parameters can also be set with the analysis business as the granularity, that is, there are corresponding vertical federation capability-related parameters for each analysis business (or analysis identifier #2). And for one analysis business (or analysis identifier #2), there can also be corresponding multiple sets of different vertical federation capability-related parameters, or vertical federation capability-related parameters for multiple different situations. It can be understood that the vertical federation capability-related parameters can include the above-mentioned interoperability identifier #2.

[0372] For example, as shown in Table 3 below, AF range #1 may include AF sub-range #c1, AF sub-range #c2, and AF sub-range #c3. AF sub-range #c1, AF sub-range #c2, and AF sub-range #c3 are indicated by enterprise #c1, enterprise #c2, and enterprise #c3, respectively, such as indicating AF sub-range #c1 by enterprise #c1. Enterprise #c1 corresponds to analysis identifier #c1, which corresponds to a set of vertical federation-related parameters #c11. Enterprise #c2 corresponds to analysis identifier #c21 and analysis identifier #c22, which corresponds to a set of vertical federation-related parameters #c21; analysis identifier #c22 corresponds to three sets of vertical federation-related parameters, namely vertical federation-related parameters #c22, vertical federation-related parameters #c23, and vertical federation-related parameters #c24. Enterprise #c3 corresponds to analysis identifier #c31 and analysis identifier #c32, which both correspond to vertical federation-related parameters #c31.

[0373] Table 3

[0374] In addition, if the analysis identifier #2 is not carried in the registration request message #2, it can be identified that each AF in at least one AF sub-range #1 included in the AF range #1 can participate in any analysis service, that is, there is no restriction on the analysis service that the AF can participate in. In this case, each AF sub-range #1 can correspond to a set of vertical federation-related parameters, which may include interoperability identifier #2, security sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or one or more parameters in the UE range #2 of the service.

[0375] In an embodiment of the present application, when registering with NRF, NEF can register AF range #1 and at least one interoperability identifier #2 corresponding to AF range #1 to NRF, so that NRF can search for whether there is an AF that can provide services based on information such as AF range #1 during subsequent service discovery.

[0376] It can be understood that in an embodiment of the present application, NEF#1 may also carry AF range #3 instead of AF range #1 in registration request message #2. The AF range #3 may include at least one AF or at least one AF sub-range served by NEF#1. Each AF in AF range #3 carries an indicator (or indication information) of whether it is willing to provide VFL service, that is, the indicator can be used to determine whether the AF has VFL capability or whether the AF is willing to participate in the VFL group. It can be understood that in this case, AF range #1 includes each AF in AF range #3 that carries an indicator of willingness to provide VFL service, that is, AF range #1 can be determined by each AF in AF range #3 that carries an indicator of willingness to provide VFL service.

[0377] For example, AF range #3 includes AF#31, AF#32, and AF#33, all of which carry indicators indicating willingness to provide VFL services.

[0378] For another example, AF range #3 includes AF#31, AF#32, AF#33, AF#34, and AF#35. AF#31 and AF#32 carry indicators indicating that they do not provide the VFL service, while AF#33, AF#34, and AF#35 carry indicators indicating that they provide the VFL service. In this case, AF range #1 includes AF#33, AF#34, and AF#35.

[0379] Furthermore, when AF range #3 includes at least one AF sub-range, each AF included in each AF sub-range in the at least one AF sub-range carries an indicator indicating whether it is willing to provide VFL services. In this case, AF range #1 includes each AF in AF range #3 that carries an indicator indicating willingness to provide VFL services, and these AFs can be divided into ranges (or sets, or lists).

[0380] For example, AF range #3 includes AF sub-range #1, AF sub-range #2, and AF sub-range #3. AF sub-range #1 includes AF#31 and AF#32. AF sub-range #2 includes AF#33, AF#34, and AF#35. AF sub-range #3 includes AF#36. AF#31 and AF#34 carry indicators that they do not provide VFL service, while the other AFs carry indicators that they provide VFL service. In this case, AF range #1 includes AF sub-range #1, AF sub-range #2, and AF sub-range #3. AF sub-range #1 includes AF#32, AF sub-range #2 includes AF#33 and AF#35, and AF sub-range #3 includes AF#35. That is, the AF sub-range #1 and AF sub-range #2 included in AF range #1 are different from the AF sub-range #1 and AF sub-range #2 included in AF range #3.

[0381] S903: NWDAF sends a discovery request message to NRF. Correspondingly, NRF receives the discovery request message from NWDAF.

[0382] Among them, the specific implementation of S903 can refer to the relevant introduction of the aforementioned "S707", which will not be repeated here.

[0383] S904: The NRF sends a discovery response message to the NWDAF. Correspondingly, the NWDAF receives the discovery response message from the NRF.

[0384] The specific implementation of S904 is similar to that of S708, except that:

[0385] In S708, the NF instance selected by the NRF includes AF#1 located outside the network, and the NRF sends the NEF#1 identifier, or the NEF#1 identifier and the AF#1 identifier to the NWDAF.

[0386] In S904, the NF instance selected by the NRF includes at least one AF sub-range #1 in the above AF range #1. The NRF may send the NEF #1 identifier, or the NEF #1 identifier and information indicating AF range #2 (referred to as indication information #3), to the NWDAF to indicate the AF that can provide services to the NWDAF. The AF range #2 includes at least one AF sub-range #1 in the above AF range #1.

[0387] There are various relationships between AF range #2 and AF range #1. For example, AF range #2 is the same as AF range #1, meaning that AF range #2 is AF range #1, and in this case, all AFs included in AF range #1 can provide NWDAF services. Alternatively, AF range #2 is larger than AF range #1, meaning that AF range #2 includes AF range #1, meaning that AF range #2 includes at least one AF sub-range #1 included in AF range #1, and in this case, all AFs included in AF range #1 can provide NWDAF services. Alternatively, AF range #2 is smaller than AF range #1, meaning that AF range #1 includes AF range #2, meaning that AF range #2 can include at least part of the AF sub-range #1 included in AF range #1. It is understood that AF range #2 may include not only at least one AF sub-range #1 in AF range #1, but also AF sub-ranges included in other AF ranges. The specific relationship can be determined based on actual conditions and is not limited thereto.

[0388] For example, AF range #1 includes AF subrange #d1 and AF subrange #d2, AF range #2 may include AF subrange #d1 and AF subrange #d2; or, AF range #2 may include AF subrange #d1 or AF subrange #d2; or, AF range #2 may include AF subrange #d1 and AF subrange #e2.

[0389] It is understood that the above-mentioned indication information #3 may include different information in different situations. For example, indication information #3 may include an enterprise identifier, such as an enterprise ID, an enterprise Hypertext Transfer Protocol (HTTP) address, or an enterprise Internet Protocol (IP) address. Indication information #3 may also include a UE identifier, such as a UE ID. Indication information #3 may also include area information. Indication information #3 is related to the setting of AF range #1. For example, when AF range #1 includes at least one enterprise identifier, indication information #3 may include the enterprise identifier.

[0390] In addition, after receiving the discovery response message, the NWDAF may determine the AF range requested to join the VFL group according to the indication information #3, such as a certain AF sub-range #1 included in the AF range #1.

[0391] In addition, the specific implementation of S903 can be understood by referring to the relevant introduction of the aforementioned "S708", which will not be repeated here.

[0392] S905: NWDAF sends an access token request message to NRF. Correspondingly, NRF receives the access token request message from NWDAF.

[0393] S906: The NRF performs authorization verification according to the access token request message.

[0394] S907: The NRF sends an access token response message to the NWDAF. Correspondingly, the NWDAF receives the access token response message from the NRF.

[0395] S908: NWDAF sends a service request message to NEF#1. Correspondingly, NEF#1 receives the service request message from NWDAF.

[0396] S909, NEF#1 verifies the access token.

[0397] The specific implementation of S905-S909 is similar to the aforementioned S709-S713a, except that:

[0398] In S709-S713a, the AF#1 identifier is used, for example: the access token request message carries the AF#1 identifier; the NRF performs authorization verification based on the information of the vertical federation authorization scope of AF#1 found by the AF#1 identifier; the access token includes the AF#1 identifier; and the service request message can be used to request AF#1 to join the VFL group, and the service request message can include the AF#1 identifier; NEF#1 verifies the AF#1 identifier in the access token.

[0399] In S905-S909, indication information #3 is used. For example, the access token request message carries indication information #3; the NRF performs authorization verification by finding information about the vertical federation authorization scope of a certain range of AFs based on indication information #3; the access token may include indication information #3; the service request message may be used to request that at least one AF in a certain range join the VFL group, and the service request message may include indication information #3; and NEF #1 verifies indication information #3 in the access token. Therefore, the specific implementation of S905-S909 can be understood by referring to the relevant description of "S709-S713a" above. For example, the AF #1 identifier in S709-S713a can be replaced with indication information #3 for understanding, and will not be repeated here.

[0400] Furthermore, in S909, after NEF#1 verifies the access token, it can select one or more AFs from the at least one AF indicated by indication information #3 as AFs for subsequent requests to access the VFL group, based on NEF#1's local policy, such as selecting an AF based on a locally stored AF priority list. The following description uses the selection of AF#1 as the AF for subsequent requests to access the VFL group as an example.

[0401] S910, NEF#1 sends a VFL group joining request message to AF#1. Correspondingly, AF#1 receives the VFL group joining request message from NEF#1.

[0402] S911, AF#1 sends a VFL group joining response message to NEF#1. In response, NEF#1 receives the VFL group joining response message from AF#1.

[0403] S912, NEF#1 sends a service response message to NWDAF. Correspondingly, NWDAF receives the service response message from NEF#1.

[0404] Among them, the specific implementation of S910-S912 can refer to the relevant introduction of the aforementioned "S714a-S716a", which will not be repeated here.

[0405] In summary, according to the introduction of scenario 2, NEF can register the vertical federation authorization information corresponding to the AF list of its service that is located outside the network and has vertical federation capabilities. When the VFL server (i.e., NWDAF) requests at least one AF in the AF list to join the VFL group, NEF can verify the VFL server through the access token, that is, verify whether the VFL server is authorized to access the VFL services provided by each AF in the AF list, and if the verification is successful, trigger at least one AF in the AF list to join the VFL group. In this way, the service authorization of the VFL server can be implemented for AFs located outside the network where the VFL server is located. And it can enable AFs located outside the network where the VFL server is located to join the VFL group, thereby enriching the data sources in the VFL group. In addition, by verifying the VFL server through NEF, VFL services can be carried out in scenarios where the security needs of AFs outside the network are met.

[0406] The above describes in detail the process of the communication method provided by the embodiment of the present application in conjunction with Figure 9. The following describes the overall process of the communication method in conjunction with Figure 10.

[0407] For example, Figure 10 is a fourth flow chart of the communication method. The communication method primarily involves interactions between a first VFL server, an NRF, an NEF, and a first AF. The first VFL server can be understood as the NWDAF in Scenario 2 above, the NEF can be understood as NEF#1 in Scenario 2 above, the first AF can be understood as AF#1 in Scenario 2 above, the first AF list can be understood as AF range #2 in Scenario 2 above, and the second AF list can be understood as AF range #1 in Scenario 2 above.

[0408] As shown in Figure 10, the process of the communication method is as follows:

[0409] S1001: When a first VFL server needs to perform model training, the first VFL server obtains information of a first AF list.

[0410] If the first VFL server needs to perform model training, please refer to the relevant introduction in the aforementioned S801, which will not be repeated here.

[0411] The first AF list includes AFs that the first VFL server requests to participate in a VFL group, and each of the at least one AF included in the first AF list has VFL client capabilities. Each of the at least one AF included in the first AF list is not a network element in the network (PLMN) where the first VFL server is located. The VFL group includes VFL clients and VFL servers for participating in model training.

[0412] The first AF list information may be used to indicate the first AF list. The first AF list information corresponds to AFs that the first VFL server requests to participate in the VFL group, and each of the at least one AF corresponding to the first AF list information has VFL client capabilities. Each of the at least one AF corresponding to the first AF list information is not a network element in the network where the first VFL server is located.

[0413] It can be understood that in the embodiment of the present application, the information of the first AF list can also be referred to as the information used to indicate the first AF list, that is, the two can be used interchangeably. The information of the first AF list is similar to the information used to indicate AF range #2. For details, please refer to the relevant introduction of AF range #1 in S904 above for understanding, which will not be repeated here. In addition, in the embodiment of the present application, the vertical federation capabilities, vertical federation-related parameters and other information corresponding to the AF list (such as the first AF list or the second AF list) can be understood as the vertical federation capabilities, vertical federation-related parameters and other information corresponding to the information of the AF list; the at least one AF included in the AF list can also be understood as the at least one AF corresponding to the information of the AF list; that is, the AF list and the information of the AF list have a corresponding relationship, and the two can be converted.

[0414] The information of the first AF list may be the enterprise identifier corresponding to the first AF list, or other information, such as location information, terminal information, etc. The enterprise identifier corresponding to the first AF list may be used to indicate the first AF list in the network where the first VFL server is located. That is, the enterprise identifier corresponding to the first AF list may be an internal identifier, i.e., it identifies the first AF list in the network where the first VFL server is located. It is understandable that the first AF list may have an identifier outside the network that is different from that inside the network. And the NEF may convert the internal and external identifiers of the first AF list, for example: when the NEF sends the information sent by the AF in the first AF list to the network element in the network, the NEF may convert the external identifier of the first AF list carried in the information to the internal identifier of the first AF list, or, when the NEF sends the information sent by the network element in the network to the AF in the first AF list, the NEF may convert the internal identifier of the first AF list carried in the information to the external identifier of the first AF list. In this way, the security of the data in the network can be improved.

[0415] The first VFL server obtaining the information of the first AF list can be understood as the first VFL server obtaining the information of the AF list containing the AFs that it requests to participate in the VFL group. It can be understood that the first VFL server can obtain the information of the first AF list from other network elements, that is, the other network elements can instruct the first VFL server to request the information of the AF list containing the AFs that it requests to participate in the VFL group, such as the information of the AF list containing the AFs that the NRF instructs the first VFL server to request to participate in the VFL group. The first VFL server can also independently determine the information of the AF list containing the AFs that it requests to participate in the VFL group, such as the NRF can provide the first VFL server with the AF list containing the AFs that can participate in the VFL group through service request discovery, such as the second AF list. The first VFL server can determine the information of the AF list containing the AFs that it requests to participate in the VFL group based on the AF list, such as the information of the first AF list. For details, please refer to the relevant introduction in S903 and S904 above, which will not be repeated here.

[0416] In one possible design scheme, before the first VFL server obtains the information of the first AF list (i.e., S1001), the above-mentioned communication method may also include: the NEF registers the vertical federation capability corresponding to the information of the second AF list to the NRF, the information of the second AF list includes the information of the first AF list, and the vertical federation capability corresponding to the information of the second AF list is used to indicate that each AF in at least one AF corresponding to the information of the second AF list has the capability of the VFL client.

[0417] It can be understood that the specific implementation of the NEF registering the vertical federation capability corresponding to the second AF list with the NRF can refer to the relevant introduction in the above S802, which will not be repeated here.

[0418] Optionally, the vertical federation capability corresponding to the second AF list registered by the NEF to the NRF may specifically include: the vertical federation capability corresponding to the information of the second AF list registered by the NEF to the NRF and the vertical federation-related parameters corresponding to the information of the second AF list, the vertical federation-related parameters corresponding to the information of the second AF list include the vertical federation-related parameters corresponding to the information of the first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list are used to indicate the capability that each AF in at least one AF corresponding to the information of the first AF list requires the VFL server to have in the VFL.

[0419] The vertical federation-related parameters corresponding to the information of the first AF list include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, security sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of the terminal served. For details, please refer to the relevant introduction in S902 above, which will not be repeated here. It can be understood that the first analysis identifier corresponds to the analysis identifier #2 in S902, the first interoperability identifier corresponds to the interoperability identifier #2 in S902, and the scope of the terminal served corresponds to the UE scope #2 of the service in S902.

[0420] It can be understood that the specific implementation of the vertical federation capability and vertical federation related parameters corresponding to the information of the second AF list registered by the NEF to the NRF can refer to the relevant introduction in the above S902, which will not be repeated here.

[0421] Furthermore, the above-mentioned NEF registers the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list to the NRF, which can specifically include: the NEF sends a registration request message to the NRF, and the registration request message includes at least one of the following: the information of the second AF list, the vertical federation capability corresponding to the information of the second AF list, or the vertical federation-related parameters corresponding to the information of the second AF list; the NRF receives the registration request message from the NEF; after successfully registering the vertical federation capability corresponding to the information of the second AF list, the NRF sends a registration response message to the NEF.

[0422] The information of the second AF list may include at least one corporate identifier. It is understood that the second AF list may include at least one AF sublist, such as the first AF list described above may be an AF sublist within the second AF list. In this case, the AF sublist may be indicated by the corporate identifier, i.e., the information of the second AF list may include at least one corporate identifier. The information of the second AF list may be specifically understood with reference to the description of AF range #1 in S902 above, and will not be further elaborated here.

[0423] It can be understood that the specific implementation of the NEF registering the vertical federation capability corresponding to the information of the second AF list and the vertical federation related parameters corresponding to the information of the second AF list through the registration request message can refer to the relevant introduction in the above S902, which will not be repeated here.

[0424] It can also be understood that the NEF can trigger the registration of the vertical federation capability and / or vertical federation related parameters corresponding to the information of the second AF list through other network elements, which can be flexibly set according to actual conditions without limitation.

[0425] S1002: The first VFL server obtains an access token.

[0426] The access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information in the first AF list.

[0427] In a possible design scheme, when NEF registers the vertical federation capability corresponding to the second AF list with NRF, the first VFL server obtains the access token, which can specifically include: the first VFL server sends an access token request message to the NRF, and the access token request message requests a token used to indicate that the first VFL server is authorized to access the services provided by each AF corresponding to the information of the first AF list; the NRF receives the access token request message from the first VFL server; in response to the access token request message, the NRF performs authorization verification on the first VFL server based on the access token request message and the vertical federation capability corresponding to the information of the registered first AF list; if the authorization verification of the first VFL server is passed, the NRF sends the access token to the first VFL server; the first VFL server receives the access token from the NRF.

[0428] It can be understood that the specific implementation of the first VFL server obtaining the access token can refer to the relevant introduction in the above S905-S907, which will not be repeated here.

[0429] Optionally, in the case where the NEF registers the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list to the NRF, the above-mentioned NRF performs authorization verification on the first VFL server based on the access token request message and the vertical federation capability corresponding to the information of the registered first AF list. It can specifically include: the NRF performs authorization verification on the first VFL server based on the access token request message, the vertical federation capability corresponding to the information of the registered first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list.

[0430] It can be understood that the specific implementation of NRF's authorization verification of the first VFL server based on the access token request message, the vertical federation capabilities corresponding to the information of the registered first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list can be referred to the relevant introduction in the above S905-S907, which will not be repeated here.

[0431] S1003: The first VFL sends a service request message to the NEF. Correspondingly, the NEF receives the service request message from the first VFL.

[0432] The service request message includes information of the first AF list and an access token.

[0433] It can be understood that the specific implementation of the first VFL server sending the service request message to the NEF can refer to the relevant introduction in the above S908, which will not be repeated here.

[0434] S1004: In response to the service request message, the NEF verifies the access token.

[0435] It is understandable that the specific implementation of NEF verifying the access token can refer to the relevant introduction in S909, which will not be repeated here.

[0436] S1005 : When the access token is verified, trigger at least one AF corresponding to the first AF list to be added to the VFL group according to the information of the first AF list.

[0437] The NEF triggering, based on the information of the first AF list, to add at least one AF corresponding to the information of the first AF list to the VFL group can specifically include: the NEF determining, based on the information of the first AF list, the first AF participating in the VFL group; the NEF sending a VFL group joining request message to the first AF; the first AF receiving the VFL group joining request message from the NEF; in response to the VFL group joining request message, the first AF sending a VFL group joining response message to the NEF, where the VFL group response message is used to instruct the first AF to join the VFL group; the NEF receiving the VFL group joining response message from the first AF; in response to the VFL group response message, the NEF sending a service response message to the first VFL server, where the service response message is used to instruct the first AF to join the VFL group; the first VFL server receives the service response message from the NEF.

[0438] It can be understood that the specific implementation of the NEF triggering at least one AF in the first AF list to add at least one AF in the first AF list to the VFL group according to the information of the first AF list can refer to the relevant introduction in S810-S812, which will not be repeated here.

[0439] In summary, in an embodiment of the present application, when a VFL server requests at least one AF in a first AF list located outside the network where the VFL server resides to join a VFL group, the NEF can verify the VFL server using an access token, namely, whether the VFL server is authorized to access the VFL services provided by each AF in the first AF list. If verification is successful, the NEF triggers the addition of at least one AF in the first AF list to the VFL group. This allows the VFL server to authorize services for AFs located outside the network where the VFL server resides. Furthermore, AFs located outside the network where the VFL server resides can be added to the VFL group, thereby enriching the data sources within the VFL group. Furthermore, by verifying the VFL server through the NEF, VFL services can be provided while meeting the security requirements of AFs outside the network.

[0440] Scenario 3:

[0441] For example, FIG11 is a flowchart diagram 5 of the communication method provided in an embodiment of the present application. In scenario 3, NEF#1 (the above-mentioned NEF) can update its own vertical federation authorization information based on the relevant capabilities of the VFL of AF#1 (the above-mentioned AF) it serves, that is, the relevant capabilities of the VFL corresponding to AF#1 are not updated. When the NWDAF (the above-mentioned VFL server) starts a vertical federation task, the NRF can determine the NEF that can provide services to the NWDAF, such as NEF#1, based on the registered vertical federation authorization information of NEF#1, and authorize the NWDAF.

[0442] Specifically, as shown in FIG11 , the process of the communication method is as follows:

[0443] S1101: NWDAF sends a registration request message #1 to NRF. Correspondingly, NRF receives the registration request message #1 from NWDAF.

[0444] S1102: NEF#1 sends a registration request message #2 to NRF. In response, NRF receives the registration request message #2 from NEF#1.

[0445] S1103, AF#1 sends a subscription message #1 to NEF#1. Correspondingly, NEF#1 receives the subscription message #1 from AF#1.

[0446] Among them, the specific implementation of S1101-S1103 can refer to the relevant introduction of the aforementioned "S701-S703", which will not be repeated here.

[0447] S1104, NEF#1 sends an NF configuration file update request message to NRF. Correspondingly, NRF receives the NF configuration file update request message from NEF#1.

[0448] The NF Profile Update Request message can be used to update NEF#1's vertical federation authorization information, such as NEF#1's vertical federation capabilities and vertical federation-related parameters. It is understood that updating NEF#1's vertical federation authorization information can include adding a new set of vertical federation capabilities and vertical federation-related parameters to the NF profile registered with NEF#1, or updating a set of already registered vertical federation capabilities and vertical federation-related parameters. The following describes different scenarios.

[0449] Case 2.1: The NF Profile Update Request message is used to request the addition of a new set of vertical federation capabilities and vertical federation related parameters.

[0450] In situation 2.1, when AF#1 comes online and sends subscription message #1 to NEF#1, NEF#1 can request, through an NF profile update request message, to add the vertical federation capability and vertical federation-related parameters sent by AF#1 to the NF profile with which it is registered. That is, the vertical federation capability and vertical federation-related parameters can be used in the NF profile as a new set of vertical federation authorization information, that is, the vertical federation capability and vertical federation-related parameters can correspond to a case of vertical federation authorization.

[0451] For example, the NF configuration file of NEF#1 includes cases #a1-#a3, where case #a1 corresponds to vertical federation capability #a1 and vertical federation-related parameter #a1, case #a2 corresponds to vertical federation capability #a2 and vertical federation-related parameter #a2, and case #a3 corresponds to vertical federation capability #a3 and vertical federation-related parameter #a3. Subscription message #1 includes vertical federation capability #a4 and vertical federation-related parameter #a4 of AF#1. Based on the NF configuration file update request message sent by subscription message #1, NEF#1 can request to add a case, such as case #a4, to the NF configuration file of NEF#1. Case #a4 corresponds to vertical federation capability #a4 and vertical federation-related parameter #a4 carried in the NF configuration file update request message. It can be understood that the cases in the example can also be understood as groups, such as case #a1 can be understood as group #a1.

[0452] The NF configuration file update request message may include the vertical federation capability and vertical federation related parameters sent by AF#1, and the vertical federation capability and vertical federation related parameters sent by AF#1 may be the parameters sent by AF#1 to NEF#1 through the above-mentioned subscription message #1. For example, the subscription message #1 includes: AF#1's vertical federation capability #2, analysis identifier #2 and interoperability identifier #2, then AF#1's vertical federation related parameters may include analysis identifier #2 and interoperability identifier #2. In other words, NEF#1 does not need to process the vertical federation capability and vertical federation related parameters of AF#1 in the subscription message #1, that is, NEF#1 can send the vertical federation capability #2 and vertical federation related parameters sent by AF#1 to NRF through the NF configuration file update request message.

[0453] Optionally, the NF configuration file update request message may include at least one of the following: indication information #3, or indication information #4.

[0454] Indication information #3 can be used to indicate the sequence number or situation corresponding to the vertical federation capabilities and vertical federation-related parameters sent by AF#1 as a group of data. For example, if indication information #3 is 5, it means that the vertical federation capabilities and vertical federation-related information carried in the NF configuration file update request message can be registered as the fifth group of information, or the vertical federation capabilities and vertical federation-related information carried in the NF configuration file update request message can be made to correspond to situation 5. It can be understood that if the NEF sends the NF configuration file update request message only to add a new set of vertical federation capabilities and vertical federation-related parameters, that is, if there is no update of a new set of vertical federation capabilities and vertical federation-related parameters, the NF configuration file update request message may not include indication information #3, that is, the NRF can register the vertical federation capabilities and vertical federation-related parameters carried in the NF configuration file update request message as a new set of vertical federation authorization information based on the received NF configuration file update request message.

[0455] Indication #4 can be used to indicate the addition of the vertical federation-related parameters carried in the NF Profile Update Request message, such as vertical federation capabilities and vertical federation-related parameters. That is, when the NF Profile Update Request message carries Indication #4, the NRF can, based on Indication #4, register the vertical federation-related parameters carried in the NF Profile Update Request message as a set of vertical federation authorization information with the NF Profile of NEF #1.

[0456] Case 2.2: The NF Profile Update Request message is used to request the update of a new set of vertical federation capabilities and vertical federation related parameters.

[0457] After AF#1 updates its vertical federation-related capabilities and sends a subscription message #1 or a subscription update message to NEF#1, NEF#1 may request to update its corresponding set of vertical federation capabilities and / or vertical federation-related parameters through an NF profile update request message.

[0458] For example, NEF#1's NF configuration file includes cases #b1-#b3. Case #b1 corresponds to vertical federation capability #b1 and vertical federation-related parameters #b1, case #b2 corresponds to vertical federation capability #b2 and vertical federation-related parameters #b2, and case #b3 corresponds to vertical federation capability #b3 and vertical federation-related parameters #b3. Subscription message #1 includes AF#1's vertical federation capability #b31 and vertical federation-related parameters #b31. AF#1 has previously sent subscription message #2, which includes AF#1's vertical federation capability #b3 and vertical federation-related parameters #b3. Therefore, case b3 corresponds to AF#1. In other words, AF#1's vertical federation capability #b31 and vertical federation-related parameters #b31 are the latest vertical federation authorization information for AF#1. At this point, the NF configuration file update request message sent by NEF#1 can request an update of the vertical federation authorization information corresponding to case #b3.

[0459] The NF configuration file update request message may include at least one of the following: the vertical federation capability sent by AF#1, the vertical federation-related parameters sent by AF#1, or indication information #3. The vertical federation-related parameters sent by AF#1 may include the vertical federation-related parameters sent by AF#1 to NEF#1 through the above-mentioned subscription message #1. Alternatively, the NF configuration file update request message may include at least one of the following: the vertical federation capability after being updated by AF#1, the vertical federation-related information after being updated by AF#1, or indication information #3. The vertical federation capability after being updated by AF#1 and / or the vertical federation-related information after being updated by AF#1 may be sent to the NEF through the subscription update message, or may be obtained by the NEF based on the vertical federation capability and / or vertical federation-related parameters previously sent by AF#1, and the vertical federation capability and / or vertical federation-related parameters of AF#1 in the subscription message #1. The specific setting may be flexibly made according to the actual situation and is not limited. For indication information #3, please refer to the relevant introduction in the aforementioned "Case 2.2" and will not be repeated here.

[0460] Optionally, the NF configuration file update request message may include indication information #1. Indication information #1 may be used to indicate that the NF configuration file update request message carries updated vertical federation authorization information for NEF#1. This facilitates the NRF to subsequently update the vertical federation capabilities and / or vertical federation-related parameters of NEF#1 based on indication information #1, eliminating the need to determine whether to update the vertical federation capabilities and / or vertical federation-related parameters of NEF#1 by determining whether indication information #3 exists in the NF configuration file of NEF#1, thereby reducing the processing overhead of the NRF.

[0461] S1105: NRF sends an NF configuration file update response message to NEF#1. Correspondingly, NEF#1 receives the NF configuration file update response message from NRF.

[0462] The NF profile update response message can be used to indicate that the NRF has updated the NF profile registered by NEF#1, that is, the parameters carried by the NF profile update request message (such as vertical federation capabilities and / or vertical federation related parameters) have been registered to the NRF.

[0463] After receiving the NF profile update request message, the NRF can store the parameters carried in the NF profile update request message. Exemplarily, the NRF can determine whether the indication information #3 exists in the NF profile of NEF#1 based on the indication information #3 in the NF profile update request message. If the indication information #3 does not exist in the NF profile of NEF#1, it means that before the NRF receives the NF profile update request message, the vertical federation capability and vertical federation-related parameters carried in the NF profile update request message have not been registered to the NRF. At this time, the NRF can add the indication information #3 and the vertical federation capability and vertical federation-related parameters carried in the NF profile update request message to the NF profile of NEF#1, thereby completing the registration of the vertical federation capability and vertical federation-related parameters. If the indication information #3 exists in the NF configuration file of NEF#1, it means that before the NRF receives the NF configuration file update request message, the NRF has registered this set of vertical federation capabilities and vertical federation related parameters. At this time, the NRF can replace the vertical federation capabilities and vertical federation related parameters corresponding to the stored indication information #3 with the corresponding latest vertical federation capabilities and vertical federation related parameters carried by the NF configuration file update request message; or, the NRF can compare the vertical federation capabilities and vertical federation related parameters corresponding to the stored indication information #3 with the vertical federation capabilities and vertical federation related parameters carried in the NF configuration file update request message to determine the parameters for this update and update the parameters in the vertical federation capabilities and vertical federation related parameters corresponding to the stored indication information #3.

[0464] For example, the NF configuration file update request message includes indication information #3#c1, as well as the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment, and end-to-end secure transmission corresponding to indication information #3#c1. If indication information #3#c1 does not exist in the NF configuration file of NEF#1 in the NRF, the NRF may store indication information #3#c1 and the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment, and end-to-end secure transmission corresponding to AF#1, thereby completing the registration of the vertical federation capability and vertical federation-related parameters of indication information #3#c1.

[0465] For another example, the NF configuration file update request message includes indication information #3#c2, as well as the vertical federation capability #2, analysis identifier #2, interoperability identifier #2, security sample alignment and end-to-end secure transmission (recorded as the latest parameters) corresponding to indication information #3#c2. The vertical federation capability #2 and vertical federation-related parameters (recorded as previous parameters) corresponding to indication information #3#c2 stored in the NRF include analysis identifier #2 and interoperability identifier #2. At this time, the NRF can replace the previous parameters with the latest parameters; or, the NRF can compare the latest parameters with the previous parameters to determine that the updated parameters are security sample alignment and end-to-end secure transmission, and add security sample alignment and end-to-end secure transmission to the vertical federation-related parameters corresponding to indication information #3#c2.

[0466] It can be understood that in the above scenario 2.2, if the NF Profile Update Request message carries Indication Information #1, the NRF can directly update AF#1's vertical federation capabilities and / or vertical federation-related parameters based on Indication Information #1, without having to determine whether the NF Profile Update Request message carries the updated parameters. This reduces the NRF's processing overhead.

[0467] After completing the update of the NF configuration file of NEF#1, NRF may send an NF configuration file update response message to NEF#1 to notify NEF#1 that the update of its NF configuration file has been completed.

[0468] S1106: NEF#1 sends the subscription result to AF#1. Correspondingly, AF#1 receives the subscription result from NEF#1.

[0469] After receiving the above NF profile update response message, NEF#1 can send a subscription result to AF#1 according to the NF profile update response message to notify AF#1 that the vertical federation capability and vertical federation related parameters sent by AF#1 have been registered.

[0470] S1107: NWDAF sends a discovery request message to NRF. Correspondingly, NRF receives the discovery request message from NWDAF.

[0471] Among them, the specific implementation of S1107 can refer to the relevant introduction of the aforementioned "S707", which will not be repeated here.

[0472] S1108: The NRF sends a discovery response message to the NWDAF. Correspondingly, the NWDAF receives the discovery response message from the NRF.

[0473] After receiving the discovery request message, the NRF can determine the NF instance that can provide services to the NWDAF based on the parameters carried in the discovery request message and send the information of the selected NF instance to the NWDAF. The number of NF instances can be one or more, and the specific number can be determined based on actual conditions. Furthermore, when there are multiple NF instances, these NF instances can be different, such as network elements of different types. For example, these NF instances can include NEFs, base stations, etc.

[0474] Exemplarily, the NRF may select a suitable NF instance as the VFL client based on the parameters carried in the discovery request message and the vertical federation capabilities and vertical federation-related parameters of each NF instance registered with the NRF, and send the selected suitable NF instance to the NWDAF. It is understood that when selecting a suitable NF instance, the NRF may determine whether the parameters carried in the discovery request message meet the requirements of the vertical federation-related capabilities of each NF instance, that is, whether the vertical federation-related parameters of the NF instance belong to the parameters carried in the discovery request message.

[0475] It can be understood that in the embodiment of the present application, the NF instance NF instance selected by NRF includes NEF#1. And the vertical federation authorization information corresponding to NEF#1 that meets the parameters carried in the discovery request message is the vertical federation authorization information corresponding to AF#1, that is, the parameters carried in the subscription message #1. In other words, AF#1 meets the requirements of the VFL client corresponding to the discovery request message. In addition, the discovery response message can also carry information on the situation or serial number corresponding to the vertical federation authorization information that NEF#1 meets the requirements (recorded as information #1), for example: the NEF#1 identifier and situation 1 (or group 1) that can be carried in the discovery response message to indicate that the vertical federation authorization information of situation 1 corresponding to NEF#1 meets the requirements.

[0476] S1109: NWDAF sends an access token request message to NRF. Correspondingly, NRF receives the access token request message from NWDAF.

[0477] The access token request message can be used to request an access token for NEF#1, which can be used to indicate that NWDAF is authorized to access the services provided by NEF#1. The access token request message may include an NEF#1 identifier and an analysis identifier #3. Among them, the NEF#1 identifier can be used to indicate that NWDAF expects the VFL client, NEF#1, to participate in vertical federated learning. For analysis identifier #3, please refer to the relevant introduction in "S707" and will not be repeated here. It can be understood that carrying the NEF#1 identifier and analysis identifier #3 in the access token request message enables NRF to perform authorization verification based on the vertical federation authorization information and analysis service information of NEF#1, that is, to determine whether NEF#1 is an NEF that NWDAF can access, that is, whether it can be authorized.

[0478] Optionally, the access token request message may also include at least one of the following: information #1, interoperability indication #3, secure sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or trained UE scope. For details, please refer to the relevant introduction in "S707 and S709" above and will not be repeated here. By carrying security capability parameters in the access token request message, the NRF can further perform authorization verification based on these security capability parameters, that is, verify whether the NWDAF and NEF#1 meet these security capability parameters, thereby improving the security of authorization.

[0479] In an embodiment of the present application, after receiving the discovery response message, NWDAF can determine the VFL client used for this vertical federated learning, such as NEF#1, based on the NF instance provided in the discovery response message. Exemplarily, when the discovery response message indicates one NEF, NWDAF can select the NEF as the VFL client, that is, the NEF is NEF#1 at this time; when the discovery response message indicates multiple NEFs, NWDAF can select at least one NEF from the multiple NEFs as the VFL client based on local policies, such as the preset usage priority of the NEF, such as selecting NEF#1 and NEF#2 as VFL clients. After selecting NEF#1 that it wishes to participate in vertical federated learning, NWDAF can request an access token corresponding to NEF#1 from NRF.

[0480] S1110 , the NRF performs authorization verification based on the access token request message.

[0481] After receiving the access token request message, the NRF can verify the authenticity of the data sent by the NWDAF based on the information carried in the access token request message, and check whether the NEF is within the range accessible to the NWDAF.

[0482] Exemplarily, NRF can obtain the NF profile registered by NWDAF, and compare the parameters in the access token except the NEF#1 identifier with the information on the vertical federation authorization scope of NWDAF in the NF profile registered by NWDAF (i.e., the information on the vertical federation capabilities registered by NWDAF in the aforementioned S1101, or the information on the vertical federation capabilities and vertical federation-related parameters registered by NWDAF), so as to verify whether the parameters sent by NWDAF in the access token request message are authentic.

[0483] The NRF can also find the NF profile registered by NEF#1 based on the NEF#1 identifier in the access token request message. After the NRF obtains the information about the vertical federation authorization scope of NEF#1, it can compare the other parameters in the access token, except the NEF#1 identifier, with the information about the vertical federation authorization scope of NEF#1 to verify whether the other parameters meet the vertical federation-related parameters registered by NEF#1.

[0484] Through these two verification operations, NRF can determine whether NWDAF can access NEF#1, that is, whether NWDAF is authorized to access the services provided by NEF#1, and use this as a basis to determine whether to send an access token to NWDAF.

[0485] S1111: The NRF sends an access token response message to the NWDAF. Correspondingly, the NWDAF receives the access token response message from the NRF.

[0486] The access token response message can be used to indicate an access token, which can be used to indicate that the NWDAF is authorized to access the services provided by NEF#1. The access token may include the NEF#1 identifier and the analysis identifier #3, and the access token may not include the AF#1 identifier. Optionally, the access token may also include at least one of the following parameters: AF#1 identifier, security sample alignment, end-to-end secure transmission, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or trained UE range, etc. For details, please refer to the aforementioned related introduction, which will not be repeated here. It can be understood that in S1111, the network element that subsequently verifies the access token is NEF#1. Therefore, S1111 can be understood by referring to the relevant introduction in the aforementioned "S711 Case 1.1", which will not be repeated here.

[0487] S1112: NWDAF sends a service request message to NEF#1. Correspondingly, NEF#1 receives the service request message from NWDAF.

[0488] The service request message can be used to request that NEF#1 join the VFL group. The service request message includes the NEF#1 identifier and an access token. For details, refer to the previous description and are not repeated here. It is understood that the NEF#1 identifier included in the service request message indicates that the NEF requesting to join the VFL group is NEF#1.

[0489] It is understood that the service request message may also include information #1, which can be used to indicate whether NEF#1 meets the required vertical federation authorization information or the corresponding information on the sequence number. That is, NEF#1 can determine the AFs that can participate in the VFL group based on this information #1, such as AF#1. It is also understood that if the service request message does not include information #1, the service request message can include the NWDAF's requirements for this VFL, that is, the information carried by the NDWAF in the discovery request message. In this case, NEF#1 can find the AFs that can participate in the VFL group based on this requirement from its NF configuration file, such as AF#1.

[0490] Optionally, the service request message may further include at least one of the following: analysis identifier #3, or relevant parameters of VFL. For details, please refer to the relevant introduction in the previous "S712a", which will not be repeated here.

[0491] S1113, NEF#1 verifies the access token.

[0492] After receiving the service request message, NEF#1 can verify the access token's signature. The specific verification method can be found in existing technologies and will not be detailed here. It will be appreciated that if the service request message includes an analysis identifier, NEF#1 can obtain the analysis identifier in the access token, i.e., analysis identifier #3, after successfully verifying the access token's signature. It can then verify whether the analysis identifier in the access token matches the analysis identifier in the service request message. If they match, verification is successful. Furthermore, based on information #1, NEF#1 can identify AF#1, the AF that can provide services to the NWDAF.

[0493] In an embodiment of the present application, NEF#1's successful verification of the access token indicates that the scope of the service requested by NWDAF is authorized, that is, the service meets the security requirements of AF#1. After NEF#1 passes the verification, it can send a VFL group joining request message (described below) to AF#1 to request AF to join the VFL group and act as a VFL client, that is, S1114a-S1116a below (recorded as case 3.1). Alternatively, after NEF#1 passes the verification, NEF#1 can obtain data from AF#1 and join the VFL group as a VFL client, that is, S1114b below (recorded as case 3.2). It can be understood that in cases 3.1 and 3.2, NWDAF perceives NEF#1, not AF#1.

[0494] In addition, if the access token also includes other information, such as security sample alignment, end-to-end secure transmission, etc., NEF#1 can also carry this information in the VFL group joining request message and send it to AF#1.

[0495] It can be understood that the specific implementation of S1109-S1113 is similar to the aforementioned S709-S713, except that:

[0496] In S709-S713, each message includes the AF#1 identifier, and all are operations for AF#1, for example: the access request message includes the AF#1 identifier; when the NRF performs authorization verification based on the access token request message, it will find the vertical federation authorization information registered by AF#1 and perform authorization verification based on the vertical federation authorization information; the access token is used to indicate that the NWDAF is authorized to access the services provided by AF#1; the service request message is used to request AF#1 to join the VFL group.

[0497] In S1109-S1113, none of the messages include AF#1, and all operations are directed at NEF#1. For example, the access request message does not include the AF#1 identifier, but includes the NEF#1 identifier and analysis identifier #3. When the NRF performs authorization verification based on the access token request message, it finds the vertical federation authorization information registered by NEF#1 and performs authorization verification based on this vertical federation authorization information. The access token is used to indicate that the NWDAF is authorized to access the services provided by NEF#1. The service request message is used to request that NEF#1 join the VFL group. Therefore, the specific implementation of S1109-S1113 can be understood by referring to the relevant description of "S709-S713" above. For example, the operations directed at AF#1 in S709-S713 can be replaced with the operations directed at NEF#1. This will not be repeated here.

[0498] S1114a, NEF#1 sends a VFL group joining request message to AF#1. Correspondingly, AF#1 receives the VFL group joining request message from NEF#1.

[0499] S1115a, AF#1 sends a VFL group joining response message to NEF#1. Correspondingly, NEF#1 receives the VFL group joining response message from AF#1.

[0500] Among them, the specific implementation of S1114a-S1115a can refer to the relevant introduction of the aforementioned "S714a-715a", which will not be repeated here.

[0501] S1116a, NEF#1 sends a service response message to NWDAF. Correspondingly, NWDAF receives the service response message from NEF#1.

[0502] After receiving the VFL group response message, NEF#1 can confirm that AF#1 has decided to join the VFL group and send this information to NWDAF via a service response message. After receiving the service response message, NWDAF can initiate vertical federated learning and interact with NEF#1. For example, it can send VFL parameters such as training accuracy and model size to NEF#1, or send the model to NEF#1.

[0503] S1114b, NEF#1 sends a service response message to NWDAF. Correspondingly, NWDAF receives the service response message from NEF#1.

[0504] After verifying the access token, NEF#1 can decide whether to join the VFL group based on local policies, such as whether NEF#1's load exceeds a threshold. After deciding to join the VFL group, NEF#1 can send a service response message to NWDAF to indicate its decision. It is understood that NEF#1 can also decide not to join the VFL group based on local policies. In this case, NEF#1 can return a response to NWDAF to indicate its decision not to join the VFL group.

[0505] In summary, as described in Scenario 3, the NEF can update the vertical federation authorization information of the AF it serves, which is located outside the network and has vertical federation capabilities, to the NEF's own vertical federation authorization information. When the VFL server (i.e., NWDAF) requests that the NEF join the VFL group, the NEF can verify the VFL server using the access token to verify whether the VFL server is authorized to access the VFL services provided by the NEF. If verification is successful, the NEF determines whether to join the VFL group. This allows the VFL server to authorize services for AFs located outside the VFL server's network.

[0506] Scenario 4:

[0507] For example, Figure 12 is a flowchart of the communication method provided in an embodiment of the present application. In scenario 4, NEF has the ability to perform service discovery and authorization verification. AF#1 (the above-mentioned AF) located outside the network can subscribe to the vertical federation capability from NEF#1 (the above-mentioned NEF), that is, register the vertical federation capability and vertical federation-related parameters of AF#1 in NEF#1. When NWDAF starts a vertical federation task, NWDAF can request service discovery from NEF. After passing the service discovery, NEF can provide AF#1 as a VFL client to NWDAF and authorize NWDAF.

[0508] Specifically, as shown in FIG12 , the process of the communication method is as follows:

[0509] S1201: NWDAF sends a registration request message #1 to NEF. Correspondingly, NEF receives the registration request message #1 from NWDAF.

[0510] S1202: AF#1 sends a subscription message #1 to NEF#1. Correspondingly, NEF#1 receives the subscription message #1 from AF#1.

[0511] Among them, the specific implementation of S1201 and S1202 can refer to the relevant introduction of the aforementioned "S701, S703" respectively, and will not be repeated here.

[0512] S1203: NEF#1 sends the subscription result to AF#1. Correspondingly, AF#1 receives the subscription result from NEF#1.

[0513] After registering the vertical federation capability and vertical federation related parameters of AF#1 according to subscription message #1, NEF#1 may send a subscription result to AF#1 to notify AF#1 that the registration of the vertical federation capability and vertical federation related parameters of AF#1 has been completed.

[0514] It can be understood that the specific implementation of S1203 is similar to the aforementioned S705, with the difference being that in S703, the registration is performed by NRF, that is, after NEF#1 receives the subscription message #1, it will send an NF configuration file update request message to NRF to register the vertical federation capabilities and / or vertical federation related parameters of AF#1 in NRF. In S1202, the registration is performed by NEF#1, that is, after NEF#1 receives the subscription message #1, it can register the vertical federation capabilities and vertical federation related parameters of AF#1 in NEF#1. In other words, NEF#1 will not send an NF configuration file update request message to NRF after receiving the subscription message #1. Therefore, the specific implementation of S1203 can be understood by referring to the relevant introduction of the aforementioned "S705", and will not be repeated here.

[0515] S1204: NWDAF sends a discovery request message to NEF#1. Correspondingly, NEF#1 receives the discovery request message from NWDAF.

[0516] S1205: NEF#1 sends a discovery response message to NWDAF. Correspondingly, NWDAF receives the discovery response message from NEF#1.

[0517] S1206: NWDAF sends an access token request message to NEF#1. Correspondingly, NEF#1 receives the access token request message from NWDAF.

[0518] S1207, NEF#1 performs authorization verification according to the access token request message.

[0519] S1208: NEF#1 sends an access token response message to NWDAF. Correspondingly, NWDAF receives the access token response message from NEF#1.

[0520] The specific implementation of S1204-S1208 is similar to the aforementioned S707-S711, with the difference that, in S707-S711, it is NRF that performs service discovery and authorization verification. For example, NWDAF requests service discovery from NRF, and NRF performs authorization verification on NWDAF. In S1204-S1208, it is NEF#1 that performs service discovery and authorization verification. For example, NWDAF requests service discovery from NEF#1, and NEF#1 performs authorization verification on NWDAF. Therefore, the specific implementation of S1204-S1208 can be understood by referring to the relevant introduction of "S707-S711" above. For example, the various operations of NRF in S707-S711 can be replaced with the various operations of NEF#1, that is, the subject of service discovery and authorization verification is replaced with NEF#1, which will not be repeated here.

[0521] It is understood that when performing service discovery and authorization verification, NEF#1 uses its locally stored files, such as the AF's contract information and registration information. It is also understood that when NEF#1 passes authorization verification based on the access token request message, the access token generated by NEF#1 includes the AF#1 identifier and analysis identifier #3. That is, in this application solution, the network element that subsequently verifies the access token is AF#1. For details, please refer to the relevant description of "S711 Case 1.2" above, which will not be repeated here. In addition, the access token generated by NEF#1 is recorded as Access Token #1.

[0522] S1209: NWDAF sends a service request message to NEF#1. Correspondingly, NEF#1 receives the service request message from NWDAF.

[0523] The service request message may be used to request AF#1 to join the VFL group, and the service request message may include AF#1 identification, access token #1, and access token #2.

[0524] The details of AF#1 identifier and access token #1 can be referred to the above related introduction, which will not be repeated here. It can be understood that carrying AF#1 identifier in the service request message can indicate the AF requesting to join the VFL group, namely AF#1.

[0525] Access token #2 can be used to indicate that NWDAF is authorized to access the services provided by NEF #1, that is, the services that NWDAF can verify authorization with NEF #1. This access token #2 can be obtained from NEF by NWDAF through existing procedures (such as the above-mentioned "4. NF Service Authorization Procedure"). For details, please refer to the existing technology and will not be repeated here.

[0526] Optionally, the service request message may further include at least one of the following: analysis identifier #3, or relevant parameters of VFL. For details, please refer to the relevant introduction in the aforementioned "S112a", which will not be repeated here.

[0527] After obtaining the access token, NWDAF may send a service request message to NEF#1 to request AF#1 to join the VFL group.

[0528] S1210: NEF#1 sends a VFL group joining request message to AF#1. Correspondingly, AF#1 receives the VFL group joining request message from NEF#1.

[0529] The VFL group request message can be used to request AF#1 to join the VFL group. The VFL group request message may include access token #1 and analysis identifier #3. For details, please refer to the above related introduction and will not be repeated here.

[0530] Optionally, the VFL group request message may further include relevant parameters of the VFL. For details, please refer to the aforementioned related introduction and will not be repeated here.

[0531] After receiving the service request message, NEF#1 can verify the signature of access token #2. The specific verification method can be referred to the existing technology and will not be repeated here. If NEF#1 verifies the signature of access token #2 and passes it, it can determine the AF that NWDAF requested to join the VFL group, namely AF#1, based on the AF#1 identifier carried in the service request message. It can also send other information carried in the service request message, except for access token #2 and AF#1 identifier, to AF#1 via a VFL group request message, so that AF#1 can verify the other information and decide whether to join the VFL group.

[0532] S1211, AF#1 verifies access token#1.

[0533] After receiving the VFL group join request, AF#1 can verify the signature of access token #1. The specific verification method can be referred to in the existing technology and will not be repeated here. AFF#1's successful verification of access token #1 indicates that the scope of the service requested by NWDAF is authorized, that is, the service meets AF#1's security requirements.

[0534] It is understood that when the VFL group join request message includes an analysis identifier, AF#1 can, after verifying the access token signature, obtain the analysis identifier in access token #1, i.e., analysis identifier #3, and verify whether the analysis identifier in access token #1 is consistent with the analysis identifier carried in the VFL group join request message. If they are consistent, the verification is successful. Furthermore, if the VFL group join request message also includes VFL-related parameters, AF#1 can determine the various NWDAF model training requirements based on the VFL-related parameters.

[0535] S1212: AF#1 sends a VFL group joining response message to NEF#1. Correspondingly, NEF#1 receives the VFL group joining response message from AF#1.

[0536] After AF#1 verifies access token #1 based on the VFL group request message and its local policy, it can decide whether to join the VFL group. For example, if AF#1's load exceeds the threshold, AF#1 will not join the VFL group. Alternatively, if AF#1's capabilities meet the requirements, AF#1 will join the VFL group.

[0537] After deciding to join the VFL group, AF#1 may send a VFL group response message to NEF#1 to indicate its decision to join the VFL group.

[0538] S1213, NEF#1 sends a service response message to NWDAF. Correspondingly, NWDAF receives the service response message from NEF#1.

[0539] After receiving the VFL group response message, NEF#1 can send information about AF#1's decision to join the VFL group to NWDAF via a service response message. After receiving the service response message, NWDAF can initiate vertical federated learning and interact with AF#1. For example, it can send VFL parameters such as training accuracy and model size to AF#1, or send models to AF#1.

[0540] In summary, according to the introduction of scenario 4, an AF located outside the network where the VFL server (i.e., NWDAF) is located can register its capabilities with the NEF when it has vertical federation capabilities. When the VFL server requests the AF to join the VFL group, the NEF can perform authorization verification and other services for the VFL server. The AF can verify the VFL server through the access token, that is, verify whether the VFL server is authorized to access the VFL service provided by the AF, and decide whether to join the VFL group if the verification is successful. In this way, the service authorization of the VFL server can be implemented for the AF located outside the network where the VFL server is located. It can also enable the AF located outside the network where the VFL server is located to join the VFL group, thereby enriching the data sources in the VFL group.

[0541] The communication method provided in the embodiment of the present application is described in detail above in conjunction with Figures 7 to 12. The communication device for executing the communication method provided in the embodiment of the present application is described in detail below in conjunction with Figures 13 and 14.

[0542] Figure 13 is a structural diagram of a communication device according to an embodiment of the present application. As shown in Figure 13, the communication device 1300 includes a transceiver module 1301 and a processing module 1302. For ease of illustration, Figure 13 only shows the main components of the communication device.

[0543] The transceiver module 1301 is used to perform the transceiver function of the method shown in FIG. 7 to FIG. 12 , and the processing module 1302 is used to perform other functions of the method shown in FIG. 7 to FIG. 12 except the transceiver function.

[0544] Optionally, the transceiver module 1301 may include a sending module (not shown in FIG13 ) and a receiving module (not shown in FIG13 ). The sending module is used to implement the sending function of the communication device 1300 , and the receiving module is used to implement the receiving function of the communication device 1300 .

[0545] Optionally, the communication device 1300 may further include a storage module (not shown in FIG. 13 ) storing a program or instruction. When the processing module 1302 executes the program or instruction, the communication device 1300 may perform the functions of the network device (e.g., VFL server, NEF, or AF, etc.) in the methods shown in FIG. 7 to FIG. 12 in the above-described method.

[0546] It can be understood that the communication device 1300 can be a network device, or a chip (system) or other parts or components that can be set in the network device, or a device that includes the network device, which is not limited in this application.

[0547] In addition, the technical effects of the communication device 1300 can refer to the technical effects of the communication method shown in Figures 7 to 12, and will not be repeated here.

[0548] Figure 14 is a second structural diagram of a communication device provided in an embodiment of the present application. Exemplarily, the communication device may be a terminal, or a chip (system) or other component or assembly that can be provided in a terminal. As shown in Figure 14, the communication device 1400 may include a processor 1401. Optionally, the communication device 1400 may further include a memory 1402 and / or a transceiver 1403. The processor 1401 is coupled to the memory 1402 and the transceiver 1403, such as by a communication bus.

[0549] The following is a detailed introduction to the various components of the communication device 1400 with reference to FIG14 :

[0550] The processor 1401 is the control center of the communication device 1400 and can be a single processor or a collective term for multiple processing elements. For example, the processor 1401 can be one or more central processing units (CPUs), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSPs) or one or more field programmable gate arrays (FPGAs).

[0551] Optionally, the processor 1401 may execute various functions of the communication device 1400 , such as executing the above-mentioned communication method, by running or executing a software program stored in the memory 1402 and calling data stored in the memory 1402 .

[0552] In a specific implementation, as an embodiment, the processor 1401 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG14 .

[0553] In a specific implementation, as an embodiment, the communication device 1400 may also include multiple processors, such as the processor 1401 and the processor 1404 shown in FIG14 . Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0554] The memory 1402 is used to store the software program for executing the solution of the present application, and the execution is controlled by the processor 1401. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0555] Alternatively, the memory 1402 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1402 may be integrated with the processor 1401 or exist independently and be coupled to the processor 1401 via an interface circuit (not shown in FIG. 14 ) of the communication device 1400, which is not specifically limited in this embodiment of the present application.

[0556] Transceiver 1403 is used for communication with other communication devices. For example, if communication device 1400 is a terminal, transceiver 1403 can be used to communicate with a network device or another terminal device. For another example, if communication device 1400 is a network device, transceiver 1403 can be used to communicate with a terminal or another network device.

[0557] Optionally, the transceiver 1403 may include a receiver and a transmitter (not shown separately in FIG14 ), wherein the receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0558] Optionally, the transceiver 1403 can be integrated with the processor 1401, or can exist independently and be coupled to the processor 1401 through the interface circuit of the communication device 1400 (not shown in Figure 14), which is not specifically limited in this embodiment of the present application.

[0559] It is understandable that the structure of the communication device 1400 shown in FIG14 does not constitute a limitation on the communication device, and an actual communication device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0560] In addition, the technical effects of the communication device 1400 can refer to the technical effects of the methods described in the above method embodiments, and will not be repeated here.

[0561] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0562] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0563] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (such as infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0564] It should be understood that the term "and / or" as used herein simply describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the associated objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0565] In this application, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0566] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0567] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0568] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0569] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0570] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0571] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0572] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0573] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: The method comprises: The network function exposure functional entity NEF receives a service request message from a first vertical federated learning VFL server, where the service request message includes information for indicating a first AF and an access token, where the first AF is the AF that the first VFL server requests to participate in a VFL group, where the VFL group includes a VFL client and a VFL server for participating in the model training, where the first AF is not a network element in the network where the first VFL server is located, and where the first AF has the capability of the VFL client. The access token is used to indicate that the first VFL server is authorized to access services provided by the first AF; In response to the service request message, the NEF verifies the access token, and if the access token passes the verification, triggers adding the first AF to the VFL group according to the information indicating the first AF.

2. The method according to claim 1, characterized in that The information used to indicate the first AF is an identifier of the first AF.

3. The method according to claim 1 or 2, characterized in that Before the NEF receives the service request message from the first VFL server, the method further includes: The NEF registers the vertical federation capability of the first AF with the network storage function NRF, where the vertical federation capability of the first AF is used to indicate that the first AF has a VFL client capability.

4. The method according to claim 3, characterized in that The NEF registers the vertical federation capability of the first AF with the NRF, including: In a case where the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF, the NEF registers the vertical federation capability of the first AF and the first vertical federation related parameters with the NRF.

5. The method according to claim 4, characterized in that In a case where the first AF initiates registration of the vertical federation capability of the first AF and the first vertical federation related parameters of the first AF, the NEF registering the vertical federation capability of the first AF and the first vertical federation related parameters with the NRF includes: The NEF receives a subscription message from the AF, where the subscription message is used to request registration of the vertical federation capability of the first AF and the first vertical federation related parameters; The NEF sends a network function NF configuration file update request message to the NRF according to the subscription message, where the NF configuration file update request message includes the vertical federation capability of the first AF and the first vertical federation related parameters.

6. The method according to claim 4 or 5, characterized in that The first vertical federation related parameters include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

7. The method according to any one of claims 1 to 6, characterized in that The NEF triggering, according to the information indicating the first AF, to add the first AF to the VFL group, including: The NEF sends a VFL group joining request message to the first AF according to the information used to indicate the first AF; The NEF receives a VFL group joining response message from the first AF; In response to the joining VFL group response message, the NEF sends the service response message to the first VFL server, where the service response message is used to instruct the first AF to join the VFL group.

8. The method according to any one of claims 1 to 7, characterized in that The access token includes the identifier of the first AF and a first analysis identifier, and the service request message includes a second analysis identifier, where the second analysis identifier is used to indicate the analysis service corresponding to the model training; The NEF verifies the access token, including: Determining, by the NEF, whether the identifier of the first AF in the access token matches the information indicating the first AF in the service request message; The NEF determines whether the first analysis identifier in the access token matches the second analysis identifier in the service request message; If the identifier of the first AF in the access token matches the information indicating the first AF in the service request message, and the first analysis identifier in the access token matches the second analysis identifier in the service request message, the NEF succeeds in verifying the access token; otherwise, the NEF fails in verifying the access token.

9. A communication method, characterized in that: The method comprises: When a first vertical federated learning VFL server needs to perform model training, the first VFL server obtains information indicating a first application function AF, where the first AF is an AF requested by the first VFL server to participate in a VFL group, the VFL group includes a VFL client and a VFL server for participating in the model training, the first AF is not a network element in a network where the first VFL server is located, and the first AF has capabilities of the VFL client; The first VFL server obtains an access token, where the access token is used to indicate that the first VFL server is authorized to access services provided by the first AF; The first VFL server sends a service request message to a network function openness function entity NEF, where the service request message includes the information used to indicate the first AF and the access token; The first VFL server receives the service response message from the NEF, where the service response message is used to instruct the first AF to join the VFL group.

10. The method according to claim 9, characterized in that The information used to indicate the first AF is an identifier of the first AF.

11. A communication method, characterized in that: The method comprises: The network function exposure functional entity NEF receives the service request message from the first vertical federated learning VFL server, where the service request message includes information of a first AF list and an access token, the information of the first AF list corresponds to the AF requested by the first VFL server to participate in a VFL group, the VFL group includes a VFL client and a VFL server for participating in the model training, each AF in at least one AF corresponding to the information of the first AF list is not a network element in the network where the first VFL server is located, and each AF in at least one AF corresponding to the information of the first AF list has the capability of the VFL client, and the access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information of the first AF list; In response to the service request message, the NEF verifies the access token and, if the access token passes the verification, triggers at least one AF corresponding to the information in the first AF list to be added to the VFL group according to the information in the first AF list.

12. The method according to claim 11, characterized in that The information of the first AF list is the enterprise identifier corresponding to the first AF list.

13. The method according to any one of claims 11 or 12, characterized in that Before the NEF receives the service request message from the first VFL server, the method further includes: The NEF registers the vertical federation capability corresponding to the information of the second AF list with the network storage function NRF, where the information of the second AF list includes the information of the first AF list, and the vertical federation capability corresponding to the information of the second AF list is used to indicate that each AF in at least one AF corresponding to the information of the second AF list has the capability of the VFL client.

14. The method according to claim 13, characterized in that The vertical federation capability corresponding to the second AF list information registered by the NEF to the NRF includes: The NEF registers the vertical federation capabilities corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list with the NRF, the vertical federation-related parameters corresponding to the information of the second AF list include the vertical federation-related parameters corresponding to the information of the first AF list, and the vertical federation-related parameters corresponding to the information of the first AF list are used to indicate the capabilities that each AF in at least one AF corresponding to the information of the first AF list requires the VFL server to have in the VFL.

15. The method according to claim 14, characterized in that The NEF registers, with the NRF, the vertical federation capability corresponding to the information of the second AF list and the vertical federation-related parameters corresponding to the information of the second AF list, including: The NEF sends a registration request message to the NRF, where the registration request message includes at least one of the following: information of the second AF list, vertical federation capability corresponding to the information of the second AF list, or vertical federation related parameters corresponding to the information of the second AF list.

16. The method according to any one of claims 13 to 15, characterized in that The information of the second AF list includes at least one enterprise identification.

17. The method according to any one of claims 14 to 16, characterized in that The vertical federation-related parameters corresponding to the information of the first AF list include at least one of the following: at least one first analysis identifier, at least one first interoperability identifier, secure sample alignment, end-to-end secure transmission, authorization time, model usage scope, long-term storage of intermediate model parameters, anonymization processing, or the scope of terminals served.

18. The method according to any one of claims 11 to 17, characterized in that The NEF triggering, according to the information of the first AF list, to add at least one AF corresponding to the information of the first AF list to the VFL group includes: The NEF determines, based on information of the first AF list, a first AF participating in the VFL group; The NEF sends a VFL group joining request message to the first AF; The NEF receives a VFL group joining response message from the first AF, where the VFL group joining response message is used to instruct the first AF to join the VFL group; In response to the join VFL group response message, the NEF sends the service response message to the first VFL server, where the service response message is used to instruct the first AF to join the VFL group.

19. A communication method, characterized in that: The method comprises: When a first vertical federated learning VFL server needs to perform model training, the first VFL server obtains information of a first application function AF list, where the information of the first AF list corresponds to an AF requested by the first VFL server to participate in a VFL group, where the VFL group includes a VFL client and a VFL server for participating in the model training, each AF in at least one AF corresponding to the information of the first AF list is not a network element in a network where the first VFL server is located, and each AF in at least one AF corresponding to the information of the first AF list has a capability of the VFL client; The first VFL server obtains an access token, where the access token is used to indicate that the first VFL server is authorized to access services provided by each AF corresponding to the information in the first AF list; The first VFL sends a service request message to a network function openness function entity NEF, where the service request message includes information about the first AF list and the access token; The first VFL server receives the service response message from the NEF, where the service response message is used to instruct the first AF to join the VFL group.

20. The method according to claim 19, characterized in that The information of the first AF list is the enterprise identifier corresponding to the first AF list.

21. A communication device, characterized in that: The apparatus comprises: a module for executing the method according to any one of claims 1-20.

22. A communication device, characterized in that: The communication device comprises: a processor; when the processor executes computer instructions, the communication device executes the method according to any one of claims 1 to 20.

23. A communication system, characterized in that: The communication system comprises: a NEF for executing the method according to any one of claims 1 to 8, and a first VFL server for executing the method according to claim 9 or 10; or, a NEF for executing the method according to any one of claims 11 to 18, and a first VFL server for executing the method according to claim 19 or 20.

24. A communication chip, characterized in that: The communication chip includes: a logic circuit and a communication interface, the logic circuit is used to execute computer instructions, and the communication interface is used for the communication chip to communicate with other devices or chips. When the logic circuit executes the computer instructions, the method described in any one of claims 1 to 20 is implemented.

25. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a computer program or instructions, which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 20.

26. A computer program product, characterized in that The computer program product includes a computer program or instructions, and when the computer program or instructions are executed by a communication device, the method according to any one of claims 1 to 20 is executed.

Images