Information processing method, device, communication system, and storage medium

Abstract

Embodiments of the present disclosure provide an information processing method, a device, a communication system, and a storage medium. The information processing method is executed by a first device, and comprises: receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used for requesting a security mechanism for interaction between the second device and the third device; and sending a first response to the second device, wherein the first response is used for indicating the security mechanism for interaction between the second device and the third device.

Description

Information processing method, device, communication system and storage medium TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to an information processing method, device, communication system and storage medium. BACKGROUND

[0002] In the field of communication technology, a Common Application Program Interface (API) Framework (CAPIF) system is introduced. The CAPIF system can be used to authorize an API Invoker to access a communication system. However, in the CAPIF interconnection scenario, there is no clear solution for the identity verification process of the API Invoker.

[0003] SUMMARY

[0004] Embodiments of the present disclosure need to solve the problem that there is no mechanism to authenticate the identity of the API Invoker and negotiate the security mechanism in the CAPIF interconnection scenario.

[0005] According to a first aspect of embodiments of the present disclosure, an information processing method is provided, executed by a first device, comprising: receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; and sending a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0006] According to a second aspect of embodiments of the present disclosure, an information processing method is provided, executed by a first device, comprising: receiving a fourth message sent by a fourth device, wherein the fourth message comprises a second identifier, the second identifier is an identifier of the second device; the fourth message is used to request security information; and the security information is used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting the related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a Transport Layer Security (TLS) connection between the second device and the first device; and sending a fourth response to the fourth device, wherein the fourth response comprises the security information.

[0007] According to a third aspect of embodiments of the present disclosure, an information processing method is provided, performed by a fourth device, comprising: receiving a third message sent by a first device, wherein the third message comprises a first identifier, the first identifier being an identifier of a third device, and the third message being used to request a security mechanism for interaction between the second device and the third device; and sending a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

[0008] According to a fourth aspect of embodiments of the present disclosure, an information processing method is provided, performed by a fourth device, comprising: receiving a fifth message sent by a third device, wherein the fifth message comprises a second identifier, the second identifier being an identifier of a second device; and the fifth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; and sending a fifth response to the third device, wherein the fifth response comprises the security information.

[0009] According to a fifth aspect of embodiments of the present disclosure, an information processing method is provided, performed by a second device, comprising: sending a first message to a first device, wherein the first message comprises a first identifier, the first identifier being an identifier of a third device, and the first message being used to request a security mechanism for interaction between the second device and the third device; and receiving a first response sent by the first device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0010] According to a sixth aspect of embodiments of the present disclosure, an information processing method is provided, performed by a second device, comprising: sending a sixth message to a third device, wherein the sixth message comprises a second identifier, the second identifier being an identifier of the second device, and the sixth message being used to request to start an authentication process.

[0011] According to a seventh aspect of embodiments of the present disclosure, an information processing method is provided, performed by a third device, comprising: sending third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device, and wherein the third information is used for the first device to determine the security mechanism for interaction between the second device and the third device, or the third information is used for the fourth device to determine the security mechanism for interaction between the second device and the third device.

[0012] According to an eighth aspect of embodiments of the present disclosure, an information processing method is provided, performed by a third device, comprising: receiving a sixth message sent by a second device, wherein the sixth message comprises a second identifier, and the second identifier is an identifier of the second device; and the sixth message is used to request to start an authentication process.

[0013] According to a ninth aspect of embodiments of the present disclosure, an information processing method is provided. The method comprises: sending, by a second device, a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for an interaction between the second device and the third device; and sending, by the first device, a first response to the second device, wherein the first response is used to indicate the security mechanism for the interaction between the second device and the third device.

[0014] According to a tenth aspect of embodiments of the present disclosure, an information processing method is provided. The method comprises: sending, by a third device, a fifth message to a fourth device, wherein the fifth message comprises a second identifier, the second identifier is an identifier of a second device, and the fifth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device, verifying and / or protecting related authorization information of the second device, and establishing a TLS connection between the second device and the first device; and sending, by the fourth device, a fifth response to the third device, wherein the fifth response comprises the security information.

[0015] According to an eleventh aspect of embodiments of the present disclosure, a first device is provided. The first device comprises: a first transceiver configured to receive a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for an interaction between the second device and the third device; and the first transceiver is configured to send a first response to the second device, wherein the first response is used to indicate the security mechanism for the interaction between the second device and the third device.

[0016] According to a twelfth aspect of embodiments of the present disclosure, a first device is provided. The first device comprises: a first transceiver configured to receive a fourth message sent by a fourth device, wherein the fourth message comprises a second identifier, the second identifier is an identifier of a second device, and the fourth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device, verifying and / or protecting related authorization information of the second device, and establishing a TLS connection between the second device and the first device; and the first transceiver is configured to send a fourth response to the fourth device, wherein the fourth response comprises the security information.

[0017] According to a thirteenth aspect of the embodiments of the present disclosure, a fourth device is provided, comprising: a second transceiver configured to receive a third message sent by a first device, wherein the third message comprises a first identifier, the first identifier being an identifier of a third device, and the third message being used to request a security mechanism for interaction between the second device and the third device; and the second transceiver is configured to send a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

[0018] According to a fourteenth aspect of the embodiments of the present disclosure, a fourth device is provided, comprising: a second transceiver configured to receive a fifth message sent by a third device, wherein the fifth message comprises a second identifier, the second identifier being an identifier of the second device; and the fifth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; and the second transceiver is configured to send a fifth response to the third device, wherein the fifth response comprises the security information.

[0019] According to a fifteenth aspect of the embodiments of the present disclosure, a second device is provided, comprising: a third transceiver configured to send a first message to a first device, wherein the first message comprises a first identifier, the first identifier being an identifier of the third device, and the first message being used to request a security mechanism for interaction between the second device and the third device; and the third transceiver is configured to receive a first response sent by the first device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0020] According to a sixteenth aspect of the embodiments of the present disclosure, a second device is provided, comprising: a third transceiver configured to send a sixth message to a third device, wherein the sixth message comprises a second identifier, the second identifier being an identifier of the second device, and the sixth message being used to request to start an authentication procedure.

[0021] According to a seventeenth aspect of the embodiments of the present disclosure, a third device is provided, comprising: a fourth transceiver configured to send third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device, and the third information is used for the first device to determine the security mechanism for interaction between the second device and the third device, or the third information is used for the fourth device to determine the security mechanism for interaction between the second device and the third device.

[0022] According to an eighteenth aspect of the embodiments of the present disclosure, a third device is provided, comprising: a fourth transceiver configured to receive a sixth message sent by a second device, wherein the sixth message comprises a second identifier, and the second identifier is an identifier of the second device; and the sixth message is used to request to start an authentication procedure.

[0023] According to a nineteenth aspect of the present disclosure, a communication device is provided, including one or more processors; wherein the communication device is configured to execute optional implementations of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, and the tenth aspect.

[0024] According to a seventh aspect of the present disclosure, a communication system is provided, comprising: a first device, a fourth device, a second device, and a third device; wherein the first device is configured to perform a method as described in the first aspect, the second aspect, or an optional implementation of the first and second aspects; the fourth device is configured to perform a method as described in the third aspect, the fourth aspect, or an optional implementation of the third and fourth aspects; the second device is configured to perform a method as described in the fifth aspect, the sixth aspect, or an optional implementation of the fifth and sixth aspects; and the third device is configured to perform a method as described in the seventh aspect, the eighth aspect, or an optional implementation of the seventh and eighth aspects.

[0025] According to an eighth aspect of the present disclosure, a storage medium is provided that stores instructions, which, when executed on a communication device, cause the communication device to perform the method described in the optional implementations of the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, and tenth aspects.

[0026] According to a ninth aspect of the present disclosure, a computer program product is provided, comprising a computer program or instructions, which, when executed by a processor, implement the methods described in the optional implementations of the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, and tenth aspects.

[0027] The embodiments disclosed herein enable authentication and negotiation of security mechanisms for API callers in CAPIF interconnect scenarios. Attached Figure Description

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following describes the drawings required for the embodiments, and the following drawings are only some embodiments of the present disclosure, and do not specifically limit the protection scope of the present disclosure.

[0029] FIG. 1A is a structural schematic diagram of an information processing system according to an embodiment of the present disclosure.

[0030] FIG. 1B is a schematic diagram of CAPIF interconnection according to an embodiment of the present disclosure.

[0031] FIG. 2A is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0032] FIG. 2B is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0033] FIG. 3A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0034] FIG. 3B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0035] FIG. 3C is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0036] FIG. 3D is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0037] FIG. 4A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0038] FIG. 4B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0039] FIG. 4C is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0040] FIG. 4D is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0041] FIG. 4E is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0042] FIG. 5A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0043] FIG. 5B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0044] FIG. 6A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0045] FIG. 6B is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0046] FIG. 6C is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0047] FIG. 7A is an interaction diagram of an information processing method according to an embodiment of the present disclosure.

[0048] FIG. 7B is an interaction diagram of an information processing method according to an embodiment of the present disclosure.

[0049] FIG. 8A is a diagram illustrating an overview of a CAPIF interconnection related authentication mechanism according to an embodiment of the present disclosure.

[0050] FIG. 8B is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0051] FIG. 8C is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0052] FIG. 8D is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0053] FIG. 9A is a structural diagram of a first device according to an embodiment of the present disclosure.

[0054] FIG. 9B is a structural diagram of a second device according to an embodiment of the present disclosure.

[0055] FIG. 9C is a structural diagram of a third device according to an embodiment of the present disclosure.

[0056] FIG. 9D is a structural diagram of a fourth device according to an embodiment of the present disclosure.

[0057] FIG. 10A is a structural diagram of a communication device according to an embodiment of the present disclosure.

[0058] FIG. 10B is a structural diagram of a chip according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0059] Embodiments of the present disclosure provide an information processing method, device, communication system and storage medium.

[0060] In a first aspect, embodiments of the present disclosure provide an information processing method, performed by a first device, comprising: receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier being an identifier of a third device, and the first message being used to request a security mechanism for interaction between the second device and the third device; and sending a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0061] In the above embodiments, the security mechanism of the interaction between the second device and the third device can be determined. For example, the negotiation of the security mechanism in the CAPIF interconnection scenario can be implemented.

[0062] With reference to some embodiments of the first aspect, in some embodiments, the first message further comprises at least one of: first information, wherein the first information is used to indicate the security mechanism supported by the second device; service information, wherein the service information comprises at least one of: a service API, a resource, a service, and a service operation.

[0063] With reference to some embodiments of the first aspect, in some embodiments, the method further comprises: determining the security mechanism of the interaction between the second device and the third device based on information of at least one of: the first information; second information, wherein the second information is used to indicate the security mechanism supported by the first device; third information, wherein the third information is used to indicate the security mechanism supported by the third device; and service information.

[0064] With reference to some embodiments of the first aspect, in some embodiments, the method further comprises: in a case where it is determined that the third device is discovered by a fourth device or it is determined that the service information in the first message is discovered by the fourth device, sending, to the fourth device, a second message, wherein the second message comprises the first identifier, and the second message is used to request the third information; and receiving a second response sent by the fourth device, wherein the second response comprises the third information.

[0065] With reference to some embodiments of the first aspect, in some embodiments, the method further comprises: sending, to the fourth device, a third message, wherein the third message is used to request the security mechanism of the interaction between the second device and the third device; and receiving a third response sent by the fourth device, wherein the third response is used to indicate the security mechanism of the interaction between the second device and the third device.

[0066] With reference to some embodiments of the first aspect, in some embodiments, sending, to the fourth device, the third message comprises: in a case where it is determined that the third device is discovered by the fourth device or it is determined that the service information in the first message is discovered by the fourth device, sending, to the fourth device, the third message, wherein the third message comprises fourth information; and wherein the fourth information is used to indicate: the security mechanism commonly supported by the first device and the second device, or the security mechanism supported by the first device and / or the security mechanism supported by the second device.

[0067] In some embodiments of the first aspect, in some embodiments, the security mechanism comprises at least one of: a first security mechanism, wherein the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, wherein the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, wherein the third security mechanism is a TLS with OAuth token based mechanism; a fourth security mechanism, wherein the fourth security mechanism is an OAuth client credential flow based mechanism; a fifth security mechanism, wherein the fifth security mechanism is an authorization code flow based mechanism; a sixth security mechanism, wherein the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

[0068] In some embodiments of the first aspect, in some embodiments, the first device and the second device are in a first domain; the third device and the fourth device are in a second domain.

[0069] In a second aspect, the embodiments of the present disclosure provide an information processing method, executed by a first device, comprising: receiving a fourth message sent by a fourth device, wherein the fourth message comprises a second identifier, the second identifier being an identifier of a second device; the fourth message being used to request security information; the security information being used for at least one of: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; sending a fourth response to the fourth device, wherein the fourth response comprises the security information.

[0070] In the above embodiments, the security information for authenticating and / or protecting the identity of the second device, verifying and / or protecting the related authorization information of the second device, and establishing the TLS between the second device and the first device can be obtained. For example, it is beneficial to realize effective authentication of the identity of the second device in the CAPIF interconnection scenario.

[0071] In some embodiments of the second aspect, in some embodiments, the fourth message comprises a first identifier, the first identifier being an identifier of the third device, and the first identifier being used by the first device to return information related to the security information to the fourth device so that the fourth device sends the third device corresponding to the first identifier.

[0072] In some embodiments of the second aspect, in some embodiments, the security information comprises at least one of: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a certificate of the first device or a root certificate of a certificate of the second device.

[0073] In some embodiments of the second aspect, in some embodiments, the first device and the second device are in a first domain; the third device and the fourth device are in a second domain.

[0074] In a third aspect, the embodiments of the present disclosure provide an information processing method, executed by a fourth device, comprising: receiving a third message sent by a first device, wherein the third message comprises a first identifier, the first identifier is an identifier of a third device, and the third message is used to request a security mechanism for interaction between the second device and the third device; and sending a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

[0075] In some embodiments of the third aspect, in some embodiments, the third message is sent by the first device in a case that the first device determines that the third device is discovered by the fourth device or in a case that the first device determines that the service information in the first message is discovered by the fourth device, the first message being received by the first device from the second device; the third message comprises fourth information; and the fourth information is used to indicate a security mechanism supported by the first device and the second device jointly, or a security mechanism supported by the first device and / or a security mechanism supported by the second device.

[0076] In some embodiments of the third aspect, in some embodiments, the method further comprises: determining the security mechanism for interaction between the second device and the third device based on information of at least one of the following: the fourth information; the third information, wherein the third information is used to indicate a security mechanism supported by the third device, and the third information is obtained from the device; and the service information.

[0077] In some embodiments of the third aspect, in some embodiments, the method further comprises: receiving a second message sent by the first device, wherein the second message comprises the first identifier, and the second message is used to request the third information; and sending a second response to the first device, wherein the second response comprises the third information.

[0078] In some embodiments of the third aspect, in some embodiments, the security mechanism comprises at least one of the following: a first security mechanism, wherein the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, wherein the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, wherein the third security mechanism is a TLS based mechanism with OAuth token; a fourth security mechanism, wherein the fourth security mechanism is an OAuth client credential flow based mechanism; a fifth security mechanism, wherein the fifth security mechanism is an authorization code flow based mechanism; and a sixth security mechanism, wherein the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

[0079] In some embodiments of the third aspect, in some embodiments, the first device and the second device are in a first domain, and the third device and the fourth device are in a second domain.

[0080] In a fourth aspect, the embodiments of the present disclosure provide an information processing method, executed by a fourth device, comprising: receiving a fifth message sent by a third device, wherein the fifth message comprises a second identifier, the second identifier being an identifier of a second device; the fifth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and a first device; sending a fifth response to the third device, wherein the fifth response comprises the security information.

[0081] In some embodiments in combination with the fourth aspect, in some embodiments, the fifth message comprises at least one of the following: a first identifier, wherein the first identifier is an identifier of the third device, the first identifier being used for the fourth device to send the fifth response to the third device corresponding to the first identifier; a third identifier, wherein the third identifier is an identifier of the first device.

[0082] In some embodiments in combination with the fourth aspect, in some embodiments, the fifth message comprises the third identifier, and the method further comprises: based on the third identifier, sending a fourth message to the first device corresponding to the third identifier; wherein the fourth message comprises the second identifier, the second identifier being an identifier of the second device; the fourth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; receiving a fourth response sent by the first device.

[0083] In some embodiments in combination with the fourth aspect, in some embodiments, the fourth message comprises: a first identifier, the first identifier being an identifier of the third device, the first identifier being used for the first device to return information related to the security information to the fourth device, so that the fourth device sends to the third device corresponding to the first identifier.

[0084] In some embodiments in combination with the fourth aspect, in some embodiments, the security information comprises at least one of the following: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a root certificate of a certificate of the first device or a certificate of the second device.

[0085] In some embodiments in combination with the fourth aspect, in some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0086] In a fifth aspect, the embodiments of the present disclosure provide an information processing method, executed by a second device, comprising: sending a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; and receiving a first response sent by the first device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0087] In some embodiments of the fifth aspect, the first device and the second device are in a first domain, and the third device and the fourth device are in a second domain.

[0088] In a sixth aspect, the embodiments of the present disclosure provide an information processing method, executed by a second device, comprising: sending a sixth message to a third device, wherein the sixth message comprises a second identifier, the second identifier is an identifier of the second device, and the sixth message is used to request to start an authentication process.

[0089] In some embodiments of the sixth aspect, the sixth message comprises at least one of: a third identifier, wherein the third identifier is an identifier of a first device; and the first identifier, wherein the first identifier is an identifier of the third device.

[0090] In some embodiments of the sixth aspect, the first device and the second device are in a first domain, and the third device and a fourth device are in a second domain.

[0091] In a seventh aspect, the embodiments of the present disclosure provide an information processing method, executed by a third device, comprising: sending third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device, and the third information is used for a first device to determine a security mechanism for interaction between a second device and the third device, or the third information is used for the fourth device to determine the security mechanism for interaction between the second device and the third device.

[0092] In some embodiments of the seventh aspect, the sending of the third information to the fourth device comprises: sending the third information to the fourth device in a process in which the third device registers to the fourth device.

[0093] In some embodiments of the seventh aspect, the method further comprises: receiving a seventh message sent by the fourth device, wherein the seventh message is used to request the third information.

[0094] In some embodiments of the seventh aspect, the first device and the second device are in a first domain, and the third device and the fourth device are in a second domain.

[0095] In an eighth aspect, the embodiments of the present disclosure provide an information processing method, executed by a third device, comprising: receiving a sixth message sent by a second device, wherein the sixth message comprises a second identifier; the second identifier is an identifier of the second device; and the sixth message is used to request to start an authentication process.

[0096] In some embodiments in combination with the eighth aspect, in some embodiments, the sixth message comprises at least one of: a third identifier, wherein the third identifier is an identifier of the first device; and a first identifier, wherein the first identifier is an identifier of the third device.

[0097] In some embodiments in combination with the eighth aspect, in some embodiments, the method comprises: sending, to a fourth device, a fifth message, wherein the fifth message comprises the second identifier, the second identifier is an identifier of the second device, the fifth message is used to request security information; the security information is used for at least one of: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprises a token related to the second device; and establishing a TLS connection between the second device and the first device; and receiving a fifth response sent by the fourth device, wherein the fifth response comprises the security information.

[0098] In some embodiments in combination with the eighth aspect, in some embodiments, the fifth message comprises at least one of: the first identifier, wherein the first identifier is an identifier of the third device, the first identifier is used for the fourth device to send the fifth response to the third device corresponding to the first identifier; and the third identifier, wherein the third identifier is an identifier of the first device.

[0099] In some embodiments in combination with the eighth aspect, in some embodiments, the security information comprises at least one of: a key, wherein the key is generated by the first device; and a certificate, wherein the certificate is a root certificate that is a certificate of the first device or a certificate of the second device.

[0100] In some embodiments in combination with the eighth aspect, in some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0101] In a ninth aspect, the embodiments of the present disclosure provide an information processing method, comprising: a second device sending a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; and the first device sending a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0102] In a tenth aspect, the embodiments of the present disclosure provide an information processing method, including: a third device sending a fifth message to a fourth device, wherein the fifth message includes a second identifier, the second identifier being an identifier of a second device; the fifth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information including a token related to the second device; and establishing a TLS connection between the second device and the first device; and the fourth device sending a fifth response to the third device, wherein the fifth response includes the security information.

[0103] In an eleventh aspect, the embodiments of the present disclosure provide a first device, including: a first transceiver configured to receive a first message sent by a second device, wherein the first message includes a first identifier, the first identifier being an identifier of a third device, and the first message being used to request a security mechanism for interaction between the second device and the third device; and the first transceiver configured to send a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0104] In a twelfth aspect, the embodiments of the present disclosure provide a first device, including: a first transceiver configured to receive a fourth message sent by a fourth device, wherein the fourth message includes a second identifier, the second identifier being an identifier of a second device; the fourth message being used to request security information; and the security information being used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information including a token related to the second device; and establishing a TLS connection between the second device and the first device; and the first transceiver configured to send a fourth response to the fourth device, wherein the fourth response includes the security information.

[0105] In a thirteenth aspect, the embodiments of the present disclosure provide a fourth device, including: a second transceiver configured to receive a third message sent by a first device, wherein the third message includes a first identifier, the first identifier being an identifier of a third device, and the third message being used to request a security mechanism for interaction between a second device and the third device; and the second transceiver configured to send a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

[0106] In a fourteenth aspect, the embodiments of the present disclosure provide a fourth device, comprising: a second transceiver configured to receive a fifth message sent by a third device, wherein the fifth message comprises a second identifier, the second identifier being an identifier of the second device; the fifth message being used to request security information; the security information being used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; and the second transceiver is configured to send a fifth response to the third device, wherein the fifth response comprises the security information.

[0107] In a fifteenth aspect, the embodiments of the present disclosure provide a second device, comprising: a third transceiver configured to send a first message to a first device, wherein the first message comprises a first identifier, the first identifier being an identifier of the third device, and the first message being used to request a security mechanism for interaction between the second device and the third device; and the third transceiver is configured to receive a first response sent by the first device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0108] In a sixteenth aspect, the embodiments of the present disclosure provide a second device, comprising: a third transceiver configured to send a sixth message to a third device, wherein the sixth message comprises a second identifier, the second identifier being an identifier of the second device, and the sixth message being used to request to start an authentication process.

[0109] In a seventeenth aspect, the embodiments of the present disclosure provide a third device, comprising: a fourth transceiver configured to send third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device, and wherein the third information is used by the first device to determine the security mechanism for interaction between the second device and the third device, or the third information is used by the fourth device to determine the security mechanism for interaction between the second device and the third device.

[0110] In an eighteenth aspect, the embodiments of the present disclosure provide a third device, comprising: a fourth transceiver configured to receive a sixth message sent by a second device, wherein the sixth message comprises a second identifier; the second identifier being an identifier of the second device; and the sixth message being used to request to start an authentication process.

[0111] In a nineteenth aspect, the embodiments of the present disclosure provide a communication device, comprising one or more processors; wherein the communication device is configured to perform the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, and the tenth aspect.

[0112] In a twentieth aspect, the embodiments of the present disclosure provide a communication system, comprising: a first device, a fourth device, a second device and a fourth device; wherein the first device is configured to perform the method described in the first aspect, the second aspect, or the optional implementation manners of the first aspect and the second aspect; the fourth device is configured to perform the method described in the third aspect, the fourth aspect, or the optional implementation manners of the third aspect and the fourth aspect; the second device is configured to perform the method described in the fifth aspect, the sixth aspect, or the optional implementation manners of the fifth aspect and the sixth aspect; and the third device is configured to perform the method described in the seventh aspect, the eighth aspect, or the optional implementation manners of the seventh aspect and the eighth aspect.

[0113] In a twenty-first aspect, the embodiments of the present disclosure provide a storage medium, which stores instructions, when the instructions are run on a communication device, causing the communication device to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the optional implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect and the tenth aspect.

[0114] In a twenty-second aspect, the embodiments of the present disclosure provide a computer program product, which comprises a computer program or instructions, and the computer program or instructions are executed by a processor to implement the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the optional implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect and the tenth aspect.

[0115] In a twenty-third aspect, the embodiments of the present disclosure provide a computer program, when it is run on a computer, causing the computer to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the optional implementation manners of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect and the tenth aspect.

[0116] In a twenty-fourth aspect, the embodiments of the present disclosure provide a chip or chip system, which comprises processing circuitry configured to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, the tenth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, the seventh aspect, the eighth aspect, the ninth aspect, and the tenth aspect.

[0117] It can be understood that the above-mentioned devices (for example, the first device, the second device, the third device, the fourth device, and the like), the communication system, the storage medium, the program product, the computer program, the chip or the chip system are used to execute the method provided by the embodiments of the present disclosure. Therefore, the beneficial effects achieved thereby can refer to the beneficial effects in the corresponding method, which will not be described here again.

[0118] The embodiments of the present disclosure provide an information processing method, device, communication system, and storage medium. In some embodiments, the information processing method and the information processing method can be replaced with each other, the information processing device and the communication device can be replaced with each other, and the information processing system and the communication system can be replaced with each other.

[0119] The embodiments of the present disclosure are not exhaustive, but only illustrate some embodiments, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, each step in an embodiment can be implemented as an independent embodiment, and the steps can be combined arbitrarily, for example, the scheme after removing some steps in an embodiment can also be implemented as an independent embodiment, and the order of the steps in an embodiment can be exchanged arbitrarily, in addition, the optional implementation in an embodiment can be combined arbitrarily; in addition, the embodiments can be combined arbitrarily, for example, the steps of different embodiments or part or all of the steps of different embodiments can be combined arbitrarily, and an embodiment can be combined with the optional implementation of other embodiments.

[0120] In the embodiments of the present disclosure, the terms and / or descriptions between the embodiments are consistent and can be used with each other if there is no special description and logical conflict, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0121] The terms used in the embodiments of the present disclosure are only for the purpose of describing the specific embodiments, and not as a limitation on the present disclosure.

[0122] In the embodiments of the present disclosure, an element expressed in singular form, such as "a", "an", "the", "said", "the aforementioned", "the foregoing", "this", and the like, unless otherwise specified, can represent "one and only one", or can represent "one or more", "at least one", and the like. For example, in the case of using an article such as "a", "an", "the" in English, the noun after the article can be understood as a singular expression, or can be understood as a plural expression.

[0123] In the embodiments of the present disclosure, "plurality" refers to two or more.

[0124] In some embodiments, the terms "at least one of", "one or more", "a plurality of", "multiple", and the like can be replaced with each other.

[0125] In some embodiments, the description manner such as "at least one of A, B", "A and / or B", "A in one case and B in another case", "responding to a case A, responding to another case B", and the like can include the following technical solutions according to the case: A is executed in some embodiments (A is executed regardless of B); B is executed in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected to be executed); A and B are executed in some embodiments (A and B are both executed). When there are more branches such as A, B, C, and the like, it is similar to the above.

[0126] In some embodiments, the description manner such as "A or B" and the like can include the following technical solutions according to the case: A is executed in some embodiments (A is executed regardless of B); B is executed in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected to be executed). When there are more branches such as A, B, C, and the like, it is similar to the above.

[0127] The prefix words of "first", "second" and the like in the embodiments of the present disclosure are only used to distinguish different description objects, and do not constitute limitation on the position, order, priority, quantity or content of the description objects. The description of the description objects should refer to the description in the context of the claims or embodiments, and should not constitute redundant limitation because of the use of the prefix words. For example, the description object is "field", and the ordinal words before "field" in "first field" and "second field" do not limit the position or order between "fields". "First" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of "first field" and "second field". For another example, the description object is "level", and the ordinal words before "level" in "first level" and "second level" do not limit the priority between "levels". For another example, the quantity of the description object is not limited by the ordinal words, and can be one or more. For example, "first device", where the quantity of "device" can be one or more. In addition, the objects modified by different prefix words can be the same or different. For example, the description object is "device", and "first device" and "second device" can be the same device or different devices, and their types can be the same or different. For another example, the description object is "information", and "first information" and "second information" can be the same information or different information, and their contents can be the same or different.

[0128] In some embodiments, "including A", "containing A", "for indicating A", "carrying A" can be interpreted as directly carrying A, or indirectly indicating A.

[0129] In some embodiments, the terms "in response to", "in response to determining", "in the case of", "when", "when", "if", "if" and the like can be replaced with each other.

[0130] In some embodiments, the terms "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", "above" and the like can be replaced with each other, and the terms "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", "below" and the like can be replaced with each other.

[0131] In some embodiments, an apparatus or the like can be interpreted as an entity, and can also be interpreted as virtual, and the name thereof is not limited to the name described in the embodiments, and the terms "apparatus", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", "subject" and the like can be replaced with each other.

[0132] In some embodiments, a "network" can be interpreted as an apparatus (for example, an access network device, a core network device, and the like) included in the network.

[0133] In some embodiments, the terms "access network device (AN device)", "radio access network device (RAN device)", "base station (BS)", "radio base station", "fixed station", "node", "access point", "transmission point (TP)", "reception point (RP)", "transmission / reception point (TRP)", "panel", "antenna panel", "antenna array", "cell", "macro cell", "small cell", "femto cell", "pico cell", "sector", "cell group", "carrier", "component carrier", "bandwidth part (BWP)" and the like can be replaced with each other.

[0134] In some embodiments, the terms "terminal," "terminal device," "user equipment (UE)," "user terminal," "mobile station (MS)," "mobile terminal (MT)," "subscriber station," "mobile unit," "subscriber unit," "wireless unit," "remote unit," "mobile device," "wireless device," "wireless communication device," "remote device," "mobile subscriber station," "access terminal," "mobile terminal," "wireless terminal," "remote terminal," "handset," "user agent," "mobile client," "client," and so on can be replaced with each other.

[0135] In some embodiments, an access network device, a core network device, or a network device can be replaced with a terminal. For example, for a structure in which communication between an access network device, a core network device, or a network device and a terminal is replaced with communication between a plurality of terminals (for example, also referred to as device-to-device (D2D), vehicle-to-everything (V2X), and so on), embodiments of the present disclosure can also be applied. In this case, a structure in which a terminal has all or part of the functions of an access network device can also be provided. Furthermore, the language of "uplink," "downlink," and so on can also be replaced with language corresponding to communication between terminals (for example, "side"). For example, an uplink channel, a downlink channel, and so on can be replaced with a side channel, and an uplink, a downlink, and so on can be replaced with a side link.

[0136] In some embodiments, a terminal can be replaced with an access network device, a core network device, or a network device. In this case, a structure in which an access network device, a core network device, or a network device has all or part of the functions of a terminal can also be provided.

[0137] In some embodiments, obtaining data, information, and the like can comply with laws and regulations of the country where the location is.

[0138] In some embodiments, data, information, and the like can be obtained after obtaining the consent of the user.

[0139] In addition, each element, each row, or each column in the table of the embodiments of the present disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0140] FIG. 1A is a structural schematic diagram of an information processing system 100 according to an embodiment of the present disclosure. As shown in FIG. 1A, the information processing system 100 can include a terminal 101 and a network device 102.

[0141] In some embodiments, the network device 102 can include at least one of an access network device and a core network device.

[0142] In some embodiments, the terminal 101 includes at least one of a mobile phone, a wearable device, an IOT device or terminal, a car with communication function, a smart car, a Pad, a computer with wireless transceiver function, a VR terminal device, an AR terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid, a wireless terminal device in transportation safety, a wireless terminal device in smart city, a wireless terminal device in smart home, and the like, but is not limited thereto.

[0143] In some embodiments, the access network device is, for example, a node or device that accesses a terminal to a wireless network, and the access network device can include at least one of an evolved NodeB (eNB) in a 5G communication system, a next generation eNB (ng-eNB), a next generation NodeB (gNB), a node B (NB), a home node B (HNB), a home evolved node B (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an open base station (Open RAN), a cloud base station (Cloud RAN), a base station in other communication systems, an access node in a wireless fidelity (WiFi) system, but is not limited thereto.

[0144] In some embodiments, the technical solutions of the present disclosure can be applied to an Open RAN architecture, at this time, the interfaces between or within the access network devices involved in the embodiments of the present disclosure can become internal interfaces of the Open RAN, and the processes and information interactions between these internal interfaces can be realized through software or programs.

[0145] In some embodiments, the access network device can be composed of a central unit (CU) and a distributed unit (DU), wherein the CU can also be referred to as a control unit. The CU-DU structure can split the protocol layers of the access network device, and the functions of part of the protocol layers are controlled by the CU, and the functions of the remaining part or all of the protocol layers are distributed in the DU and controlled by the CU, but are not limited thereto.

[0146] In some embodiments, the core network device can be one device including the first device, the second device, the third device, and / or the fourth device, etc., or can be a plurality of devices or device groups including all or part of the above-mentioned devices, respectively. The first device, the second device, the third device, and / or the fourth device can be virtual or physical. The core network includes at least one of an evolved packet core (EPC), a 5G core network (5GCN), a next generation core (NGC), and a 6G core network (6GCN), for example.

[0147] In some embodiments, the first device and the fourth device can both be a common application program interface framework core network function (CAPIF core function, CCF); the first device and the fourth device are CCFs in different domains; the names of the first device and the fourth device are not limited thereto.

[0148] In some embodiments, the first device and the fourth device can both be any definable API authentication, authorization, diary recording, and / or charging function, or a device or network element or function or entity that provides a common requirement for a network capability exposure API, etc.

[0149] In some embodiments, the second device is an API invoker (Invoker); the name of the second device is not limited thereto.

[0150] In some embodiments, the API invoker can be a terminal or UE, or an application (such as a browser, etc.) or a public account or applet running on the terminal or UE, or an application function, or an application server, or a server belonging to a third party (such as A company, B operator, or C platform, etc.).

[0151] In some embodiments, the third device can be an API exposing function (AEF); the name of the third device is not limited thereto.

[0152] In some embodiments, the third device can be any device or network element or function or entity that can provide authentication and / or establish a TLS session, etc.

[0153] It can be understood that the information processing system described in the embodiments of the present disclosure is for more clearly illustrating the technical solutions of the embodiments of the present disclosure, and does not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art can know that, with the evolution of system architecture and the appearance of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0154] The embodiments of the present disclosure described below can be applied to the information processing system 100 shown in FIG. 1A or part of the subjects, but are not limited thereto. The subjects shown in FIG. 1A are illustrative, and the information processing system can include all or part of the subjects in FIG. 1A, or other subjects other than those in FIG. 1A. The number and form of each subject is arbitrary, and the connection relationship between the subjects is illustrative. The subjects can be connected or not connected, and the connection can be in any manner, can be direct connection or indirect connection, can be wired connection or wireless connection.

[0155] Embodiments of the present disclosure can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 6th generation mobile communication system (6G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (Bluetooth (registered trademark)), Public Land Mobile Network (PLMN) network, Device-to-Device (D2D) system, Machine to Machine (M2M) system, Internet of Things (IoT) system, Vehicle-to-Everything (V2X), system using other communication methods, next-generation system expanded based thereon, and the like. Further, a plurality of systems can be applied in combination (for example, combination of LTE or LTE-A and 5G, combination of 5G and 5G, combination of 5G and 6G, and the like).

[0156] In some embodiments, the CAPIF is a north-bound API framework for authorizing API invokers (e.g., third party Application Functions (AFs)) to access a communication system. Optionally, as shown in FIG. IB, the CAPIF framework can include a CCF and an API exposure function (AEF). The API invokers can send service APIs of the AEF through the CCF; the CAPIF framework can also include, among others, an API publishing function (APF) and / or an API management function (AMF). The AEF can use authorization information (e.g., tokens, authorization policies, etc.) provided by the CCF to authorize API invocation requests of the API invokers. CAPIF-1e, CAPIF-2e, CAPIF-3e, CAPIF-4e, CAPIF-5e, and CAPIF-6e are interfaces between devices in different domains; CAPIF-1, CAPIF-2, CAPIF-3, CAPIF-4, and CAPIF-5 are interfaces between devices in the same domain.

[0157] In some embodiments, referring again to FIG. IB, in a CAPIF interconnection scenario, two CCFs (e.g., CCF-A and CCF-B) can be connected to provide services for API invokers. Assume that CCF-A is in a trust domain A and CCF-B is in a trust domain B. When CCF-A is triggered by discovery of a service API of an API invoker, CCF-A can discover the service API related to CCF-B. Optionally, the trust domain A can be referred to as domain A or a first domain; the trust domain B can be referred to as domain B or a second domain.

[0158] Before requesting discovery of a service API, the identity of the API invoker should be authenticated; however, the identity authentication process of the API invoker in the CAPIF interconnection scenario is unclear.

[0159] In some embodiments, the UE can be a terminal, or the terminal can be a UE.

[0160] In some embodiments, the first device can be CCF-A; the second device can be an API invoker; the third device can be an AEF; and the fourth device can be CCF-B.

[0161] Optionally, the CCF-A can be a first CCF; and the CCF-A can be a CCF in a first domain.

[0162] Optionally, the CCF-B can be a second CCF; the CCF-B can be a CCF in the second domain.

[0163] Optionally, the third device can be an AEF in the second domain.

[0164] Optionally, the first device and the second device are in the first domain; the third device and the fourth device are in the second domain.

[0165] Optionally, the first domain can be a first trust domain; the second domain can be a second trust domain.

[0166] Optionally, the first domain can be domain A; the second domain can be domain B.

[0167] Optionally, the first domain can be CAPIF domain A; the second domain can be CAPIF domain B.

[0168] Optionally, the first domain and the second domain can belong to two different operators or companies or other institutions or organizations, etc. For example, the first domain is deployed by operator A; the second domain is deployed by operator B. For another example, the first domain is deployed by operator A, and the second domain is deployed by company B.

[0169] Optionally, the API invoker can be: a terminal or UE, or an application (such as a browser, etc.) or a public account or a mini program running on the terminal or UE, or an application function, or an application server, or a server belonging to a third party (such as company A, operator B, or platform C, etc.).

[0170] Figure 2A is an interaction diagram of an information processing method according to an embodiment of the present disclosure. As shown in Figure 2A, the present embodiment relates to an information processing method for an information processing system 100, and the method comprises:

[0171] In step S2101, the second device sends a first message to the first device.

[0172] In some embodiments, the first device receives the first message sent by the second device.

[0173] In some embodiments, the first message is used to request a security mechanism for interaction between the second device and the third device.

[0174] Optionally, the security mechanism can be referred to as a security method.

[0175] Optionally, the security mechanism can include at least one of: a first security mechanism, a second security mechanism, a third security mechanism, a fourth security mechanism, a fifth security mechanism, a sixth security mechanism, and the like. For example, the first security mechanism is a TLS-PSK based mechanism. For example, the second security mechanism is a TLS-PKI based mechanism. For example, the third security mechanism is a TLS with OAuth token based mechanism. For example, the fourth security mechanism is an OAuth client credential flow based mechanism. For example, the fifth security mechanism is an authorization code flow based mechanism. For example, the sixth security mechanism is a Proof Key for Code Exchange (PKCE) flow based mechanism.

[0176] Optionally, the security mechanism can include at least one of: TLS-PSK, TLS-PKI, TLS with OAuth token, OAuth client credential flow, authorization code flow, and Proof Key for Code Exchange (PKCE).

[0177] Optionally, the first message is used to request a selected security mechanism for an interaction between the second device and the third device.

[0178] Optionally, the first message is used to request a negotiation of a security mechanism for an interaction between the second device and the third device.

[0179] In some embodiments, the first message can include at least one of: a first identity, a second identity, first information, service information, and access scenario information.

[0180] Optionally, the first identity is an identity of the third device.

[0181] Optionally, the first identity is not limited in name, for example, an AEF ID identity, and the like.

[0182] Optionally, the second identity is an identity of the second device.

[0183] Optionally, the second identity is not limited in name, for example, an API Invoker ID, and the like.

[0184] Optionally, the first information is used to indicate a security mechanism supported by the second device.

[0185] Optionally, the first information is used to indicate a security mechanism supported by the second device for an interaction with at least one third device.

[0186] Optionally, the first information can be a list including an identity of at least one security mechanism supported by the second device; or the list can include an identity of at least one security mechanism supported by the second device when interacting with at least one third device respectively.

[0187] Optionally, the name of the first information is not limited, for example, information of the second device or capability information or security capability information of the second device.

[0188] Optionally, the service information includes at least one of the following: service API, resource, service and service operation.

[0189] For example, the service refers to a service provided by the second device, etc.; for example, a user management related service is provided.

[0190] For example, the service operation information is used to indicate an operation of the service that needs to be authorized. For example, the service operation can be deleting or a new user of the user management service.

[0191] For example, the resource can be address information (for example, a website address) of the second device, a location, etc.

[0192] Optionally, the access scenario information is used to indicate that the second device accesses the third device before the service API call or accesses the third device after the service API call.

[0193] For example, the access scenario information includes: first indication information used to indicate that the second device accesses the third device before the service API call; or second indication information used to indicate that the second device accesses the third device after the service API call.

[0194] Optionally, the names of the service information, the service, the service API, the resource and the service operation are not limited.

[0195] In some embodiments, the name of the first message is not limited; for example, a security method request or a security mechanism request, etc.

[0196] In step S2102, the third device sends third information to the fourth device.

[0197] In some embodiments, the fourth device receives the third information sent by the third device.

[0198] In some embodiments, the third information is used to indicate a security mechanism supported by the third device.

[0199] In some embodiments, the third information is used for the first device to determine a security mechanism for interaction between the second device and the third device, or the third information is used for the fourth device to determine a security mechanism for interaction between the second device and the third device.

[0200] In some embodiments, the name of the third information is not limited, which is, for example, information of the AEF or AEF capability information or AEF security mechanism information, etc.

[0201] In some embodiments, the third device sends the third information to the fourth device in a process in which the third device registers to the fourth device.

[0202] In some optional embodiments, the fourth device sends a seventh message to the third device.

[0203] In some optional embodiments, the third device receives the seventh message sent by the fourth device.

[0204] In some embodiments, the seventh message is used to request the third information.

[0205] In some embodiments, the name of the seventh message is not limited, which is, for example, AEF capability request or AEF security method request or AEF security mechanism request, etc.

[0206] Step S2103, the first device sends a second message to the fourth device.

[0207] In some embodiments, the fourth device receives the second message sent by the first device.

[0208] In some embodiments, the second message includes the first identity, and the second message is used to request the third information.

[0209] In some embodiments, the name of the second message is not limited, which is, for example, AEF capability request or AEF security method request or AEF security mechanism request, etc.

[0210] In some embodiments, the first device sends the second message to the fourth device in a case where it is determined that the third device is discovered by the fourth device.

[0211] In some embodiments, the first device sends the second message to the fourth device in a case where it is determined that the service information in the first message is discovered by the fourth device.

[0212] Step S2104, the fourth device sends a second response to the first device.

[0213] In some embodiments, the first device receives the second response sent by the fourth device.

[0214] In some embodiments, the second response is determined based on the second message.

[0215] In some embodiments, the second response includes the third information.

[0216] In some embodiments, the name of the second response is not limited, which is, for example, an AEF capability response or an AEF security method response or an AEF security mechanism response, etc.

[0217] At step S2105, the first device determines the security mechanism of the interaction between the second device and the third device.

[0218] In some embodiments, the first device determines the security mechanism of the interaction between the second device and the third device based on one of the following: the first information, the second information, the third information, and the service information.

[0219] For example, the first device determines the security mechanism of the interaction between the second device and the third device based on the first information. For example, the first information is used to indicate that the second device supports the first security mechanism, and the first security mechanism is determined as the security mechanism of the interaction between the second device and the third device.

[0220] For example, the first device determines the security mechanism of the interaction between the second device and the third device based on the second information. For example, the second information is used to indicate that the first device supports the second security mechanism, and the second security mechanism is determined as the security mechanism of the interaction between the second device and the third device.

[0221] For example, the first device determines the security mechanism of the interaction between the second device and the third device based on the third information. For example, the second information is used to indicate that the third device supports the third security mechanism, and the third security mechanism is determined as the security mechanism of the interaction between the second device and the third device.

[0222] For example, the first device determines the security mechanism of the interaction between the second device and the third device based on the first information and the third information. For example, the first information is used to indicate that the second device supports the first security mechanism and the second security mechanism, and the third information is used to indicate that the third device indicates the second security mechanism and the third security mechanism, and the second security mechanism is determined as the security mechanism of the interaction between the second device and the third device.

[0223] For example, the first device determines the security mechanism of the interaction between the second device and the third device based on the first information, the second information, and the third information. For example, the first information is used to indicate that the second device supports the first security mechanism and the fourth security mechanism, the second information is used to indicate that the first device supports the second security mechanism and the fourth security mechanism, and the third information is used to indicate that the third device supports the third security mechanism and the fourth security mechanism, and the fourth security mechanism is determined as the security mechanism of the interaction between the second device and the third device.

[0224] For example, the first device determines that the service information indicates that the service requested by the second device is a service requiring real-time feedback, and determines that the security mechanism for the interaction between the second device and the third device is an authorization code flow. Alternatively, the first device determines that the service information indicates that the service requested by the second device is a service not requiring real-time feedback, and determines that the security mechanism for the interaction between the second device and the third device is TLS-PSK or TLS-PKI, etc.

[0225] For example, the first device can determine the security mechanism exchanged between the second device and the third device based on the security mechanism supported by one of the first device, the second device and the third device and the security mechanism required by the service indicated by the service information.

[0226] The above is only an example of determining the security mechanism for the interaction between the second device and the third device, and the implementation of determining the security mechanism for the interaction between the second device and the third device is not limited thereto.

[0227] At step S2106, the first device sends a third message to the fourth device.

[0228] In some embodiments, the fourth device receives the third message sent by the first device.

[0229] In some embodiments, the third message is used to request the security mechanism for the interaction between the second device and the third device.

[0230] In some embodiments, the third message includes the first identifier and / or the second identifier.

[0231] In some embodiments, the third message includes fourth information.

[0232] Optionally, the fourth information is used to indicate the security mechanism commonly supported by the first device and the second device. For example, the commonly supported security mechanism can be a common security mechanism or common security methods.

[0233] Optionally, the fourth information is used to indicate the security mechanism supported by the first device and / or the security mechanism supported by the second device. For example, the security mechanism supported by the first device can refer to a security mechanism or security method supported by the first device alone, or a full set of security mechanisms or full set of security methods supported by the first device. For example, the security mechanism supported by the second device can refer to a security mechanism or security method supported by the second device alone, or a full set of security mechanisms or full set of security methods supported by the second device.

[0234] In some embodiments, the first device sends the third message to the fourth device upon determining that the third device is discovered by the fourth device.

[0235] In some embodiments, the first device sends the third message to the fourth device upon determining that the third device is discovered by the fourth device.

[0236] In some embodiments, the first device sends the third message to the fourth device upon determining that the service information in the first message is discovered by the fourth device.

[0237] In some embodiments, the name of the third message is not limited, which is, for example, a security method request or a security mechanism request, etc.

[0238] In step S2107, the fourth device determines the security mechanism of the interaction between the second device and the third device.

[0239] In some embodiments, the fourth device determines the security mechanism of the interaction between the second device and the third device based on information of at least one of the following: the fourth information, the third information, and the service information.

[0240] Alternatively, when the fourth information is used to indicate the security mechanisms supported by the first device and / or the security mechanisms supported by the second device, i.e., the fourth information includes the second information and the third information, the fourth device can determine the security mechanism of the interaction between the second device and the third device based on information of at least one of the following: the first information, the second information, the third information, and the service information. Here, the fourth device determines the security mechanism of the interaction between the second device and the third device is similar to that determined by the first device, and the specific implementation manner can be referred to the example in step S2105.

[0241] Alternatively, when the fourth information is used to indicate the security mechanisms supported by the first device and / or the security mechanisms supported by the second device, i.e., the fourth information is determined based on the first information and the second information, the first device determines the security mechanisms supported by the first device and the second device in common, and then sends the fourth information to the fourth device so that the fourth device determines the security mechanism of the interaction between the second device and the third device based on the security mechanisms supported by the first device and the second device in common, and other information (e.g., at least one of the third information and the service information). Here, the fourth device determines the security mechanism of the interaction between the second device and the third device is also similar to that determined by the first device, and the specific implementation manner can be referred to the example in step S2105.

[0242] In step S2108, the fourth device sends a third response to the first device.

[0243] In some embodiments, the first device receives a third response sent by the fourth device.

[0244] In some embodiments, the third response is used to indicate the security mechanism for the interaction between the second device and the third device.

[0245] In some embodiments, the third response is determined based on the third message.

[0246] In some embodiments, the third response can include the first identity and / or the second identity. For example, the third response can include a fourth identity, the first identity, and the second identity; wherein the fourth identity is an identity of the fourth device, and the fourth identity is used to indicate that the security mechanism is provided by the fourth device.

[0247] Optionally, the name of the fourth identity is not limited, which is, for example, CCF-B ID.

[0248] In some embodiments, the name of the third response is not limited, which is, for example, a security method response or a security mechanism response.

[0249] In some optional embodiments, steps S2103 to S2105 are parallel to steps S2106 to S2108; steps S2103 to S2105 are optional, or steps S2106 to S2108 are optional.

[0250] In step S2109, the first device sends a first response to the second device.

[0251] In some embodiments, the second device receives the first response sent by the first device.

[0252] In some embodiments, the first response is used to indicate the security mechanism for the interaction between the second device and the third device.

[0253] In some embodiments, the first response can include the first identity and / or the second identity.

[0254] For example, the first response can include a fourth identity, the first identity, and the second identity; wherein the fourth identity is an identity of the fourth device, and the fourth identity is used to indicate that the security mechanism is provided by the fourth device.

[0255] For example, the first response can include a third identity, the first identity, and the second identity; wherein the third identity is an identity of the first device, and the first identity is used to indicate that the security mechanism is provided by the first device.

[0256] Optionally, the name of the third identity is not limited, which is, for example, CCF-A ID.

[0257] In some embodiments, the first response is determined based on the first message.

[0258] In some embodiments, the name of the first response is not limited, for example, it is a security method response or a security mechanism response, etc.

[0259] In some embodiments, the name of information, etc. is not limited to the name described in the embodiments, and the terms of "information", "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "domain", "field", "symbol", "symbol", "codebook", "codeword", "codepoint", "bit", "data", "program", "chip", etc. can be replaced with each other.

[0260] In some embodiments, "acquire", "obtain", "get", "receive", "transmit", "bidirectional transmission", "send and / or receive" can be replaced with each other, which can be interpreted as receiving from other subjects, acquiring from protocols, acquiring from higher layers, obtaining by self-processing, autonomously implementing, etc.

[0261] In some embodiments, the terms of "send", "transmit", "report", "issue", "transmit", "bidirectional transmission", "send and / or receive" can be replaced with each other.

[0262] In some embodiments, the terms of "certain", "preset", "pre-set", "set", "indicated", "a certain", "arbitrary", "first", etc. can be replaced with each other, and "certain A", "preset A", "pre-set A", "set A", "indicated A", "a certain A", "arbitrary A", "first A" can be interpreted as A specified in advance in protocols, etc., can be interpreted as A obtained by setting, configuring, or indicating, etc., can be interpreted as certain A, a certain A, arbitrary A, or first A, etc., but not limited thereto.

[0263] In some embodiments, the determination or judgment can be performed by a value represented by 1 bit (0 or 1), or by a true or false value (Boolean value) represented by true or false, or by comparison of numerical values (for example, comparison with a predetermined value), but not limited thereto.

[0264] The information processing method according to the embodiments of the present disclosure can include at least one of steps S2101 to S2109. For example, step S2101 can be implemented as an independent embodiment; step S2102 can be implemented as an independent embodiment; step S2103 can be implemented as an independent embodiment; step S2104 can be implemented as an independent embodiment; step S2105 can be implemented as an independent embodiment; step S2106 can be implemented as an independent embodiment; step S2107 can be implemented as an independent embodiment; step S2108 can be implemented as an independent embodiment; step S2109 can be implemented as an independent embodiment; a combination of step S2101 and step S2109 can be implemented as an independent embodiment; a combination of step S2103 and step S2104 can be implemented as an independent embodiment; a combination of step S2102, step S2103 and step S2104 can be implemented as an independent embodiment; a combination of step S2103, step S2104 and step S2105 can be implemented as an independent embodiment; a combination of step S2102, step S2103, step S2104 and step S2105 can be implemented as an independent embodiment; a combination of step S2101, step S2102, step S2103, step S2104, step S2105 and step S2109 can be implemented as an independent embodiment; a combination of step S2106 to step S2108 can be implemented as an independent embodiment; a combination of step S2106, step S2107 and step S2108 can be implemented as an independent embodiment; a combination of step S2102, step S2106, step S2107 and step S2108 can be implemented as an independent embodiment; a combination of step S2101, step S2102, step S2106, step S2107, step S2108 and step S2109 can be implemented as an independent embodiment; a combination of step S2101 to step S2109 can be implemented as an independent embodiment.

[0265] In some embodiments, steps S2102 to S2104 and steps S2106 to S2108 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0266] In some embodiments, steps S2102 to S2105 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0267] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0268] FIG. 2B is an interaction diagram of a method for processing information according to an embodiment of the present disclosure. As shown in FIG. 2B, the method for processing information according to an embodiment of the present disclosure is used in the information processing system 100, and the method comprises the following steps.

[0269] In step S2201, the second device sends a sixth message to the third device.

[0270] In some embodiments, the third device receives the sixth message sent by the second device.

[0271] In some embodiments, the sixth message is used to request to start an authentication process or to initiate an authentication process.

[0272] In some embodiments, the sixth message is used to request to start an authentication process or to initiate an authentication process for the identity of the second device.

[0273] In some embodiments, the sixth message can also be used to request to authenticate the identity of the second device.

[0274] In some embodiments, the sixth message comprises at least one of the second identity, the first identity and the third identity. Optionally, the second identity is the identity of the second device; the third identity is the identity of the first device; and the first identity is the identity of the third device.

[0275] In some embodiments, the name of the sixth message is not limited, and it is, for example, an authentication initiation request or an authentication start request (Authentication Initiation Request).

[0276] In step S2202, the third device sends a fifth message to the fourth device.

[0277] In some embodiments, the fourth device receives the fifth message sent by the third device.

[0278] In some embodiments, the fifth message comprises the second identity, and the fifth message is used to request security information.

[0279] In some embodiments, the fifth message can also comprise at least one of the first identity and the third identity.

[0280] Optionally, the second identity is used to indicate the device to be authenticated.

[0281] Optionally, the first identity is used for the fourth device to send the fifth response to the third device corresponding to the first identity.

[0282] For example, the first identity is used by the first device to return information related to the security information to the fourth device, so that the fourth device sends the third device corresponding to the first identity.

[0283] Optionally, the third identity is used by the fourth device to select the first device corresponding to the third identity to send the fourth message.

[0284] For example, the fifth message includes the third identity, and the third device sends the fourth message to the first device corresponding to the third identity based on the third identity.

[0285] In some embodiments, the security information is used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting the relevant authorization information of the second device, the relevant authorization information including a token related to the second device; and establishing a TLS connection between the second device and the first device.

[0286] In some embodiments, the security information can include at least one of the following: a key and a certificate.

[0287] Optionally, the key is generated by the first device.

[0288] Optionally, the certificate is a certificate of the first device or a root certificate of a certificate of the second device.

[0289] In some embodiments, the name of the fifth message is not limited, which is, for example, a security information request or a key request or a certificate request, etc.

[0290] In some optional embodiments, if the fourth device stores the security information, it can directly send the security information to the third device without interacting with the first device. That is, steps S2203 and S2204 below can be ignored.

[0291] Step S2203: The fourth device sends the fourth message to the first device.

[0292] In some embodiments, the first device receives the fourth message sent by the fourth device.

[0293] In some embodiments, the fourth message is used to request the security information.

[0294] In some embodiments, the fourth message can include at least one of the following: the first identity, the second identity, and the third identity.

[0295] Optionally, the fourth message includes the first identity, and the first identity is used by the first device to return information related to the security information to the fourth device, so that the fourth device sends the third device corresponding to the first identity.

[0296] In some embodiments, the fourth message is not limited in name, which is, for example, a security information request or a key request or a certificate request, etc.

[0297] Step S2204, the first device sends a fourth response to the fourth device.

[0298] In some embodiments, the fourth response includes security information.

[0299] In some embodiments, the fourth response can include at least one of the first identity, the second identity, and the third identity. Illustratively, the first identity is further used to indicate that the security information is returned to the third device corresponding to the first identity. Illustratively, the second identity is further used to indicate the second device authenticating the identity. Illustratively, the third identity is used to indicate that the security information is obtained from the first device corresponding to the third identity.

[0300] In some embodiments, the fourth response is determined based on the fourth message.

[0301] In some embodiments, the fourth response is not limited in name, which is, for example, a security information response or a key response or a certificate response, etc.

[0302] Step S2205, the fourth device sends a fifth response to the third device.

[0303] In some embodiments, the fifth response includes security information.

[0304] In some embodiments, the fifth response can include at least one of the first identity, the second identity, and the third identity.

[0305] In some embodiments, the fifth response can include at least one of the first identity, the second identity, and the fourth identity. Illustratively, the fourth identity is further used to indicate that the security information is obtained from the first device corresponding to the fourth identity.

[0306] In some embodiments, the fifth response is determined based on the fifth message.

[0307] In some embodiments, the fifth response is not limited in name, which is, for example, a security information response or a key response or a certificate response.

[0308] Step S2206, the third device sends a sixth response to the second device.

[0309] In some embodiments, the second device receives the sixth response sent by the third device.

[0310] In some embodiments, the sixth response is used to agree to start the authentication process or to start the authentication process.

[0311] In some embodiments, the sixth response is used to agree to start an authentication procedure or initiate an authentication procedure for the identity of the second device.

[0312] In some embodiments, the sixth response includes security information. Alternatively, the sixth response includes a security mechanism corresponding to the security information.

[0313] In some embodiments, the name of the sixth response is not limited, for example, it is an authentication initiation response or an authentication start response (Authentication Initiation Response).

[0314] The information processing method according to the embodiments of the present disclosure can include at least one of steps S2201 to S2206. For example, step S2201 can be implemented as an independent embodiment; step S2202 can be implemented as an independent embodiment; step S2203 can be implemented as an independent embodiment; step S2204 can be implemented as an independent embodiment; step S2205 can be implemented as an independent embodiment; step S2206 can be implemented as an independent embodiment; a combination of step S2201 and step S2206 can be implemented as an independent embodiment; a combination of step S2202 and step S2205 can be implemented as an independent embodiment; a combination of step S2203 and step S2204 can be implemented as an independent embodiment; a combination of step S2201, step S2202, step S2205, and step S2206 can be implemented as an independent embodiment; and a combination of steps S2201 to S2206 can be implemented as an independent embodiment.

[0315] In some embodiments, steps S2201 and S2206 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0316] In some embodiments, steps S2201 and S2206, steps S2203 to S2204 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0317] In some embodiments, steps S2203 to S2204 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0318] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0319] FIG. 3A is a flow diagram illustrating a method for processing information according to an embodiment of the present disclosure. As shown in FIG. 3A, the embodiment of the present disclosure relates to a method for processing information, which is performed by a first device, and the method comprises the following steps:

[0320] In step S3101, a first message is acquired.

[0321] The optional implementation of step S3101 can refer to the optional implementation of step S2101 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0322] In some embodiments, the first device receives the first message sent by the second device, but is not limited thereto, and can also receive the first message sent by other subjects.

[0323] In some embodiments, the first device acquires the first message specified by a protocol.

[0324] In some embodiments, the first device acquires the first message from an upper layer.

[0325] In some embodiments, the first device processes to obtain the first message.

[0326] In some embodiments, step S3101 is omitted, and the first device autonomously implements the function indicated by the first message, or the above function is default.

[0327] In step S3102, a second message is sent.

[0328] The optional implementation of step S3102 can refer to the optional implementation of step S2103 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0329] In some embodiments, the first device can send the second message to the fourth device, but is not limited thereto, and can also send the second message to other subjects.

[0330] In step S3103, a second response is acquired.

[0331] The optional implementation of step S3103 can refer to the optional implementation of step S2104 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0332] In some embodiments, the first device receives the second response sent by the fourth device, but is not limited thereto, and can also receive the second response sent by other subjects.

[0333] In some embodiments, the first device acquires the second response specified by a protocol.

[0334] In some embodiments, the first device obtains the second response from upper layer(s).

[0335] In some embodiments, the first device processes to obtain the second response.

[0336] In some embodiments, step S3101 is omitted, and the first device autonomously implements the function indicated by the second response, or the function is default or default.

[0337] Step S3104, determine the security mechanism of the interaction between the second device and the third device.

[0338] The optional implementation of step S3104 can refer to the optional implementation of step S2105 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0339] Step S3105, send the third message.

[0340] The optional implementation of step S3105 can refer to the optional implementation of step S2106 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0341] In some embodiments, the first device can send the third message to the fourth device, but is not limited thereto, and can also send the third message to other subjects.

[0342] Step S3106, obtain the third response.

[0343] The optional implementation of step S3106 can refer to the optional implementation of step S2108 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0344] In some embodiments, the first device receives the third response sent by the access network device, but is not limited thereto, and can also receive the third response sent by other subjects.

[0345] In some embodiments, the first device obtains the third response specified by the protocol.

[0346] In some embodiments, the first device obtains the third response from upper layer(s).

[0347] In some embodiments, the first device processes to obtain the third response.

[0348] In some embodiments, step S3106 is omitted, and the first device autonomously implements the function indicated by the third response, or the function is default or default.

[0349] In some optional embodiments, steps S3102 to S3104 are optional, or steps S3105 and S3106 are optional.

[0350] Step S3107: sending the first response.

[0351] Optional implementation of step S3107 can refer to optional implementation of step S2109 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0352] In some embodiments, the first device can send the first response to the second device, but is not limited thereto, and can also send the first response to other subjects.

[0353] The information processing method involved in the embodiments of the present disclosure can include at least one of steps S3101 to S3107. For example, step S3101 can be implemented as an independent embodiment; step S3102 can be implemented as an independent embodiment; step S3103 can be implemented as an independent embodiment; step S3104 can be implemented as an independent embodiment; step S3105 can be implemented as an independent embodiment; step S3106 can be implemented as an independent embodiment; step S3107 can be implemented as an independent embodiment; a combination of step S3101 and step S3107 can be implemented as an independent embodiment; a combination of step S3102 and step S3103 can be implemented as an independent embodiment; a combination of step S3102 and step S3103 and step S3104 can be implemented as an independent embodiment; a combination of step S3101 and step S3102 and step S3103 and step S3104 and step S3107 can be implemented as an independent embodiment; a combination of step S3105 and step S3106 can be implemented as an independent embodiment; a combination of step S3101 and step S3105 and step S3106 and step S3107 can be implemented as an independent embodiment; and a combination of steps S3101 to S3107 can be implemented as an independent embodiment.

[0354] In some embodiments, steps S3102 to S3104 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0355] In some embodiments, steps S3105 and S3106 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0356] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0357] FIG. 3B is a flow diagram illustrating a method of information processing according to some embodiments of the present disclosure. As shown in FIG. 3B, the embodiments of the present disclosure relate to a method of information processing, performed by a first device, comprising:

[0358] At step S3201, receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier being an identifier of a third device, and the first message being used to request a security mechanism for interaction between the second device and the third device.

[0359] Optional implementation of step S3201 can refer to optional implementation of step S2101 in FIG. 2A, or step S3101 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described here again.

[0360] At step S3202, sending a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

[0361] Optional implementation of step S3202 can refer to optional implementation of step S2109 in FIG. 2A, or step S3107 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described here again.

[0362] In some embodiments, the first message further comprises at least one of: first information, wherein the first information is used to indicate the security mechanism supported by the second device; and service information, the service information comprising at least one of: a service API, a resource, a service, and a service operation.

[0363] In some embodiments, the method further comprises: determining the security mechanism for interaction between the second device and the third device based on information of at least one of: the first information; second information, wherein the second information is used to indicate the security mechanism supported by the first device; third information, wherein the third information is used to indicate the security mechanism supported by the third device; and the service information.

[0364] In some embodiments, the method further comprises: in a case where it is determined that the third device is discovered by a fourth device or it is determined that the service information in the first message is discovered by the fourth device, sending a second message to the fourth device, wherein the second message comprises the first identifier, and the second message is used to request the third information; and receiving a second response sent by the fourth device, wherein the second response comprises the third information.

[0365] In some embodiments, the method further comprises: sending a third message to the fourth device, wherein the third message is used to request the security mechanism for interaction between the second device and the third device; and receiving a third response sent by the fourth device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

[0366] In some embodiments, the sending the third message to the fourth device comprises: in a case that it is determined that the third device is discovered by the fourth device or it is determined that the service information in the first message is discovered by the fourth device, the fourth device sends the third message, wherein the third message comprises fourth information; and the fourth information is used to indicate: a security mechanism that is supported by the first device and the second device jointly, or a security mechanism that is supported by the first device and / or a security mechanism that is supported by the second device.

[0367] In some embodiments, the security mechanism comprises at least one of: a first security mechanism, wherein the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, wherein the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, wherein the third security mechanism is a TLS based mechanism with OAuth token; a fourth security mechanism, wherein the fourth security mechanism is an OAuth client credential flow based mechanism; a fifth security mechanism, wherein the fifth security mechanism is an authorization code flow based mechanism; and a sixth security mechanism, wherein the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

[0368] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0369] The above embodiments can be implemented independently or in combination with each other. The optional implementation can refer to the optional implementation of the steps of FIG. 2A and FIG. 3A, which will not be described here.

[0370] FIG. 3C is a flow diagram illustrating a method for processing information according to some embodiments of the present disclosure. As shown in FIG. 3B, the embodiments of the present disclosure relate to a method for processing information, which is performed by a first device, and the above method comprises:

[0371] In step S3301, the first message is obtained.

[0372] The optional implementation of step S3301 can refer to the optional implementation of step S2101 in FIG. 2A, or the optional implementation of step S3101 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which will not be described here.

[0373] In step S3302, the second message is sent.

[0374] The optional implementation of step S3302 can refer to the optional implementation of step S2103 in FIG. 2A, or the optional implementation of step S3102 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which will not be described here.

[0375] In step S3303, the second response is obtained.

[0376] The optional implementation of step S3303 can refer to the optional implementation of step S2104 in FIG. 2A, or the optional implementation of step S3103 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described here again.

[0377] Step S3304, determining a security mechanism for interaction between the second device and the third device.

[0378] The optional implementation of step S3304 can refer to the optional implementation of step S2105 in FIG. 2A, or the optional implementation of step S3104 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described here again.

[0379] Step S3305, sending a first response.

[0380] The optional implementation of step S3305 can refer to the optional implementation of step S2109 in FIG. 2A, or the optional implementation of step S3107 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described here again.

[0381] The above embodiments can be implemented alone or in combination with each other, and the optional implementation can refer to the optional implementation of the steps in FIG. 2A and FIG. 3A, which are not described here again.

[0382] FIG. 3D is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 3D, the embodiments of the present disclosure relate to an information processing method, which is performed by a first device, and the above method comprises:

[0383] Step S3401, obtaining a fourth message.

[0384] Optionally, the fourth message comprises a second identifier, the second identifier being an identifier of the second device; the fourth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting the relevant authorization information of the second device, the relevant authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device.

[0385] The optional implementation of step S3401 can refer to the optional implementation of step S2203 in FIG. 2B, and other associated parts in the embodiments related to FIG. 2B, which are not described here again.

[0386] In some embodiments, the first device receives the fourth message sent by the second device, but is not limited thereto, and can also receive the fourth message sent by other subjects.

[0387] In some embodiments, the first device obtains the fourth message specified by a protocol.

[0388] In some embodiments, the first device obtains the fourth message from upper layer(s).

[0389] In some embodiments, the first device processes to obtain the fourth message.

[0390] In some embodiments, step S3401 is omitted, and the first device autonomously implements the function indicated by the fourth message, or the above function is default or default.

[0391] Step S3402, sending the fourth response.

[0392] Optionally, the fourth response includes security information.

[0393] The optional implementation of step S3402 can refer to the optional implementation of step S2204 in FIG. 2B and other associated parts in the embodiments involved in FIG. 2B, which will not be repeated here.

[0394] In some embodiments, the first device can send the fourth response to the fourth, but not limited to this, and can also send the fourth response to other subjects.

[0395] The information processing method involved in the embodiments of the present disclosure can include at least one of steps S3401 to S3402. For example, step S3401 can be implemented as an independent embodiment; step S3402 can be implemented as an independent embodiment; the combination of step S3401 and step S3402 can be implemented as an independent embodiment.

[0396] In some embodiments, the fourth message includes a first identifier, the first identifier is an identifier of the third device, and the first identifier is used by the first device to return information related to the security information to the fourth device, so that the fourth device sends to the third device corresponding to the first identifier.

[0397] In some embodiments, the security information includes at least one of the following: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a certificate of the first device or a root certificate of a certificate of the second device.

[0398] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0399] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished from the previous steps.

[0400] FIG. 4A is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4A, the embodiments of the present disclosure involve an information processing method, which is performed by a fourth device, and the above method includes:

[0401] Step S4101: Obtain the third information.

[0402] The optional implementation of step S4101 can refer to the optional implementation of step S2102 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0403] In some embodiments, the fourth device receives the third information sent by the third device, but is not limited thereto, and can also receive the third information sent by other subjects.

[0404] In some embodiments, the fourth device obtains the third information specified by the protocol.

[0405] In some embodiments, the fourth device obtains the third information from the upper layer(s).

[0406] In some embodiments, the fourth device processes to obtain the third information.

[0407] In some embodiments, step S4101 is omitted, and the fourth device autonomously implements the function indicated by the third information, or the above function is default or default.

[0408] In some optional embodiments, the fourth device sends a seventh message to the third device. Optionally, the seventh message is used to request the third information.

[0409] Step S4102: Obtain the second message.

[0410] The optional implementation of step S4102 can refer to the optional implementation of step S2103 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0411] In some embodiments, the fourth device receives the second message sent by the first device, but is not limited thereto, and can also receive the second message sent by other subjects.

[0412] In some embodiments, the fourth device obtains the second message specified by the protocol.

[0413] In some embodiments, the fourth device obtains the second message from the upper layer(s).

[0414] In some embodiments, the fourth device processes to obtain the second message.

[0415] In some embodiments, step S4102 is omitted, and the fourth device autonomously implements the function indicated by the second message, or the above function is default or default.

[0416] Step S4103: Send the second response.

[0417] The optional implementation of step S4103 can refer to the optional implementation of step S2104 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0418] In some embodiments, the fourth device can send the second response to the first device, but is not limited thereto, and can also send the second response to other subjects.

[0419] Step S4104, obtaining a third message.

[0420] The optional implementation of step S4104 can refer to the optional implementation of step S2106 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0421] In some embodiments, the fourth device receives the third message sent by the first device, but is not limited thereto, and can also receive the third message sent by other subjects.

[0422] In some embodiments, the fourth device obtains the third message as specified by a protocol.

[0423] In some embodiments, the fourth device obtains the third message from upper layer(s).

[0424] In some embodiments, the fourth device processes to obtain the third message.

[0425] In some embodiments, step S4104 is omitted, and the fourth device autonomously implements the function indicated by the third message, or the above function is default or default.

[0426] Step S4105, determining a security mechanism for interaction between the second device and the third device.

[0427] The optional implementation of step S4105 can refer to the optional implementation of step S2107 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0428] Step S4106, sending a third response.

[0429] The optional implementation of step S4106 can refer to the optional implementation of step S2108 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0430] In some embodiments, the fourth device can send the third response to the first device, but is not limited thereto, and can also send the third response to other subjects.

[0431] In an optional embodiment, the step S4102 and the step S4103 are optional, or, the step S4104 to the step S4106 are optional.

[0432] The information processing method related to the embodiments of the present disclosure can include at least one of the steps S4101 to S4106. For example, the step S4101 can be implemented as an independent embodiment; the step S4102 can be implemented as an independent embodiment; the step S4103 can be implemented as an independent embodiment; the step S4104 can be implemented as an independent embodiment; the step S4105 can be implemented as an independent embodiment; the step S4106 can be implemented as an independent embodiment; a combination of the step S4102 and the step S4103 can be implemented as an independent embodiment; a combination of the step S4101 and the step S4102 and the step S4103 can be implemented as an independent embodiment; a combination of the step S4104 and the step S4106 can be implemented as an independent embodiment; a combination of the step S4104 and the step S4105 and the step S4106 can be implemented as an independent embodiment; a combination of the step S4101 and the step S4104 and the step S4105 and the step S4106 can be implemented as an independent embodiment; and a combination of the steps S4101 to S4106 can be implemented as an independent embodiment.

[0433] In some embodiments, the step S4101, the step S4104 to the step S4106 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0434] In some embodiments, the step S4101 to the step S4103 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0435] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0436] FIG. 4B is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4B, the embodiments of the present disclosure relate to an information processing method, which is performed by a fourth device, and the above method comprises:

[0437] The step S4201 receives a third message sent by a first device, wherein the third message includes a first identifier, the first identifier is an identifier of a third device, and the third message is used to request a security mechanism for interaction between a second device and the third device.

[0438] The optional implementation of step S4201 can refer to the optional implementation of step S2106 in FIG. 2A, or the optional implementation of step S4104 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A and FIG. 4A, which are not described here again.

[0439] In step S4202, a third response is sent to the first device, where the third response is used to indicate a security mechanism of the interaction between the second device and the third device.

[0440] The optional implementation of step S4202 can refer to the optional implementation in the optional embodiment of step S2108 in FIG. 2A, or the optional implementation in the optional embodiment of step S4106 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A and FIG. 4A, which are not described here again.

[0441] In some embodiments, the third message is sent in a case where the first device determines that the third device is discovered by the fourth device, or determines that the service information in the first message is discovered by the fourth device, the first message being received by the first device from the second device; the third message includes fourth information; where the fourth information is used to indicate: a security mechanism commonly supported by the first device and the second device, or a security mechanism supported by the first device and / or a security mechanism supported by the second device.

[0442] In some embodiments, the method further comprises: determining the security mechanism of the interaction between the second device and the third device based on information of at least one of: the fourth information; the third information, where the third information is used to indicate a security mechanism supported by the third device, the third information being obtained from the device; and the service information.

[0443] In some embodiments, the method further comprises: receiving a second message sent by the first device, where the second message includes a first identifier, and the second message is used to request the third information; and sending a second response to the first device, where the second response includes the third information.

[0444] In some embodiments, the security mechanism includes at least one of: a first security mechanism, where the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, where the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, where the third security mechanism is a TLS based mechanism with OAuth token; a fourth security mechanism, where the fourth security mechanism is a OAuth client credential flow based mechanism; a fifth security mechanism, where the fifth security mechanism is a authorization code flow based mechanism; and a sixth security mechanism, where the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

[0445] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0446] The above-mentioned embodiments can be implemented independently or in combination with each other. For optional implementation, refer to the optional implementation of the steps in FIG. 2A and FIG. 4A, which are not described herein again.

[0447] FIG. 4C is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4C, the embodiment of the present disclosure relates to an information processing method, which is performed by a fourth device, and the method comprises the following steps:

[0448] In step S4301, a third message is acquired.

[0449] For optional implementation of step S4301, refer to the optional implementation of step S2102 in FIG. 2A, or the optional implementation of step S4101 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A and FIG. 4A, which are not described herein again.

[0450] In step S4302, a second message is acquired.

[0451] For optional implementation of step S4302, refer to the optional implementation of step S2103 in FIG. 2A, or the optional implementation of step S4102 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A and FIG. 4A, which are not described herein again.

[0452] In step S4303, a second response is sent.

[0453] For optional implementation of step S4303, refer to the optional implementation of step S2104 in FIG. 2A, or the optional implementation of step S4103 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A and FIG. 4A, which are not described herein again.

[0454] The above-mentioned embodiments can be implemented independently or in combination with each other. For optional implementation, refer to the optional implementation of the steps in FIG. 2A and FIG. 4A, which are not described herein again.

[0455] FIG. 4D is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4D, the embodiment of the present disclosure relates to an information processing method, which is performed by a fourth device, and the method comprises the following steps:

[0456] In step S4401, a fifth message is acquired.

[0457] For optional implementation of step S4401, refer to the optional implementation of step S2202 in FIG. 2B, and other associated parts in the embodiments related to FIG. 2B, which are not described herein again.

[0458] In some embodiments, the fourth device receives the fifth message sent by the third device, but is not limited thereto, and can also receive the fifth message sent by other subjects.

[0459] In some embodiments, the fourth device obtains the fifth message according to a protocol.

[0460] In some embodiments, the fourth device obtains the fifth message from upper layer(s).

[0461] In some embodiments, the fourth device processes to obtain the fifth message.

[0462] In some embodiments, step S4401 is omitted, and the fourth device autonomously implements the function indicated by the fifth message, or the above function is default or default.

[0463] Step S4402, sending the fourth message.

[0464] The optional implementation of step S4402 can refer to the optional implementation of step S2203 in FIG. 2B and other associated parts in the embodiments involved in FIG. 2B, which will not be repeated here.

[0465] In some embodiments, the fourth device can send the fourth message to the first device, but is not limited thereto, and can also send the fourth message to other subjects.

[0466] Step S4403, obtaining the fourth response.

[0467] The optional implementation of step S4403 can refer to the optional implementation of step S2204 in FIG. 2B and other associated parts in the embodiments involved in FIG. 2B, which will not be repeated here.

[0468] In some embodiments, the fourth device receives the fourth response sent by the first device, but is not limited thereto, and can also receive the fourth response sent by other subjects.

[0469] In some embodiments, the fourth device obtains the fourth response according to a protocol.

[0470] In some embodiments, the fourth device obtains the fourth response from upper layer(s).

[0471] In some embodiments, the fourth device processes to obtain the fourth response.

[0472] In some embodiments, step S4403 is omitted, and the fourth device autonomously implements the function indicated by the fourth response, or the above function is default or default.

[0473] Step S4404, sending the fifth response.

[0474] The optional implementation of step S4404 can refer to the optional implementation of step S2205 in FIG. 2B, and other associated parts in the embodiments involved in FIG. 2B, which are not described herein again.

[0475] In some embodiments, the fourth device can send the fifth response to the third device, but is not limited thereto, and can also send the fifth response to other subjects.

[0476] The information processing method involved in the embodiments of the present disclosure can include at least one of steps S4401 to S4404. For example, step S4401 can be implemented as an independent embodiment; step S4402 can be implemented as an independent embodiment; step S4402 can be implemented as an independent embodiment; step S4403 can be implemented as an independent embodiment; a combination of steps S4401 and S4404 can be implemented as an independent embodiment; a combination of steps S4401 to S4404 can be implemented as an independent embodiment.

[0477] In some embodiments, steps S4402 and S4403 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0478] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0479] FIG. 4E is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4E, the embodiments of the present disclosure involve an information processing method, which is performed by a fourth device, and the above method includes:

[0480] Step S4501, receiving a fifth message sent by a third device, wherein the fifth message includes a second identifier, and the second identifier is an identifier of a second device; and the fifth message is used to request security information.

[0481] Optionally, the security information is used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting the relevant authorization information of the second device, the relevant authorization information including a token related to the second device; and establishing a TLS connection between the second device and the first device.

[0482] The optional implementation of step S4501 can refer to the optional implementation of step S2202 in FIG. 2A, or the optional implementation of step S4401 in FIG. 4D, and other associated parts in the embodiments involved in FIG. 2B and FIG. 4D, which are not described herein again.

[0483] Step S4502, sending a fifth response to the third device, wherein the fifth response includes security information.

[0484] The optional implementation of step S4501 can refer to the optional implementation of step S2205 in FIG. 2A, or step S4404 in FIG. 4B, and other related parts in the embodiments related to FIG. 2B and FIG. 4D, which are not described herein again.

[0485] In some embodiments, the fifth message comprises at least one of: a first identifier, wherein the first identifier is an identifier of the third device, and the first identifier is used by the fourth device to send the fifth response to the third device corresponding to the first identifier; and a third identifier, wherein the third identifier is an identifier of the first device.

[0486] In some embodiments, the fifth message comprises the third identifier, and the method further comprises: based on the third identifier, sending, to the first device corresponding to the third identifier, a fourth message; wherein the fourth message comprises a second identifier, and the second identifier is an identifier of the second device; the fourth message is used to request security information; the security information is used for at least one of: authenticating and / or protecting the second device; verifying and / or protecting related authorization information of the second device, and the related authorization information comprises a token related to the second device; and establishing a TLS connection between the second device and the first device; and receiving a fourth response sent by the first device.

[0487] In some embodiments, the fourth message comprises: a first identifier, and the first identifier is an identifier of the third device, and the first identifier is used by the first device to return information related to the security information to the fourth device, so that the fourth device sends to the third device corresponding to the first identifier.

[0488] In some embodiments, the security information comprises at least one of: a key, wherein the key is generated by the first device; and a certificate, wherein the certificate is a root certificate of a certificate of the first device or a certificate of the second device.

[0489] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0490] The above embodiments can be implemented alone or in combination with each other, and the optional implementation can refer to the optional implementation of steps in FIG. 2B and FIG. 4D, which are not described herein again.

[0491] FIG. 5A is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5A, the embodiment of the present disclosure relates to an information processing method, which is performed by a second device, and the above method comprises:

[0492] In step S5101, a first message is sent to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device.

[0493] The optional implementation of step S5101 can refer to the optional implementation of step S2101 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0494] In step S5102, a first response sent by the first device is received, where the first response is used to indicate a security mechanism of interaction between the second device and the third device.

[0495] The optional implementation of step S5102 can refer to the optional implementation of step S2109 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0496] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0497] The information processing method related to the embodiments of the present disclosure can include at least one of steps S5101 to S5102. For example, step S5101 can be implemented as an independent embodiment; step S5102 can be implemented as an independent embodiment; and the combination of step S5101 and step S5102 can be implemented as an independent embodiment.

[0498] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0499] FIG. 5B is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5B, the embodiments of the present disclosure relate to an information processing method, which is performed by a second device, and the above method includes:

[0500] In step S5201, a sixth message is sent to a third device, where the sixth message includes a second identifier, the second identifier is an identifier of the second device, and the sixth message is used to request to start an authentication process.

[0501] The optional implementation of step S5201 can refer to the optional implementation of step S2201 in FIG. 2B and other associated parts in the embodiments related to FIG. 2B, which will not be repeated here.

[0502] In step S5202, a sixth response sent by the third device is received, where the sixth response is used to indicate an agreement to start the authentication process.

[0503] The optional implementation of step S5202 can refer to the optional implementation of step S2206 in FIG. 2B and other associated parts in the embodiments related to FIG. 2B, which will not be repeated here.

[0504] In some embodiments, the sixth message comprises at least one of: a third identity, wherein the third identity is an identity of the first device; and the first identity, wherein the first identity is an identity of the third device.

[0505] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0506] The above embodiments can be implemented independently or in combination with each other. For optional implementation, refer to the optional implementation of the steps in FIG. 2B, which will not be described here.

[0507] FIG. 6A is a flow diagram illustrating a method of information processing according to an embodiment of the present disclosure. As shown in FIG. 6A, the embodiment of the present disclosure relates to a method of information processing, which is performed by a third device, and comprises:

[0508] In step S6101, third information is sent to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device.

[0509] Optionally, the third information is used by the first device to determine a security mechanism for interaction between the second device and the third device, or the third information is used by the fourth device to determine a security mechanism for interaction between the second device and the third device.

[0510] For optional implementation of step S6101, refer to the optional implementation of step S2102 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be described here.

[0511] In some embodiments, sending the third information to the fourth device comprises: sending the third information to the fourth device in a process in which the third device registers to the fourth device.

[0512] In some embodiments, the method further comprises: receiving a seventh message sent by the fourth device, wherein the seventh message is used to request the third information.

[0513] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0514] The above embodiments can be implemented independently or in combination with each other. For optional implementation, refer to the optional implementation of the steps in FIG. 2A, which will not be described here.

[0515] FIG. 6B is a flow diagram illustrating a method of information processing according to an embodiment of the present disclosure. As shown in FIG. 6B, the embodiment of the present disclosure relates to a method of information processing, which is performed by a third device, and comprises:

[0516] In step S6201, a sixth message is obtained.

[0517] The optional implementation of step S6201 can refer to the optional implementation of step S2201 in FIG. 2B and other associated parts in the embodiments related to FIG. 2B, which will not be repeated here.

[0518] In some embodiments, the third device receives the sixth message sent by the second device, but is not limited thereto, and can also receive the sixth message sent by other subjects.

[0519] In some embodiments, the third device acquires the sixth message specified by the protocol.

[0520] In some embodiments, the third device acquires the sixth message from the upper layer(s).

[0521] In some embodiments, the third device processes to obtain the sixth message.

[0522] In some embodiments, step S6201 is omitted, and the third device autonomously implements the function indicated by the sixth message, or the above function is default or default.

[0523] Step S6202, sending the fifth message.

[0524] The optional implementation of step S6202 can refer to the optional implementation of step S2202 in FIG. 2B and other associated parts in the embodiments related to FIG. 2B, which will not be repeated here.

[0525] In some embodiments, the third device can send the fifth message to the fourth device, but is not limited thereto, and can also send the fifth message to other subjects.

[0526] Step S6203, acquiring the fifth response.

[0527] The optional implementation of step S6203 can refer to the optional implementation of step S2205 in FIG. 2B and other associated parts in the embodiments related to FIG. 2B, which will not be repeated here.

[0528] In some embodiments, the third device receives the fifth response sent by the fourth device, but is not limited thereto, and can also receive the fifth response sent by other subjects.

[0529] In some embodiments, the third device acquires the fifth response specified by the protocol.

[0530] In some embodiments, the third device acquires the fifth response from the upper layer(s).

[0531] In some embodiments, the third device processes to obtain the fifth response.

[0532] In some embodiments, step S6203 is omitted, and the third device autonomously implements the function indicated by the fifth response, or the function is default or default.

[0533] Step S6204, sending a sixth response.

[0534] The optional implementation of step S6204 can refer to the optional implementation of step S2206 in FIG. 2B, and other associated parts in the embodiments involved in FIG. 2B, which will not be repeated here.

[0535] In some embodiments, the third device can send the sixth response to the second device, but is not limited thereto, and can also send the sixth response to other subjects.

[0536] The information processing method involved in the embodiments of the present disclosure can include at least one of steps S6201 to S6204. For example, step S6201 can be implemented as an independent embodiment; step S6202 can be implemented as an independent embodiment; step S6203 can be implemented as an independent embodiment; step S6204 can be implemented as an independent embodiment; a combination of steps S6201 and S6204 can be implemented as an independent embodiment; a combination of steps S6201 to S6204 can be implemented as an independent embodiment.

[0537] In some embodiments, steps S6202 and S6203 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0538] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0539] FIG. 6C is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 6C, the embodiments of the present disclosure involve an information processing method, which is performed by a third device, and the method includes:

[0540] Step S6301, receiving a sixth message sent by a second device, wherein the sixth message includes a second identifier; the second identifier is an identifier of the second device; and the sixth message is used to request to start an authentication process.

[0541] The optional implementation of step S6301 can refer to the optional implementation of step S2201 in FIG. 2B, or the optional implementation of step S6201 in FIG. 6B, and other associated parts in the embodiments involved in FIG. 2B and FIG. 6B, which will not be repeated here.

[0542] Step S6302, sending a sixth response to the second device, wherein the sixth response is used to indicate an agreement to start the authentication process.

[0543] The optional implementation of step S6302 can refer to the optional implementation of step S2201 in FIG. 2B, or the optional implementation of step S6204 in FIG. 6B, and other associated parts in the embodiments related to FIG. 2B and FIG. 6B, which are not described here again.

[0544] In some embodiments, the sixth message comprises at least one of: the third identity, wherein the third identity is an identity of the first device; and the first identity, wherein the first identity is an identity of the third device.

[0545] In some embodiments, the method comprises: sending, to the fourth device, a fifth message, wherein the fifth message comprises a second identity, the second identity is an identity of the second device, and the fifth message is used to request security information; the security information is used for at least one of: authenticating and / or protecting the identity of the second device; verifying and / or protecting relevant authorization information of the second device, the relevant authorization information comprises a token related to the second device; and establishing a TLS connection between the second device and the first device; and receiving a fifth response sent by the fourth device, wherein the fifth response comprises the security information.

[0546] In some embodiments, the fifth message comprises at least one of: the first identity, wherein the first identity is an identity of the third device, and the first identity is used for the fourth device to send the fifth response to the third device corresponding to the first identity; and the third identity, wherein the third identity is an identity of the first device.

[0547] In some embodiments, the security information comprises at least one of: a key, wherein the key is generated by the first device; and a certificate, wherein the certificate is a root certificate that is a certificate of the first device or a certificate of the second device.

[0548] In some embodiments, the first device and the second device are in a first domain; and the third device and the fourth device are in a second domain.

[0549] The above embodiments can be implemented alone or in combination with each other, and the optional implementation can refer to the optional implementation of the steps in FIG. 2B and FIG. 6B, which are not described here again.

[0550] FIG. 7A is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 7A, the embodiment of the present disclosure relates to an information processing method, which is used for an information processing system 100, and the method comprises one of the following steps:

[0551] In step S7101, the second device sends a first message to the first device, wherein the first message comprises a first identity, the first identity is an identity of the third device, and the first message is used to request a security mechanism for interaction between the second device and the third device.

[0552] The optional implementation of step S7101 can refer to the optional implementation in step S2101 in FIG. 2A, step S3101 in FIG. 3A, step S5101 in FIG. 5A, and other associated parts in the embodiments related to FIG. 2A, FIG. 3A, FIG. 4A, and FIG. 5A, which will not be repeated here.

[0553] In step S7102, the first device sends a first response to the second device, where the first response is used to indicate a security mechanism of the interaction between the second device and the third device.

[0554] The optional implementation of step S7102 can refer to the optional implementation in step S2109 in FIG. 2A, step S3107 in FIG. 3A, step S5102 in FIG. 5A, and other associated parts in the embodiments related to FIG. 2A, FIG. 3A, and FIG. 5A, which will not be repeated here.

[0555] In some embodiments, the above method can include the method of the above-mentioned information processing system side, first device side, second device side, third device side, and / or fourth device side, and other embodiments, which will not be repeated here.

[0556] FIG. 7B is an interaction diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 7B, the embodiments of the present disclosure relate to an information processing method, for an information processing system 100, the method comprising one of the following steps:

[0557] In step S7201, the third device sends a fifth message to the fourth device, where the fifth message includes a second identifier, the second identifier being an identifier of the second device; and the fifth message is used to request security information.

[0558] Optionally, the security information is used for at least one of the following: authenticating and / or protecting the identity of the second device; verifying and / or protecting the relevant authorization information of the second device, the relevant authorization information including a token related to the second device; and establishing a TLS connection between the second device and the first device.

[0559] The optional implementation of step S7201 can refer to the optional implementation in step S2202 in FIG. 2B, step S4401 in FIG. 4D, step S6202 in FIG. 6B, step S5101 in FIG. 5A, and other associated parts in the embodiments related to FIG. 2B, FIG. 4D, and FIG. 6B, which will not be repeated here.

[0560] In step S7202, the fourth device sends a fifth response to the third device, where the fifth response includes the security information.

[0561] The optional implementation of step S7202 can refer to the optional implementation in step S2205 in FIG. 2B, the optional implementation in step S4404 in FIG. 4D, the optional implementation in step S6203 in FIG. 6B, and other associated parts in the embodiments related to FIG. 2B, FIG. 4D, and FIG. 6B, which are not described herein again.

[0562] In some embodiments, the above method can include the method of the above-mentioned information processing system side, first device side, second device side, third device side, and / or fourth device side, and the like, which are not described herein again.

[0563] FIG. 8A is a schematic diagram illustrating an overview of a CAPIF interconnection related authentication mechanism according to embodiments of the present disclosure. As shown in FIG. 8A, the CAPIF interconnection related authentication mechanism can include: scheme one, a TLS-PSK based authentication mechanism in a CCF interconnection scenario; scheme two, a TLS-PKI based authentication mechanism in a CCF interconnection scenario; scheme three, negotiation of a security mechanism for a CAPIF interconnection scenario; and the scheme three can be used to support the scheme one and the scheme two.

[0564] In some embodiments, the prerequisites for the following scheme one, scheme two, and scheme three are:

[0565] The resource owner can be a user of a UE or a subscription user, depending on the use case and regulations.

[0566] The resource owner function is responsible for interacting with the resource owner; the resource owner function can be part of a UE, a personal computer, and the like.

[0567] The resource owner function enables at least one of the following functions: resource access authorization, management, and revocation of resource access authorization.

[0568] Scheme one, a TLS-PSK based authentication mechanism in a CCF interconnection scenario:

[0569] FIG. 8B is a flow diagram of an information processing method according to embodiments of the present disclosure. As shown in FIG. 8B, the present disclosure relates to an information processing method, which includes:

[0570] Step S8101, a TLS connection is established between an API invoker and a CCF-A.

[0571] Optionally, the API invoker sends service API interface information to the CCF-A to export a key (AEF psk ). The key (AEF psk ) is derived by setting the input key of a key derivation function (KDF) as the key of the CAPIF-1e TLS session, and the following parameters are also input of the KDF:

[0572] FC = 0x7A;

[0573] P0 = Service API interface information; P0 is the interface information of CAPIF-1e, which is the interface between API Invoker and CCF-A;

[0574] L0 = Length of the Service API interface information;

[0575] P1 = Session ID of CAPIF-1e TLS session, generated as part of TLS full handshake;

[0576] L1 = Length of the Session ID of CAPIF-1e TLS session.

[0577] Optionally, the key (AEF psk ) is the key in the previous embodiments.

[0578] Step S8102, the API Invoker and the CCF-A derive a key (AEF psk ).

[0579] Optionally, after the successful establishment of TLS between the API Invoker and the CCF-A, the API Invoker and the CCF-A derive a key (AEF psk ).

[0580] Step S8103, the API Invoker sends an Authentication Initiation Request protected by the key (AEF psk ) to the AEF.

[0581] Optionally, the Authentication Initiation Request includes an API Invoker ID and a CCF-A ID. The API Invoker ID is the second identifier in the previous embodiments; the CCF-A ID is the third identifier in the previous embodiments. The Authentication Initiation Request can be the sixth message in the previous embodiments.

[0582] Step S8104A, the AEF sends a Security Information Request to the CCF-B to request security information.

[0583] Optionally, based on the received Authentication Initiation Request, if the AEF does not have a valid key, the AEF requests security information from the CCF-B. The Security Information Request in step S8104A is the fifth message in the previous embodiments.

[0584] Step S8104B, the CCF-B sends a Security Information Request to the CCF-A to request security information.

[0585] Optionally, after receiving the security information request, the CCF-B sends the security information request to the CCF-A corresponding to the CCF-A ID based on the CCF-A ID in the security information request. Optionally, the security information request in step S8104B is the fourth message in the previous embodiments.

[0586] Step S8104C, the CCF-A sends a security information response to the CCF-B.

[0587] Optionally, the CCF-A sends the security information response to the CCF-B, and the security information response includes the security information and the AEF ID; the security information can further include the CCF-A ID and / or the API Invoker ID. The security information response in step S8304C can be the fourth response in the previous embodiments.

[0588] Step S8104D, the CCF-B sends the security information response to the AEF.

[0589] Optionally, the CCF-B sends the security information response to the AEF corresponding to the AEF ID based on the AEF ID in the security information response. The security information response in step S8304D can be the fifth response in the previous embodiments.

[0590] Step S8105, the AEF sends an authentication initiation response to the API Invoker.

[0591] Optionally, after obtaining the security information (e.g., the AEF psk ) used for authentication, the AEF sends the authentication initiation response to the API Invoker to initiate the TLS session establishment, etc. The authentication initiation response can be the sixth response in the previous embodiments.

[0592] Step S8106, the API Invoker and the AEF perform mutual authentication and establish a TLS session using the key (the AEF psk ).

[0593] Step S8107, the API Invoker sends an API invocation request to the AEF.

[0594] Optionally, the API invocation request includes the CCF-A ID.

[0595] Step S8108A, the AEF sends an authorization request to the CCF-B.

[0596] Optionally, the AEF sends an authorization request to the CCF-B to request authorization of the API invoker's invocation request; the API invoker has been authenticated by the CCF-A.

[0597] Step S8108B, the CCF-B sends an authorization response to the AEF.

[0598] Optionally, the CCF-B sends an authorization response to the AEF to authorize the API invoker's API invocation request authenticated by the CCF-A.

[0599] Step S8109, the AEF sends an API invocation response to the API invoker.

[0600] In the embodiments of the present disclosure, part or all of the steps, and the optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with the optional implementation manners of other embodiments.

[0601] Scheme two, TLS-PKI based authentication mechanism in the CCF interconnection scenario:

[0602] FIG. 8C is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 8C, the present disclosure relates to an information processing method, which comprises:

[0603] Step S8201, the API invoker sends an authentication start request to the AEF.

[0604] Optionally, the authentication start request comprises an API Invoker ID and a CCF-A ID. The API Invoker ID is the second identifier in the previous embodiment; the CCF-A ID is the third identifier in the previous embodiment. The authentication start request can be the sixth message in the previous embodiment.

[0605] The API invoker authenticates with the AEF by establishing a TLS session with the AEF based on an authentication and authorization method (i.e., server (AEF) side certificate authentication or certificate-based mutual authentication) as indicated by the CCF-A on which the API invoker is onboarding. Before establishing the TLS session, the following procedures should be performed:

[0606] Step S8202A, the AEF sends a security information request to the CCF-B to request security information (Request security information).

[0607] Optionally, the security information includes an API Invoker ID and a CCF-A ID. The API Invoker ID is the second identity in the previous embodiments; the CCF-A ID is the third identity in the previous embodiments. The security information request in step S8202A is the fifth message in the previous embodiments. The CCF-A is a CCF that the API Invoker is online subscribed to.

[0608] In step S8202B, the CCF-B sends a security information request to the CCF-A to request the security information.

[0609] Optionally, the CCF-B indicates, based on the received CCF-A ID, that the AEF does not use the certificate of the CCF-B to verify the certificate of the API Invoker, but obtains the security information from the CCF-A to perform authentication and security connection establishment with the API Invoker. The CCF-B sends the security information request to the CCF-A indicated by the CCF-A ID.

[0610] In step S8202C, the CCF-A sends a security information response to the CCF-B.

[0611] Optionally, the CCF-A sends the security information response to the CCF-B, and the security information response includes the security information (e.g., the certificate of the CCF-A) and the AEF ID; the security information can further include the CCF-A ID and / or the API Invoker ID. The security information response in step S8304C can be the fourth response in the previous embodiments.

[0612] In step S8202D, the CCF-B sends the security information response to the AEF.

[0613] Optionally, the CCF-B sends the security information response to the AEF corresponding to the AEF ID in the security information response. Optionally, the CCF-B can send the security response to the AEF through the CAPIF-3 interface. The security information response in step S8304D can be the fifth response in the previous embodiments.

[0614] Optionally, the security information can be security information related to a security mechanism (e.g., a security mechanism such as TLS with an OAuth token) selected by the AEF and the API Invoker for the interaction.

[0615] Optionally, based on the trusted business relationship between the CCF-A and the CCF-B, the CCF-A returns the root CA certificate (e.g., the CCF-A certificate) of the API Invoker to the AEF through the CCF-B for verifying the certificate of the API Invoker.

[0616] Optionally, the CCF-A returns the root certificate of the CCF-A to the AEF through the CCF-B for verifying the certificate of the API Invoker.

[0617] Optionally, since the root CA certificate of the API invoker (i.e. CCF-A certificate) is not for each API invoker, the CCF-B can have obtained the CCF-A certificate due to business relationship between domain A and domain B before the AEF requests the API invoker to authenticate. Then, the CCF-B can send the stored CCF-A certificate directly to the AEF without contacting the CCF-A in step S8202B; i.e. steps S802B and S8202C can be removed.

[0618] Optionally, after obtaining the security information for authenticating the identity of the API invoker, the AEF can authenticate the identity of the API invoker using the CCF-A certificate and send an authentication initiation response message to the API invoker to initiate a TLS session establishment procedure.

[0619] Step S8203, the AEF sends an authentication initiation response to the API invoker.

[0620] Optionally, after obtaining the security information for authenticating (e.g. CCF-A certificate), the AEF sends an authentication initiation response to the API invoker to initiate a TLS session establishment, etc. The authentication initiation response can be the sixth response in the previous embodiments.

[0621] Step S8204, the API invoker and the AEF perform mutual authentication using the certificates and establish a TLS session.

[0622] Step S8205, the API invoker sends an API invocation request to the AEF.

[0623] Optionally, the API invocation request includes the CCF-A ID.

[0624] Step S8206A, the AEF sends an authorization request to the CCF-B.

[0625] Optionally, the AEF sends an authorization request to the CCF-B to request authorization of the invocation request of the API invoker; the API invoker has been authenticated by the CCF-A.

[0626] Step S8206B, the CCF-B sends an authorization request to the CCF-A.

[0627] Step S8206C, the CCF-A sends an authorization response to the CCF-B

[0628] Optionally, the CCF-A sends an authorization response to the CCF-B to authorize the API invocation request of the API invoker authenticated by the CCF-A.

[0629] At step S8206D, the CCF-B sends an authorization response to the AEF.

[0630] Optionally, the CCF-B sends an authorization response to the AEF to authorize the API invocation request of the API invoker authenticated by the CCF-A.

[0631] At step S8207, the AEF sends an API invocation response to the API invoker.

[0632] In the embodiments of the present disclosure, part or all of the steps, and the optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with the optional implementation manners of other embodiments.

[0633] Scheme three, negotiation of security mechanism of CAPIF interconnection scenario:

[0634] The API invoker and the CCF should negotiate the security method (i.e., security mechanism) used by the API invoker and the AEF for identity authentication and / or protection. After successful mutual authentication of the CAPIF-1e interface (interface between the API invoker and the CCF), according to the service API subscribed by the API invoker, the access scenario (whether the API invoker accesses the AEF before the service API invocation or accesses the AEF when the service API is invoked), and the AEF capability, the CCF should select the security mechanism, and send the selected security mechanism to the API invoker together with the information required for the authentication of the API invoker by the AEF. The information can include the validity time of the CAPIF-2e (interface between the API invoker and the AEF) credential.

[0635] Optionally, the CCF can include a CCF-A and a CCF-B; the API invoker can be in the same domain as the CCF-A; the CCF-A determines the security mechanism for the interaction between the API invoker and the AEF, and sends the security mechanism to the API invoker; or the CCF-B determines the security mechanism for the interaction between the API invoker and the AEF, and sends the security mechanism to the CCF-A, and the CCF-A forwards the security mechanism to the API invoker.

[0636] Prerequisite: the API invoker is online and subscribes in the CCF-A.

[0637] FIG. 8D is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 8D, the embodiments of the present disclosure relate to an information processing method, which includes:

[0638] Step S8301, the AEF configures the supported security mechanism to the CCF-B.

[0639] Optionally, the AEF sends the CCF-B the security mechanism supported by the AEF, or the CCF-B requests the AEF to provide the security mechanism supported by the AEF. The AEF sending the CCF-B the security mechanism supported by the AEF can be the third information sent in the previous embodiment; the CCF-B requesting the AEF to provide the security mechanism can be the seventh information sent to the AEF in the previous embodiment.

[0640] Optionally, the security mechanism can include at least one of the following: TLS-PSK, TLS-PKI, TLS with OAuth token, oauth client credential flow, authorization code flow, and PKCE flow.

[0641] Step S8302, a TLS connection is established between the API invoker and the CCF-A.

[0642] Optionally, the mutual authentication based on client and server certificates is established between the API invoker and the CCF-A using TLS.

[0643] Step S8303, the API invoker sends a security method request to the CCF-A.

[0644] Optionally, the security method request is used to request the security mechanism for the interaction between the API invoker and the AEF; the security method request includes the information (such as address information) of the AEF and / or the security mechanism supported by the API invoker. The security method request can be the first message in the previous embodiment, and the security mechanism supported by the API invoker can be the first information in the previous embodiment.

[0645] Optionally, the first information can also be replaced by CAPIF-2 / CAPIF-2e security capability information, which indicates the list of security mechanisms supported by the API invoker for each AEF on the CAPIF-2 / CAPIF-2e interface. The security mechanism can include at least one of the following: TLS-PSK, TLS-PKI, TLS with OAuth token, oauth client credential flow, authorization code flow, and PKCE flow.

[0646] Step S8304A, the CCF-B selects a security mechanism.

[0647] Optionally, the CCF-A sends to the CCF-B a common security mechanism supported by both the CCF-A and the API invoker, or the CCF-A sends to the CCF-B a full set of security mechanisms supported by the CCF-A and a full set of security mechanisms supported by the API invoker. Here, the common security mechanism can be the security mechanism commonly supported in the previous embodiment; the full set of security mechanisms supported by the CCF-A can be the security mechanisms supported by the first device in the previous embodiment, and the full set of security mechanisms supported by the API invoker can be the security mechanisms supported by the second device in the previous embodiment. Here, the AEF can be the target AEF.

[0648] Optionally, if the CCF-A finds that the AEF is discovered through the CCF-B, the CCF-A sends to the CCF-B a common security mechanism supported by both the CCF-A and the API invoker, or the CCF-A sends to the CCF-B a full set of security mechanisms supported by the CCF-A and a full set of security mechanisms supported by the API invoker.

[0649] Optionally, if the CCF-A finds that the AEF-related service information (e.g., service API) is discovered through the CCF-B, the CCF-A sends to the CCF-B a common security mechanism supported by both the CCF-A and the API invoker, or the CCF-A sends to the CCF-B a full set of security mechanisms supported by the CCF-A and a full set of security mechanisms supported by the API invoker.

[0650] Optionally, the CCF-B should select a security mechanism used on the CAPIF-2 / CAPIF-2e interface for each requested AEF, while taking into account the information from the CCF-A in step S8303, the access scenario, and the AEF capabilities. The information from the CCF-A refers to the security mechanisms supported by the CCF-A (i.e., the second information in the previous embodiment); the AEF capabilities refer to the security mechanisms supported by the AEF (i.e., the third information in the previous embodiment); and the access scenario refers to whether the API invoker accesses the AEF before or after the API service invocation.

[0651] Optionally, the CCF-B should send to the CCF-A a security method response indicating the selected security mechanism for each AEF and the security information related to the security mechanism.

[0652] Step S8304B, the CCF-A selects a security mechanism.

[0653] Optionally, if CCF-A discovers that AEF is discovered through CCF-B, CCF-A sends AEF ID to CCF-B. AEF ID is used to request CCF-B to provide security methods supported by AEF (i.e. the third information in the previous embodiment).

[0654] Optionally, if CCF-A discovers that AEF-related service information (e.g. service API) is discovered through CCF-B, CCF-A sends AEF ID to CCF-B. AEF ID is used to request CCF-B to provide security methods supported by AEF (i.e. the third information in the previous embodiment).

[0655] Optionally, CCF-A sends AEF ID to CCF-B. AEF ID is used to request CCF-B to provide security methods supported by AEF (i.e. the third information in the previous embodiment).

[0656] Optionally, CCF-A shall select the security mechanism to be used on CAPIF-2 / CAPIF-2e interface for each requested AEF, taking into account the information from API invoker in step S8303, security mechanisms supported by CCF-A, access scenario and AEF capabilities.

[0657] In step S8305, CCF-A sends a security method response to the API invoker.

[0658] Optionally, the security method response is used to indicate the security mechanism selected for each AEF and the security information related to the security mechanism (i.e. the security mechanism agreed for the interaction between API invoker and AEF).

[0659] Optionally, the security method response is used to indicate the security mechanism for the interaction between API invoker and AEF.

[0660] In the embodiments of the present disclosure, part or all of the steps, and the optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with the optional implementation manners of other embodiments.

[0661] The embodiments of the present disclosure relate to an information processing method, which comprises:

[0662] The CCF-A comprises:

[0663] In some embodiments, the CCF-A shall be able to provide AEF ID and security information to CCF-B.

[0664] In some embodiments, if CCF-A finds that the target AEF is discovered by CCF-B, CCF-A should be able to send to CCF-B the common security mechanisms supported by both CCF-A and API Invoker.

[0665] In some embodiments, CCF-A should be able to send to CCF-B the full set of security mechanisms supported by CCF-A and the full set of security mechanisms supported by API Invoker.

[0666] In some embodiments, if CCF-A finds that the target AEF is discovered by CCF-B, CCF-A sends to CCF-B the AEF ID. The AEF ID is used to request CCF-B to provide the security mechanisms supported by the AEF.

[0667] In some embodiments, CCF-A should be able to select for each requested AEF the security mechanism to use on CAPIF-2 / Interface, taking into account the information from API Invoker, the security mechanisms supported by CCF-A, the access scenario and the AEF capabilities.

[0668] CCF-B:

[0669] In some embodiments, CCF-B should be able to receive from AEF the AEF ID, API Invoker ID and CCF-A ID.

[0670] In some embodiments, CCF-B should be able to request security information from the identified CCF-A.

[0671] In some embodiments, CCF-B should be able to receive from CCF-B the supported security mechanisms. The security mechanisms include at least one of: TLS-PSK, TLS-PKI, TLS with OAuth token, OAuth client credentials flow, authorization code flow and PKCE flow, etc.

[0672] In some embodiments, CCF-B should be able to select for each requested AEF the security mechanism to use on CAPIF-2 / CAPIF-2e interface, taking into account the information from CCF-A, the access scenario and the AEF capabilities.

[0673] In some embodiments, CCF-B should be able to send to CCF-A a security method response indicating the selected security mechanism for each AEF, any security information related to the security mechanism.

[0674] In some embodiments, to request security information, CCF-B should be able to send to API Invoker Invoker the CCF identified by the CCF-A ID.

[0675] In some embodiments, CCF-B should be able to send the security information provided by CCF-A to AEF.

[0676] API Invoker:

[0677] In some embodiments, the API Invoker should be able to send an API invocation request to AEF, the API invocation request including CCF-A ID.

[0678] AEF:

[0679] In some embodiments, the AEF should be able to receive CCF-A ID from the API Invoker.

[0680] In some embodiments, the AEF should be able to send a security information request to CCF-B, the security information request including AEF ID, API Invoker ID and CCF-A ID.

[0681] In some embodiments, the AEF should be able to send supported security mechanisms to CCF-B. The security mechanisms include TLS-PSK, TLS-PKI, TLS with OAuth token, OAuth client credential flow, authorization code flow, PKCE flow, etc.

[0682] In some embodiments, upon receiving the CCF-A ID, the AEF should be able to request security information from CCF-A via CCF-B to perform authentication and security connection establishment with the API Invoker.

[0683] In some embodiments, part or all of the steps, and optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with optional implementation manners of other embodiments.

[0684] The embodiments of the present disclosure also propose an apparatus for implementing any of the above methods, for example, an apparatus including units or modules for implementing each step performed by a terminal in any of the above methods. For another example, another apparatus is proposed, including units or modules for implementing each step performed by a network device (such as an access network device, a core network function node, a core network device, etc.) in any of the above methods.

[0685] It should be understood that the division of each unit or module in the above apparatus is only a logical function division, and all or part of them can be integrated into a physical entity or physically separated in actual implementation. In addition, the units or modules in the apparatus can be implemented in the form of processor calling software: for example, the apparatus includes a processor, the processor is connected with a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to realize any of the above methods or realize the functions of each unit or module of the above apparatus, wherein the processor is a general processor such as a central processing unit (CPU) or a microprocessor, and the memory is a memory in the apparatus or a memory outside the apparatus. Alternatively, the units or modules in the apparatus can be implemented in the form of hardware circuit, and the functions of part or all of the units or modules can be realized by the design of hardware circuit. The above hardware circuit can be understood as one or more processors; for example, in one implementation, the above hardware circuit is an application-specific integrated circuit (ASIC), and the functions of part or all of the units or modules are realized by the design of the logical relationship of elements in the circuit; for another example, in another implementation, the above hardware circuit is a programmable logic device (PLD), and a field programmable gate array (FPGA) is taken as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of part or all of the above units or modules. All units or modules of the above apparatus can be all implemented in the form of processor calling software, or all implemented in the form of hardware circuit, or part implemented in the form of processor calling software and the remaining part implemented in the form of hardware circuit.

[0686] In the embodiments of the present disclosure, the processor is a circuit with signal processing capability. In one implementation, the processor can be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), a digital signal processor (DSP), or the like. In another implementation, the processor can implement certain functions through a logical relationship of hardware circuits, and the logical relationship of the hardware circuits is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In the reconfigurable hardware circuit, the processor loads a configuration document to implement the configuration of the hardware circuit. It can be understood that the processor loads instructions to implement the functions of the above part or all units or modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), or the like.

[0687] FIG. 9A is a structural schematic diagram of a first device 9100 according to an embodiment of the present disclosure. As shown in FIG. 9A, the first device 9100 includes a first receiving and transmitting module 9101 and a first processing module 9102. In some embodiments, the first receiving and transmitting module 9101 is configured to receive the first message and / or receive the fourth message. Optionally, the first receiving and transmitting module 9101 is configured to perform at least one of the sending and / or receiving steps performed by the first device 9100 in any of the methods, details of which are not described herein again. In some embodiments, the first processing module 9102 is configured to determine the security mechanism of the interaction between the second device and the third device. Optionally, the first processing module 9102 performs at least one of the processing steps performed by the first device 9100 in any of the methods, details of which are not described herein again.

[0688] FIG. 9B is a structural schematic diagram of the fourth device 9200 according to an embodiment of the present disclosure. As shown in FIG. 9B, the fourth device 9200 includes a second transceiver module 9201 and a second processing module 9202. In some embodiments, the second transceiver module 9201 is configured to send the second response message and / or receive the fifth message. Optionally, the second transceiver module 9201 is configured to perform at least one of the sending and / or receiving steps performed by the fourth device 9200 in any of the methods described above, details of which are not described herein again. In some embodiments, the second processing module 9202 is configured to determine the security mechanism for the interaction between the second device and the third device. Optionally, the second processing module 9202 is configured to perform at least one of the processing steps performed by the fourth device 9200 in any of the methods described above, details of which are not described herein again.

[0689] FIG. 9C is a structural schematic diagram of the second device 9300 according to an embodiment of the present disclosure. As shown in FIG. 9C, the second device 9300 includes a third transceiver module 9301. In some embodiments, the third transceiver module 9301 is configured to send the first message and / or send the sixth message. Optionally, the third transceiver module 9301 is configured to perform at least one of the sending and / or receiving steps performed by the second device 9300 in any of the methods described above, details of which are not described herein again.

[0690] FIG. 9D is a structural schematic diagram of the third device 9400 according to an embodiment of the present disclosure. As shown in FIG. 9D, the third device 9400 includes a fourth transceiver module 9401. In some embodiments, the fourth transceiver module 9401 is configured to receive the seventh message and / or send the fifth message. Optionally, the fourth transceiver module 9401 is configured to perform at least one of the sending and / or receiving steps performed by the third device 9400 in any of the methods described above, details of which are not described herein again.

[0691] In some embodiments, the transceiver module can include a sending module and / or a receiving module, which can be separate or integrated together. Optionally, the transceiver module can be replaced by a transceiver. For example, the first transceiver module includes a first sending module and / or a first receiving module. For example, the second transceiver module includes a second sending module and / or a second receiving module.

[0692] In some embodiments, the processing module can be one module or include multiple sub-modules. Optionally, the multiple sub-modules perform all or part of the steps required to be performed by the processing module. Optionally, the processing module can be replaced by a processor.

[0693] FIG. 10A is a structural schematic diagram of a communication device 10100 according to an embodiment of the present disclosure. The communication device 10100 can be a network device (for example, an access network device, a core network device, etc.), a terminal, a chip, a chip system, or a processor supporting the network device to implement any of the above methods, or a chip, a chip system, or a processor supporting the terminal to implement any of the above methods. The communication device 10100 can be used to implement the methods described in the above method embodiments, and details can be referred to the descriptions in the above method embodiments.

[0694] As shown in FIG. 10A, the communication device 10100 includes one or more processors 10101. The processor 10101 can be a general processor or a special-purpose processor, for example, a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data, and the central processing unit can be used to control the communication device (for example, a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute programs, and process data of the programs. Optionally, the communication device 10100 is configured to implement any of the above methods. Optionally, the one or more processors 10101 are configured to invoke instructions to enable the communication device 10100 to implement any of the above methods.

[0695] In some embodiments, the communication device 10100 further includes one or more transceivers 10102. When the communication device 10100 includes the one or more transceivers 10102, the transceiver 10102 performs at least one of the communication steps (for example, at least one of steps S2101 to S2104, S2106, S2108, S2109, S2201 to S2206, etc., but not limited to) in the above methods, and the processor 10101 performs at least one of the other steps (for example, steps S2105 and / or S2107, etc., but not limited to). In optional embodiments, the transceiver can include a receiver and / or a transmitter, which can be separate or integrated together. Optionally, the terms of transceiver, transceiving unit, transceiver, transceiving circuit, interface circuit, interface, etc. can be replaced with each other, and the terms of transmitter, transmitting unit, transmitter, transmitting circuit, etc. can be replaced with each other, and the terms of receiver, receiving unit, receiver, receiving circuit, etc. can be replaced with each other.

[0696] In some embodiments, the communication device 10100 also includes one or more memories 10103 for storing data. Optionally, all or a portion of the memory 10103 can also reside in the communication device 10100. In some embodiments, the communication device 10100 can include one or more interface circuits 10104. Optionally, the interface circuit 10104 can be used to receive data from the memory 10103 or from another device or system, or to send data to the memory 10103 or to another device or system. For example, the interface circuit 10104 can receive data in packets, each packet having a header and a payload.

[0697] The communication device 10100 described in the above embodiments can be a network device or a terminal, but the scope of the communication device 10100 described in the present disclosure is not limited thereto, and the structure of the communication device 10100 can not be limited by FIG. 10A. The communication device can be a standalone device or can be part of a larger device. For example, the communication device can be: (1) a standalone integrated circuit (IC), or a chip, or a chip system or subsystem; (2) a set of one or more ICs, which can optionally also include a storage component for storing data, programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, a terminal device, a smart terminal device, a cellular phone, a wireless device, a handset, a mobile unit, a vehicle-mounted device, a network device, a cloud device, an artificial intelligence device, etc.; (6) other devices, etc.

[0698] FIG. 10B is a structural diagram of a chip 10200 according to an embodiment of the present disclosure. For the case where the communication device 10100 is a chip or a chip system, the structural diagram of the chip 10200 shown in FIG. 10B can be referred to, but is not limited thereto.

[0699] The chip 10200 includes one or more processors 10201. The chip 10200 is configured to perform any of the above methods.

[0700] In some embodiments, the chip 10200 further includes one or more interface circuits 10202. Optionally, the terms interface circuit, interface, transceiver pin, etc. can be replaced by each other. In some embodiments, the chip 10200 further includes one or more memories 10203 for storing data. Optionally, all or part of the memory 10203 can be outside the chip 10200. Optionally, the interface circuit 10202 is connected with the memory 10203, the interface circuit 10202 can be used to receive data from the memory 10203 or other devices, the interface circuit 10202 can be used to send data to the memory 10203 or other devices. For example, the interface circuit 10202 can read the data stored in the memory 10203 and send the data to the processor 10201.

[0701] In some embodiments, the interface circuit 10202 performs at least one of the communication steps (such as at least one of steps S2101 to S2104, S2106, S2108, S2109, S2201 to S2206, etc.) of the above method. The interface circuit 10202 performing the communication steps of the above method, for example, means that the interface circuit 10202 performs data interaction between the processor 10201, the chip 10200, the memory 10203 or the transceiver device. In some embodiments, the processor 10201 performs at least one of the other steps (such as steps S2105 and / or S2107, etc., but not limited thereto).

[0702] The modules and / or devices described in each embodiment of the virtual device, the physical device, the chip, etc. can be combined or separated as appropriate. Optionally, part or all of the steps can also be performed by multiple modules and / or devices, which are not limited herein.

[0703] The disclosure also proposes a storage medium, and the above storage medium stores instructions, when the above instructions run on the communication device 10100, the communication device 10100 executes any one of the above methods. Optionally, the above storage medium is an electronic storage medium. Optionally, the above storage medium is a computer readable storage medium, but not limited thereto, it can also be a storage medium readable by other devices. Optionally, the above storage medium can be a non-transitory storage medium, but not limited thereto, it can also be a transitory storage medium.

[0704] The disclosure also proposes a program product, and the above program product is executed by the communication device 10100, so that the communication device 10100 executes any one of the above methods. Optionally, the above program product is a computer program product.

[0705] The present disclosure also proposes a computer program which, when running on a computer, causes the computer to perform any of the above methods.

Claims

1. An information processing method characterized by comprising: The method is performed by a first device, comprising: receiving a first message sent by a second device, wherein the first message comprises a first identity, the first identity is an identity of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; sending a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

2. The method of claim 1, wherein, The first message further comprises at least one of: first information, wherein the first information is used to indicate a security mechanism supported by the second device; service information, the service information comprises at least one of: a service API, a resource, a service, and a service operation.

3. The method according to claim 1 or 2, characterized in that, The method further comprises: determining the security mechanism for interaction between the second device and the third device based on information of at least one of: the first information; second information, wherein the second information is used to indicate a security mechanism supported by the first device; third information, wherein the third information is used to indicate a security mechanism supported by the third device; service information.

4. The method of claim 3, wherein, The method further comprises: in a case where it is determined that the third device is discovered by a fourth device or in a case where it is determined that service information in the first message is discovered by the fourth device, sending a second message to the fourth device, wherein the second message comprises the first identity, and the second message is used to request the third information; receiving a second response sent by the fourth device, wherein the second response comprises the third information.

5. The method according to claim 1 or 2, characterized in that, The method further comprises: sending a third message to a fourth device, wherein the third message is used to request a security mechanism for interaction between a second device and the third device; receiving a third response sent by the fourth device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

6. The method of claim 5, wherein, The sending of the third message to the fourth device comprises: in a case where it is determined that the third device is discovered by the fourth device or in a case where it is determined that service information in the first message is discovered by the fourth device, the fourth device sends the third message, wherein the third message comprises fourth information; wherein the fourth information is used to indicate: a security mechanism commonly supported by the first device and the second device, or a security mechanism supported by the first device and / or a security mechanism supported by the second device.

7. The method according to any one of claims 1 to 6, characterized in that, The security mechanism comprises at least one of: a first security mechanism, wherein the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, wherein the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, wherein the third security mechanism is a TLS based mechanism with OAuth token; a fourth security mechanism, wherein the fourth security mechanism is an OAuth client credential flow based mechanism; a fifth security mechanism, wherein the fifth security mechanism is an authorization code flow based mechanism; a sixth security mechanism, wherein the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

8. The method according to any one of claims 1 to 7, characterized in that, The first device and the second device are in a first domain; the third device and the fourth device are in a second domain.

9. An information processing method characterized by comprising: The method is performed by a first device, and includes: receiving a fourth message sent by a fourth device, wherein the fourth message comprises a second identity, the second identity being an identity of a second device; the fourth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; sending a fourth response to the fourth device, wherein the fourth response comprises the security information.

10. The method of claim 9, wherein, The fourth message comprises a first identity, the first identity being an identity of a third device, and the first identity is used by the first device to return information related to the security information to the fourth device so that the fourth device sends the information to the third device corresponding to the first identity.

11. The method according to claim 9 or 10, characterized in that, The security information comprises at least one of the following: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a certificate of the first device or a root certificate of a certificate of the second device.

12. The method according to any one of claims 9 to 11, characterized in that, The first device and the second device are in a first domain; the third device and the fourth device are in a second domain.

13. An information processing method characterized by comprising: The method is performed by a fourth device, and includes: receiving a third message sent by a first device, wherein the third message comprises a first identity, the first identity being an identity of a third device, and the third message is used to request a security mechanism for interaction between a second device and the third device; sending a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

14. The method of claim 13, wherein, The third message is sent by the first device in a case where the first device determines that the third device is discovered by the fourth device or determines that service information in a first message is discovered by the fourth device, the first message being received by the first device from the second device; the third message comprises fourth information; wherein the fourth information is used to indicate a security mechanism commonly supported by the first device and the second device, or a security mechanism supported by the first device and / or a security mechanism supported by the second device.

15. The method according to claim 13 or 14, characterized in that, The method further comprises: determining the security mechanism for interaction between the second device and the third device based on information of at least one of the following: the fourth information; third information, wherein the third information is used to indicate a security mechanism supported by the third device, and the third information is obtained from the device; service information.

16. The method of claim 13, wherein, The method further comprises: receiving a second message sent by the first device, wherein the second message comprises the first identity, and the second message is used to request third information; sending a second response to the first device, wherein the second response comprises the third information.

17. The method according to any one of claims 13 to 16, characterized in that, The security mechanism comprises at least one of the following: a first security mechanism, wherein the first security mechanism is a TLS-PSK based mechanism; a second security mechanism, wherein the second security mechanism is a TLS-PKI based mechanism; a third security mechanism, wherein the third security mechanism is a TLS with OAuth token based mechanism; a fourth security mechanism, wherein the fourth security mechanism is an OAuth client credential flow based mechanism; a fifth security mechanism, wherein the fifth security mechanism is an authorization code flow based mechanism; a sixth security mechanism, wherein the sixth security mechanism is a code exchange proof key PKCE flow based mechanism.

18. An information processing method characterized by comprising: performed by a fourth device, comprising: receiving a fifth message sent by a third device, wherein the fifth message comprises a second identity, the second identity being an identity of a second device; the fifth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a transport layer security TLS connection between the second device and the first device; sending a fifth response to the third device, wherein the fifth response comprises the security information.

19. The method of claim 18, wherein, the fifth message comprises at least one of the following: a first identity, wherein the first identity is an identity of the third device, the first identity is used by the fourth device to send the fifth response to the third device corresponding to the first identity; a third identity, wherein the third identity is an identity of a first device.

20. The method of claim 19, wherein, the fifth message comprises a third identity, the method further comprising: based on the third identity, sending a fourth message to the first device corresponding to the third identity; wherein the fourth message comprises a second identity, the second identity being an identity of a second device; the fourth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a transport layer security TLS connection between the second device and the first device; receiving a fourth response sent by the first device.

21. The method of claim 20, wherein, the fourth message comprises: a first identity, the first identity being an identity of a third device, the first identity is used by the first device to return information related to the security information to the fourth device, so that the fourth device sends to the third device corresponding to the first identity.

22. The method according to any one of claims 18 to 21, characterized in that, the security information comprises at least one of the following: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a root certificate of a certificate of the first device or a certificate of the second device.

23. An information processing method characterized by comprising: performed by a second device, comprising: sending a first message to a first device, wherein the first message comprises a first identity, the first identity being an identity of a third device, the first message is used to request a security mechanism for interaction between the second device and the third device; receiving a first response sent by the first device, wherein the first response is used to indicate a security mechanism for interaction between the second device and the third device.

24. An information processing method characterized by comprising: performed by the second device, comprising: sending a sixth message to the third device, wherein the sixth message comprises a second identity, the second identity being an identity of the second device, and the sixth message is used to request to initiate an authentication procedure.

25. The method of claim 24, wherein, The sixth message comprises at least one of: a third identity, wherein the third identity is an identity of the first device; a first identity, wherein the first identity is an identity of the third device.

26. An information processing method characterized by comprising: performed by the third device, comprising: sending third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device, and wherein the third information is used by the first device to determine a security mechanism for interaction between the second device and the third device, or the third information is used by the fourth device to determine a security mechanism for interaction between the second device and the third device.

27. The method of claim 26, wherein, The sending of the third information to the fourth device comprises: sending the third information to the fourth device in a process in which the third device registers to the fourth device.

28. The method of claim 26 or 27, wherein, The method further comprises: receiving a seventh message sent by the fourth device, wherein the seventh message is used to request the third information.

29. An information processing method characterized by comprising: performed by the third device, comprising: receiving a sixth message sent by the second device, wherein the sixth message comprises a second identity, the second identity being an identity of the second device, and the sixth message is used to request to initiate an authentication procedure.

30. The method of claim 29, wherein, The sixth message comprises at least one of: a third identity, wherein the third identity is an identity of the first device; a first identity, wherein the first identity is an identity of the third device.

31. The method of claim 29 or 30, wherein, The method comprises: sending a fifth message to a fourth device, wherein the fifth message comprises a second identity, the second identity being an identity of the second device, and the fifth message is used to request security information, and wherein the security information is used for at least one of: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a Transport Layer Security (TLS) connection between the second device and a first device; receiving a fifth response sent by the fourth device, wherein the fifth response comprises the security information.

32. The method of claim 31, wherein, The fifth message comprises at least one of: a first identity, wherein the first identity is an identity of the third device, and the first identity is used by the fourth device to send the fifth response to the third device corresponding to the first identity; a third identity, wherein the third identity is an identity of the first device.

33. The method of claim 31 or 32, wherein, The security information comprises at least one of: a key, wherein the key is generated by the first device; a certificate, wherein the certificate is a root certificate of a certificate of the first device or a certificate of the second device.

34. An information processing method characterized by comprising: comprising: The second device sends a first message to the first device, wherein the first message comprises a first identity, the first identity being an identity of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; The first device sends a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

35. An information processing method characterized by comprising: Comprising: The third device sends a fifth message to a fourth device, wherein the fifth message comprises a second identity, the second identity being an identity of a second device; the fifth message is used to request security information; and the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a Transport Layer Security (TLS) connection between the second device and the first device. The fourth device sends a fifth response to the third device, wherein the fifth response comprises the security information.

36. A first device, comprising: Comprising: The first transceiver module is configured to receive a first message sent by a second device, wherein the first message comprises a first identity, the first identity being an identity of a third device, and the first message is used to request a security mechanism for interaction between the second device and the third device; The first transceiver module is configured to send a first response to the second device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

37. A first device, comprising: Comprising: The first transceiver module is configured to receive a fourth message sent by a fourth device, wherein the fourth message comprises a second identity, the second identity being an identity of a second device; the fourth message is used to request security information; and the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a Transport Layer Security (TLS) connection between the second device and the first device. The first transceiver module is configured to send a fourth response to the fourth device, wherein the fourth response comprises the security information.

38. A fourth apparatus, comprising: Comprising: The second transceiver module is configured to receive a third message sent by a first device, wherein the third message comprises a first identity, the first identity being an identity of a third device, and the third message is used to request a security mechanism for interaction between a second device and the third device; The second transceiver module is configured to send a third response to the first device, wherein the third response is used to indicate the security mechanism for interaction between the second device and the third device.

39. A fourth apparatus, comprising: Comprising: receive, by a second transceiver module, a fifth message sent by a third device, wherein the fifth message comprises a second identity, the second identity being an identity of the second device; the fifth message is used to request security information; the security information is used for at least one of the following: authenticating and / or protecting an identity of the second device; verifying and / or protecting related authorization information of the second device, the related authorization information comprising a token related to the second device; and establishing a TLS connection between the second device and the first device; send, by the second transceiver module, a fifth response to the third device, wherein the fifth response comprises the security information.

40. A second device, comprising: comprising: send, by a third transceiver module, a first message to a first device, wherein the first message comprises a first identity, the first identity being an identity of the third device; the first message is used to request a security mechanism for interaction between the second device and the third device; receive, by the third transceiver module, a first response sent by the first device, wherein the first response is used to indicate the security mechanism for interaction between the second device and the third device.

41. A second device, comprising: comprising: send, by a third transceiver module, a sixth message to a third device, wherein the sixth message comprises a second identity, the second identity being an identity of the second device; the sixth message is used to request starting an authentication procedure.

42. A third apparatus, comprising: comprising: send, by a fourth transceiver module, third information to a fourth device, wherein the third information is used to indicate a security mechanism supported by the third device; wherein the third information is used by the first device to determine the security mechanism for interaction between the second device and the third device, or the third information is used by the fourth device to determine the security mechanism for interaction between the second device and the third device.

43. A third device, comprising: comprising: receive, by a fourth transceiver module, a sixth message sent by a second device, wherein the sixth message comprises a second identity; the second identity is an identity of the second device; the sixth message is used to request starting an authentication procedure.

44. A communications device, characterized by comprising: one or more processors; wherein the communication device is configured to perform the information processing method of any one of claims 1-12, or claims 13-22, or claims 23-25, or claims 26-33, or claims 34-35.

45. A communication system, characterized by comprising: a first device, a fourth device, a second device and a third device; wherein the first device is configured to implement the information processing method of any one of claims 1-12, the fourth device is configured to implement the information processing method of any one of claims 13-22, the second device is configured to implement the information processing method of any one of claims 23-25, and the third device is configured to implement the information processing method of any one of claims 26-33.

46. A storage medium, the storage medium storing instructions, wherein, The computer program product, when executed on a computer, causes the computer to perform the information processing method of any one of claims 1-12, or claims 13-22, or claims 23-25, or claims 26-33, or claims 34-35.

47. A computer program product comprising a computer program or instructions, characterized in that, The computer program product, when executed on a computer, causes the computer to perform the information processing method of any one of claims 1-12, or claims 13-22, or claims 23-25, or claims 26-33, or claims 34-36.

Images