Data exposure method and apparatus

Abstract

A data exposure method and apparatus. The method comprises: receiving a first message, wherein the first message is used for requesting authorization information of a terminal, and the first message comprises an identifier of the terminal, an identifier of a third-party data requester, and a data identifier; on the basis of the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, determining authorization information, wherein the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, and the configuration information of the terminal indicates that the terminal allows data collected by at least one third-party data requester; and sending the authorization information. In the method, by adding the configuration information of the terminal, the authorization information can be determined on the basis of the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal, that is, whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier can be determined, thereby preventing the data of the terminal from being directly exposed to the third-party data requester, and improving the security of data exposure.

Description

Data opening method and device

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202411098022.6, filed on August 9, 2024, and entitled "A data opening method and device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of communication, in particular to a data opening method and device. BACKGROUND

[0004] The terminal can deploy some artificial intelligence (AI) models, and can use air interface measurement data as model input, deduce model output by using the AI model, and assist the terminal or the network to perform some operations.

[0005] For example, the terminal can deploy an AI positioning model, which is used to infer a positioning intermediate result (such as a non-line of sight (NLOS) indication or a line of sight (LOS) indication) based on measurement data (such as channel impulse response (CIR) or channel power delay profile (PDP)) as model input. Further, the terminal can send the positioning intermediate result to a location management function (LMF) network element, and the LMF network element determines the position of the terminal based on the positioning intermediate result. In addition, the AI model deployed by the terminal can also be other models. For example, a channel state information (CSI) prediction model or a beam prediction model.

[0006] Currently, the terminal may not be able to train the AI model by itself due to computing power and other reasons, and generally an over the top (OTT) server or other device is responsible for training the AI model. The current terminal does not support opening data to a third party, so that the device responsible for training the AI model cannot obtain the data of the terminal. SUMMARY

[0007] The embodiments of the present application provide a data opening method and device to realize the terminal authorized opening of data to a third party.

[0008] In a first aspect, a data opening method is provided. The method can be applied to a first network element or a chip or module in the first network element. The first network element can be a unified data management network element. The method comprises: receiving a first message, the first message being used to request authorization information of a terminal, the first message comprising an identifier of the terminal, an identifier of a third-party data requester, and a data identifier, the data identifier being used to identify a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element; determining the authorization information according to the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identifier; the configuration information of the terminal being determined according to the identifier of the terminal, the configuration information of the terminal indicating data allowed to be collected by at least one third-party data requester, the at least one third-party data requester each being an untrusted application function network element; and sending the authorization information. The third-party data requester mainly refers to a network element deployed by a non-operator, for example, an application function network element corresponding to a third-party application.

[0009] By adding the configuration information of the terminal, the authorization information can be determined according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal, it is determined whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, and then data corresponding to the data identifier can be collected from the terminal after it is determined that the terminal allows the third-party data requester to collect data corresponding to the data identifier, or it is determined whether data corresponding to the data identifier is provided to the third-party data requester after the data corresponding to the data identifier is obtained according to the authorization information, which can avoid that data of the terminal is directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains expected data.

[0010] In a possible design, the configuration information of the terminal comprises one or more of the following: an identifier of the at least one third-party data requester allowed to collect data of the terminal; an identifier of a third-party data requester not allowed to collect data of the terminal; a type of data allowed to be collected by the at least one third-party data requester; and a type of data not allowed to be collected by the at least one third-party data requester.

[0011] In a possible design, the configuration information of the terminal further indicates that data of the terminal is allowed to be opened to the at least one third-party data requester.

[0012] In a possible design, the configuration information of the terminal further comprises data opening indication information, the data opening indication being used to indicate whether data of the terminal is allowed to be opened to the at least one third-party data requester.

[0013] In a possible design, the configuration information of the terminal further includes a data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; and the data processing indication is sent in a case where the third-party data requester is allowed to collect the data corresponding to the data identifier.

[0014] With the above design, the data of the terminal can be subjected to one or more data processing operations of data anonymization, data aggregation, and data normalization before being opened to the third-party data requester, through the data anonymization, the privacy security problem that sensitive information of a user is directly opened to the third-party can be avoided, through the data aggregation, data of a specific granularity, for example, data of a specific region or data of a specific time period, can be conveniently obtained, and through the data normalization, the data can be scaled to the same range, and the dimension difference between features can be eliminated.

[0015] In a second aspect, a data opening method is provided, which can be applied to a second network element or a chip or module in the second network element, the second network element can be a data processing function network element or a network capability exposure function network element, and the method includes the following steps: sending a first message, the first message being used to request authorization information of a terminal, the authorization information indicating whether the terminal allows a third-party data requester to collect data corresponding to a data identifier, the first message including an identifier of the terminal, an identifier of the third-party data requester, and the data identifier, the data identifier being used to identify a type of data requested by the third-party data requester, and the third-party data requester being an untrusted application function network element; receiving the authorization information,

[0016] With the above method, by requesting the authorization information, it can be determined whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier, and then the data corresponding to the data identifier can be collected from the terminal after it is determined that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, or the data corresponding to the data identifier can be provided to the third-party data requester according to the authorization information after the data corresponding to the data identifier is obtained, which can avoid the data of the terminal being directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0017] In a possible design, a data processing indication is received, where the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are to be performed on data of the terminal before the data of the terminal is opened to at least one third-party data requester; and the data processing operation indicated by the data processing indication is performed on the data corresponding to the data identifier, to obtain first data.

[0018] With the above design, the data of the terminal can be subjected to one or more data processing operations of data anonymization, data aggregation, and data normalization before being opened to the third-party data requester, through data anonymization, the privacy security problem that sensitive information of a user is directly opened to the third-party can be avoided, through data aggregation, data of a specific granularity, for example, data of a specific region or data of a specific time period, can be conveniently obtained, and through data normalization, the data can be scaled to the same range, and the dimension difference between features can be eliminated.

[0019] In a possible design, before the first message is sent, a subscription request message is received, where the subscription request message is used to request subscription of data of the terminal; the subscription request message includes an identifier of the third-party data requester and the data identifier; the subscription request message further includes an identifier of the terminal or region information, where the region information is used to determine the identifier of the terminal; and the first data is sent.

[0020] In a third aspect, a data opening method is provided, which can be applied to a first network element or a chip or module in the first network element. The first network element can be a unified data management network element. The method includes the following steps: receiving a first message, where the first message is used to request configuration information of a terminal, and the first message includes an identifier of the terminal; the configuration information of the terminal indicates data that is allowed to be collected by at least one third-party data requester; the at least one third-party data requester is all untrusted application function network elements; determining the configuration information of the terminal according to the identifier of the terminal; and sending the configuration information of the terminal.

[0021] In a possible design, the configuration information of the terminal includes one or more of the following: an identifier of the at least one third-party data requester that is allowed to collect data of the terminal; an identifier of a third-party data requester that is not allowed to collect data of the terminal; a type of data that is allowed to be collected by the at least one third-party data requester; and a type of data that is not allowed to be collected by the at least one third-party data requester.

[0022] In a possible design, the configuration information of the terminal further indicates that the data of the terminal is allowed to be opened to the at least one third-party data requester.

[0023] In a possible design, the configuration information of the terminal further includes data opening indication information, where the data opening indication information is used to indicate whether the data of the terminal is allowed to be opened to the at least one third-party data requester.

[0024] In a possible design, the configuration information of the terminal further includes data processing indication, where the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, data normalization are performed on the data of the terminal before the data of the terminal is opened to the at least one third-party data requester.

[0025] In a fourth aspect, a data opening method is provided, which can be applied to a second network element or a chip or module in the second network element, and the second network element can be a data processing function network element or a network capability exposure function network element. The method includes the following steps: sending a first message, where the first message is used to request configuration information of a terminal, the first message includes an identifier of the terminal, and the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, and the at least one third-party data requester is an untrusted application function network element; receiving the configuration information of the terminal; determining authorization information according to an identifier of a third-party data requester, a data identifier, and the configuration information of the terminal, the data identifier is used to identify a type of data requested by the third-party data requester, and the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, and the third-party data requester is an untrusted application function network element.

[0026] By using the method, whether the terminal allows the third-party data requester to collect data corresponding to the data identifier can be determined according to the configuration information of the terminal, and then data corresponding to the data identifier can be collected from the terminal after it is determined that the terminal allows the third-party data requester to collect data corresponding to the data identifier, or whether data corresponding to the data identifier is provided to the third-party data requester can be determined according to the authorization information after data corresponding to the data identifier is obtained, which can avoid that the data of the terminal is directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains expected data.

[0027] In a possible design, the configuration information of the terminal includes one or more of the following: an identifier of the at least one third-party data requester that is allowed to collect the data of the terminal; an identifier of a third-party data requester that is not allowed to collect the data of the terminal; a type of data that the at least one third-party data requester is allowed to collect; and a type of data that the at least one third-party data requester is not allowed to collect.

[0028] In a possible design, the configuration information of the terminal further indicates that data of the terminal is allowed to be opened to the at least one third-party data requester.

[0029] In a possible design, the configuration information of the terminal further includes data processing indication, where the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; and in a case where the third-party data requester is allowed to collect the data corresponding to the data identifier, the data processing operation indicated by the data processing indication is performed on the data corresponding to the data identifier, to obtain first data.

[0030] In a possible design, before the first message is sent, a subscription request message is received, where the subscription request message is used to request subscription of data of the terminal; the subscription request message includes the identifier of the third-party data requester and the data identifier; the subscription request message further includes the identifier of the terminal or region information used to determine the identifier of the terminal; and the first data is sent.

[0031] In a fifth aspect, a data opening method is provided, which is applied to a first network element or a chip or module in the first network element, and the first network element can be a network capability exposure function network element. The method includes the following steps: receiving a first subscription request message from a second network element, where the first subscription request message is used to request subscription of data of a terminal; the first subscription request message includes an identifier of a third-party data requester and a data identifier, where the data identifier is used to identify a type of data requested by the third-party data requester, and the third-party data requester is an untrusted application function network element; determining configuration information of the terminal according to an identifier of the terminal; the configuration information of the terminal indicates data of the terminal that is allowed to be collected by at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element; determining authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal, where the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier.

[0032] By using the method, whether the terminal allows the third-party data requester to collect data corresponding to the data identifier is determined according to the configuration information of the terminal, so that the data of the terminal can be prevented from being directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain expected collected data.

[0033] In a possible design, the first subscription request message further includes the identifier of the terminal or region information used to determine the identifier of the terminal.

[0034] In a possible design, a second subscription request message is sent to a third network element in a case where the third-party data requester is allowed to collect data corresponding to the data identifier, the second subscription request message including an identifier of the terminal, an identifier of the third-party data requester, and the data identifier.

[0035] In a possible design, the configuration information of the terminal further includes a data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; the data processing indication is sent to the third network element in a case where the third-party data requester is allowed to collect data corresponding to the data identifier; first data from the third network element is received, the first data being data corresponding to the data identifier and processed based on the data processing indication; and the first data is sent to the second network element.

[0036] In a sixth aspect, a data opening method is provided, which can be applied to a first network element or a chip or module in the first network element, and the first network element can be a unified data management network element. The method includes the following steps: receiving a first message, the first message being used to request subscription information of a terminal, and the first message including an identifier of the terminal; determining subscription information of the terminal according to the identifier of the terminal, the subscription information of the terminal including first indication information, the first indication information indicating at least one third-party data requester determined by the terminal to allow collection of data of the terminal and data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester each being an untrusted application function network element; and sending the first indication information.

[0037] In a possible design, the first indication information further indicates a data processing indication determined by the terminal; and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester.

[0038] In a seventh aspect, the present application provides a data opening method, which can be applied to a second network element or a chip or module in the second network element, the second network element can be a data processing function network element, and the method comprises the following steps: sending a first message, wherein the first message is used for requesting subscription information of a terminal, and the first message comprises an identifier of the terminal; receiving first indication information, wherein the subscription information of the terminal comprises the first indication information, the first indication information indicates at least one third-party data requester allowed to collect data of the terminal and data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester is all untrusted application function network elements; sending a data collection request according to the first indication information, wherein the data collection request is used for requesting data of the terminal, the data collection request comprises an identifier of a third-party data requester, a data identifier and an identifier of the terminal, the data identifier is used for identifying a type of data requested by the third-party data requester, and the third-party data requester is an untrusted application function network element; and receiving data corresponding to the data identifier or receiving second indication information, wherein the second indication information indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier.

[0039] In a possible design, the data processing indication is received, and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation and data normalization are performed on the data of the terminal before the data of the terminal is opened to the at least one third-party data requester; and the data processing operation indicated by the data processing indication is performed on the data corresponding to the data identifier, to obtain first data.

[0040] In a possible design, before the first message is sent, a subscription request message is received, and the subscription request message is used to request subscription of the data of the terminal; the subscription request message comprises the identifier of the third-party data requester and the data identifier; the subscription request message further comprises the identifier of the terminal or regional information, and the regional information is used to determine the identifier of the terminal; and the first data is sent.

[0041] In an eighth aspect, the present application provides a data opening method, which can be applied to a terminal or a chip or module in the terminal, and the method comprises the following steps: receiving a first request message, wherein the first request message is used to request data of the terminal, the first request message comprises an identifier of a third-party data requester and a data identifier, the third-party data requester is an untrusted application function network element, and the data identifier is used to identify a type of data requested by the third-party data requester; in a case where the third-party data requester is allowed to collect data corresponding to the data identifier, sending the data corresponding to the data identifier; or in a case where the third-party data requester is not allowed to collect the data corresponding to the data identifier, sending second indication information, wherein the second indication information indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier.

[0042] By using the above method, the terminal can autonomously determine whether to allow the third-party data requester to collect data corresponding to a data identifier, and after determining that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the terminal provides the data corresponding to the data identifier, thereby avoiding that data of the terminal is directly opened to the third-party data requester, improving the security of data opening, and ensuring that the third-party data requester obtains expected collected data.

[0043] In a possible design, in the case where the third-party data requester is allowed to collect the data corresponding to the data identifier, a data processing indication is sent, and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on the data of the terminal before the data of the terminal is opened to at least one third-party data requester.

[0044] In a possible design, whether to allow the third-party data requester to collect the data corresponding to the data identifier is determined according to the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, the configuration information of the terminal indicates data allowed to be collected by at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element.

[0045] In a ninth aspect, the present application provides a data opening method, which comprises: a first network element sending a first message to a second network element, the first message being used for requesting authorization information of a terminal, the first message comprising an identifier of the terminal, an identifier of a third-party data requester and a data identifier, the data identifier being used for identifying a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element; the second network element receiving the first message, determining the authorization information according to the identifier of the third-party data requester, the data identifier and configuration information of the terminal, the configuration information of the terminal being determined according to the identifier of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester each being an untrusted application function network element, the authorization information indicating whether the terminal allows the third-party data requester indicated by the first message to collect data corresponding to the data identifier; and the second network element sending the authorization information to the first network element. Through the above method, the data of the terminal can be prevented from being directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain the expected collected data.

[0046] In a tenth aspect, the present application provides a data opening method, which comprises: a first network element sending a first message to a second network element, the first message being used for requesting configuration information of a terminal, the first message comprising an identifier of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester each being an untrusted application function network element; the second network element receiving the first message, determining the configuration information of the terminal according to the identifier of the terminal, and sending the configuration information of the terminal to the first network element; the first network element receiving the configuration information of the terminal, and determining authorization information according to the identifier of the third-party data requester, a data identifier and the configuration information of the terminal, the data identifier being used for identifying a type of data requested by the third-party data requester, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, the third-party data requester being an untrusted application function network element. Through the above method, the data of the terminal can be prevented from being directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain the expected collected data.

[0047] In a eleventh aspect, the present application provides a data opening method, which comprises: a first network element sending a first message to a second network element, the first message being used for requesting subscription information of a terminal, and the first message comprising an identifier of the terminal; the second network element receiving the first message, determining the subscription information of the terminal according to the identifier of the terminal, the subscription information of the terminal comprising first indication information, the first indication information indicating at least one third-party data requester allowed to collect data of the terminal and the data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester each being an untrusted application function network element; the second network element sending the first indication information to the first network element; the first network element receiving the first indication information, and sending a data collection request to a third network element according to the first indication information, the data collection request being used for requesting data of the terminal, and the data collection request comprising an identifier of the third-party data requester, data identifier and the identifier of the terminal, the data identifier being used for identifying a type of data requested by the third-party data requester, and the third-party data requester being the untrusted application function network element; the third network element sending a first request message to the terminal, the first request message being used for requesting data of the terminal, and the first request message comprising the identifier of the third-party data requester, the data identifier, the third-party data requester being the untrusted application function network element, and the data identifier being used for identifying the type of data requested by the third-party data requester; and the terminal receiving the first request message, and sending data corresponding to the data identifier to the first network element through the third network element in a case that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, or sending second indication information to the first network element through the third network element in a case that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier, wherein the second indication information indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier.

[0048] In a twelfth aspect, the present application provides a communication apparatus, which can be a first apparatus, or a module or unit (for example, a chip, or a chip system, or a circuit) corresponding to the method / operation / step / action described in any one of the first aspect to the eighth aspect, or can be matched with the first apparatus.

[0049] In a thirteenth aspect, the present application provides a communication device, comprising at least one processing element, and at least one storage element for storing programs and data, wherein the at least one processing element is configured to read and execute the programs and data stored in the storage element, so that the method described in any one of the aspects of the present application is implemented.

[0050] In a possible design, the communication device further comprises the at least one storage element.

[0051] In a fourteenth aspect, the present application provides a computer program which, when running on a computer, causes the computer to perform the method of any one of the preceding aspects.

[0052] In a fifteenth aspect, the present application provides a communication apparatus, comprising: an interface circuit and at least one processor; the interface circuit is configured to provide input and / or output of a program or instructions for the at least one processor; the at least one processor is configured to execute the program or instructions to enable the communication apparatus to implement the method of any one of the preceding aspects.

[0053] In a possible implementation, the communication apparatus comprises the at least one memory configured to store the program or instructions.

[0054] In a sixteenth aspect, the present application provides a computer storage medium, which stores a software program, and the software program, when read and executed by one or more processors, enables the method of any one of the preceding aspects.

[0055] In a seventeenth aspect, the present application provides a computer program product comprising instructions which, when executed on a computer, cause the computer to perform the method of any one of the preceding aspects.

[0056] In an eighteenth aspect, the present application provides a chip system, comprising at least one chip and a memory, the at least one chip is configured to read and execute a program stored in the memory to implement the method of any one of the preceding aspects.

[0057] On the basis of the implementation provided in the above aspects, the present application can be further combined to provide more implementations. BRIEF DESCRIPTION OF DRAWINGS

[0058] FIG. 1 shows a schematic diagram of a 5G network architecture based on a service-oriented architecture;

[0059] FIG. 2 shows a flowchart of collecting UE application data by NWDAF through DCAF;

[0060] FIG. 3 shows a flowchart of one of the data exposure methods in the present application;

[0061] FIG. 4 shows a flowchart of another of the data exposure methods in the present application;

[0062] FIG. 5 shows a flowchart of a third of the data exposure methods in the present application;

[0063] FIG. 6 shows a flowchart of a fourth of the data exposure methods in the present application;

[0064] Figure 7 shows a fifth flow chart of a data opening method according to the present application;

[0065] Figure 8 shows a structural diagram of a communication device according to the present application;

[0066] Figure 9 shows a structural diagram of another communication device according to the present application. DETAILED DESCRIPTION

[0067] The specific implementation of the present application will be described below in conjunction with the accompanying drawings of the embodiments of the present application. However, the implementation of the present application can also include combining these embodiments without departing from the scope of the present application, such as using other embodiments and making structural changes. Therefore, the detailed description of the following embodiments should not be interpreted in a limiting sense. The terms used in the embodiment section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0068] The embodiments of the present application can be applied to various communication systems, such as global system for mobile communications (GSM) system, code division multiple access (CDMA) system, wideband code division multiple access (WCDMA) system, general packet radio service (GPRS), long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), worldwide interoperability for microwave access (WIMAX) communication system, 5th generation (5G) system or new radio (NR), or future communication system or other similar communication system, etc.

[0069] FIG. 1 is a schematic diagram of a 5G network architecture based on a service-based architecture. The 5G network architecture shown in FIG. 1 can include terminals, access network devices, and core network devices. The terminals access a data network (DN) through the access network devices and the core network devices. The core network devices include various network functions (NFs) or network elements, for example, including some or all of the following network elements: a unified data management (UDM) network element, a unified data repository (UDR) network element, an application function (AF) network element, a policy control function (PCF) network element, an access and mobility management function (AMF) network element, a session management function (SMF) network element, a user plane function (UPF) network element, a network repository function (NRF) network element, a network data analytics function (NWDAF) network element, a data handling function (DHF) network element, a network exposure function (NEF), and the like.

[0070] The access network device can be a radio access network (RAN) device. For example, a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next generation NodeB (gNB) in a 5G mobile communication system, a next generation base station in a future mobile communication system, or an access node in a wireless fidelity (WiFi) system, etc. The access network device can also be a module or unit that performs part of the functions of the access network device, for example, a central unit (CU) or a distributed unit (DU). The access network device can be a macro base station, a micro base station, or an indoor station, and can also be a relay node, a donor node, etc. The embodiments of the present application do not limit the specific technology and specific device form of the access network device.

[0071] The terminal can be a user equipment (UE), a mobile station, a mobile terminal, etc. The terminal can be widely used in various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, remote medical treatment, smart power grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a wearable device, a vehicle, an urban air vehicle (such as a pilotless plane, a helicopter, etc.), a ship, a robot, a mechanical arm, a smart home device, etc.

[0072] The access network device and the terminal can be fixed in position or movable. The access network device and the terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water surface; can also be deployed on aircraft, balloons, and artificial satellites in the air. The embodiments of the present application do not limit the application scenarios of the access network device and the terminal.

[0073] Some core network devices are briefly introduced below:

[0074] The AMF network element, referred to as AMF, includes functions such as performing mobility management, access authentication / authorization, etc. In addition, it is also responsible for delivering user policies between the terminal and the PCF.

[0075] SMF network element, referred to as SMF, contains functions of performing session management, execution of control policy issued by PCF, selection of UPF, terminal internet protocol (IP) address allocation, etc.

[0076] UPF network element, referred to as UPF, as an interface with a data network, contains functions of completing user plane data forwarding, session / stream level-based charging statistics, bandwidth limitation, etc.

[0077] UDM network element, referred to as UDM, UDM supports functions of terminal subscription data management, terminal context management, terminal authentication information management, and data exposure, etc.

[0078] UDR network element, referred to as UDR, contains functions of performing access of types of data such as subscription data, policy data, and application data.

[0079] NEF network element, referred to as NEF, is used for supporting opening of capabilities and events.

[0080] AF network element, referred to as AF, delivers application-side requirements for network side, for example, quality of service (QoS) requirements or user state event subscription, etc. AF can be a third-party functional entity or an application server deployed by an operator.

[0081] PCF network element, referred to as PCF, contains policy control functions responsible for charging, QoS bandwidth guarantee, and mobility management at session and service flow level, and terminal policy decision, etc.

[0082] NRF network element, referred to as NRF, can be used to provide network element discovery function, and provide network element information corresponding to a network element type based on a request of another network element. The NRF network element also provides network element management services such as network element registration, update, deregistration, and network element state subscription and push, etc.

[0083] DHF network element: collects data and performs data processing based on a request of a consumer NF (such as AF, NEF, NWDAF, etc.), and then opens the data. The DHF can be a separate network element, or a function / module which can be deployed in a network element such as NWDAF, data collection coordination function (DCCF), NEF, etc.

[0084] It can be understood that the above network element is an example of an implementation manner, and the application does not exclude that a network element or device having the function of the above network element exists in a future communication system or other similar communication system, has other names, or has other forms. In addition, the above network element or function can be a network element in a hardware device, or a software function running on a special hardware, or a virtualized function instantiated on a platform (for example, a cloud platform). As a possible implementation method, the above network element or function can be implemented by one device, or can be implemented by multiple devices together, or can be a functional module in one device, and the embodiments of the application do not make specific limitations thereto.

[0085] As shown in FIG. 2, a specific flowchart of UE application data collected by the NWDAF through a data collection application function (DCAF) network element is shown.

[0086] Exemplarily, the UE application data can include mobile features of the UE, such as the moving direction, route, speed, etc. of the UE, and can also include communication features of the UE, such as customer quality of experience (QoE) metric data, application (application) ID, etc.

[0087] S201: The NF sends a first subscription analysis request to the NWDAF.

[0088] The first subscription analysis request includes an analysis ID, analysis filtering information, and analysis report target. The analysis filtering information can include an area of interest (AoI) and / or an application ID known in the core network, and the analysis filter can also include other content. The analysis ID is used to identify the type of analysis result, for example, the analysis ID is UE mobility, indicating that the NF requests an analysis result of UE mobility, and the analysis ID is service experience, indicating that the NF requests an analysis result of service experience. The analysis filtering information is used to indicate the range to which the analysis result is directed, for example, the analysis filtering information includes an AoI, indicating that the NF requests an analysis result of the area corresponding to the AoI, and for another example, the analysis filtering information includes single network slice selection assistance information (S-NSSAI), indicating that the NF requests an analysis result of the slice corresponding to the S-NSSAI. The analysis report target is used to indicate the target to which the analysis result is directed, for example, the analysis includes a target of a UE ID, indicating that the NF requests an analysis result of the UE, and for another example, the analysis report target is any UE, indicating that the NF requests an analysis result of any UE. The any UE is any UE within the range defined by the analysis filtering information. For example, the analysis filtering information includes an AoI, and the analysis report target is any UE, and at this time, the any UE is any UE in the area corresponding to the AoI.

[0089] In addition, the NWDAF can also start data collection before receiving the first subscription analysis request.

[0090] S202: The NWDAF discovers and selects an AF that provides data collection.

[0091] For example, the NWDAF can determine the selected AF based on the AF information (AF profile) registered in the NRF and the first subscription analysis request.

[0092] The NWDAF can determine that data collection for model training / model inference is needed based on the first subscription analysis request, and then the NWDAF can determine which UE or UEs whose data are needed (i.e., determine the UE ID) and the purpose of data collection, for example, the purpose of data collection is model training. In addition, if the NF requests an analysis result of a specific UE, the first subscription analysis request can carry the UE ID. If the NF requests an analysis result of a group of UEs or an analysis result of any UE, the first subscription analysis request can carry a UE group ID or indicate any UE.

[0093] The NWDAF also needs to check the user consent information to determine whether the UE allows the network to collect its data. Illustratively, the NWDAF can query the user consent information from the UDM, and the user consent information can be stored in the UDM, for example, the UE subscription information in the UDM can include the user consent information. The user consent information includes the following two contents:

[0094] a) whether the user (i.e. the UE) authorizes the collection and use of its data for a specific data collection purpose.

[0095] b) the data collection purpose, for example, the data collection purpose can be data analysis or model training, etc.

[0096] Illustratively, before performing S203a or S203b, the NWDAF needs to first send a request message to the UDM, requesting the subscription information of the UE, the request message including the UE ID and the data collection purpose, the UDM can determine the subscription information of the UE according to the UE ID, wherein the subscription information of the UE includes the user consent information, and the UDM sends the subscription information of the UE to the NWDAF. The NWDAF determines whether to allow the collection of data of the UE based on the data collection purpose according to the user consent information, if allowed, the NWDAF can continue to perform S203a or S203b; otherwise, the NWDAF does not perform the following steps.

[0097] Wherein, in S202, the AF selected by the NWDAF can be a trusted AF or an untrusted AF, so there can be two branches of S203a and S203b, wherein S203a is applied to the NWDAF sending a second subscription analysis request to the trusted AF, and S203b is applied to the NWDAF sending a second subscription analysis request to the untrusted AF through the NEF. Wherein, the AF in FIG. 3 can represent a trusted AF or an untrusted AF.

[0098] S203a: the NWDAF sends a second subscription analysis request to the AF. Wherein, the second subscription analysis request is used to request UE application data, and the second subscription analysis request includes an application ID known in the core network, and the second subscription analysis request can also include other contents, which are not limited by the present application.

[0099] S203b: the NWDAF sends a second subscription analysis request to the AF through the NEF.

[0100] The specific contents included in the second subscription analysis request can refer to the related description in S203a above, which will not be repeated here.

[0101] S204: The AF associates the application ID known in the core network and the application ID provided by the UE application, and collects the UE application data from the UE.

[0102] The AF stores the association between the application ID known in the core network and the application ID provided by the UE application. The UE application data is the UE application data corresponding to the application ID provided by the UE application, and is also the UE application data corresponding to the application ID known in the core network.

[0103] S205a: The AF sends the collected UE application data to the NWDAF.

[0104] Exemplarily, the AF can process (for example, anonymize, aggregate, and normalize, etc.) the collected data according to (3) in the service level agreement (SLA) configuration in the AF. It can be understood that if the AF performs the above processing, the AF sends the collected UE application data to the NWDAF, and it can also be understood that the AF sends the processed UE application data to the NWDAF.

[0105] The content configured by the ASP for the AF can be referred to as SLA configuration. The SLA configuration can include the following content:

[0106] (1) The AF to which the UE application needs to be connected (for example, the UE connects to the AF based on the fully qualified domain name (FQDN));

[0107] (2) If the UE allows the AF to collect UE application data, the UE application can share information with the AF. That is, the UE application data that the AF can collect is determined by the SLA configuration configured by the ASP for the AF.

[0108] (3) Data anonymization, aggregation, or normalization algorithms that can be used.

[0109] (4) Authentication information that enables the AF to verify the authenticity of the UE application providing the data.

[0110] S205b: The AF sends the collected UE application data to the NWDAF through the NEF.

[0111] Exemplarily, the AF can process (for example, anonymize, aggregate, and normalize, etc.) the collected UE application data according to (3) in the configuration in the AF. It can be understood that, if the AF performs the above processing, the AF sends the collected UE application data to the NWDAF through the NEF, and it can also be understood that the AF sends the processed UE application data to the NWDAF through the NEF. It should be noted that the application service provider (ASP) can configure the AF and the UE respectively with application identification as granularity.

[0112] The content configured by the ASP for the UE can include the following content.

[0113] (1) The address of the AF that needs to interact.

[0114] (2) The parameter authorized by the UE application to provide to the AF. That is, the UE application data that the UE can provide to the AF is determined by the content configured by the ASP for the UE.

[0115] (3) The authentication information that enables the UE application to verify the authenticity of the AF that requests the data.

[0116] S206: The NWDAF generates an analysis report according to the obtained UE data.

[0117] S207: The NWDAF sends the analysis report to the NF.

[0118] As can be seen from the above process, the ASP configures the UE and the AF respectively, that is, the AF can collect the UE application data from the UE, that is, there is a limit to the UE application data that the AF can collect. However, the NWDAF only knows from the user consent information in the UDM whether to allow collecting the data of the UE based on a certain data collection purpose, and the user consent information does not limit which data can be collected in particular. Therefore, the data expected to be collected by the NWDAF may not be obtained by the AF from the UE, or the data obtained by the AF from the UE is not the data expected to be collected by the NWDAF. And the above process can only obtain the UE application data.

[0119] Based on this, in order to realize the data authorized to be opened to the third party by the terminal, the data opening method as shown in FIG. 3 to FIG. 7 is provided in the embodiments of the present application. For the convenience of description, in each of the following embodiments, the interaction between the untrusted application function network element (for example, AF), NEF, DHF, UDM, AMF and the like is taken as an example for description, and the above network elements can also be replaced by a communication device having a corresponding network element function, or a chip, unit or module inside the communication device having a corresponding function. The terminal can be referred to as a communication device. For example, the terminal can be understood as a device having a terminal function. For example, the device having a terminal function can be a terminal; or can be a device capable of supporting the terminal to realize the function, such as a chip system, a hardware circuit, a software module, or a hardware circuit plus a software module, which can be installed in the terminal or can be used in matching with the terminal.

[0120] Embodiment 1

[0121] The present application provides a data opening method, which comprises: a first network element sends a first message to a second network element, the first message is used to request authorization information of a terminal, the first message comprises an identifier of the terminal, an identifier of a third party data requester and a data identifier, the data identifier is used to identify a type of data requested by the third party data requester, and the third party data requester is an untrusted application function network element. The second network element receives the first message, determines the authorization information according to the identifier of the third party data requester, the data identifier and configuration information of the terminal, the configuration information of the terminal is determined according to the identifier of the terminal, the configuration information of the terminal indicates data allowed to be collected by at least one third party data requester, the at least one third party data requester is an untrusted application function network element, and the authorization information indicates whether the terminal allows the third party data requester indicated by the first message to collect data corresponding to the data identifier. The second network element sends the authorization information to the first network element. Through the above method, the first network element can request the authorization information from the second network element to determine whether the terminal allows the third party data requester to collect data corresponding to the data identifier. In the case where it is determined that the terminal allows the third party data requester to collect data corresponding to the data identifier, the third party data requester is provided with the data corresponding to the data identifier collected from the terminal, which can avoid the security problem caused by directly opening the data of the terminal to the third party data requester, and can ensure that the third party data requester obtains the expected collected data.

[0122] As shown in FIG. 3, based on the data opening method provided in the above embodiment 1, if the first network element is DHF and the second network element is UDM, the specific process of data opening is as follows:

[0123] S300, the DHF sends a first message to the UDM. Correspondingly, the UDM receives the first message from the DHF.

[0124] Exemplarily, before S300, the AF sends a first subscription request message to the NEF. The first subscription request message is used to request subscription of data of the terminal. After the NEF receives the first subscription request message from the AF, the NEF sends a second subscription request message to the DHF. The second subscription request message is used to request subscription of data of the terminal. After the DHF receives the second subscription request message from the NEF, the DHF sends a first message to the UDM.

[0125] The following describes each message involved in the above:

[0126] 1. The first subscription request message

[0127] Exemplarily, the AF can be a third-party data requestor. The third-party data requestor in the present application can also be referred to as an untrusted data requestor, for example, the third-party data requestor is an untrusted AF, or an ASP, or an application server, or a server for model training, etc. The untrusted AF can be a 3GPP network element, but is not a network element deployed by an operator network.

[0128] For example, the AF sends the first subscription request message to the NEF through an event-exposed subscription (Nnef_EventExposure_Subscribe) service operation.

[0129] Exemplarily, the first subscription request message includes an identifier of the third-party data requestor and a data identifier.

[0130] Exemplarily, the third-party data requestor can be the AF that sends the first subscription request message, and the AF can be an untrusted AF. For example, the identifier of the third-party data requestor can be an AF ID or an ASP ID. The following will be described only by taking the AF sending the first subscription request message to the NEF as an example.

[0131] The data identifier is used to identify the type of data requested by the third-party data requester, for example, the data identifier can be an event identifier (event ID), which is used to identify the type of event requested by the third-party data requester. For example, the event ID is CSI measurement, indicating that the third-party data requester requests CSI measurement data; for another example, the event ID is AI positioning measurement, indicating that the third-party data requester requests AI positioning related measurement data, such as UE position information, CIR, PDP, etc.; for another example, the event ID is beam measurement, indicating that the third-party data requester requests beam related measurement data, such as beam identifier (beam ID), reference signal received power (RSRP), etc.

[0132] In addition, the first subscription request message further includes an identifier of the terminal or area information. The identifier of the terminal can be a subscription permanent identity (SUPI). The area information can be used to determine the identifier of the terminal. The area information can be used to indicate the data of the terminal in the area indicated by the area information. For example, the area information can indicate an AoI, which can be represented by a group of tracking areas (TAs) or cells.

[0133] Optionally, the first subscription request message can further include a data collection purpose (or data use purpose), for example, the data collection purpose is model training, indicating that the data is collected for model training.

[0134] 2. Second subscription request message

[0135] The content included in the second subscription request message can be the same as the content included in the first subscription request message.

[0136] For example, the NEF sends the second subscription request message to the DHF through the event exposure notification (Ndhf_EventExposure_Notify) service operation.

[0137] 3. First message

[0138] The first message is used to request authorization information of the terminal, and the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, or the authorization information indicates whether the terminal allows the third-party data requester to open data corresponding to the data identifier. Optionally, the DHF needs to determine whether the terminal allows the third-party data requester to collect data corresponding to the data identifier before obtaining the data of the terminal. Or, after the DHF obtains the data of the terminal and before opening to the AF, it needs to determine whether the terminal allows the third-party data requester to collect data corresponding to the data identifier.

[0139] In addition, the authorization information can also be described as follows: the authorization information indicates whether the terminal supports opening data corresponding to the data identifier to the third-party data requester, or the authorization information indicates whether the terminal allows the third-party data requester to obtain data corresponding to the data identifier.

[0140] For example, the DHF sends the first message to the UDM through a request message (Nudm_SDM_Get Request) service operation for obtaining subscription data.

[0141] The first message includes the identifier of the terminal, the identifier of the third-party data requester, and the data identifier. Optionally, the first message can also include the data collection purpose. In addition, it can be understood that if the second subscription request message includes the identifier of the terminal, the identifier of the terminal in the first message is the identifier of the terminal carried by the second subscription request message. If the second subscription request message includes the area information, the DHF can first determine the identifier of the terminal included in the area indicated by the area information based on the area information (for example, it can be a SUPI list of the terminal in the area indicated by the area information).

[0142] S301, the UDM determines the authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal.

[0143] Exemplarily, the UDM first determines the configuration information of the terminal according to the identifier of the terminal. For example, the UDM determines the subscription information of the terminal according to the identifier of the terminal, the subscription information of the terminal includes the configuration information of the terminal, the configuration information of the terminal is part of the user consent information of the terminal, the configuration information of the terminal can also be called the data opening information of the terminal, or the configuration information of the terminal is the content newly added by the UDM, which is independent of the user consent information of the terminal.

[0144] The configuration information of the terminal indicates data allowed to be collected by the at least one third-party data requester. Alternatively, the configuration information of the terminal indicates the at least one third-party data requester allowed to collect data of the terminal, and data allowed to be collected by each third-party data requester. Alternatively, the configuration information of the terminal indicates data supported to be opened to the at least one third-party data requester. Illustratively, the at least one third-party data requester is an untrusted AF, or an ASP, or an application server, or a server for model training, etc. It can be understood that the data allowed to be opened to the third-party data requester can be existing data, or data collected upon request of the AF.

[0145] Illustratively, the configuration information of the terminal includes one or more of the following: identification of the at least one third-party data requester allowed to collect data of the terminal (hereinafter referred to as item A), identification of the third-party data requester not allowed to collect data of the terminal (hereinafter referred to as item B), type of data allowed to be collected by the at least one third-party data requester (hereinafter referred to as item C), and type of data not allowed to be collected by the at least one third-party data requester (hereinafter referred to as item D).

[0146] For example, the identification of the at least one third-party data requester allowed to collect data of the terminal can include a list of AF IDs or a list of ASP IDs. For example, the identification of the at least one third-party data requester allowed to collect data of the terminal includes AF1 ID and AF2 ID, indicating that AF1 and AF2 are allowed to collect data of the terminal. The identification of the third-party data requester not allowed to collect data of the terminal can include a list of AF IDs or a list of ASP IDs. For example, the identification of the third-party data requester not allowed to collect data of the terminal includes AF3 ID and AF4 ID, indicating that AFs other than AF3 and AF4 are allowed to collect data of the terminal.

[0147] The type of data allowed to be collected by the at least one third-party data requester can include a list of event IDs. For example, the list of events includes an identification of a first event, and the first event is a location report, indicating that location data is supported to be collected (or opened), or the first event is QoS monitoring, indicating that QoS monitoring related data such as uplink and downlink packet delay, data rate, and congestion, etc. is supported to be collected (or opened). Similarly, the type of data not allowed to be collected by the at least one third-party data requester can also include a list of event IDs.

[0148] The above is described in combination with Examples 1 to 4. It can be understood that the following examples are not limiting of the present application.

[0149] Example 1: The configuration information of UE1 includes the identification of at least one third-party data requestor allowed to collect data of UE1 and the event identification of data allowed to be collected by the at least one third-party data requestor. For example, the identification of at least one third-party data requestor allowed to collect data of UE1 includes AF1 ID and AF2 ID, and the event identification of data allowed to be collected by the at least one third-party data requestor includes Event ID1 and Event ID2, the configuration information of UE1 indicates that AF1 and AF2 are allowed to collect data corresponding to Event ID1 and Event ID2 respectively. Therefore, the data that is open to each of the at least one third-party data requestor can be the same.

[0150] In combination with Example 1, if the first message includes SUPI 1 (as the identification of UE1), AF1 ID and Event ID1, the UDM determines the configuration information of UE1 according to SUPI 1, and determines the authorization information according to AF1 ID, Event ID1 and the configuration information of UE1. As known from Example 1, the identification of at least one third-party data requestor allowed to collect data of UE1 includes AF1 ID, and the event identification of data allowed to be collected by the at least one third-party data requestor includes Event ID1. Therefore, the authorization information indicates that UE is allowed to collect data corresponding to Event ID1 by AF1.

[0151] In combination with Example 1, if the first message includes SUPI 1 (as the identification of UE1), AF1 ID and Event ID3, the UDM determines the configuration information of UE1 according to SUPI 1, and determines the authorization information according to AF1 ID, Event ID3 and the configuration information of UE1. As known from Example 1, the identification of at least one third-party data requestor allowed to collect data of UE1 includes AF1 ID, but the event identification of data allowed to be collected by the at least one third-party data requestor does not include Event ID3. Therefore, the authorization information indicates that UE is not allowed to collect data corresponding to Event ID3 by AF1.

[0152] If the first message includes SUPI 1 (as the identification of UE1), AF3 ID and Event ID2, the UDM determines the configuration information of UE1 according to SUPI 1, and determines the authorization information according to AF3 ID, Event ID2 and the configuration information of UE1. As known from Example 1, the identification of at least one third-party data requestor allowed to collect data of UE1 does not include AF1 ID, and the event identification of data allowed to be collected by the at least one third-party data requestor includes Event ID2. The authorization information indicates that UE is not allowed to collect data corresponding to Event ID2 by AF3.

[0153] Example 2: The configuration information of UE1 includes the identification of at least one third-party data requestor allowed to collect data of UE1 and the event identification of data allowed to be collected by the at least one third-party data requestor, for example, the identification of at least one third-party data requestor allowed to collect data of UE1 includes AF1 ID and AF2 ID, and the event identification of data allowed to be collected by the at least one third-party data requestor includes the Event ID corresponding to the data allowed to be collected by AF1 and the Event ID corresponding to the data allowed to be collected by AF2, for example, the Event ID corresponding to the data allowed to be collected by AF1 includes Event ID1, and the Event ID corresponding to the data allowed to be collected by AF2 includes Event ID3. The configuration information of UE1 indicates that AF1 is allowed to collect data corresponding to Event ID1, and AF2 is allowed to collect data corresponding to Event ID3. Therefore, the data that can be opened to each of the at least one third-party data requestor can be different.

[0154] Example 3: The configuration information of UE1 includes the identification of at least one third-party data requestor allowed to collect data of UE1 and the event identification of data not allowed to be collected by the at least one third-party data requestor, for example, the identification of at least one third-party data requestor allowed to collect data of UE1 includes AF1 ID and AF2 ID, and the event identification of data not allowed to be collected by the at least one third-party data requestor includes Event ID1 and Event ID2, then the configuration information of UE1 indicates that AF1 and AF2 are allowed to collect data except for the data corresponding to Event ID1 and Event ID2 respectively. Therefore, the data that can not be opened to each of the at least one third-party data requestor can be the same.

[0155] In Example 4, the configuration information of the UE1 includes the identification of the at least one third-party data requestor allowed to collect the data of the UE1 and the event identification of the data not allowed to be collected by the at least one third-party data requestor. For example, the identification of the at least one third-party data requestor allowed to collect the data of the UE1 includes the AF1 ID and the AF2 ID, and the event identification of the data not allowed to be collected by the at least one third-party data requestor includes the Event ID corresponding to the data not allowed to be collected by the AF1 and the Event ID corresponding to the data not allowed to be collected by the AF2. For example, the Event ID corresponding to the data not allowed to be collected by the AF1 includes the Event ID2, and the Event ID corresponding to the data not allowed to be collected by the AF2 includes the Event ID1. The configuration information of the UE1 indicates that the AF1 is allowed to collect the data except the data corresponding to the Event ID2, and the AF2 is allowed to collect the data except the data corresponding to the Event ID1. Therefore, the data that is not supported to be opened to each of the at least one third-party data requestor can be different.

[0156] In addition, in a possible design, the configuration information of the terminal further indicates that the data of the terminal is allowed to be opened to the at least one third-party data requestor. Alternatively, the configuration information of the terminal further indicates that the terminal supports to open the data to the at least one third-party data requestor.

[0157] Optionally, the configuration information of the terminal further includes a data opening indication, which is used to indicate whether the data of the terminal is allowed to be opened to the at least one third-party data requestor, or which is used to indicate whether the terminal supports to open the data to the at least one third-party data requestor. Alternatively, the data opening indication is used to indicate whether the terminal supports to open the data to the third-party data requestor, which is generic. It can also be understood that the at least one third-party data requestor mentioned in the data opening indication is not limited to a specific data requestor or data requestors. When the data opening indication indicates that the data of the terminal is allowed to be opened to the at least one third-party data requestor, it can be understood that there is at least one third-party data requestor, and the terminal can open the data of the terminal to these third-party data requestors.

[0158] It can be understood that if the configuration information of the terminal includes one or more of the above-mentioned A, B, C, or D, it indicates or implicitly indicates that the data of the terminal is allowed to be opened to the at least one third-party data requestor. Since the configuration information of the terminal includes one or more of the above-mentioned A, B, C, or D, according to the configuration information of the terminal, it can be determined which data type of the data of the terminal is allowed to be provided to which third-party data requestor, which indicates that the terminal allows the data of the terminal to be opened to the at least one third-party data requestor. At this time, the data opening indication can not be sent, and the data opening indication is optional information.

[0159] In a possible scenario, the configuration information of the terminal can only include the data opening indication, and the data opening indication indicates that the data of the terminal is not allowed to be opened to at least one third-party data requester, or the data opening indication indicates that the data of the terminal is not allowed to be opened to any third-party data requester. At this time, the UDM determines the authorization information according to the configuration of the terminal, and the authorization information indicates that the terminal does not allow the third-party data requester indicated by the first message to collect the data corresponding to the data identifier, or the terminal does not support opening data. Further, the DHF sends a first notification message to the NEF, and the first notification message indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier, or the terminal does not support opening data, or the subscription fails. The NEF sends a second notification message to the AF, and the content of the second notification message is the same as that of the first notification message.

[0160] In another possible scenario, the configuration information of the terminal can include the data opening indication, and one or more of the above A, B, C, or D, and the data opening indication indicates that the data of the terminal is allowed to be opened to at least one third-party data requester.

[0161] Optionally, the configuration information of the terminal can further include a data processing indication, and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on the data of the terminal before the data of the terminal is opened to the third-party data requester.

[0162] For example, the data anonymization can specifically include but is not limited to the following operations: pseudonymization, generalization, masking, scrambling, and the like. For example, pseudonymization refers to replacing a real identifier with a false identifier. Generalization refers to modifying fine-grained data into coarse-grained data, for example, modifying a house number into a street. Masking refers to replacing sensitive data with characters, for example, replacing a birth date with ** / ** / ****. Scrambling refers to shuffling data to rearrange, for example, rearranging the birth dates of different users, so that the birth date of each user in the data set is not his real birth date. Perturbation refers to adding random noise to modify the data set slightly, for example, adding random numerical values to age and house number.

[0163] The data aggregation can specifically include, but is not limited to, the following operations: aggregation according to a region granularity, aggregation according to a time granularity, and the like. For example, in the region granularity aggregation, the data can be initially arranged in a scattered manner, such as the first piece of data being data of cell 1, the second piece of data being data of cell 7, and the third piece of data being data of cell 1, and the like. The region granularity aggregation is to aggregate the data in the same region together, for example, to aggregate the data in cell 1 together, and can be labeled as cell 1, so that all the data in cell 1 can be directly obtained according to the label without going through the piece-by-piece screening. Similarly, the time granularity aggregation: the data can be aggregated according to the time granularity, for example, the data from 7 o'clock to 9 o'clock in the morning is aggregated together, and the like.

[0164] The following describes possible data processing operations in combination with examples a to d:

[0165] Example a: performing data processing according to the granularity of a third-party data requester, indicating that the data opened to the third-party data requester needs to perform the data processing operation. Different third-party data requesters can correspond to different data processing indications.

[0166] Example b: performing data processing according to the granularity of an Event ID, indicating that the data corresponding to the Event ID needs to perform the data processing operation. Different Event IDs can correspond to different data processing indications.

[0167] Example c: performing data processing according to the granularity of a parameter. For example, the data corresponding to an Event ID can include multiple parameters, such as the event being QoS monitoring, the parameters corresponding to the event including uplink and downlink packet delay, data rate, and congestion, and the like, and each of the parameters can be individually processed. For example, the event ID is AI positioning measurement, the parameters corresponding to the AI positioning measurement can include UE position information, and multiple position information of a UE can leak the real route information of the UE, so the real route information of the UE can be hidden by mixing the multiple position information; for example, the event ID is beam measurement, the parameters corresponding to the beam measurement include beam identifiers, and the real beam identifiers can be hidden by pseudonymization.

[0168] Example d: performing data processing in the granularity of a terminal or a terminal group (UE group). For example, if only the data of one terminal is collected, the data of the terminal cannot be anonymized (because the AF knows which terminal's data it collects), so the data of the terminal can be processed in the granularity of parameters, for example, the real route information of the terminal is concealed by shuffling, the real beam identifier is concealed by pseudonymization, etc. For another example, if the data of a terminal group or any terminal (any UE) is collected, the data of the terminals can be processed in the granularity of a terminal group or any terminal, for example, the terminal identifier (such as UE ID) in the terminal group is anonymized.

[0169] With the above design, the data of the terminal is processed by performing at least one data processing operation before being opened to the third-party requester, and the privacy security problem caused by directly opening the user sensitive information to the third party can be avoided by data anonymization. Through data aggregation, specific granularity data such as data of a specific area or data of a specific time period can be obtained conveniently, and through data normalization, the data can be scaled to the same range, eliminating the dimensional difference between features.

[0170] In a possible implementation, in a case where the authorization information indicates that the terminal allows the third-party data requester to collect data corresponding to the data identifier, the UDM sends the data processing indication to the DHF. Alternatively, the authorization information further includes the data processing indication. That is, the data processing indication can be carried by the same message as the authorization information or by different messages, and the data processing indication can be included in or outside the authorization message.

[0171] S302, the UDM sends authorization information to the DHF. Correspondingly, the DHF receives the authorization information from the UDM.

[0172] Exemplarily, the DHF sends the authorization information to the UDM through a service operation of a subscription data acquisition response message (Nudm_SDM_Get Response).

[0173] In addition, in combination with the embodiment shown in FIG. 2, the UDM can also determine whether to allow the data of the terminal to be collected based on the data collection purpose in the first message according to the user consent information, and feed back to the DHF.

[0174] As a possible implementation, the UDM sends authorization information to the DHF, or the authorization information and a user consent indication, wherein the authorization information includes 1 bit, which indicates 1, indicating that the terminal allows the third-party data requester to collect data corresponding to the data identifier, and which indicates 0, indicating that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier. The user consent indication can also include 1 bit, wherein the 1 bit indicates 1, indicating that the terminal allows data collection based on the data collection purpose in the first message, and the 1 bit indicates 0, indicating that the terminal does not allow data collection based on the data collection purpose in the first message.

[0175] In combination with Table 1, if the first message includes SUPI 1 (an identifier of UE1), AF1 ID, and Event ID1, the UDM determines Table 1 according to SUPI 1, and determines authorization information according to AF1 ID and Event ID1 and Table 1, wherein the authorization information indicates that UE1 allows AF1 to collect data corresponding to Event ID1. The UDM sends the authorization information and the data processing indication to the DHF. For example, the authorization information includes 1 bit, and the bit indicates 1.

[0176] In combination with Table 1, if the first message includes SUPI 1 (an identifier of UE1), AF1 ID, and Event ID4, and the data collection purpose is model training, the UDM determines Table 1 according to SUPI 1, and first judges whether to allow data of UE1 to be collected based on the purpose of model training according to the user consent information in Table 1, determines a user consent indication, wherein the user consent indication indicates that data of UE1 is allowed to be collected based on the purpose of model training. The UDM further judges whether to allow data of UE1 to be exposed to a third-party data requester according to the data exposure indication in Table 1, and if allowed, judges whether the identifier of at least one third-party data requester allowed to collect data of UE1 includes AF1 ID, and if so, further judges whether the event identifier of data allowed to be collected by the at least one third-party data requester includes Event ID4, and if not, determines authorization information, wherein the authorization information indicates that UE1 does not allow AF1 to collect data corresponding to Event ID4. The UDM sends the user consent indication and the authorization information to the DHF. For example, the user consent information includes 1 bit, which indicates 1, and the authorization information includes 1 bit, which indicates 0. Alternatively, since the authorization information indicates that UE1 does not allow AF1 to collect data corresponding to Event ID4, the UDM can not send the user consent indication.

[0177] As another possible implementation, the UDM sends authorization information to the DHF, the authorization information including 1 bit, the 1 bit indicating 1, indicating that the terminal allows the third-party data requester to collect data corresponding to the data identifier, and allows the terminal data to be collected based on the data collection purpose in the first message. The 1 bit indicates 0, indicating that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier, and / or does not allow the third-party data requester to collect the terminal data based on the data collection purpose in the first message.

[0178] In combination with Table 1, if the first message includes SUPI 1 (an identifier of UE1), AF1 ID, Event ID1, and the data collection purpose is model training, the UDM determines Table 1 according to SUPI 1, and first judges whether the UE1 data is allowed to be collected based on the model training purpose according to the user consent information in Table 1, if allowed, then judges whether the UE1 data is allowed to be opened to the third-party data requester according to the data opening indication in Table 1, if allowed, judges whether the identifier of at least one third-party data requester allowed to collect the UE1 data includes AF1 ID, if yes, further judges whether the event identifier of the data allowed to be collected by the at least one third-party data requester includes Event ID1, if yes, determines the authorization information, the authorization information indicating that the UE1 allows AF1 to collect data corresponding to Event ID1, and allows the UE1 data to be collected based on the model training purpose. The UDM sends the authorization information and the data processing indication to the DHF. For example, the authorization information includes 1 bit, and the bit indicates 1.

[0179] As another possible implementation, if the third-party data requester requests data corresponding to multiple data identifiers, and the terminal only allows the third-party data requester to collect data corresponding to part of the multiple data identifiers, the UDM sends authorization information to the DHF, the authorization information including data identifiers of data allowed to be collected by the terminal from the third-party data requester, or data identifiers of data not allowed to be collected by the terminal from the third-party data requester.

[0180] In combination with Table 1, if the first message includes SUPI 1 (an identifier of UE1), AF1 ID, Event ID1, Event ID4, and the data collection purpose is model training, the UDM determines Table 1 according to SUPI 1, and first determines whether the data of UE1 is allowed to be collected for the purpose of model training according to the user consent information in Table 1, determines the user consent indication, where the user consent indication indicates that the data of UE1 is allowed to be collected for the purpose of model training. The UDM further determines whether the data of UE1 is allowed to be exposed to the third-party data requestor according to the data exposure indication in Table 1, and if so, determines whether the identifier of at least one third-party data requestor allowed to collect the data of UE1 includes AF1 ID, and if so, further determines whether the event identifier of the data allowed to be collected by the at least one third-party data requestor includes Event ID1 and Event ID4. As can be seen from Table 1, the event identifier of the data allowed to be collected by the at least one third-party data requestor includes Event ID1 and Event ID2, and the authorization information is determined, where the authorization information indicates that UE1 allows AF1 to collect the data corresponding to Event ID1, but does not allow AF1 to collect the data corresponding to Event ID4. The UDM sends the user consent indication and the authorization information to the DHF. For example, the user consent information includes 1 bit, the 1 bit indicates 1, and the authorization information includes Event ID1.

[0181] For example, the subscription data of UE1 includes the content shown in Table 1, or the user consent information of UE1 includes the content.

[0182] Table 1

[0183] After S302, the DHF can perform the following two possible operations:

[0184] Possible operation 1: In the case where the authorization information indicates that the terminal allows the third-party data requestor to collect the data corresponding to the data identifier, the DHF acquires the data corresponding to the data identifier from the terminal.

[0185] For example, in the case where the terminal allows the third-party data requestor to collect the data corresponding to the data identifier, and allows the data of the terminal to be collected for the data collection purpose, the DHF acquires the data corresponding to the data identifier from the terminal.

[0186] It should be noted that the path of the DHF collecting the data is not limited in the present application. For example, the DHF can collect the data through the control plane, for example, the DHF collects the data corresponding to the data identifier from the terminal through the AMF, or the DHF can collect the data through the user plane, for example, the DHF collects the data corresponding to the data identifier from the terminal through the UPF.

[0187] Possible operation 2, if the DHF has obtained or has stored the data corresponding to the data identifier, it can not be necessary to obtain the data corresponding to the data identifier from the terminal again, and the DHF can determine whether to provide the data corresponding to the data identifier to the third-party data requester according to the authorization information.

[0188] Further, in combination with the above two possible operations, if the DHF also receives a data processing instruction, the DHF can perform the data processing operation indicated by the data processing instruction on the data corresponding to the data identifier according to the data processing instruction, to obtain the first data.

[0189] Exemplarily, in combination with the above first subscription request message and the second subscription request message, in the case where the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the DHF can also send the data corresponding to the data identifier to the NEF. Correspondingly, the NEF receives the data corresponding to the data identifier from the DHF. Exemplarily, the DHF sends the first data to the NEF. In addition, the NEF can also send the data corresponding to the data identifier to the AF. Correspondingly, the AF receives the data corresponding to the data identifier from the NEF. Exemplarily, the NEF sends the first data to the AF.

[0190] With the above embodiment shown in FIG. 3, by enhancing the subscription information of the terminal or adding new configuration information of the terminal, the DHF can request the authorization information from the UDM to determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier, and collect the data corresponding to the data identifier from the terminal after determining that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, or determine whether to provide the data corresponding to the data identifier to the third-party data requester according to the authorization information after obtaining the data corresponding to the data identifier, which can avoid the direct opening of the data of the terminal to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0191] As shown in FIG. 4, based on the data opening method provided in the above embodiment 1, if the first network element is the NEF and the second network element is the UDM, the specific process of data opening is as follows:

[0192] S400, the AF sends a first subscription request message to the NEF. Correspondingly, the NEF receives the first subscription request message from the AF.

[0193] For details, please refer to the related content of the first subscription request message in the above S300, which will not be described here.

[0194] S401, the NEF sends a first message to the UDM. Correspondingly, the UDM receives the first message from the NEF.

[0195] That is, before the NEF sends the second subscription request message to the DHF, that is, before S404, it needs to be determined whether the terminal allows the third-party data requester to collect data corresponding to the data identifier.

[0196] The related content of the first message can refer to S300 described above.

[0197] S402, the UDM determines the authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal.

[0198] For details, please refer to S301 described above, which will not be repeated here.

[0199] S403, the UDM sends the authorization information to the NEF. Correspondingly, the NEF receives the authorization information from the UDM.

[0200] For details, please refer to S302 described above, which will not be repeated here.

[0201] In addition, in the case where the authorization information indicates that the terminal allows the third-party data requester to collect data corresponding to the data identifier, the UDM also sends a data processing indication to the NEF.

[0202] S404, in the case where the authorization information indicates that the terminal allows the third-party data requester to collect data corresponding to the data identifier, the NEF sends a second subscription request message to the DHF. Correspondingly, the DHF receives the second subscription request message from the NEF.

[0203] In addition, in the case where the authorization information indicates that the terminal allows the third-party data requester to collect data corresponding to the data identifier, if the NEF receives the data processing indication from the UDM, the NEF sends the data processing indication to the DHF.

[0204] S405, the DHF obtains data corresponding to the data identifier from the terminal.

[0205] The application does not limit the path of the DHF collecting data. Illustratively, the DHF can collect data through the control plane, for example, the DHF collects data corresponding to the data identifier from the terminal through the AMF, or the DHF can collect data through the user plane, for example, the DHF collects data corresponding to the data identifier from the terminal through the UPF.

[0206] Alternatively, if the DHF has obtained or stored data corresponding to the data identifier, it can not be necessary to obtain data corresponding to the data identifier from the terminal again, and the DHF can determine whether to provide data corresponding to the data identifier to the third-party data requester according to the authorization information.

[0207] Further, if the DHF also receives the data processing indication, the DHF can perform the data processing operation indicated by the data processing indication on the data corresponding to the data identification according to the data processing indication, to obtain the first data.

[0208] S406. The DHF sends the data corresponding to the data identification to the NEF.

[0209] Exemplarily, the DHF sends the first data to the NEF.

[0210] S407. The NEF sends the data corresponding to the data identification to the AF.

[0211] Exemplarily, the NEF sends the first data to the AF.

[0212] The embodiment shown in FIG. 4 is different from the embodiment shown in FIG. 3 in that, before sending the second subscription request message to the DHF, the NEF can request authorization information from the UDM to determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identification. After determining that the terminal allows the third-party data requester to collect the data corresponding to the data identification, the NEF triggers the DHF to collect the data corresponding to the data identification from the terminal, which can avoid the data of the terminal being directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0213] Further, the DHF can also request the UDM to request authorization information from the AMF or the UPF, and after the AMF or the UPF obtains the authorization information, the AMF or the UPF determines whether to collect the data corresponding to the data identification from the terminal based on the authorization information. Alternatively, after the DHF obtains the authorization information, the DHF provides the authorization information to the AMF or the UPF, and the AMF or the UPF determines whether to collect the data corresponding to the data identification from the terminal based on the authorization information. In addition, the DHF or the AMF or the UPF performs at least one data processing operation on the collected data corresponding to the data identification according to the data processing indication. It can be understood that the process of the AMF or the UPF requesting the authorization information from the UDM is similar to the process of the DHF or the NEF requesting the authorization information from the UDM, which will not be described herein.

[0214] Embodiment 2:

[0215] The application provides a data opening method, which comprises the following steps: a first network element sends a first message to a second network element, the first message is used for requesting configuration information of a terminal, the second message comprises an identifier of the terminal, and the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, wherein the at least one third-party data requester is an untrusted application function network element. The second network element receives the first message, determines the configuration information of the terminal according to the identifier of the terminal, and sends the configuration information of the terminal to the first network element. The first network element receives the configuration information of the terminal, determines authorization information according to the identifier of the third-party data requester, a data identifier and the configuration information of the terminal, the data identifier is used for identifying the type of data requested by the third-party data requester, and the authorization information indicates whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier, wherein the third-party data requester is an untrusted application function network element. Through the above method, the data of the terminal can be prevented from being directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain the expected collected data.

[0216] As shown in FIG. 5, based on the data opening method provided in Embodiment 2, if the first network element is a DHF and the second network element is a UDM, the specific process of data opening is as follows:

[0217] S500, the AF sends a first subscription request message to the NEF. Correspondingly, the NEF receives the first subscription request message from the AF.

[0218] For details, reference can be made to the related content of the first subscription request message in S300, which will not be described here again.

[0219] S501, the NEF sends a second subscription request message to the DHF. Correspondingly, the DHF receives the second subscription request message from the NEF.

[0220] For details, reference can be made to the related content of the second subscription request message in S300, which will not be described here again.

[0221] S502, the DHF sends a first message to the UDM. Correspondingly, the UDM receives the first message from the DHF.

[0222] The first message is used for requesting configuration information of a terminal. That is to say, the DHF needs to obtain the configuration information of the terminal before obtaining the data of the terminal, that is, before S506, and then can determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier according to the configuration information of the terminal. Alternatively, after the DHF obtains the data of the terminal and before opening to the AF, it is necessary to determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier.

[0223] For example, the DHF sends a first message to the UDM through a Nudm_SDM_Get Request service operation. The first message includes the identity of the terminal. In addition, it can be understood that if the second subscription request message includes the identity of the terminal, the identity of the terminal in the first message is the identity of the terminal carried by the second subscription request message, and if the second subscription request message includes the area information, the DHF can first determine the identity of the terminal (for example, a SUPI list) included in the area indicated by the area information based on the area information.

[0224] S503, the UDM determines the configuration information of the terminal according to the identity of the terminal.

[0225] The configuration information of the terminal can refer to the related content in S301 described above.

[0226] S504, the UDM sends the configuration information of the terminal to the DHF. Correspondingly, the DHF receives the configuration information of the terminal from the UDM.

[0227] For example, the DHF sends the configuration information of the terminal to the UDM through a Nudm_SDM_Get Response service operation.

[0228] S505, the DHF determines the authorization information according to the identity of the third-party data requester, the data identity and the configuration information of the terminal.

[0229] For details, please refer to S301 described above, which will not be repeated here.

[0230] S506, in the case where the third-party data requester is allowed to collect data corresponding to the data identity, the DHF obtains the data corresponding to the data identity from the terminal.

[0231] S507, the DHF sends the data corresponding to the data identity to the NEF.

[0232] S508: the NEF sends the data corresponding to the data identity to the AF.

[0233] S506 to S508 can refer to S405 to S407 described above, which will not be repeated here.

[0234] With the above embodiment shown in FIG. 5, by enhancing the subscription information of the terminal or adding the configuration information of the terminal, the DHF can request the configuration information of the terminal from the UDM, and determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier according to the configuration information of the terminal. After the DHF determines that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the DHF collects the data corresponding to the data identifier from the terminal, or, after the DHF obtains the data of the terminal and before the data is opened to the AF, the DHF determines that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, and then provides the data to the AF. Therefore, the data of the terminal can be avoided to be directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain the expected collected data. At this time, the UDM can not need to determine the authorization information, and the processing logic of the UDM can be simplified.

[0235] In addition, in a possible implementation, the first network element can also be a NEF, and the second network element is a UDM, that is, the NEF can obtain the configuration information of the terminal from the UDM before sending the second subscription request message to the DHF, and determine the authorization information based on the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal. In the case where the third-party data requester is allowed to collect the data corresponding to the data identifier, the NEF sends the second subscription request message to the DHF.

[0236] Embodiment 3

[0237] The present application provides a data opening method, which comprises: a first network element receiving a first subscription request message from a second network element, the first subscription request message being used for requesting to subscribe to data of a terminal; the first subscription request message comprising an identifier of a third-party data requester and a data identifier, the data identifier being used for identifying a type of data requested by the third-party data requester, and the third-party data requester being an untrusted application function network element. The first network element determines configuration information of the terminal according to an identifier of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, and the at least one third-party data requester each being an untrusted application function network element. The first network element further determines authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identifier. With the above method, the first network element itself saves the configuration information of the terminal, and when receiving a subscription request message for the terminal, the first network element can determine authorization information of the terminal according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal in the subscription request message. Therefore, the data of the terminal can be avoided to be directly opened to the third-party data requester, the security of data opening is improved, and the third-party data requester can obtain the expected collected data.

[0238] As shown in FIG. 6, based on the data exposure method provided in Embodiment 3, if the first network element is an NEF and the second network element is an AF, the specific process of data exposure is as follows:

[0239] S600, the AF sends a first subscription request message to the NEF. Correspondingly, the NEF receives the first subscription request message from the AF.

[0240] For details, refer to the related content of the first subscription request message in S300 above, which will not be repeated here.

[0241] S601, the NEF determines authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal.

[0242] For example, the NEF first determines the configuration information of the terminal according to the identifier of the terminal. The configuration information of the terminal can be preconfigured in the NEF according to SLA information.

[0243] In addition, in combination with the embodiment shown in FIG. 2, before S601, the NEF can also query the user consent information from the UDM to know whether the data of the terminal is allowed to be collected based on the data collection purpose in the first subscription request message. If not, a rejection message can be sent to the AF, which is used to reject the data collection request of the AF.

[0244] For how the NEF determines authorization information according to the identifier of the third-party data requester, the data identifier, and the configuration information of the terminal, refer to S301 above.

[0245] S602, in the case where the third-party data requester is allowed to collect data corresponding to the data identifier, the NEF sends a second subscription request message to the DHF. Correspondingly, the DHF receives the second subscription request message from the NEF.

[0246] The second subscription request message includes the content of the first subscription request message, and in addition, the second subscription request message can also include data processing instructions.

[0247] S603, the DHF obtains data corresponding to the data identifier from the terminal.

[0248] S604, the DHF sends data corresponding to the data identifier to the NEF.

[0249] S605, the NEF sends data corresponding to the data identifier to the AF.

[0250] S603 to S605 can be specifically referred to S405 to 407 above, which will not be repeated here.

[0251] With the above embodiment shown in FIG. 6, through the SLA information or the configuration information of the new terminal, the NEF can save the configuration information of the terminal, and determine whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier according to the configuration information of the terminal. After determining that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the NEF triggers the DHF terminal to collect the data corresponding to the data identifier, which can avoid the data of the terminal being directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0252] Embodiment 4:

[0253] The present application provides a data opening method, which comprises: a first network element sends a first message to a second network element, the first message being used for requesting subscription information of a terminal, and the first message comprising an identifier of the terminal. The second network element receives the first message, and determines the subscription information of the terminal according to the identifier of the terminal, wherein the subscription information of the terminal comprises first indication information, and the first indication information indicates at least one third-party data requester allowed by the terminal to collect data of the terminal and the data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element. The second network element sends the first indication information to the first network element. The first network element receives the first indication information, and sends a data collection request to a third network element according to the first indication information, wherein the data collection request is used for requesting data of the terminal, and the data collection request comprises an identifier of the third-party data requester, a data identifier and the identifier of the terminal, the data identifier is used for identifying a type of data requested by the third-party data requester, and the third-party data requester is an untrusted application function network element. The third network element sends a first request message to the terminal, wherein the first request message is used for requesting data of the terminal, the first request message comprises the identifier of the third-party data requester, the data identifier, the third-party data requester is an untrusted application function network element, and the data identifier is used for identifying the type of data requested by the third-party data requester; and the terminal receives the first request message, and in a case where the third-party data requester is allowed to collect data corresponding to the data identifier, the terminal sends the data corresponding to the data identifier to the first network element through the third network element; or in a case where the third-party data requester is not allowed to collect the data corresponding to the data identifier, the terminal sends second indication information to the first network element through the third network element, wherein the second indication information indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier.

[0254] Through the method, the terminal can autonomously determine whether to allow the third-party data requester to collect the data corresponding to the data identifier, and after determining that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the terminal provides the data corresponding to the data identifier, which can avoid the data of the terminal being directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0255] As shown in FIG. 7, based on the data opening method provided in Embodiment 4, if the first network element is a DHF, the second network element is a UDM, and the third network element is an AMF, the specific process of data opening is as follows:

[0256] S700, the AF sends a first subscription request message to the NEF. Correspondingly, the NEF receives the first subscription request message from the AF.

[0257] For details, refer to the related content of the first subscription request message in S300.

[0258] S701, the NEF sends a second subscription request message to the DHF. Correspondingly, the DHF receives the second subscription request message from the NEF.

[0259] For details, refer to the related content of the second subscription request message in S300.

[0260] S702, the DHF sends a first message to the UDM. Correspondingly, the UDM receives the first message from the DHF.

[0261] The first message is used to request the subscription information of the terminal. The first message includes the identifier of the terminal. Optionally, the first message includes the data collection purpose. In addition, it can be understood that if the second subscription request message includes the identifier of the terminal, the identifier of the terminal in the first message is the identifier of the terminal carried by the second subscription request message, and if the second subscription request message includes the area information, the DHF can first determine the identifier of the terminal included in the area indicated by the area information based on the area information.

[0262] Exemplarily, the DHF sends the first message to the UDM through the Nudm_SDM_Get Request service operation.

[0263] S703, the UDM determines the subscription information of the terminal according to the identifier of the terminal, and the subscription information of the terminal includes first indication information.

[0264] Exemplarily, the first indication information can be newly added content in the subscription information of the terminal.

[0265] The first indication information is used to indicate that the authorization information is determined by the terminal.

[0266] The first indication information can further indicate one or more of at least one third-party data requester determined by the terminal to be allowed to collect data of the terminal, data allowed to be collected by the at least one third-party data requester, and data not allowed to be collected by the at least one third-party data requester.

[0267] Optionally, the first indication information further indicates a data processing indication determined by the terminal.

[0268] In addition, in combination with the embodiment shown in FIG. 2, the UDM can send a user consent indication to the DHF, the user consent indication indicating whether data of the terminal is allowed to be collected based on the data collection purpose in the first message. If not, a first rejection message indicating that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier, or the terminal does not support open data, or the subscription fails, can be directly sent to the NEF. The NEF sends a second rejection message to the AF, and the content of the second rejection message is the same as that of the first rejection message.

[0269] S704, the UDM sends first indication information to the DHF.

[0270] S705, the DHF sends a data collection request to the AMF.

[0271] Exemplarily, the DHF sends the data collection request to the AMF according to the first indication information.

[0272] Exemplarily, the DHF sends the data collection request to the AMF through a Namf_EventExposure_Subscribe service operation, the data collection request being used to request data of the terminal, and the data collection request including an identifier of the third-party data requester, a data identifier, and an identifier of the terminal. Optionally, the data collection request further includes a data collection purpose.

[0273] S706, the AMF sends a first request message to the terminal, the first request message including an identifier of the third-party data requester and a data identifier. Optionally, the first request message further includes a data collection purpose. The first request message is a non-access-stratum (NAS) message.

[0274] Exposure_Notify service operation to the DHF. Optionally, the AMF also sends the data processing indication to the DHF. The AMF or the DHF can perform a data processing operation on the obtained data corresponding to the data identifier according to the data processing indication, to obtain first data.

[0275] S707A, in the case that the third-party data requester is allowed to collect the data corresponding to the data identifier, the terminal sends the data corresponding to the data identifier to the DHF through the AMF.

[0276] Exposure_Notify service operation to the DHF. Optionally, the AMF also sends the data processing indication to the DHF. The AMF or the DHF can perform a data processing operation on the obtained data corresponding to the data identifier according to the data processing indication, to obtain first data.

[0277] Exposure_Notify service operation to the DHF. Optionally, the AMF also sends the data processing indication to the DHF. The AMF or the DHF can perform a data processing operation on the obtained data corresponding to the data identifier according to the data processing indication, to obtain first data.

[0278] S708A, the DHF sends the data corresponding to the data identifier to the NEF.

[0279] For example, the DHF sends the first data to the NEF.

[0280] S709A, the NEF sends the data corresponding to the data identifier to the AF.

[0281] For example, the NEF sends the first data to the AF.

[0282] S708A to S709A can be specifically referred to S406 to S407 described above, and will not be described here.

[0283] S707B, in the case that the third-party data requester is not allowed to collect the data corresponding to the data identifier, the terminal sends second indication information to the DHF through the AMF. The second indication information indicates that the third-party data requester is not allowed to collect the data corresponding to the data identifier.

[0284] Exposure_Notify service operation to the DHF.

[0285] S708B: The DHF sends a first notification message to the NEF, the first notification message indicating that the third-party data requester is not allowed to collect data corresponding to the data identifier, or the terminal does not support open data, or the subscription fails.

[0286] S709B: The NEF sends a second notification message to the AF, the content of the second notification message being the same as that of the first notification message.

[0287] With the above-mentioned embodiment shown in FIG. 7, the terminal can autonomously determine whether the third-party data requester is allowed to collect data corresponding to the data identifier, and after determining that the terminal allows the third-party data requester to collect data corresponding to the data identifier, the terminal provides the data corresponding to the data identifier to the DHF, which can avoid the data of the terminal being directly opened to the third-party data requester, improve the security of data opening, and ensure that the third-party data requester obtains the expected collected data.

[0288] It can be understood that, in order to implement the functions in the above-mentioned embodiments, each communication device (for example, UDM or DHF or terminal or NEF, etc.) includes a hardware structure and / or software module for performing each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in the present application, the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0289] FIGS. 8 and 9 are structural schematic diagrams of possible communication devices provided by the embodiments of the present application. These communication devices can be used to implement the functions of each communication device in the above-mentioned method embodiments, and thus can also achieve the beneficial effects possessed by the above-mentioned method embodiments.

[0290] As shown in FIG. 8, the communication device 800 includes a processing unit 810 and a transceiver unit 820.

[0291] When the communication device 800 is used to implement the functions of the UDM in the above-mentioned method embodiments, the processing unit 810 is configured to:

[0292] The transceiver 820 is configured to receive a first message, where the first message is used to request authorization information of a terminal, and the first message includes an identifier of the terminal, an identifier of a third-party data requester, and a data identifier, where the data identifier is used to identify a type of data requested by the third-party data requester; and the third-party data requester is an untrusted application function network element.

[0293] The processing unit 810 is configured to determine the authorization information according to the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, where the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier; and the configuration information of the terminal is determined according to the identifier of the terminal, and the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, where the at least one third-party data requester is an untrusted application function network element.

[0294] The transceiver 820 is configured to send the authorization information.

[0295] In a possible design, the configuration information of the terminal further includes a data processing indication, where the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester.

[0296] The transceiver 820 is configured to send the data processing indication in a case where the third-party data requester is allowed to collect data corresponding to the data identifier.

[0297] When the communication apparatus 800 is configured to implement the function of the UDM in the method embodiments, the transceiver 820 is configured to receive a first message, where the first message is used to request configuration information of a terminal, and the first message includes an identifier of the terminal, and the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, where the at least one third-party data requester is an untrusted application function network element.

[0298] The transceiver 820 is configured to receive a first message, where the first message is used to request authorization information of a terminal, and the first message includes an identifier of the terminal, an identifier of a third-party data requester, and a data identifier, where the data identifier is used to identify a type of data requested by the third-party data requester; and the third-party data requester is an untrusted application function network element.

[0299] The processing unit 810 is configured to determine the configuration information of the terminal according to the identifier of the terminal.

[0300] The transceiver 820 is configured to send the configuration information of the terminal.

[0301] When the communication apparatus 800 is configured to implement the function of the UDM in the method embodiments, the transceiver 820 is configured to receive a first message, where the first message is used to request configuration information of a terminal, and the first message includes an identifier of the terminal, and the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, where the at least one third-party data requester is an untrusted application function network element.

[0302] The processing unit 810 invokes the transceiver unit 820 to perform receiving a first message, the first message being used to request subscription information of a terminal, the first message comprising an identifier of the terminal; determining subscription information of the terminal according to the identifier of the terminal, the subscription information of the terminal comprising first indication information, the first indication information indicating at least one third-party data requestor determined by the terminal to allow collecting data of the terminal and data allowed to be collected by the at least one third-party data requestor, the at least one third-party data requestor each being an untrusted application function network element; and sending the first indication information.

[0303] In a possible design, the first indication information further indicates a data processing indication determined by the terminal; the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on the data of the terminal before the data of the terminal is opened to the at least one third-party data requestor.

[0304] When the communication apparatus 800 is used to implement the function of the DHF or the NEF in the method embodiments, the processing unit 810 is configured to:

[0305] The processing unit 810 invokes the transceiver unit 820 to perform sending a first message, the first message being used to request authorization information of a terminal, the first message comprising an identifier of the terminal, an identifier of a third-party data requestor, and a data identifier, the data identifier being used to identify a type of data requested by the third-party data requestor, the third-party data requestor being an untrusted application function network element; and receiving authorization information, the authorization information indicating whether the terminal allows the third-party data requestor to collect data corresponding to the data identifier.

[0306] In a possible design, the transceiver unit 820 is configured to receive a data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on the data of the terminal before the data of the terminal is opened to at least one third-party data requestor; and the processing unit 810 is configured to perform the data processing operation indicated by the data processing indication on the collected data corresponding to the data identifier, to obtain first data.

[0307] In a possible design, the transceiver unit 820 is configured to, before sending the first message, receive a subscription request message, the subscription request message being used to request subscription of data of the terminal; the subscription request message comprising the identifier of the third-party data requestor and the data identifier; the subscription request message further comprising the identifier of the terminal or regional information, the regional information being used to determine the identifier of the terminal; and the first data is sent.

[0308] When the communication apparatus 800 is configured to implement the functions of the DHF or the NEF in the above method embodiments, the following configuration is needed:

[0309] The transceiver 820 is configured to send a first message, the first message being used to request configuration information of a terminal, the first message comprising an identifier of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester each being an untrusted application function network element; and receive the configuration information of the terminal.

[0310] The processing unit 810 is configured to determine authorization information according to the identifier of the third-party data requester, a data identifier, and the configuration information of the terminal, the data identifier being used to identify a type of data requested by the third-party data requester, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identifier, the third-party data requester being an untrusted application function network element.

[0311] In a possible design, the configuration information of the terminal further comprises a data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; and the processing unit 810 is configured to, in a case where the third-party data requester is allowed to collect the data corresponding to the data identifier, perform a data processing operation indicated by the data processing indication on the collected data corresponding to the data identifier, to obtain first data.

[0312] In a possible design, the transceiver 820 is configured to, before sending the first message, receive a subscription request message, the subscription request message being used to request subscription of data of the terminal; the subscription request message comprising the identifier of the third-party data requester and the data identifier; the subscription request message further comprising the identifier of the terminal or area information, the area information being used to determine the identifier of the terminal; and send the first data.

[0313] When the communication apparatus 800 is configured to implement the functions of the DHF or the NEF in the above method embodiments, the following configuration is needed:

[0314] The transceiver 820 is configured to receive a first subscription request message from a second network element, the first subscription request message being used to request subscription of data of a terminal; the first subscription request message comprising an identifier of a third-party data requester and a data identifier, the data identifier being used to identify a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element.

[0315] The processing unit 810 is configured to determine configuration information of the terminal according to the identifier of the terminal; the configuration information of the terminal indicates data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester is an untrusted application function network element; determine authorization information according to the identifier of the third-party data requester, the data identifier and the configuration information of the terminal, the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identifier.

[0316] In a possible design, the transceiver 820 is configured to, in the case where the terminal allows the third-party data requester to collect the data corresponding to the data identifier, send a second subscription request message to a third network element, the second subscription request message including the identifier of the terminal, the identifier of the third-party data requester and the data identifier.

[0317] In a possible design, the configuration information of the terminal further includes a data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; in the case where the authorization information indicates that the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the transceiver 820 is configured to send the data processing indication to the third network element; receive first data from the third network element, the first data being data corresponding to the data identifier and processed based on the data processing indication; and send the first data to the second network element.

[0318] When the communication apparatus 800 is configured to implement the functions of the DHF or the NEF in the method embodiments described above, the following applies:

[0319] The processing unit 810 invokes the transceiver unit 820 to perform sending a first message, the first message being used to request subscription information of a terminal, the first message comprising an identifier of the terminal; receiving first indication information, the subscription information of the terminal comprising the first indication information, the first indication information indicating at least one third-party data requester determined by the terminal to allow collecting data of the terminal and data allowed to be collected by the at least one third-party data requester, the at least one third-party data requester each being an untrusted application function network element; sending a data collection request according to the first indication information, the data collection request being used to request data of the terminal, the data collection request comprising an identifier of a third-party data requester, a data identifier, and an identifier of the terminal, the data identifier being used to identify a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element; receiving data corresponding to the data identifier, or receiving second indication information, the second indication information indicating that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier.

[0320] In a possible design, the transceiver unit 820 is configured to receive data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are to be performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; and the processing unit 810 is configured to perform the data processing operation indicated by the data processing indication on the data corresponding to the data identifier received, to obtain first data.

[0321] In a possible design, the transceiver unit 820 is configured to, before sending the first message, receive a subscription request message, the subscription request message being used to request subscription of data of the terminal; the subscription request message comprising the identifier of the third-party data requester and the data identifier; the subscription request message further comprising the identifier of the terminal or regional information, the regional information being used to determine the identifier of the terminal; and the processing unit 810 is configured to send the first data.

[0322] When the communication apparatus 800 is configured to implement the functions of the terminal in the method embodiments, the transceiver unit 820 is configured to:

[0323] The processing unit 810 invokes the transceiver unit 820 to perform receiving a first request message, the first request message being used to request data of a terminal, the first request message comprising an identifier of a third-party data requester, the third-party data requester being an untrusted application function network element, and a data identifier, the data identifier being used to identify a type of data requested by the third-party data requester; in a case where the third-party data requester is allowed to collect data corresponding to the data identifier, sending the data corresponding to the data identifier; or in a case where the third-party data requester is not allowed to collect the data corresponding to the data identifier, sending second indication information, wherein the second indication information indicates that the terminal does not allow the third-party data requester to collect the data corresponding to the data identifier.

[0324] In a possible design, the transceiver unit 820 is configured to, in a case where the third-party data requester is allowed to collect the data corresponding to the data identifier, send data processing indication, the data processing indication being used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on the data of the terminal before the data of the terminal is opened to at least one third-party data requester.

[0325] In a possible design, the processing unit 810 is configured to determine, according to the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, whether the terminal allows the third-party data requester to collect the data corresponding to the data identifier, the configuration information of the terminal indicating data allowed to be collected by at least one third-party data requester, the at least one third-party data requester each being an untrusted application function network element.

[0326] For more details of the processing unit 810 and the transceiver unit 820, refer to the related description in the method embodiments.

[0327] As shown in FIG. 9, the communication apparatus 900 includes a processor 910 and an interface circuit 920. The processor 910 and the interface circuit 920 are coupled to each other. It can be understood that the interface circuit 920 can be a transceiver or an input / output interface. Optionally, the communication apparatus 900 further includes a memory 930, used to store instructions executed by the processor 910 or to store input data required by the processor 910 to run instructions or to store data generated after the processor 910 runs instructions.

[0328] When the communication apparatus 900 is used to implement the method embodiments, the processor 910 is configured to implement the functions of the processing unit 810, and the interface circuit 920 is configured to implement the functions of the transceiver unit 820.

[0329] It is to be understood that the processor in the embodiments of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0330] In the present application, another example of providing an apparatus is provided, the notification apparatus comprising at least one processor and at least one memory coupled to the at least one processor, the at least one memory for storing instructions that, when executed by the at least one processor, cause the communication apparatus to perform the method in the above embodiments. Taking the communication apparatus comprising one processor and one memory as an example, as shown in FIG. 9, the communication apparatus 900 comprises one processor 910 and one memory 930. The processor 910 and the memory 930 are coupled, and the memory 930 stores instructions, when the instructions stored in the memory 930 are executed by the processor 910, the communication apparatus 900 performs the method performed by each communication apparatus in the above embodiments.

[0331] The method steps in the embodiments of the present application can be implemented in hardware, or can be implemented in software instructions executable by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a CD-ROM or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. The storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in the terminal or the access network device described above. The processor and the storage medium can also exist as discrete components in the terminal or the access network device.

[0332] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments are performed. The computer can be a general purpose computer, a special purpose computer, a computer network, a network device, a user equipment or other programmable apparatus. The computer programs or instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer programs or instructions can be transferred from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape; or an optical medium, such as a digital video disc; or a semiconductor medium, such as a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0333] In various embodiments of the present application, the terms and / or descriptions of different embodiments are consistent and can be referred to each other if there is no special description and logical conflict. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0334] In the present application, "at least one" means one or more, and "multiple" means two or more. The association relationship between the associated objects is described, which means that there can be three kinds of relationships, for example, A and / or B, which can represent the following cases: A exists alone, A and B exist together, B exists alone, where A and B can be singular or plural. In the literal description of the present application, the character " / ", generally represents that the associated objects before and after are in an "or" relationship; in the formula of the present application, the character " / ", represents that the associated objects before and after are in a "division" relationship. "Including at least one of A, B and C" can mean: including A; including B; including C; including A and B; including A and C; including B and C; including A, B and C.

[0335] It can be understood that various numerical numbers involved in the embodiments of the present application are only distinguished for convenience of description, and do not limit the scope of the embodiments of the present application. The size of the serial number of the above processes does not mean the order of execution, and the execution order of the processes should be determined according to its function and inherent logic.

Claims

1. A data opening method characterized by comprising: The method comprises: receiving a first message, the first message being used for requesting authorization information of a terminal, the first message comprising an identity of the terminal, an identity of a third-party data requester and a data identity, the data identity being used for identifying a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element; determining the authorization information according to the identity of the third-party data requester, the data identity and configuration information of the terminal, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identity, the configuration information of the terminal being determined according to the identity of the terminal, the configuration information of the terminal being used for indicating data allowed to be collected by at least one third-party data requester, the at least one third-party data requester each being an untrusted application function network element; sending the authorization information.

2. The method of claim 1, wherein, The configuration information of the terminal comprises one or more of the following: identities of the at least one third-party data requester allowed to collect data of the terminal; identities of third-party data requesters not allowed to collect data of the terminal; types of data allowed to be collected by the at least one third-party data requester; types of data not allowed to be collected by the at least one third-party data requester.

3. The method of claim 1 or 2, wherein, The configuration information of the terminal further indicates that data of the terminal is allowed to be opened to the at least one third-party data requester.

4. The method of claim 3, wherein, The configuration information of the terminal further comprises data opening indication information, the data opening indication being used for indicating whether data of the terminal is allowed to be opened to the at least one third-party data requester.

5. The method according to any one of claims 1 to 4, wherein The configuration information of the terminal further comprises data processing indication, the data processing indication being used for indicating that one or more data processing operations of data anonymization, data aggregation and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; The method further comprises: in a case where the third-party data requester is allowed to collect data corresponding to the data identity, sending the data processing indication.

6. A data opening method characterized by comprising: The method comprises: sending a first message, the first message being used for requesting authorization information of a terminal, the authorization information indicating whether the terminal allows a third-party data requester to collect data corresponding to a data identity, the first message comprising an identity of the terminal, an identity of the third-party data requester and the data identity, the data identity being used for identifying a type of data requested by the third-party data requester, the third-party data requester being an untrusted application function network element; receiving the authorization information.

7. The method of claim 6, wherein, The method further comprises: receiving data processing indication, the data processing indication being used for indicating that one or more data processing operations of data anonymization, data aggregation and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; performing the data processing operation indicated by the data processing indication on data corresponding to the data identity, to obtain first data.

8. The method of claim 7, wherein, Before the first message is sent, the method further comprises: receiving a subscription request message, the subscription request message being used for requesting to subscribe to data of the terminal; the subscription request message comprising an identity of the third-party data requester and the data identity; the subscription request message further comprising an identity of the terminal or area information, the area information being used for determining the identity of the terminal; The method further comprises: sending the first data.

9. A data opening method characterized by comprising: The method comprises: receiving a first message, the first message being used for requesting configuration information of a terminal, the first message comprising an identity of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester each being an untrusted application function network element; determining the configuration information of the terminal according to the identity of the terminal; sending the configuration information of the terminal.

10. A data opening method characterized by comprising: The method comprises: sending a first message, the first message being used for requesting configuration information of a terminal, the first message comprising an identity of the terminal, the configuration information of the terminal indicating data that the terminal allows at least one third-party data requester to collect, the at least one third-party data requester each being an untrusted application function network element; receiving the configuration information of the terminal; determining authorization information according to the identity of the third-party data requester, the data identity, and the configuration information of the terminal, the data identity being used for identifying a type of data that the third-party data requester requests, the authorization information indicating whether the terminal allows the third-party data requester to collect data corresponding to the data identity, the third-party data requester being an untrusted application function network element.

11. The method of claim 10, wherein, The configuration information of the terminal further comprises data processing indication, the data processing indication being used for indicating that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; The method further comprises: in a case where the third-party data requester is allowed to collect data corresponding to the data identity, performing a data processing operation indicated by the data processing indication on the data corresponding to the data identity, to obtain first data.

12. The method of claim 11, wherein, Before sending the first message, the method further comprises: receiving a subscription request message, the subscription request message being used for requesting to subscribe to data of the terminal; the subscription request message comprising an identity of the third-party data requester and the data identity; the subscription request message further comprising an identity of the terminal or area information, the area information being used for determining the identity of the terminal; The method further comprises: sending the first data.

13. A data opening method characterized by comprising: The method comprises: receiving a first subscription request message from a second network element, the first subscription request message being used for requesting to subscribe to data of a terminal; the first subscription request message comprising an identity of a third-party data requester and a data identity, the data identity being used for identifying a type of data that the third-party data requester requests, the third-party data requester being an untrusted application function network element; determining configuration information of the terminal according to the identity of the terminal, wherein the configuration information of the terminal indicates data allowed to be collected by at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element; determining authorization information according to the identity of the third-party data requester, the data identity, and the configuration information of the terminal, wherein the authorization information indicates whether the terminal allows the third-party data requester to collect data corresponding to the data identity.

14. The method of claim 13, wherein, The first subscription request message further includes an identity of the terminal or area information, and the area information is used to determine the identity of the terminal.

15. The method of claim 13 or 14, wherein, Further comprising: In a case where the third-party data requester is allowed to collect data corresponding to the data identity, sending a second subscription request message to a third network element, wherein the second subscription request message includes the identity of the terminal, the identity of the third-party data requester, and the data identity.

16. The method of claim 15, wherein, The configuration information of the terminal further includes data processing indication, and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; The method further comprises: In a case where the third-party data requester is allowed to collect data corresponding to the data identity, sending the data processing indication to the third network element; receiving first data from the third network element, wherein the first data is data corresponding to the data identity and processed based on the data processing indication; sending the first data to the second network element.

17. A data opening method characterized by comprising: The method comprises: receiving a first message, wherein the first message is used to request subscription information of a terminal, and the first message includes an identity of the terminal; determining subscription information of the terminal according to the identity of the terminal, wherein the subscription information of the terminal includes first indication information, and the first indication information indicates at least one third-party data requester allowed to collect data of the terminal and data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element; sending the first indication information.

18. The method of claim 17, wherein, The first indication information further indicates data processing indication determined by the terminal, and the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester.

19. A data opening method characterized by comprising: The method comprises: sending a first message, wherein the first message is used to request subscription information of a terminal, and the first message includes an identity of the terminal; receiving the first indication information, wherein the subscription information of the terminal includes the first indication information, and the first indication information indicates at least one third-party data requester allowed to collect data of the terminal and data allowed to be collected by the at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element; According to the first indication information, a data collection request is sent, the data collection request is used to request data of the terminal, the data collection request includes an identifier of a third-party data requester, a data identifier, and an identifier of the terminal, the data identifier is used to identify a type of data requested by the third-party data requester, and the third-party data requester is an untrusted application function network element; Data corresponding to the data identifier is received, or second indication information is received, the second indication information indicates that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier.

20. The method of claim 19, wherein, Further comprising: A data processing indication is received, the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to the at least one third-party data requester; After receiving the data corresponding to the data identifier, further comprising: The data processing operation indicated by the data processing indication is performed on the data corresponding to the data identifier, and first data is obtained.

21. The method of claim 20, wherein, Before sending the first message, further comprising: A subscription request message is received, the subscription request message is used to request subscription of data of the terminal; the subscription request message includes the identifier of the third-party data requester and the data identifier; the subscription request message further includes an identifier of the terminal or region information, and the region information is used to determine the identifier of the terminal; The method further comprises: The first data is sent.

22. A data opening method characterized by comprising: The method comprises: A first request message is received, the first request message is used to request data of a terminal, the first request message includes an identifier of a third-party data requester and a data identifier, the third-party data requester is an untrusted application function network element, and the data identifier is used to identify a type of data requested by the third-party data requester; In a case where the third-party data requester is allowed to collect data corresponding to the data identifier, data corresponding to the data identifier is sent; or in a case where the third-party data requester is not allowed to collect data corresponding to the data identifier, second indication information is sent, and the second indication information indicates that the terminal does not allow the third-party data requester to collect data corresponding to the data identifier.

23. The method of claim 22, wherein, The method further comprises: In a case where the third-party data requester is allowed to collect data corresponding to the data identifier, a data processing indication is sent, the data processing indication is used to indicate that one or more data processing operations of data anonymization, data aggregation, and data normalization are performed on data of the terminal before the data of the terminal is opened to at least one third-party data requester.

24. The method of claim 22 or 23, wherein, Further comprising: Whether the third-party data requester is allowed to collect data corresponding to the data identifier is determined according to the identifier of the third-party data requester, the data identifier, and configuration information of the terminal, the configuration information of the terminal indicates data allowed to be collected by at least one third-party data requester, and the at least one third-party data requester is an untrusted application function network element.

25. A communications device, characterized by comprising means or modules for performing the method of any of claims 1 to 24.

26. A communications device, characterized by The communication device comprises at least one processor; the at least one processor is configured to perform the method of any of claims 1 to 24.

27. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a program or instructions, which when executed, cause the method of any of claims 1 to 24 to be performed.

28. A computer program product, characterised in that, The computer program product comprises a program or instructions, which when executed, cause the method of any of claims 1 to 24 to be performed.

Images