Information processing method, device, communication system, and storage medium

Abstract

Provided in the embodiments of the present disclosure are an information processing method, a device, a communication system, and a storage medium. The information processing method is executed by a first device, and comprises: receiving a first message sent by a second device, wherein the first message comprises a first identifier, which is an identifier of the second device, and the first message is used for requesting related authorization with respect to the second device.

Description

Information processing method, device, communication system and storage medium TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to an information processing method, device, communication system and storage medium. BACKGROUND

[0002] In the technical field of communication, a Common Application Program Interface (API) Framework (CAPIF) system is introduced. The CAPIF system can be used to authorize an API invoker to access a communication system. However, in a CAPIF interconnection scenario, the authorization process of the API invoker is unclear.

[0003] SUMMARY

[0004] Embodiments of the present disclosure need to solve the problem of authorization of an API invoker in a CAPIF interconnection scenario.

[0005] According to a first aspect of embodiments of the present disclosure, an information processing method is provided, executed by a first device, comprising: receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0006] According to a second aspect of embodiments of the present disclosure, an information processing method is provided, executed by a fourth device, comprising: receiving a second message sent by a first device, wherein the second message comprises a first identifier, the first identifier is an identifier of the second device, and the second message is used to request related authorization for the second device.

[0007] According to a third aspect of embodiments of the present disclosure, an information processing method is provided, executed by a fourth device, comprising: sending authorization information to a first device, wherein the authorization information is used to indicate that a second device corresponding to the first identifier has access to at least one of the following: service information, service operation information, and service API information; wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by the second device, the first message comprises the first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0008] According to a fourth aspect of embodiments of the present disclosure, an information processing method is provided, executed by a second device, comprising: sending a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0009] According to a fifth aspect of the embodiments of the present disclosure, an information processing method is provided, which is performed by a third device, and includes: receiving a fifth message sent by a second device, wherein the fifth message includes a first token, and the fourth message is used to request to invoke service information related to the first token, or the fifth message includes a second token, and the fifth message is used to request to invoke service information related to the second token.

[0010] According to a sixth aspect of the embodiments of the present disclosure, an information processing method is provided, which includes: a second device sending a first message to a first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request authorization of the second device; and the first device sending a second message to a fourth device, wherein the second message includes the first identifier, and the second message is used to request authorization of the second device.

[0011] According to a seventh aspect of the embodiments of the present disclosure, a first device is provided, which includes: a first transceiver module configured to receive a first message sent by a second device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0012] According to an eighth aspect of the embodiments of the present disclosure, a fourth device is provided, which includes: a second transceiver module configured to receive a second message sent by a first device, wherein the second message includes a first identifier, the first identifier is an identifier of the second device, and the second message is used to request related authorization for the second device.

[0013] According to a ninth aspect of the embodiments of the present disclosure, a fourth device is provided, which includes: a second transceiver module configured to send authorization information to a first device, wherein the authorization information is used to at least indicate that a second device corresponding to the first identifier has access to at least one of the following: service information, service operation information, and service API information; wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by a second device, the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0014] According to a tenth aspect of the embodiments of the present disclosure, a second device is provided, which includes: a third transceiver module configured to send a first message to a first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0015] According to a twelfth aspect of the embodiments of the present disclosure, a communication device is provided, including one or more processors; and the communication device is configured to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0016] According to a twelfth aspect of the embodiments of the present disclosure, a communication device is provided, including one or more processors; and the communication device is configured to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0017] According to a thirteenth aspect of the embodiments of the present disclosure, a communication system is provided, including a first device, a fourth device, a second device, and a third device; the first device is configured to perform the method described in the optional implementation of the first aspect; the fourth device is configured to perform the method described in the optional implementation of the second aspect, the third aspect, or the optional implementation of the first aspect and the second aspect; the second device is configured to perform the method described in the optional implementation of the fourth aspect; and the third device is configured to perform the method described in the optional implementation of the fifth aspect.

[0018] According to a fourteenth aspect of the embodiments of the present disclosure, a storage medium is provided, and the storage medium stores instructions, when the instructions are executed on a communication device, the communication device performs the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0019] According to a fifteenth aspect of the embodiments of the present disclosure, a computer program product is provided, and the computer program product includes a computer program or instructions, and the computer program or instructions are executed by a processor to implement the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0020] The embodiments of the present disclosure can authorize API invokers in a CAPIF interconnection scenario. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following describes the drawings required for the embodiments, and the following drawings are only some embodiments of the present disclosure, and do not specifically limit the protection scope of the present disclosure.

[0022] FIG. 1A is a structural schematic diagram of an information processing system according to an embodiment of the present disclosure.

[0023] FIG. 1B is a schematic diagram of CAPIF interconnection according to an embodiment of the present disclosure.

[0024] FIG. 2A is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0025] FIG. 2B is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0026] FIG. 2C is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0027] FIG. 3A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0028] FIG. 3B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0029] FIG. 3C is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0030] FIG. 4A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0031] FIG. 4B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0032] FIG. 4C is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0033] FIG. 4D is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0034] [Corrected according to Rule 91 21.08.2024]

[0035] FIG. 5A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0036] FIG. 5B is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0037] FIG. 6A is a flow schematic diagram of an information processing method according to an embodiment of the present disclosure.

[0038] FIG. 6B is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0039] FIG. 7 is an interaction diagram of an information processing method according to an embodiment of the present disclosure.

[0040] FIG. 8A is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0041] FIG. 8B is a flow diagram of an information processing method according to an embodiment of the present disclosure.

[0042] FIG. 9A is a structural diagram of a first device according to an embodiment of the present disclosure.

[0043] FIG. 9B is a structural diagram of a second device according to an embodiment of the present disclosure.

[0044] FIG. 9C is a structural diagram of a third device according to an embodiment of the present disclosure.

[0045] FIG. 9D is a structural diagram of a fourth device according to an embodiment of the present disclosure.

[0046] FIG. 10A is a structural diagram of a communication device according to an embodiment of the present disclosure.

[0047] FIG. 10B is a structural diagram of a chip according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0048] Embodiments of the present disclosure provide an information processing method, device, communication system and storage medium.

[0049] In a first aspect, embodiments of the present disclosure provide an information processing method, performed by a first device, including: receiving a first message sent by a second device, wherein the first message includes a first identifier, the first identifier being an identifier of the second device, and the first message being used to request related authorization for the second device.

[0050] In the above embodiments, the related authorization for the second device is facilitated. If the second device is in a CAPIF system, and the service or the like requested by the second device for the related authorization cannot be provided by a device in a domain where the first device is located, the related authorization for the second device in a CAPIF interconnection scenario can be facilitated.

[0051] In some embodiments of the first aspect, the first message is used to request the second device for related authorization for a third device, and the second device and the first device are in a first domain, and the third device is in a second domain.

[0052] In the above embodiments, the second device and the third device are not in the same domain, and the interconnection scenario can be implemented, and the second device can access the third device and the like in other domains.

[0053] In some embodiments of the first aspect, in some embodiments, the first message further includes at least one of: the second identifier, wherein the second identifier is an identifier of the resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0054] In the above embodiments, the authorization related to the service, the service operation, and / or the service API accessed by the second device can be implemented.

[0055] In some embodiments of the first aspect, in some embodiments, the method further includes: sending a second message to a fourth device, wherein the second message includes the first identifier, and the second message is used to request the authorization related to the second device; the fourth device is in a second domain; receiving a first token sent by the fourth device, wherein the first token is generated by the fourth device based on the second message after determining that the second device is authorized, and the first token includes at least one of: the first identifier, the second identifier, a third identifier, service information, service operation information, service API information, type information, and purpose information; the third identifier is an identifier of the fourth device; and sending the first token to the second device.

[0056] In some embodiments of the first aspect, in some embodiments, the third identifier is set as a publisher declared by the first token, and the first identifier is set as a subject declared by the first token.

[0057] In the above embodiments, the publisher of the first token can be known, and the fourth device corresponding to the third identifier can be known.

[0058] In some embodiments of the first aspect, in some embodiments, sending the second message to the fourth device comprises at least one of: sending the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information matches the service API discovered from the fourth device; sending the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information is determined to match the service API published by the fourth device; sending the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information is determined to match the service published by the fourth device; sending the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information is determined to match the service operation published by the fourth device; sending the second message to the fourth device in a case that at least one of the type information and the purpose information corresponds to the service API matching the service API published by the fourth device.

[0059] In some embodiments of the first aspect, in some embodiments, sending the second message to the fourth device comprises: sending the second message to the fourth device in a case that a fifth device in the same domain as the first device is determined to be unable to provide at least one of the service information, the service operation information, and the service API information.

[0060] In some embodiments of the first aspect, in some embodiments, the fourth device regards the first identity as having been authenticated.

[0061] In some embodiments of the first aspect, in some embodiments, the method further comprises: generating a second token in a case that the second device is determined to be authorized based on the first message and authorization information, wherein the authorization information is used at least to indicate that the second device corresponding to the first identity has access to at least one of the service information, the service operation information, and the service API information; the second token comprises a fourth identity and / or the first identity, the fourth identity being an identity of the first device; and sending the second token to the second device.

[0062] In some embodiments of the first aspect, in some embodiments, the fourth identity is set as a publisher declared by the second token; and the first identity is set as a subject declared by the second token.

[0063] In some embodiments of the first aspect, in some embodiments, the method further comprises at least one of: obtaining authorization information sent by the fourth device in a service information discovery stage; and obtaining authorization information configured by the fourth device in a service information publishing stage.

[0064] In some embodiments of the first aspect, in some embodiments, the method further comprises: receiving a third message sent by the fourth device; sending a first response to the fourth device; wherein the third message comprises the second token, the third message is used to request verification of the second token, and the first response comprises a verification result of the verification of the second token; or the third message is used to request a key for verifying the second token, and the first response comprises the key for verifying the second token; or the third message is used to request a certificate for verifying the second token, and the first response comprises the certificate for verifying the second token.

[0065] In the second aspect, the embodiments of the present disclosure provide an information processing method, executed by a fourth device, comprising: receiving a second message sent by a first device, wherein the second message comprises a first identifier, the first identifier is an identifier of a second device, and the second message is used to request related authorization of the second device.

[0066] In some embodiments of the second aspect, in some embodiments, the second message is used to request the second device to have related authorization of a third device; wherein the second device and the first device are in a first domain, and the third device and the fourth device are in a second domain.

[0067] In some embodiments of the second aspect, in some embodiments, the second message further comprises at least one of: a second identifier, wherein the second identifier is an identifier of a resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0068] In some embodiments of the second aspect, in some embodiments, the method comprises: in a case where it is determined that the second device is authorized based on the second message and authorization information, generating a first token; wherein the authorization information is used to at least indicate that the second device corresponding to the first identifier has access to at least one of: the service information, the service operation information, and the service API information; the first token comprises at least one of: the first identifier, the second identifier, a third identifier, the service information, the service operation information, the service API information, type information, and purpose information; the third identifier is an identifier of the fourth device; and sending the first token to the first device, wherein the first token is used by the first device to send to the second device.

[0069] In some embodiments of the second aspect, in some embodiments, the third identifier is set as a publisher declared by the first token, and the first identifier is set as a subject declared by the first token.

[0070] In a third aspect, the embodiments of the present disclosure provide an information processing method, executed by a fourth device, comprising: sending authorization information to a first device, wherein the authorization information is used to indicate that a second device corresponding to a first identifier has access to at least one of the following: service information, service operation information, and service API information; wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by the second device, the first message includes the first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0071] In some embodiments in combination with the third aspect, in some embodiments, the sending of the authorization information to the first device comprises at least one of the following: sending the authorization information to the first device in a service information discovery phase; and sending the authorization information to the first device in a service information publishing phase.

[0072] In some embodiments in combination with the third aspect, in some embodiments, the method further comprises: receiving a fourth message sent by a third device; sending a third message to the first device; receiving a first response sent by the first device; sending a second response to the third device; wherein the second token is included in the third message or the fourth message, the third message or the fourth message is used to request verification of the second token, the first response or the second response includes a verification result of the second token; or the third message or the fourth message is used to request a key for verifying the second token, the first response or the second response includes the key for verifying the second token; or the third message or the fourth message is used to request a certificate for verifying the second token, and the first response or the second response includes the certificate for verifying the second token.

[0073] In a fourth aspect, the embodiments of the present disclosure provide an information processing method, executed by a second device, comprising: sending a first message to a first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0074] In some embodiments in combination with the fourth aspect, in some embodiments, the first message is used to request related authorization for the second device by a third device; wherein the second device and the first device are in a first domain, and the third device is in a second domain.

[0075] In some embodiments of the fourth aspect, in some embodiments, the first message further comprises at least one of: the second identifier, wherein the second identifier is an identifier of the resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0076] In some embodiments of the fourth aspect, in some embodiments, the method further comprises one of: receiving a first token sent by the first device, wherein the first token is generated after the second device is determined to be authorized by the fourth device, and the first token comprises at least one of: the first identifier, the second identifier, the third identifier, the service information, the service operation information, the service API information, the type information, and the purpose information; the fourth device is in a second domain; and receiving a second token sent by the first device, wherein the second token is generated after the second device is determined to be authorized by the fourth device, and the second token comprises at least: the first identifier and a fourth identifier, wherein the fourth identifier is an identifier of the first device.

[0077] In some embodiments of the fourth aspect, in some embodiments, the third identifier is set as a publisher declared by the first token; the first identifier is set as a subject declared by the first token; or the fourth identifier is set as a publisher declared by the second token; and the first identifier is set as a subject declared by the second token.

[0078] In the fifth aspect, the embodiments of the present disclosure provide an information processing method, executed by a third device, comprising: receiving a fifth message sent by a second device, wherein the fourth message comprises a first token, and the fifth message is used to request to call service information related to the first token, or the fifth message comprises a second token, and the fifth message is used to request to call service information related to the second token.

[0079] In some embodiments of the fifth aspect, in some embodiments, the method comprises: sending a fourth message to the fourth device; and receiving a second response sent by the fourth device, wherein the fourth message comprises the second token, the fourth message is used to request to verify the second token, and the second response comprises a verification result of the second token; or the fourth message is used to request a key for verifying the second token, and the second response comprises the key for verifying the second token; or the fourth message is used to request a certificate for verifying the second token, and the second response comprises the certificate for verifying the second token.

[0080] In some embodiments of the fifth aspect, in some embodiments, sending the fourth message to the fourth device comprises: sending the fourth message to the fourth device based on the fourth identifier in the second token, wherein the fourth message is used by the fourth device to send the third message to the first device; and the fourth identifier is an identifier of the first device, and the fourth identifier is configured to be set as a publisher declared by the second token.

[0081] In the sixth aspect, the embodiments of the present disclosure provide an information processing method, comprising: sending, by a second device, a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request authorization of the second device; and sending, by the first device, a second message to a fourth device, wherein the second message comprises the first identifier, and the second message is used to request authorization of the second device.

[0082] In the seventh aspect, the embodiments of the present disclosure provide a first device, comprising: a first transceiver module configured to receive a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

[0083] In the eighth aspect, the embodiments of the present disclosure provide a fourth device, comprising: a second transceiver module configured to receive a second message sent by a first device, wherein the second message comprises a first identifier, the first identifier is an identifier of the second device, and the second message is used to request relevant authorization for the second device.

[0084] In the ninth aspect, the embodiments of the present disclosure provide a fourth device, comprising: a second transceiver module configured to send authorization information to a first device, wherein the authorization information is used to at least indicate that a second device corresponding to the first identifier has access to at least one of the following: service information, service operation information, and service API information; wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by the second device, the first message comprises the first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

[0085] In the tenth aspect, the embodiments of the present disclosure provide a second device, comprising: a third transceiver module configured to send a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

[0086] In an eleventh aspect, an embodiment of the present disclosure provides a third device, comprising: a fourth transceiver configured to receive a fifth message sent by a second device, wherein the fifth message comprises a first token and the fifth message is used to request to invoke service information related to the first token, or the fifth message comprises a second token and the fifth message is used to request to invoke service information related to the second token.

[0087] In a twelfth aspect, an embodiment of the present disclosure provides a communication device, comprising one or more processors; wherein the communication device is configured to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0088] In a thirteenth aspect, an embodiment of the present disclosure provides a communication system, comprising: a first device, a fourth device, a second device, and a third device; wherein the first device is configured to perform the method described in the optional implementation of the first aspect, the fourth device is configured to perform the method described in the optional implementation of the second aspect, the third aspect, or the optional implementation of the first aspect and the second aspect, the second device is configured to perform the method described in the optional implementation of the fourth aspect, and the third device is configured to perform the method described in the optional implementation of the fifth aspect.

[0089] In a fourteenth aspect, an embodiment of the present disclosure provides a storage medium, wherein the storage medium stores instructions, and when the instructions run on a communication device, the communication device performs the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0090] In a fifteenth aspect, an embodiment of the present disclosure provides a computer program product, comprising a computer program or instructions, and when the computer program or instructions are executed by a processor, the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect is implemented.

[0091] In a sixteenth aspect, an embodiment of the present disclosure provides a computer program, when running on a computer, causes the computer to perform the information processing method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0092] In a seventeenth aspect, the embodiments of the present disclosure provide a chip or chip system, which comprises processing circuitry configured to perform the method described in the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, the sixth aspect, or the optional implementation of the first aspect, the second aspect, the third aspect, the fourth aspect, the fifth aspect, and the sixth aspect.

[0093] It can be understood that the above-mentioned devices (for example, the first device, the second device, the third device, the fourth device, and the like), the communication system, the storage medium, the program product, the computer program, the chip or the chip system are used to execute the method provided by the embodiments of the present disclosure. Therefore, the beneficial effects achieved thereby can refer to the beneficial effects in the corresponding method, which will not be described here again.

[0094] The embodiments of the present disclosure provide an information processing method, device, communication system, and storage medium. In some embodiments, the information processing method and the information processing method and the like can be replaced with each other, the information processing device and the communication device and the like can be replaced with each other, and the information processing system and the communication system and the like can be replaced with each other.

[0095] The embodiments of the present disclosure are not exhaustive, but only illustrate some embodiments, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, each step in an embodiment can be implemented as an independent embodiment, and the steps can be combined arbitrarily, for example, the scheme after removing some steps in an embodiment can also be implemented as an independent embodiment, and the order of the steps in an embodiment can be exchanged arbitrarily, in addition, the optional implementation in an embodiment can be combined arbitrarily; in addition, the embodiments can be combined arbitrarily, for example, some or all steps of different embodiments can be combined arbitrarily, and an embodiment can be combined with the optional implementation of other embodiments.

[0096] In each embodiment of the present disclosure, the terms and / or descriptions between the embodiments are consistent if there is no special description and logical conflict, and can be used by each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0097] The terms used in the embodiments of the present disclosure are only for the purpose of describing the specific embodiments, and not as a limitation on the present disclosure.

[0098] In the embodiments of the present disclosure, an element expressed in singular form, such as "a", "an", "the", "said", "the aforementioned", "the foregoing", "this", and the like, unless otherwise specified, can represent "one and only one", or can represent "one or more", "at least one", and the like. For example, in the case of using an article such as "a", "an", "the" in English, the noun after the article can be understood as a singular expression, or can be understood as a plural expression.

[0099] In the embodiments of the present disclosure, "plurality" refers to two or more.

[0100] In some embodiments, the terms "at least one of", "one or more", "a plurality of", "multiple", and the like can be replaced with each other.

[0101] In some embodiments, the description manner such as "at least one of A, B", "A and / or B", "A in one case and B in another case", "in response to a case A, in response to a case B", and the like can include the following technical solutions according to the case: A is executed in some embodiments (A is executed regardless of B); B is executed in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected to be executed); A and B are executed in some embodiments (A and B are both executed). When there are more branches such as A, B, C, and the like, it is similar to the above.

[0102] In some embodiments, the description manner such as "A or B" and the like can include the following technical solutions according to the case: A is executed in some embodiments (A is executed regardless of B); B is executed in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected to be executed). When there are more branches such as A, B, C, and the like, it is similar to the above.

[0103] The prefix words of "first", "second" and the like in the embodiments of the present disclosure are merely used to distinguish different description objects, and do not constitute limitation on the position, order, priority, quantity or content of the description objects. The description objects are described in the claims or embodiments in the context of the description, and should not be construed as redundant limitation because of the use of the prefix words. For example, the ordinal words in front of the description objects "field" in "first field" and "second field" do not limit the position or order between the "fields", and "first" and "second" do not limit whether the "fields" modified thereby are in the same message or not, nor limit the order of "first field" and "second field". For another example, the ordinal words in front of the description objects "level" in "first level" and "second level" do not limit the priority between the "levels". For another example, the quantity of the description objects is not limited by the ordinal words, and can be one or more. For example, "first device", wherein the quantity of "device" can be one or more. In addition, the objects modified by different prefix words can be the same or different, for example, the description objects are "device", and "first device" and "second device" can be the same device or different devices, and the types thereof can be the same or different; for another example, the description objects are "information", and "first information" and "second information" can be the same information or different information, and the contents thereof can be the same or different.

[0104] In some embodiments, "including A", "containing A", "for indicating A", "carrying A" can be interpreted as directly carrying A, or indirectly indicating A.

[0105] In some embodiments, the terms of "in response to", "in response to determining", "in the case of", "when", "when", "if", "if" and the like can be replaced with each other.

[0106] In some embodiments, the terms of "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", "above" and the like can be replaced with each other, and the terms of "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", "below" and the like can be replaced with each other.

[0107] In some embodiments, the apparatus and the like can be interpreted as physical or virtual, and the name thereof is not limited to the name recorded in the embodiments. The terms of "apparatus", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", "subject" and the like can be replaced with each other.

[0108] In some embodiments, “network” can be interpreted as the devices (e.g., access network devices, core network devices, etc.) included in the network.

[0109] In some embodiments, the terms “access network device (AN device),” “radio access network device (RAN device),” “base station (BS),” “radio base station,” “fixed station,” “node,” “access point,” “transmission point (TP),” “reception point (RP),” “transmission / reception point (TRP),” “panel,” “antenna panel,” “antenna array,” “cell,” “macro cell,” “small cell,” “femto cell,” “pico cell,” “sector,” “cell group,” “carrier,” “component carrier,” “bandwidth part (BWP),” and the like can be replaced with each other.

[0110] In some embodiments, the terms "terminal," "terminal device," "user equipment (UE)," "user terminal," "mobile station (MS)," "mobile terminal (MT)," "subscriber station," "mobile unit," "subscriber unit," "wireless unit," "remote unit," "mobile device," "wireless device," "wireless communication device," "remote device," "mobile subscriber station," "access terminal," "mobile terminal," "wireless terminal," "remote terminal," "handset," "user agent," "mobile client," "client," and so on can be replaced with each other.

[0111] In some embodiments, an access network device, a core network device, or a network device can be replaced with a terminal. For example, for a structure in which communication between an access network device, a core network device, or a network device and a terminal is replaced with communication between a plurality of terminals (for example, also referred to as device-to-device (D2D), vehicle-to-everything (V2X), and so on), embodiments of the present disclosure can also be applied. In this case, a structure in which a terminal has all or part of the functions of an access network device can also be provided. Furthermore, the language of "uplink," "downlink," and so on can also be replaced with language corresponding to communication between terminals (for example, "side"). For example, an uplink channel, a downlink channel, and so on can be replaced with a side channel, and an uplink, a downlink, and so on can be replaced with a side link.

[0112] In some embodiments, a terminal can be replaced with an access network device, a core network device, or a network device. In this case, a structure in which an access network device, a core network device, or a network device has all or part of the functions of a terminal can also be provided.

[0113] In some embodiments, obtaining data, information, and the like can comply with laws and regulations of the country where the location is.

[0114] In some embodiments, data, information, and the like can be obtained after obtaining the consent of the user.

[0115] In addition, each element, each row, or each column in the table of the embodiments of the present disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0116] FIG. 1A is a structural schematic diagram of an information processing system 100 according to an embodiment of the present disclosure. As shown in FIG. 1A, the information processing system 100 can include a terminal 101 and a network device 102.

[0117] In some embodiments, the network device 102 can include at least one of an access network device and a core network device.

[0118] In some embodiments, the terminal 101 includes at least one of a mobile phone, a wearable device, an IOT device or terminal, a car with communication function, a smart car, a Pad, a computer with wireless transceiver function, a VR terminal device, an AR terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid, a wireless terminal device in transportation safety, a wireless terminal device in smart city, a wireless terminal device in smart home, and the like, but is not limited thereto.

[0119] In some embodiments, the access network device is, for example, a node or device that accesses a terminal to a wireless network, and the access network device can include at least one of an evolved NodeB (eNB) in a 5G communication system, a next generation eNB (ng-eNB), a next generation NodeB (gNB), a node B (NB), a home node B (HNB), a home evolved node B (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an open base station (Open RAN), a cloud base station (Cloud RAN), a base station in other communication systems, an access node in a wireless fidelity (WiFi) system, but is not limited thereto.

[0120] In some embodiments, the technical solutions of the present disclosure can be applied to an Open RAN architecture, at this time, the interfaces between or within the access network devices involved in the embodiments of the present disclosure can become internal interfaces of the Open RAN, and the processes and information interactions between these internal interfaces can be realized through software or programs.

[0121] In some embodiments, the access network device can be composed of a central unit (CU) and a distributed unit (DU), wherein the CU can also be referred to as a control unit. The CU-DU structure can split the protocol layers of the access network device, and the functions of part of the protocol layers are controlled by the CU, and the functions of the remaining part or all of the protocol layers are distributed in the DU and controlled by the CU, but are not limited thereto.

[0122] In some embodiments, the core network device can be one device including the first device, the second device, the third device, and / or the fourth device, etc., or can be a plurality of devices or device groups including all or part of the above-mentioned devices. The first device, the second device, the third device, and / or the fourth device can be virtual or physical. The core network includes at least one of an evolved packet core (EPC), a 5G core network (5GCN), a next generation core (NGC), and a 6G core network (6GCN).

[0123] In some embodiments, the first device and the fourth device can both be a common application program interface framework core network function (CAPIF core function, CCF); the first device and the fourth device are CCFs in different domains; the names of the first device and the fourth device are not limited thereto.

[0124] In some embodiments, the first device and the fourth device can both be any definable API authentication, authorization, diary recording, and / or charging function, or a device or network element or function or entity that provides a common requirement for a network capability exposure API, etc.

[0125] In some embodiments, the second device is an API invoker (Invoker); the name of the second device is not limited thereto.

[0126] In some embodiments, the API invoker can be a terminal or UE, or an application (such as a browser, etc.) or a public account or applet running on the terminal or UE, or an application function, or an application server, or a server belonging to a third party (such as A company, B operator, or C platform, etc.).

[0127] In some embodiments, the third device can be an API exposing function (AEF); the name of the third device is not limited thereto.

[0128] In some embodiments, the third device can be any device or network element or function or entity that can provide authentication and / or establish a secure transport layer security (Transport Layer Security, TLS) session, etc.

[0129] It can be understood that the information processing system described in the embodiments of the present disclosure is for more clearly illustrating the technical solutions of the embodiments of the present disclosure, and does not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art can know that, with the evolution of system architecture and the appearance of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0130] The embodiments of the present disclosure described below can be applied to the information processing system 100 shown in FIG. 1A or part of the subjects, but are not limited thereto. The subjects shown in FIG. 1A are illustrative, and the information processing system can include all or part of the subjects in FIG. 1A, or other subjects other than those in FIG. 1A. The number and form of each subject is arbitrary, and the connection relationship between the subjects is illustrative. The subjects can be connected or not connected, and the connection can be in any manner, can be direct connection or indirect connection, can be wired connection or wireless connection.

[0131] Embodiments of the present disclosure can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 6th generation mobile communication system (6G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (Bluetooth (registered trademark)), Public Land Mobile Network (PLMN) network, Device-to-Device (D2D) system, Machine to Machine (M2M) system, Internet of Things (IoT) system, Vehicle-to-Everything (V2X), system using other communication methods, next-generation system expanded based thereon, and the like. Further, a plurality of systems can be applied in combination (for example, combination of LTE or LTE-A and 5G, combination of 5G and 5G, combination of 5G and 6G, and the like).

[0132] In some embodiments, the CAPIF is a north-bound API framework for authorizing API invokers (e.g., third party Application Functions (AFs)) to access a communication system. Optionally, as shown in FIG. IB, the CAPIF framework can include a CCF and an API exposure function (AEF). The API invokers can send service APIs of the AEF through the CCF; the CAPIF framework can also include, among others, an API publishing function (APF) and / or an API management function (AMF). The AEF can use authorization information (e.g., tokens, authorization policies, etc.) provided by the CCF to authorize API invocation requests of the API invokers. CAPIF-1e, CAPIF-2e, CAPIF-3e, CAPIF-4e, CAPIF-5e, and CAPIF-6e are interfaces between devices in different domains; CAPIF-1, CAPIF-2, CAPIF-3, CAPIF-4, and CAPIF-5 are interfaces between devices in the same domain.

[0133] In some embodiments, referring again to FIG. IB, in a CAPIF interconnection scenario, two CCFs (e.g., CCF-A and CCF-B) can be connected to provide services for API invokers. Assume that CCF-A is in a trust domain A and CCF-B is in a trust domain B. When CCF-A is triggered by discovery of a service API of an API invoker, CCF-A can discover the service API related to CCF-B. Optionally, the trust domain A can be referred to as domain A or a first domain; the trust domain B can be referred to as domain B or a second domain.

[0134] Before requesting discovery of a service API, an API invoker should be authorized; however, the API invoker authorization procedure in a CAPIF interconnection scenario is not clear.

[0135] In some embodiments, the UE can be a terminal, or the terminal can be a UE.

[0136] In some embodiments, the first device can be CCF-A; the second device can be an API invoker; the third device can be an AEF or AEF-B; the fourth device can be CCF-B; and the fifth device can be AEF-A.

[0137] Optionally, the CCF-A can be a first CCF; and the CCF-A can be a CCF in a first domain.

[0138] Optionally, the CCF-B can be a second CCF; the CCF-B can be a CCF in a second domain.

[0139] Optionally, the AEF-A can be a first AEF; the AEF-B can be a second AEF.

[0140] Optionally, the AEF-A can be an AEF in a first domain; the AEF-B can be an AEF in a second domain.

[0141] Optionally, the first device, the second device and the fifth device are in a first domain; the third device and the fourth device are in a second domain.

[0142] Optionally, the first domain can be a first trust domain; the second domain can be a second trust domain.

[0143] Optionally, the first domain can be domain A; the second domain can be domain B.

[0144] Optionally, the first domain can be CAPIF domain A; the second domain can be CAPIF domain B.

[0145] Optionally, the first domain and the second domain can belong to two different operators or companies or other institutions or organizations, etc. For example, the first domain is deployed by an A operator; the second domain is deployed by a B operator. For another example, the first domain is deployed by an A operator; the second domain is deployed by a B company.

[0146] Optionally, the API invoker can be: a terminal or UE, or an application (such as a browser, etc.) or a public account or a mini program running on the terminal or UE, or an Application function, or an Application server, or a server belonging to a third party (such as an A company, a B operator or a C platform, etc.).

[0147] FIG. 2A is an interaction diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 2A, the embodiment of the present disclosure relates to an information processing method for an information processing system 100, and the method comprises:

[0148] In step S2101, the second device sends a first message to the first device.

[0149] In some embodiments, the first device receives the first message sent by the second device.

[0150] In some embodiments, the first message comprises at least one of the following: a first identifier, a second identifier, a fifth identifier, service information, service API information, type information and purpose information.

[0151] Optionally, the first identity is an identity of the second device.

[0152] Optionally, the first identity is not limited in name, for example, API invoker ID, etc.

[0153] Optionally, the second identity is an identity of a resource owner.

[0154] Optionally, the second identity is not limited in name, for example, resource owner ID, etc.

[0155] Optionally, the resource owner can be a user or a subscription number, etc.

[0156] Optionally, the fifth identity is an identity of the third device.

[0157] Optionally, the fifth identity is not limited in name, for example, AEF ID, etc.

[0158] Optionally, the service information is used to indicate a service that needs to be authorized.

[0159] Optionally, the service information can include at least one of the following: service API, service operation, and resource.

[0160] Optionally, the service operation information is used to indicate a service operation that needs to be authorized.

[0161] Optionally, the service API information is used to indicate a service API that needs to be authorized.

[0162] Optionally, the type information is used to indicate a data type that needs to be authorized.

[0163] Optionally, the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0164] Optionally, the service refers to a service provided by the second device, etc.; for example, a user management related service, etc.

[0165] Optionally, the service operation can be deleting or adding a new user to the user management service.

[0166] Optionally, the resource can be address information (for example, a website address) of the second device, etc.

[0167] Optionally, the data type can be a location information type and / or a quality type, etc.

[0168] Optionally, the data processing purpose can be revoking authorization related to location information, or improving or reducing the quality of a certain service, opening location information, etc.

[0169] Optionally, the data type and / or the data processing purpose can be used to determine the service information.

[0170] Optionally, the data type and / or the data processing purpose can be used to determine the service.

[0171] Optionally, the data type and / or the data processing purpose can be used to determine the service operation.

[0172] Optionally, the data type and / or the data processing purpose can be used to determine the service API.

[0173] Optionally, the first device stores a correspondence between at least one of the data type and the data processing and at least one of the service, the service operation and the service API.

[0174] In some embodiments, the first message is used to request the related authorization for the second device.

[0175] Optionally, the first message is used to request the related authorization for the second device for the third device.

[0176] Optionally, the second device and the first device are in a first domain, and the third device is in a second domain; or, the second device and the first device are in different domains, and the third device and the second device are in different domains. In this way, the related authorization for the second device for the third device in different domains can be realized.

[0177] Optionally, the first message is used to request authorization for the second device to access the third device.

[0178] Optionally, the first message is used to request authorization for the second device to access the service, the service operation and / or the service API published by the third device.

[0179] Optionally, the first message is used to request authorization for the second device to access the service of a predetermined data type and / or a predetermined data processing purpose, or to access the service information corresponding to the predetermined data type and / or the service.

[0180] The above is only an adaptive example description of the first message used to request the related authorization for the second device. In fact, the first message used to request the related authorization for the second device is not limited to this; the same authorization requested in the first message is different for different information carried in the first message.

[0181] In some embodiments, the information included in the first message can be referred to as authorization related information. Optionally, the first message can include the authorization related information; the authorization related information can include at least one of the first identifier, the second identifier, the fifth identifier, the service information, the service API information, the type information and the purpose information.

[0182] In some embodiments, at least part of the information in the first message can be expected information. For example, the second identity can be an expected second identity, e.g., an expected resource owner identity. For example, the service can be an expected service. For example, the service operation can be an expected service operation. For example, the service API can be an expected service API. For example, the expected indicates an expectation of something, e.g., an expectation of a data type, a data processing purpose, a service, a service API, a service operation, and / or a resource owner, etc.

[0183] In some embodiments, the first message is not limited in name, e.g., an authorization related request.

[0184] At step S2102, the first device sends a second message to a fourth device.

[0185] In some embodiments, the fourth device receives the second message sent by the first device.

[0186] In some embodiments, the second message includes at least one of the following: the first identity, the second identity, the fifth identity, the service information, the service API information, the type information, and the purpose information.

[0187] In some embodiments, the second message is used to request a related authorization for the second device.

[0188] In some embodiments, the second message is used to request a related authorization for the second device for the third device.

[0189] For example, the second message is used to request an authorization for the second device to access the third device.

[0190] For example, the second message is used to request an authorization for the second device to access a service, a service operation, and / or a service API published by the third device.

[0191] For example, the second message is used to request an authorization for the second device to access a service of a predetermined data type and / or a predetermined data processing purpose, or to access a service information corresponding to a predetermined data type and / or a service, etc.

[0192] Optionally, the information included in the second message is similar to the information included in the first message; the related authorization requested in the second message is similar to the related authorization requested in the first message; see the example of the first message for the example of the second message.

[0193] In some embodiments, the second message is not limited in name, e.g., an authorization related request.

[0194] In some embodiments, the first device sends the second message to the fourth device in a case that the fifth device, which is in the same domain as the first device, is unable to provide at least one of the service information, the service operation information, and the service API information. Optionally, both the first device and the fifth device are in the first domain.

[0195] For example, the first device sends the second message to the fourth device in a case that the fifth device, which is in the same domain as the first device, is unable to provide the service information.

[0196] For example, the first device sends the second message to the fourth device in a case that the fifth device, which is in the same domain as the first device, is unable to provide the service operation information.

[0197] For example, the first device sends the second message to the fourth device in a case that the fifth device, which is in the same domain as the first device, is unable to provide the service API information.

[0198] In some embodiments, the first device sends the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information matches the service API discovered from the fourth device.

[0199] In some embodiments, the first device sends the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information matches the service API published by the fourth device.

[0200] In some embodiments, the first device sends the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information matches the service published by the fourth device.

[0201] In some embodiments, the first device sends the second message to the fourth device in a case that at least one of the service information, the service operation information, and the service API information matches the service operation published by the fourth device.

[0202] In some embodiments, the first device sends the second message to the fourth device in a case that at least one of the type information and the purpose information corresponds to a service API that matches a service API published by the fourth device.

[0203] In some embodiments, the fourth device considers the first identity as a first identity that has been authenticated.

[0204] Optionally, the fourth device believes that a second device indicated by the first identity has been authenticated in the first device.

[0205] Optionally, the fourth device considers the first identity provided by the first device as having been authenticated.

[0206] At step S2103, the fourth device generates the first token.

[0207] In some embodiments, the fourth device generates the first token upon determining that the second device is authorized.

[0208] In some embodiments, the fourth device generates the first token upon determining that the second device is authorized based on the second message and the authorization information.

[0209] In some optional embodiments, the fourth device obtains the authorization information. For example, the authorization information is stored in the fourth device.

[0210] In some optional embodiments, the fourth device determines whether the second device is authorized based on the second message and the authorization information.

[0211] In some embodiments, the authorization information indicates at least that the first identity corresponding to the second device has access to at least one of the service information, the service operation information, and the service API information. For example, the authorization information indicates that an API invoker corresponding to the API invoker ID has access to the service information, the service operation information, and / or the service API information.

[0212] In some embodiments, the authorization information indicates at least a correspondence between the first identity and at least one of the service information, the service operation information, and the service API information.

[0213] In some embodiments, the authorization information is used to determine whether to authorize the request for authorization in the first message.

[0214] For example, the second device corresponding to the first identity indicated in the second message as requesting authorization is indicated in the authorization information as being authorized, and it is determined that the second device is authorized.

[0215] For example, the service indicated in the second message as requesting authorization of the second device is indicated in the authorization information as being accessible by the second device, and it is determined that the second device is authorized.

[0216] For example, the service operation indicated in the second message as requesting authorization of the second device is indicated in the authorization information as being accessible by the second device, and it is determined that the second device is authorized.

[0217] For example, the service API indicated in the second message as requesting authorization of the second device is indicated in the authorization information as being accessible by the second device, and it is determined that the second device is authorized.

[0218] In some embodiments, the name of the authorization information is not limited.

[0219] In some embodiments, the first token comprises at least one of the following: the first identity, the second identity, the third identity, service information, service operation information, service API information, type information, and purpose information.

[0220] Optionally, the third identity is an identity of the fourth device.

[0221] Optionally, the third identity is not limited in name, and is, for example, CCF-B ID, etc.

[0222] Optionally, the third identity is set as an issuer of the first token declaration, and the first identity is set as a subject of the first token declaration. In this way, it can be known that the fourth device corresponding to the third identity is the issuer of the first token, and the second device corresponding to the first identity is the subject of the first token.

[0223] In step S2104, the fourth device sends the first token to the first device.

[0224] In step S2105, the fourth device sends the authorization information to the first device.

[0225] In some embodiments, the fourth device sends the authorization information to the first device in the service information discovery stage.

[0226] In some embodiments, the first device receives the authorization information sent by the fourth device in the service information discovery stage.

[0227] Optionally, the service information publishing can comprise at least one of the following: service API publishing, service operation publishing, and resource publishing. For example, the fourth device sends the authorization information to the first device in the service API publishing stage.

[0228] In some embodiments, the fourth device sends the authorization information to the first device in the service information publishing stage.

[0229] In some embodiments, the first device receives the authorization information sent by the fourth device in the service information publishing stage.

[0230] Optionally, the service information discovery can comprise at least one of the following: service API discovery, service operation discovery, and resource discovery. For example, the fourth device sends the authorization information to the first device in the service API discovery stage.

[0231] In step S2106, the first device generates a second token.

[0232] In some embodiments, the first device generates the second token in a case where it is determined that the second device is authorized.

[0233] In some embodiments, the first device determines that the second device is authorized based on the first message and the authorization information.

[0234] In some optional embodiments, the first device determines whether the second device is authorized based on the first message and the authorization information.

[0235] For example, the first device determines that the second device is authorized when the first identity corresponding to the second device requesting authorization indicated in the first message is the first identity indicating authorization in the authorization information.

[0236] For example, the first device determines that the second device is authorized when the service requesting authorization of the second device indicated in the first message is the service that the second device is able to access indicated in the authorization information.

[0237] For example, the first device determines that the second device is authorized when the service requesting authorization of the second device indicated in the first message is the service operation that the second device is able to access indicated in the authorization information.

[0238] For example, the first device determines that the second device is authorized when the service API requesting authorization of the second device indicated in the first message is the service API that the second device is able to access indicated in the authorization information.

[0239] Optionally, the second token can include at least one of the fourth identity and the first identity.

[0240] For example, the fourth identity is an identity of the first device.

[0241] For example, the fourth identity is not limited in name, and is, for example, CCF-A ID, etc.

[0242] Optionally, the second token can further include at least one of the second identity, the service information, the service operation information, the service API information, the type information, and the purpose information.

[0243] Optionally, the fourth identity is set as a publisher of the second token declaration; and the first identity is set as a subject of the second token declaration. In this way, it can be known that the first device corresponding to the fourth identity is the publisher of the second token; and the second device corresponding to the first identity is the subject of the second token.

[0244] In step S2107, the first device sends the first token or the second token to the second device.

[0245] In some embodiments, the first device sends the first token to the second device.

[0246] In some embodiments, the second device receives the first token sent by the first device.

[0247] In some optional embodiments, the second device sends a fifth message to a third device.

[0248] In some optional embodiments, the third device receives the fifth message sent by the second device.

[0249] In some optional embodiments, the fifth message comprises the first token.

[0250] In some optional embodiments, the fifth message comprises the second token.

[0251] Optionally, the fifth message comprises the first token and the fifth message is used to request invoking the service information related to the first token.

[0252] Optionally, the fifth message comprises the second token and the fifth message is used to request invoking the service information related to the second token.

[0253] In some embodiments, the name of the fifth message is not limited, which is, for example, a service invocation request or a service API invocation request, etc.

[0254] In step S2108, the third device sends a fourth message to the fourth device.

[0255] In some embodiments, the fourth device receives the fourth message sent by the third device.

[0256] In some embodiments, the fourth message is used to request verifying the second token.

[0257] In some embodiments, the fourth message is used to request verifying the key of the second token.

[0258] Optionally, the key is generated by the first device.

[0259] In some embodiments, the fourth message is used to request verifying the certificate of the second token.

[0260] Optionally, the certificate is a root certificate of the certificate of the first device or the certificate of the second device.

[0261] In some embodiments, the fourth message comprises the second token.

[0262] In some embodiments, the name of the fourth message is not limited, which is, for example, a token checking request.

[0263] In some embodiments, the third device sends the fourth message to the fourth device based on the fourth identifier in the second token.

[0264] Optionally, the fourth identifier is set as the publisher declared by the second token.

[0265] Optionally, the fourth message is used for the fourth device to send the third message to the first device.

[0266] In some embodiments, the fourth message is not limited in name, for example, it is a Token checking request.

[0267] Step S2109, the fourth device sends the third message to the first device.

[0268] In some embodiments, the first device receives the third message sent by the fourth device.

[0269] In some embodiments, the third message is used to request to verify the second token.

[0270] In some embodiments, the third message is used to request a key for verifying the second token.

[0271] In some embodiments, the third message is used to request a certificate for verifying the second token.

[0272] In some embodiments, the third message includes the second token.

[0273] In some embodiments, the third message is not limited in name, for example, it is a Token checking request.

[0274] In some embodiments, the first device determines to send the third message to the first device based on the issuer of the claim in the second token containing the fourth identity.

[0275] In some embodiments, the third message includes the fifth identity.

[0276] In some optional embodiments, the third message is used to request verification, and the first device verifies the second token based on the key to obtain a verification result.

[0277] In some optional embodiments, the third message is used to request verification, and the first device verifies the second token based on the certificate to obtain a verification result.

[0278] Optionally, the verification result includes: verification passed, or verification failed.

[0279] Step S2110, the first device sends a first response to the fourth device.

[0280] In some embodiments, the fourth device receives the first response sent by the first device.

[0281] In some embodiments, the first response includes a verification result of verifying the second token.

[0282] In some embodiments, the first response comprises verifying a key of the second token.

[0283] In some embodiments, the first response comprises verifying a certificate of the second token.

[0284] In some embodiments, the first response is determined based on the third message.

[0285] In some embodiments, the first response comprises a fifth identity.

[0286] For example, the third message is used to request verifying the second token, and the first response comprises a verifying result of the second token.

[0287] For example, the third message is used to request verifying a key of the second token, and the first response comprises the key of the second token.

[0288] For example, the third message is used to request verifying a certificate of the second token, and the first response comprises the certificate of the second token.

[0289] In some embodiments, the name of the first response is not limited, for example, it is a token checking response.

[0290] In step S2111, the fourth device sends the second response to the third device.

[0291] In some embodiments, the third device receives the second response sent by the fourth device.

[0292] In some embodiments, the second response comprises a verifying result of verifying the second token.

[0293] In some embodiments, the second response comprises a key of verifying the second token.

[0294] In some embodiments, the second response comprises a certificate of verifying the second token.

[0295] In some embodiments, the second response is determined based on the fourth message.

[0296] In some embodiments, the fourth device sends the second response to the third device based on the fifth identity in the first response.

[0297] For example, the fourth message is used to request verifying the second token, and the second response comprises a verifying result of the second token.

[0298] For example, the fourth message is used to request verifying a key of the second token, and the second response comprises the key of the second token.

[0299] For example, the fourth message is used to request verifying a certificate of the second token, and the second response comprises the certificate of the second token.

[0300] In some embodiments, the name of the second response is not limited, which is, for example, a token checking response.

[0301] In some optional embodiments, the third device sends a third response to the second device.

[0302] In some optional embodiments, the second device receives the third response sent by the third device.

[0303] Optionally, the third response is determined based on a fifth message.

[0304] Optionally, the third response is used to indicate a result of invoking service information related to the first token.

[0305] Optionally, the third response is used to indicate a result of invoking service information related to the second token.

[0306] Optionally, the name of the fifth message is not limited, which is, for example, a service invocation response or an API invocation response.

[0307] In some embodiments, the names of information and the like are not limited to the names described in the embodiments, and terms such as “information”, “message”, “signal”, “signaling”, “report”, “configuration”, “indication”, “instruction”, “command”, “channel”, “parameter”, “domain”, “field”, “symbol”, “symbol”, “codebook”, “codeword”, “code point”, “bit”, “data”, “program”, “chip”, and the like can be replaced with each other.

[0308] In some embodiments, “acquire”, “obtain”, “get”, “receive”, “transmit”, “bidirectional transmission”, “send and / or receive”, and the like can be replaced with each other, which can be interpreted as receiving from other subjects, acquiring from a protocol, acquiring from a higher layer, obtaining by processing oneself, implementing autonomously, and the like.

[0309] In some embodiments, the terms “send”, “transmit”, “report”, “issue”, “transmit”, “bidirectional transmission”, “send and / or receive”, and the like can be replaced with each other.

[0310] In some embodiments, the terms "certain", "preset", "pre-set", "set", "indicated", "a certain", "any", "first", and the like can be replaced with each other, and "certain A", "preset A", "pre-set A", "set A", "indicated A", "a certain A", "any A", "first A" can be interpreted as A that is previously specified in a protocol or the like, A that is obtained by setting, configuration, or indication, or the like, A that is certain, a certain, any, or first, and the like, but are not limited thereto.

[0311] In some embodiments, determination or judgment can be made by a value (0 or 1) expressed in 1 bit, can be made by a true or false value (Boolean value) expressed in true or false, can be made by comparison of numerical values (for example, comparison with a predetermined value), and the like, but is not limited thereto.

[0312] The information processing method related to the embodiments of the present disclosure can include at least one of steps S2101 to S2111. For example, step S2101 can be implemented as an independent embodiment; step S2102 can be implemented as an independent embodiment; step S2103 can be implemented as an independent embodiment; step S2104 can be implemented as an independent embodiment; step S2105 can be implemented as an independent embodiment; step S2106 can be implemented as an independent embodiment; step S2107 can be implemented as an independent embodiment; step S2108 can be implemented as an independent embodiment; step S2109 can be implemented as an independent embodiment; step S2110 can be implemented as an independent embodiment; step S2111 can be implemented as an independent embodiment; a combination of step S2101 and step S2107 can be implemented as an independent embodiment; a combination of step S2102 and step S2104 can be implemented as an independent embodiment; a combination of step S2102, step S2103 and step S2104 can be implemented as an independent embodiment; a combination of step S2105 and step S2106 can be implemented as an independent embodiment; a combination of step S2105, step S2106 and step S2107 can be implemented as an independent embodiment; a combination of step S2103, step S2104 and step S2107 can be implemented as an independent embodiment; a combination of step S2109 to step S2110 can be implemented as an independent embodiment; a combination of step S2108, step S2109, step S2110 and step S2111 can be implemented as an independent embodiment; a combination of step S2101 to step S2104 and step S2107 can be implemented as an independent embodiment; a combination of step S2101 and step S2105 to step S2111 can be implemented as an independent embodiment; a combination of step S2101 to step S2111 can be implemented as an independent embodiment.

[0313] In some embodiments, steps S2102 to S2104 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0314] In some embodiments, steps S2105 to S2106, steps S2108 to S2111 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0315] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0316] FIG. 2B is an interaction diagram of a method for processing information according to an embodiment of the present disclosure. As shown in FIG. 2B, the embodiment of the present disclosure relates to a method for processing information used by the information processing system 100, and the method comprises the following steps:

[0317] In step S2201, the second device sends a first message to the first device.

[0318] The optional implementation of step S2201 can refer to the optional implementation of step S2101 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0319] In step S2202, the first device sends a second message to the fourth device.

[0320] The optional implementation of step S2202 can refer to the optional implementation of step S2102 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0321] In step S2203, the fourth device generates a first token.

[0322] The optional implementation of step S2203 can refer to the optional implementation of step S2103 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0323] In step S2204, the fourth device sends the first token to the first device.

[0324] The optional implementation of step S2204 can refer to the optional implementation of step S2104 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0325] In step S2205, the first device sends the first token to the second device.

[0326] The optional implementation of step S2205 can refer to the optional implementation of step S2107 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0327] The above embodiments can be implemented independently or in combination with each other, and the optional implementation can refer to the optional implementation of the steps in FIG. 2A, which will not be repeated here.

[0328] FIG. 2C is an interaction diagram of a method for processing information according to an embodiment of the present disclosure. As shown in FIG. 2C, the embodiment of the present disclosure relates to a method for processing information used by the information processing system 100, and the method comprises the following steps:

[0329] In step S2301, the second device sends a first message to the first device.

[0330] The optional implementation of step S2301 can refer to the optional implementation of step S2101 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0331] In step S2302, the fourth device sends the authorization information to the first device.

[0332] The optional implementation of step S2302 can refer to the optional implementation of step S2105 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0333] In step S2303, the first device generates a second token.

[0334] The optional implementation of step S2303 can refer to the optional implementation of step S2106 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0335] In step S2304, the first device sends the second token to the second device.

[0336] The optional implementation of step S2304 can refer to the optional implementation of step S2107 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0337] In some optional embodiments, the second device sends a fifth message to the third device.

[0338] In step S2305, the third device sends a fourth message to the fourth device.

[0339] The optional implementation of step S2305 can refer to the optional implementation of step S2108 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0340] In step S2306, the fourth device sends a third message to the first device.

[0341] The optional implementation of step S2306 can refer to the optional implementation of step S2109 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0342] In step S2307, the first device sends a first response to the fourth device.

[0343] The optional implementation of step S2307 can refer to the optional implementation of step S2110 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0344] In step S2308, the fourth device sends a second response to the third device.

[0345] The optional implementation of step S2308 can refer to the optional implementation of step S2111 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0346] In some optional embodiments, the third device sends the fifth response to the second device.

[0347] The above embodiments can be implemented independently or in combination with each other, and the optional implementation can refer to the optional implementation of steps in FIG. 2A, which will not be repeated here.

[0348] FIG. 3A is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 3A, the embodiments of the present disclosure relate to an information processing method, which is performed by a first device, and the above method comprises:

[0349] Step S3101: obtaining a first message.

[0350] The optional implementation of step S3101 can refer to the optional implementation of step S2101 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0351] In some embodiments, the first device receives the first message sent by the second device, but is not limited thereto, and can also receive the first message sent by other subjects.

[0352] In some embodiments, the first device obtains the first message specified by a protocol.

[0353] In some embodiments, the first device obtains the first message from upper layer(s).

[0354] In some embodiments, the first device processes to obtain the first message.

[0355] In some embodiments, step S3101 is omitted, and the first device autonomously implements the function indicated by the first message, or the above function is default or default.

[0356] Step S3102: sending a second message.

[0357] The optional implementation of step S3102 can refer to the optional implementation of step S2102 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0358] In some embodiments, the first device can send the second message to the fourth device, but is not limited thereto, and can also send the second message to other subjects.

[0359] Step S3103: obtaining a first token.

[0360] The optional implementation of step S3103 can refer to the optional implementation of step S2104 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0361] In some embodiments, the first device receives the first token sent by the fourth device, but is not limited thereto, and can also receive the first token sent by other subjects.

[0362] In some embodiments, the first device obtains the first token specified by the protocol.

[0363] In some embodiments, the first device obtains the first token from the upper layer(s).

[0364] In some embodiments, the first device processes to obtain the first token.

[0365] In some embodiments, step S3103 is omitted, and the first device autonomously implements the function indicated by the first token, or the above function is default or default.

[0366] Step S3104, obtaining authorization information.

[0367] The optional implementation of step S3104 can refer to the optional implementation of step S2105 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0368] In some embodiments, the first device receives the authorization information sent by the fourth device, but is not limited thereto, and can also receive the authorization information sent by other subjects.

[0369] In some embodiments, the first device obtains the authorization information specified by the protocol.

[0370] In some embodiments, the first device obtains the authorization information from the upper layer(s).

[0371] In some embodiments, the first device processes to obtain the authorization information.

[0372] In some embodiments, step S3104 is omitted, and the first device autonomously implements the function indicated by the authorization information, or the above function is default or default.

[0373] Step S3105, generating a second token.

[0374] The optional implementation of step S3105 can refer to the optional implementation of step S2106 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0375] Step S3106: sending the first token or the second token.

[0376] Optional implementation of step S3106 can refer to optional implementation of step S2107 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0377] In some embodiments, the first device can send the first token or the second token to the second device, but is not limited thereto, and can send the first token or the second token to other subjects.

[0378] Step S3107: obtaining a third message.

[0379] Optional implementation of step S3107 can refer to optional implementation of step S2109 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0380] In some embodiments, the first device receives the third message sent by the fourth device, but is not limited thereto, and can receive the third message sent by other subjects.

[0381] In some embodiments, the first device obtains the third message as specified by a protocol.

[0382] In some embodiments, the first device obtains the third message from upper layer(s).

[0383] In some embodiments, the first device processes to obtain the third message.

[0384] In some embodiments, step S3104 is omitted, and the first device autonomously implements the function indicated by the third message, or the above function is default or default.

[0385] Step S3108: sending a first response.

[0386] Optional implementation of step S3108 can refer to optional implementation of step S2110 in FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0387] In some embodiments, the first device can send the first response to the second device, but is not limited thereto, and can send the first response to other subjects.

[0388] The information processing method related to the embodiments of the present disclosure can include at least one of steps S3101 to S3108. For example, step S3101 can be implemented as an independent embodiment; step S3102 can be implemented as an independent embodiment; step S3103 can be implemented as an independent embodiment; step S3104 can be implemented as an independent embodiment; step S3105 can be implemented as an independent embodiment; step S3106 can be implemented as an independent embodiment; step S3107 can be implemented as an independent embodiment; step S3108 can be implemented as an independent embodiment; a combination of step S3101 and step S3106 can be implemented as an independent embodiment; a combination of step S3102 and step S3103 can be implemented as an independent embodiment; a combination of step S3104 and step S3105 can be implemented as an independent embodiment; a combination of step S3104, step S3105 and step S3106 can be implemented as an independent embodiment; a combination of step S3107 to step S3108 can be implemented as an independent embodiment; a combination of step S3101 to step S3103 and step S3106 can be implemented as an independent embodiment; a combination of step S3101 and step S3104 to step S3108 can be implemented as an independent embodiment; and a combination of step S3101 to step S3108 can be implemented as an independent embodiment.

[0389] In some embodiments, steps S3102 to S3103 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0390] In some embodiments, steps S3104 to S3105, steps S3107 to S3108 can be optional, and one or more of these steps can be omitted or replaced in different embodiments.

[0391] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0392] FIG. 3B is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 3B, the embodiments of the present disclosure relate to an information processing method, which is performed by a first device, and the above method comprises:

[0393] Step S3201, receiving a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0394] The optional implementation of step S3201 can refer to the optional implementation of step S2101 in FIG. 2A, or the optional implementation of step S3101 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described herein again.

[0395] In some embodiments, the first message is used to request the second device for related authorization for the third device; wherein the second device and the first device are in a first domain, and the third device is in a second domain.

[0396] In some embodiments, the first message further includes at least one of: the second identifier, wherein the second identifier is an identifier of a resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0397] In some embodiments, the method further includes: sending a second message to a fourth device, wherein the second message includes the first identifier, and the second message is used to request related authorization for the second device; the fourth device is in the second domain; receiving a first token sent by the fourth device, wherein the first token is generated by the fourth device based on the second message determining that the second device is authorized, and the first token includes at least one of: the first identifier, the second identifier, a third identifier, service information, service operation information, service API information, type information, and purpose information; the third identifier is an identifier of the fourth device; and sending the first token to the second device.

[0398] In some embodiments, the third identifier is set as a publisher declared by the first token, and the first identifier is set as a subject declared by the first token.

[0399] In some embodiments, the second message is sent to the fourth device, including at least one of: the second message is sent to the fourth device in a case that at least one of the service information, the service operation information and the service API information matches the service API discovered from the fourth device; the second message is sent to the fourth device in a case that at least one of the service information, the service operation information and the service API information is determined to match the service API published by the fourth device; the second message is sent to the fourth device in a case that at least one of the service information, the service operation information and the service API information is determined to match the service published by the fourth device; the second message is sent to the fourth device in a case that at least one of the service information, the service operation information and the service API information is determined to match the service operation published by the fourth device; the second message is sent to the fourth device in a case that at least one of the type information and the purpose information corresponds to the service API matching the service API published by the fourth device.

[0400] In some embodiments, the second message is sent to the fourth device, including: the second message is sent to the fourth device in a case that a fifth device in the same domain as the first device is determined to be unable to provide at least one of: the service information, the service operation information and the service API information.

[0401] In some embodiments, the fourth device regards the first identity as having been authenticated.

[0402] In some embodiments, the method further includes: generating a second token in a case that the second device is determined to be authorized based on the first message and authorization information, wherein the authorization information is used at least to indicate that the second device corresponding to the first identity has access to at least one of: the service information, the service operation information and the service API information; the second token includes a fourth identity and / or the first identity, the fourth identity being an identity of the first device; and the second token is sent to the second device.

[0403] In some embodiments, the fourth identity is set as a publisher declared by the second token; and the first identity is set as a subject declared by the second token.

[0404] In some embodiments, the method further includes at least one of: obtaining authorization information sent by the fourth device in a service information discovery stage; and obtaining authorization information configured by the fourth device in a service information publishing stage.

[0405] In some embodiments, the method further comprises: receiving a third message sent by the fourth device; sending a first response to the fourth device; wherein the third message comprises the second token, the third message is used to request verification of the second token, and the first response comprises a verification result of the verification of the second token; or the third message is used to request a key for verifying the second token, and the first response comprises the key for verifying the second token; or the third message is used to request a certificate for verifying the second token, and the first response comprises the certificate for verifying the second token.

[0406] The above embodiments can be implemented independently or in combination with each other. For optional implementation, refer to the optional implementation of the steps in FIG. 2A and FIG. 3A, which are not described herein again.

[0407] FIG. 3C is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 3C, the embodiment of the present disclosure relates to an information processing method, which is performed by a first device, and the above method comprises:

[0408] In step S3301, a first message is obtained.

[0409] For optional implementation of step S3301, refer to the optional implementation of step S2101 in FIG. 2A, or the optional implementation of step S3101 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described herein again.

[0410] In step S3302, authorization information is obtained.

[0411] For optional implementation of step S3302, refer to the optional implementation of step S2105 in FIG. 2A, or the optional implementation of step S3104 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described herein again.

[0412] In step S3303, a second token is generated.

[0413] For optional implementation of step S3303, refer to the optional implementation of step S2106 in FIG. 2A, or the optional implementation of step S3105 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described herein again.

[0414] In step S3304, the second token is sent.

[0415] For optional implementation of step S3304, refer to the optional implementation of step S2107 in FIG. 2A, or the optional implementation of step S3106 in FIG. 3A, and other associated parts in the embodiments related to FIG. 2A and FIG. 3A, which are not described herein again.

[0416] The above embodiments can be implemented alone or in combination with each other. The optional implementation manners can refer to the optional implementation manners of the steps in FIG. 2A and FIG. 3A, which are not described herein again.

[0417] FIG. 4A is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4A, the embodiment of the present disclosure relates to an information processing method, which is performed by a fourth device, and the method comprises the following steps:

[0418] In step S4101, a second message is acquired.

[0419] The optional implementation manner of step S4101 can refer to the optional implementation manner of step S2102 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0420] In some embodiments, the fourth device receives the second message sent by the first device, but is not limited thereto, and can also receive the second message sent by other subjects.

[0421] In some embodiments, the fourth device acquires the second message specified by a protocol.

[0422] In some embodiments, the fourth device acquires the second message from an upper layer.

[0423] In some embodiments, the fourth device processes to obtain the second message.

[0424] In some embodiments, step S4101 is omitted, and the fourth device autonomously implements the function indicated by the second message, or the above function is default.

[0425] In step S4102, a first token is generated.

[0426] The optional implementation manner of step S4102 can refer to the optional implementation manner of step S2103 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0427] In step S4103, the first token is sent.

[0428] The optional implementation manner of step S4103 can refer to the optional implementation manner of step S2105 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0429] In some embodiments, the fourth device can send the first token to the first device, but is not limited thereto, and can also send the first token to other subjects.

[0430] The information processing method involved in the embodiments of this disclosure may include at least one of steps S4101 to S4103. For example, step S4101 may be implemented as an independent embodiment; step S4102 may be implemented as an independent embodiment; step S4103 may be implemented as an independent embodiment; a combination of steps S4101 and S4103 may be implemented as an independent embodiment; a combination of steps S4101 to S4102 may be implemented as an independent embodiment; a combination of steps S4102 and S4103 may be implemented as an independent embodiment; a combination of steps S4101 to S4103 may be implemented as an independent embodiment.

[0431] In some embodiments, step S4102 may be optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0432] In the embodiments disclosed herein, each embodiment can be implemented individually or in combination with each other, and the steps in each embodiment can be distinguished by their order.

[0433] Figure 4B is a flowchart illustrating an information processing method according to an embodiment of the present disclosure. As shown in Figure 4B, the embodiment of the present disclosure relates to an information processing method executed by a fourth device, the method comprising:

[0434] Step S4201: Receive a second message sent by the first device, wherein the second message includes a first identifier, the first identifier being the identifier of the second device, and the second message is used to request relevant authorization for the second device.

[0435] Optional implementations of step S4201 can be found in step S2102 in Figure 2A or step S4101 in Figure 4A, as well as other related parts in the embodiments involved in Figures 2A and 4A, which will not be repeated here.

[0436] In some embodiments, the second message is used to request the second device to grant relevant authorization to the third device; wherein the second device and the first device are in the first domain, and the third device and the fourth device are in the second domain.

[0437] In some embodiments, the second message further includes at least one of the following: a second identifier, wherein the second identifier is an identifier of the resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0438] In some embodiments, the method comprises: generating the first token in a case where it is determined, based on the second message and the authorization information, that the second device is authorized; wherein the authorization information is used at least to indicate that the second device corresponding to the first identity has access to at least one of the following: the service information, the service operation information, and the service API information; the first token comprises at least one of the following: the first identity, the second identity, the third identity, the service information, the service operation information, the service API information, the type information, and the purpose information; the third identity is an identity of the fourth device; and sending the first token to the first device, wherein the first token is used by the first device to send to the second device.

[0439] In some embodiments, the third identity is set as an issuer of the first token claim, and the first identity is set as a subject of the first token claim.

[0440] The above embodiments can be implemented independently or in combination with each other, and optional implementation manners can refer to the optional implementation manners of the steps of FIG. 2A and FIG. 4A, which are not described herein again.

[0441] FIG. 4C is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4C, the embodiment of the present disclosure relates to an information processing method, which is performed by a fourth device, and the above method comprises:

[0442] Step S4301: sending authorization information.

[0443] Optional implementation manners of step S4301 can refer to the optional implementation manners of step S2105 of FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0444] In some embodiments, the fourth device can send the authorization information to the first device, but is not limited thereto, and can also send the authorization information to other subjects.

[0445] Step S4302: obtaining a fourth message.

[0446] Optional implementation manners of step S4302 can refer to the optional implementation manners of step S2108 of FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0447] In some embodiments, the fourth device receives the fourth message sent by the third device, but is not limited thereto, and can also receive the fourth message sent by other subjects.

[0448] In some embodiments, the fourth device obtains the fourth message specified by a protocol.

[0449] In some embodiments, the fourth device obtains the fourth message from an upper layer.

[0450] In some embodiments, the fourth device processes to obtain the fourth message.

[0451] In some embodiments, step S4302 is omitted, and the fourth device autonomously implements the function indicated by the fourth message, or the function is default or default.

[0452] Step S4303, sending the third message.

[0453] The optional implementation of step S4303 can refer to the optional implementation of step S2109 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0454] In some embodiments, the fourth device can send the third message to the first device, but is not limited thereto, and can send the third message to other subjects.

[0455] Step S4304, obtaining the first response.

[0456] The optional implementation of step S4304 can refer to the optional implementation of step S2110 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0457] In some embodiments, the fourth device receives the first response sent by the first device, but is not limited thereto, and can receive the first response sent by other subjects.

[0458] In some embodiments, the fourth device obtains the first response specified by the protocol.

[0459] In some embodiments, the fourth device obtains the first response from the upper layer(s).

[0460] In some embodiments, the fourth device processes to obtain the first response.

[0461] In some embodiments, step S4304 is omitted, and the fourth device autonomously implements the function indicated by the first response, or the function is default or default.

[0462] Step S4305, sending the second response.

[0463] The optional implementation of step S4305 can refer to the optional implementation of step S2111 of FIG. 2A and other associated parts in the embodiments involved in FIG. 2A, which will not be repeated here.

[0464] In some embodiments, the fourth device can send the second response to the third device, but is not limited thereto, and can send the second response to other subjects.

[0465] The information processing method related to the embodiments of the present disclosure can include at least one of steps S4301 to S4305. For example, step S4301 can be implemented as an independent embodiment; step S4302 can be implemented as an independent embodiment; step S4303 can be implemented as an independent embodiment; step S4304 can be implemented as an independent embodiment; step S4305 can be implemented as an independent embodiment; a combination of step S4303 and step S4304 can be implemented as an independent embodiment; a combination of steps S4302 to S4305 can be implemented as an independent embodiment; and a combination of steps S4301 to S4305 can be implemented as an independent embodiment.

[0466] In some embodiments, step S4301 can be optional, and one or more of the steps can be omitted or replaced in different embodiments.

[0467] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps or subsequent steps.

[0468] FIG. 4D is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 4D, the embodiments of the present disclosure relate to an information processing method, which is performed by a fourth device, and the above method includes:

[0469] In step S4401, authorization information is sent to the first device, wherein the authorization information is used to indicate that the second device corresponding to the first identifier has the right to access at least one of the service information, the service operation information, and the service API information; wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by the second device, the first message includes the first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0470] The optional implementation of step S4401 can refer to the optional implementation of step S2105 in FIG. 2A, or the optional implementation of step S4301 in FIG. 4C, and other related parts in the embodiments related to FIG. 2A and FIG. 4C, which will not be repeated here.

[0471] In some embodiments, the authorization information sent to the first device includes at least one of the following: the authorization information is sent to the first device in the service information discovery phase; and the authorization information is sent to the first device in the service information publishing phase.

[0472] In some embodiments, the method further includes: receiving a fourth message sent by the third device; sending a third message to the first device; receiving a first response sent by the first device; sending a second response to the third device; wherein the third message or the fourth message includes the second token, the third message or the fourth message is used to request verification of the second token, the first response or the second response includes a verification result of the second token; or, the third message or the fourth message is used to request a key for verifying the second token, the first response or the second response includes the key for verifying the second token; or, the third message or the fourth message is used to request a certificate for verifying the second token, and the first response or the second response includes the certificate for verifying the second token.

[0473] In some embodiments, the second device and the first device are in a first domain, and the third device and the fourth device are in a second domain.

[0474] The above embodiments can be implemented independently or in combination with each other, and optional implementation manners can refer to the optional implementation manners of the steps in FIG. 2A and FIG. 4C, which are not described herein again.

[0475] FIG. 5A is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5A, the embodiment of the present disclosure relates to an information processing method, which is performed by a second device, and the above method includes:

[0476] Step S5101: sending a first message.

[0477] Optional implementation manners of step S5101 can refer to the optional implementation manners of step S2101 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0478] In some embodiments, the second device can send the first message to the first device, but is not limited thereto, and can also send the first message to other subjects.

[0479] Step S5102: obtaining a first token or a second token.

[0480] Optional implementation manners of step S5102 can refer to the optional implementation manners in the optional embodiments of step S2107 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0481] In some embodiments, the second device receives the first token or the second token sent by the access network device, but is not limited thereto, and can also receive the first token or the second token sent by other subjects.

[0482] In some embodiments, the second device obtains the first token or the second token specified by a protocol.

[0483] In some embodiments, the second device obtains the first token or the second token from upper layer(s).

[0484] In some embodiments, the second device processes to obtain the first token or the second token.

[0485] In some embodiments, step S5102 is omitted, and the second device autonomously implements the function indicated by the first token or the second token, or the above function is default or default.

[0486] The information processing method related to the embodiments of the present disclosure can include at least one of steps S5101 to S5102. For example, step S5101 can be implemented as an independent embodiment; step S5102 can be implemented as an independent embodiment; and the combination of steps S5101 to S5102 can be implemented as an independent embodiment.

[0487] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0488] FIG. 5B is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5B, the embodiments of the present disclosure relate to an information processing method, which is performed by a second device, and the above method comprises:

[0489] Step S5201, sending a first message to a first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request related authorization for the second device.

[0490] The optional implementation of step S5201 can refer to the optional implementation of step S2101 in FIG. 2A, or the optional implementation of step S5101 in FIG. 5A, and other related parts in the embodiments related to FIG. 2A, FIG. 5A, which will not be repeated here.

[0491] In some embodiments, the first message is used to request the second device to request related authorization for a third device; wherein the second device and the first device are in a first domain, and the third device is in a second domain. In some embodiments, the first message further includes at least one of the following: a second identifier, wherein the second identifier is an identifier of a resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; and purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

[0492] In some embodiments, the method further comprises one of the following: receiving the first token sent by the first device, wherein the first token is generated after the fourth device determines that the second device is authorized, and the first token comprises at least one of the following: the first identifier, the second identifier, the third identifier, service information, service operation information, service API information, type information, and purpose information; the fourth device is in the second domain; receiving the second token sent by the first device, wherein the second token is generated after the fourth device determines that the second device is authorized, and the second token comprises at least the first identifier and the fourth identifier; and the fourth identifier is an identifier of the first device.

[0493] In some embodiments, the third identifier is set as a publisher declared by the first token, the first identifier is set as a subject declared by the first token, or the fourth identifier is set as a publisher declared by the second token, and the first identifier is set as a subject declared by the second token.

[0494] The above embodiments can be implemented independently or in combination with each other, and optional implementation manners can refer to the optional implementation manners of the steps of FIG. 2A and FIG. 5A, which are not described herein again.

[0495] FIG. 6A is a flow diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 6A, the present disclosure relates to an information processing method, which is performed by a third device, and the method comprises the following steps:

[0496] In step S6101, a fourth message is sent.

[0497] Optional implementation manners of step S6101 can refer to the optional implementation manners of step S2108 of FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0498] In some embodiments, the third device can send the fourth message to the fourth device, but is not limited thereto, and can also send the fourth message to other subjects.

[0499] In step S6102, a second response is obtained.

[0500] Optional implementation manners of step S6102 can refer to the optional implementation manners of step S2102 of FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which are not described herein again.

[0501] In some embodiments, the third device receives the second response sent by the terminal, but is not limited thereto, and can also receive the second response sent by other subjects.

[0502] In some embodiments, the third device obtains the second response specified by the protocol.

[0503] In some embodiments, the third device obtains the second response from upper layer(s).

[0504] In some embodiments, the third device processes to obtain the second response.

[0505] In some embodiments, step S6102 is omitted, and the third device autonomously implements the function indicated by the second response, or the function is default or default.

[0506] The information processing method related to the embodiments of the present disclosure can include at least one of steps S6101 to S6102. For example, step S6101 can be implemented as an independent embodiment; step S6102 can be implemented as an independent embodiment; and the combination of steps S6101 to S6102 can be implemented as an independent embodiment.

[0507] In the embodiments of the present disclosure, each embodiment can be implemented independently or in combination with each other, and the steps in each embodiment can be distinguished as preceding steps and subsequent steps.

[0508] FIG. 6B is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 6B, the embodiments of the present disclosure relate to an information processing method, which is performed by a second device, and the method includes:

[0509] Step S6201, receiving a fifth message sent by the second device, wherein the fourth message includes a first token, and the fifth message is used to request to call service information related to the first token, or the fifth message includes a second token, and the fifth message is used to request to call service information related to the second token.

[0510] The optional implementation of step S6201 can refer to the optional implementation of the optional embodiment of step S2107 in FIG. 2A and other associated parts in the embodiments related to FIG. 2A, which will not be repeated here.

[0511] In some embodiments, the method includes: sending a fourth message to the fourth device; and receiving a second response sent by the fourth device; wherein the second token is included in the fourth message, the fourth message is used to request to verify the second token, and the second response includes a verification result of verifying the second token; or the fourth message is used to request to verify a key of the second token, and the second response includes the key of verifying the second token; or the fourth message is used to request to verify a certificate of the second token, and the second response includes the certificate of verifying the second token.

[0512] In some embodiments, the fourth message is sent to the fourth device based on the fourth identifier in the second token, wherein the fourth message is used for the fourth device to send the third message to the first device, and the fourth identifier is an identifier of the first device, and the fourth identifier is set as a publisher declared by the second token.

[0513] The above embodiments can be implemented alone or in combination with each other, and optional implementation manners can refer to optional implementation manners of steps in FIG. 2A and FIG. 6A, which are not described herein again.

[0514] FIG. 7 is an interaction schematic diagram of an information processing method according to an embodiment of the present disclosure. As shown in FIG. 5, the embodiment of the present disclosure relates to an information processing method, which is used for an information processing system 100, and the method includes one of the following steps:

[0515] In step S7101, the second device sends a first message to the first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request authorization of the second device.

[0516] Optional implementation manners of step S7101 can refer to optional implementation manners in step S2101 in FIG. 2A, step S3101 in FIG. 3A, step S5101 in FIG. 5A, and other associated parts in the embodiments related to FIG. 2A, FIG. 3A and FIG. 5A, which are not described herein again.

[0517] In step S7102, the first device sends a second message to the fourth device, wherein the second message includes the first identifier, and the second message is used to request authorization of the second device.

[0518] Optional implementation manners of step S7102 can refer to optional implementation manners in step S2102 in FIG. 2A, step S3102 in FIG. 3A, step S4101 in FIG. 4A, and other associated parts in the embodiments related to FIG. 2A, FIG. 3A and FIG. 4A, which are not described herein again.

[0519] In some embodiments, the above method can include the method described in the above embodiments of the information processing system side, the first device side, the second device side, the third side and / or the fourth device side, which are not described herein again.

[0520] In some embodiments, the prerequisites for the following scheme one and scheme two are:

[0521] Prerequisites:

[0522] The resource owner can be a user or a subscriber of a UE, depending on the use case and regulations.

[0523] The resource owner function is responsible for interacting with the resource owner; the resource owner function can be part of a UE, a personal computer, etc.

[0524] The resource owner function enables at least one of the following functions: resource access authorization, management, and revocation of authorization for resource access.

[0525] Option 1: Authorization mechanism in the CCF interconnection scenario based on CCF-B:

[0526] FIG. 8A is a flow diagram illustrating an information processing method according to an embodiment of the present disclosure. As shown in FIG. 8A, the present disclosure relates to an information processing method, which includes the following steps:

[0527] Preconditions:

[0528] The API invoker completes onboarding with the CCF-A;

[0529] The CCF-B is connected to the AEF.

[0530] Step S8100: The API invoker and the CCF-A establish a TLS tunnel and complete mutual authentication.

[0531] Step S8101: The API invoker sends a service API discovery request to the CCF-A.

[0532] Optionally, the service API discovery request can also be a service API discovery related request.

[0533] Step S8102: The CCF-A sends a service API discovery request to the CCF-B.

[0534] Optionally, the CCF-A determines that the service API discovery request needs to be sent to the CCF-B based on a local policy (for example, a specific category of API needs to send a service API discovery request to the CCF-B), and sends the service API discovery request to the CCF-B.

[0535] Step S8103: The CCF-B sends a service API discovery response to the CCF-A.

[0536] Optionally, the service API discovery response can be a service API discovery related response. The service API discovery response includes service API information; the service API information can include services and / or service operations and / or service APIs, etc.

[0537] Step S8104, CCF-A sends a service API discovery response to the API invoker.

[0538] Step S8105, the API invoker sends an authorization related request to CCF-A.

[0539] Optionally, the authorization related request includes at least one of the following: API invoker ID, intended resource owner ID, intended service, intended service operation, intended service API, data type, and data processing purpose.

[0540] Optionally, the authorization related request in step S8105 can be the first message in the previous embodiment.

[0541] Step S8106, CCF-A sends the authorization related request to CCF-B.

[0542] Optionally, the authorization related request in step S8106 can be the second message in the previous embodiment.

[0543] Optionally, CCF-A sends the authorization related request to CCF-B if it determines that the intended service and / or service operation matches the discovered service API from CCF-B.

[0544] Optionally, CCF-A sends the authorization related request to CCF-B if it determines that the intended service and / or service operation and / or service API matches the service API published by CCF-B.

[0545] Optionally, in addition to the intended service and / or service operation, CCF-A can use the data type and / or data processing purpose to identify the matching service API; then CCF-A determines how to process the authorization related request. For example, CCF-A sends the authorization related request to CCF-B if it determines that the service API corresponding to at least one of the data type and data processing purpose matches the service API published by CCF-B.

[0546] Optionally, the authorization related request sent to CCF-B can include at least one of the following: API invoker ID, intended resource owner ID, intended service, intended service operation, intended service API, data type, and data processing purpose. Based on the trust relationship between CCF-A and CCF-B, the API invoker indicated by the API invoker ID has been authenticated and onboarded in CCF-A.

[0547] Step S8107, CCF-B sends an authorization related response to CCF-A.

[0548] Optionally, if CCF-B determines that the API invoker is authorized, CCF-B sends an authorization related response to CCF-A, the authorization related response comprising a token; the token comprising an API invoker ID, an expected resource owner ID, an expected service, an expected service operation, an expected service API, an expected data type, and a data processing purpose.

[0549] Optionally, if CCF-B determines that the API invoker is authorized, CCF-B sends an authorization related response to CCF-A, the authorization related response comprising a token; the token comprising an API invoker ID, an expected resource owner ID, an expected service, an expected service operation, an expected service API, an expected data type, and a data processing purpose.

[0550] Step S8108, CCF-A sends an authorization related response to the API invoker. Optionally, the authorization related response comprises a token.

[0551] Step S8109, the API invoker establishes a TLS session with the AEF.

[0552] Step S8110, the API invoker invokes a northbound API using the OAuth 2.0 access token.

[0553] Optionally, in the case of successful authentication to the AEF, the API invoker shall invoke the northbound API of the AEF; the access token received from CCF-B shall be sent with the invocation request to invoke the northbound API according to OAuth 2.0.

[0554] Optionally, the access token is the first token in the previous embodiment.

[0555] Step S8111, the AEF verifies the access token.

[0556] Optionally, the AEF verifies the access token using a certificate of CCF-B or a key of CCF-B.

[0557] Step S8112, the AEF sends a northbound API invocation response to the API invoker.

[0558] In the embodiments of the present disclosure, part or all of the steps, the optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with the optional implementation manners of other embodiments.

[0559] Scheme two, authorization mechanism of CCF interconnection scenario based on CCF-A:

[0560] FIG. 8B is a flow diagram illustrating a method of information processing according to an embodiment of the present disclosure. As shown in FIG. 8B, the embodiments of the present disclosure relate to a method of information processing, which comprises:

[0561] In step S8200, the API invoker and the CCF-A have established a TLS tunnel and completed mutual authentication.

[0562] In step S8201, the API invoker sends a service API discovery request to the CCF-A.

[0563] Optionally, the service API discovery request can also be a service API discovery related request.

[0564] In step S8202, the CCF-A sends a service API discovery request to the CCF-B.

[0565] Optionally, the CCF-A determines that the service API discovery request needs to be sent to the CCF-B based on a local policy (for example, a specific category of API needs to send a service API discovery request to the CCF-B), and sends the service API discovery request to the CCF-B.

[0566] In step S8203, the CCF-B sends a service API discovery response to the CCF-A.

[0567] Optionally, the service API discovery response can be a service API discovery related response. The service API discovery response comprises service API information; the service API information can comprise services and / or service operations and / or service APIs, etc.

[0568] Optionally, in the case where the token is generated by the CCF-A, the CCF-B can also send authorization information related to the discovered service to the CCF-A.

[0569] Optionally, if CCF-B has configured authorization information related to the service and / or service operation and / or service API to CCF-A, step S8202 and step S8203 are not needed. For example, CCF-B configures authorization information to CCF-A during the service and / or service operation and / or service API publishing process.

[0570] Step S8204, CCF-A sends a service API discovery response to the API invoker.

[0571] Step S8205, the API invoker sends an authorization related request to CCF-A.

[0572] Optionally, the authorization related request includes at least one of the following: API invoker ID, intended resource owner ID, intended service, intended service operation, intended service API, data type, and data processing purpose.

[0573] Optionally, the authorization related request in step S8205 can be the first message in the previous embodiments.

[0574] Step S8206, CCF-A checks the authorization related request.

[0575] Optionally, CCF-A checks the authorization related request against the authorization information received from CCF-B.

[0576] Step S8207, CCF-A sends an authorization related response to the API invoker.

[0577] Optionally, if CCF-A determines that the API invoker is authorized, CCF-A sends an authorization related response to the API invoker, the authorization related response includes a token; the token includes CCA-A ID and API invoker ID. CCF-A ID is set as the Issuer of the token claim; API invoker ID is set as the subject of the token. Optionally, the token is the second token in the previous example.

[0578] Step S8208, the API invoker establishes a TLS session with AEF.

[0579] Optionally, step S8208 is similar to step S8109 described above.

[0580] Step S8209, the API invoker sends the token to AEF to request a service API.

[0581] Step S8210, AEF verifies the token.

[0582] Alternatively, since the token sent by the API invoker is generated by the CCF-A (i.e., the token is signed by the CCF-A certificate), if the token is digitally signed with the CCF-A private key, the AEF can make the CCF-A certificate to verify the token, assuming that the CCF-A certificate used for the API invoker authentication (e.g., CCF-A Cert1) is the same as the CCF-A certificate used for signing the token (e.g., CCF-A Cert2). If CCF-A Cert1 and CCF-A Cert2 are not the same, the AEF obtains CCF-A Cert2 through the CCF-B in the same way as obtaining CCF-A Cert1 in step S8208. Here, the AEF can obtain the CCF-A certificate for verifying the token.

[0583] Alternatively, based on the publisher ID in the token, if the publisher ID is different from the CCF-B ID, the AEF sends the token to the CCF-B; the CCF-B sends the token to the CCF-A for verification based on the publisher ID (i.e., CCF-A ID) in the token; the CCF-A sends the token verification result to the AEF through the CCF-B. Here, the AEF can directly obtain the verification result.

[0584] Alternatively, if the token is integrity-protected by a shared key (i.e., corresponding to the key in the previous embodiment), the AEF sends the AEF ID and the publisher ID (i.e., CCF-A ID) to the CCF-B; the CCF-B sends the AEF ID to the CCF-A. The CCF-A sends the key to the AEF through the CCF-B. Then the AEF can verify the token with the shared key. The shared key can be a random number generated by the CCF. Here, the AEF can obtain the key for verifying the token and generated by the CCF-A.

[0585] In step S8111, the AEF sends a northbound API call response to the API invoker.

[0586] Alternatively, if the token is successfully verified, the AEF provides the API call response to the API invoker; otherwise, the AEF sends a failure message to the API invoker.

[0587] In the embodiments of the present disclosure, part or all of the steps, and optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with optional implementation manners of other embodiments.

[0588] The embodiments of the present disclosure relate to an information processing method, which comprises:

[0589] The CCF-A comprises:

[0590] In some embodiments, CCF-A is capable of verifying the token and sending the verification result to AEF; CCF-A is capable of sending the token verification result to AEF through CCF-B.

[0591] In some embodiments, CCF-A is capable of sending an authorization related request to CCF-B on behalf of the API invoker.

[0592] In some embodiments, CCF-A sends an authorization related request to CCF-B if it determines that the AEF in the same domain as CCF-A cannot provide the expected service and / or service operation and / or service API, and finds that the expected service and / or service operation matches the API discovered from CCF-B.

[0593] Optionally, CCF-A sends an authorization related request to CCF-B if it determines that the expected service and / or service operation and / or service API matches the service API published by CCF-B.

[0594] In some embodiments, in addition to the expected service and / or service operation, CCF-A can also use the data type and / or data processing purpose to identify the matching service API; then CCF-A determines how to process the authorization related request. Optionally, the authorization related request sent to CCF-B can include at least one of the following: API invoker ID, expected resource owner ID, expected service, expected service operation, expected service API, data type, and data processing purpose.

[0595] In some embodiments, CCF-A is capable of returning the root CA certificate of the API invoker (e.g., CCF-A certificate) to AEF through CCF-B; CCF-B is used to verify the root CA certificate of the API invoker.

[0596] In some embodiments, CCF-A is capable of generating a token including CCF-A ID and API invoker ID. CCF-A ID is set as the issuer of the token declaration; API invoker ID is set as the subject of the token.

[0597] In some embodiments, CCF-A is capable of sending a shared key to AEF via CCF-B. The shared key used to generate the token can be a random number generated by CCF-A.

[0598] CCF-B:

[0599] In some embodiments, CCF-B can receive from CCF-A at least one of: an API invoker ID, an expected resource owner ID, an expected service, an expected service operation, an expected service API, a data type, and a data processing purpose. CCF-B can authorize an authorization-related request of the API invoker, the authorization-related request being provided by CCF-A.

[0600] In some embodiments, CCF-B can send a token to CCF-A.

[0601] In some embodiments, CCF-B can receive a token from AEF.

[0602] In some embodiments, CCF-B can request CCF-A to provide a key for validating the token. CCF-B can send the key to AEF.

[0603] In some embodiments, CCF-B can receive from CCF-A CCF-A information (e.g., a key for validating a token generated by CCF-A, and AEF information (e.g., AEF ID, etc.), etc.).

[0604] In some embodiments, CCF-B can send CCF-A information (e.g., a key for validating a token generated by CCF-A) to an AEF identified by an AEF ID.

[0605] In some embodiments, CCF-B can send to CCF-A an AEF ID and a service API invocation request, the CCF-A being identified by the API invocation request.

[0606] In some embodiments, CCF-B can send a stored CCF-A certificate directly to AEF without contacting CCF-A.

[0607] In some embodiments, CCF-B can send to CCF-A authorization information of a discovered service to facilitate CCF-A to generate an access token.

[0608] In some embodiments, CCF-B can configure authorization policies for CCF-A during a service and / or service operation and / or service API publication process.

[0609] In some embodiments, CCF-B sends the token to CCF-A for validation based on a publisher ID (i.e., CCA-A ID) in the token.

[0610] API invoker:

[0611] In some embodiments, the API invoker can send to AEF an identity authentication initiation request, the identity authentication initiation request including a CCF-A ID.

[0612] In some embodiments, the API invoker can send a service API invocation request to the AEF, the API invocation request including the CCF-A ID.

[0613] The AEF:

[0614] In some embodiments, the AEF, if receiving the CCF-A ID, requests authorization from the CCF-B. The CCF-A ID indicates that the AEF does not use the CCF-B certificate to verify the certificate of the API invoker, but should request security information from the CCF-A through the CCF-B to perform authentication and security association establishment with the API invoker.

[0615] In some embodiments, the AEF can use the CCF-B to send a key to verify the token.

[0616] In some embodiments, the AEF can send at least one of the following to the CCF-B: the AEF ID, the API invoker ID, and the CCF-A ID.

[0617] In some embodiments, the AEF can send the token to the CCF-B based on the publisher ID in the token being different from the CCF-B ID.

[0618] In some embodiments, the AEF can send the AEF ID and the publisher ID (i.e., the CCF-A ID) to the CCF-B. In this way, a shared key for verifying the token can be retrieved.

[0619] In the embodiments of the present disclosure, part or all of the steps, and optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with optional implementation manners of other embodiments.

[0620] The embodiments of the present disclosure also propose a device for implementing any of the above methods, for example, a device including units or modules for implementing the steps performed by a terminal in any of the above methods. For another example, another device is proposed, including units or modules for implementing the steps performed by a network device (such as an access network device, a core network function node, a core network device, etc.) in any of the above methods.

[0621] It should be understood that the division of each unit or module in the above apparatus is only a logical function division, and all or part of them can be integrated into a physical entity or physically separated in actual implementation. In addition, the units or modules in the apparatus can be implemented in the form of processor calling software: for example, the apparatus includes a processor, the processor is connected with a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to realize any of the above methods or realize the functions of each unit or module of the above apparatus, wherein the processor is a general processor such as a central processing unit (CPU) or a microprocessor, and the memory is a memory in the apparatus or a memory outside the apparatus. Alternatively, the units or modules in the apparatus can be implemented in the form of hardware circuit, and the functions of part or all of the units or modules can be realized by the design of hardware circuit. The above hardware circuit can be understood as one or more processors; for example, in one implementation, the above hardware circuit is an application-specific integrated circuit (ASIC), and the functions of part or all of the units or modules are realized by the design of the logical relationship of elements in the circuit; for another example, in another implementation, the above hardware circuit is a programmable logic device (PLD), and a field programmable gate array (FPGA) is taken as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of part or all of the above units or modules. All units or modules of the above apparatus can be all implemented in the form of processor calling software, or all implemented in the form of hardware circuit, or part implemented in the form of processor calling software and the remaining part implemented in the form of hardware circuit.

[0622] In the embodiments of the present disclosure, the processor is a circuit with signal processing capability. In one implementation, the processor can be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), a digital signal processor (DSP), or the like. In another implementation, the processor can implement certain functions through a logical relationship of hardware circuits, and the logical relationship of the hardware circuits is fixed or can be reconfigured. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In the reconfigurable hardware circuit, the processor loads a configuration document to implement the configuration of the hardware circuit. It can be understood that the processor loads instructions to implement the functions of the above part or all units or modules. In addition, the hardware circuit can also be designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), or the like.

[0623] FIG. 9A is a structural schematic diagram of a first device 9100 according to an embodiment of the present disclosure. As shown in FIG. 9A, the first device 9100 includes a first receiving and transmitting module 9101 and a first processing module 9102. In some embodiments, the first receiving and transmitting module 9101 is configured to receive a first message. Optionally, the first receiving and transmitting module 9101 is configured to perform at least one of the sending and / or receiving steps (for example, steps S2101 and / or S2102 and / or S2104 and / or S2105, but not limited thereto) performed by the first device 9100 in any of the above methods, details of which are not described herein again. In some embodiments, the first processing module 9102 is configured to generate a second token. Optionally, the first processing module 9102 performs at least one of the processing steps (for example, step S2106, but not limited thereto) performed by the first device 9100 in any of the above methods, details of which are not described herein again.

[0624] FIG. 9B is a structural schematic diagram of the fourth device 9200 according to an embodiment of the present disclosure. As shown in FIG. 9B, the fourth device 9200 includes a second transceiver module 9201 and a second processing module 9202. In some embodiments, the second transceiver module 9201 is configured to send the second message. Optionally, the second transceiver module 9201 is configured to perform at least one of the sending and / or receiving steps (for example, the steps S2101 and / or the steps S2104 and / or the steps S2105, but not limited to) performed by the fourth device 9200 in any of the methods described above, details of which are not described herein again. In some embodiments, the second processing module 9202 is configured to generate the first token. Optionally, the second processing module 9202 is configured to perform at least one of the processing steps (for example, the steps S2106, but not limited to) of the fourth device 9200 in any of the methods described above, details of which are not described herein again.

[0625] FIG. 9C is a structural schematic diagram of the second device 9300 according to an embodiment of the present disclosure. As shown in FIG. 9C, the second device 9300 includes a third transceiver module 9301. In some embodiments, the third transceiver module 9301 is configured to send the first message. Optionally, the third transceiver module 9301 is configured to perform at least one of the sending and / or receiving steps (for example, the steps S2101, but not limited to) performed by the second device 9300 in any of the methods described above, details of which are not described herein again.

[0626] FIG. 9D is a structural schematic diagram of the third device 9400 according to an embodiment of the present disclosure. As shown in FIG. 9D, the third device 9400 includes a fourth transceiver module 9401. In some embodiments, the fourth transceiver module 9401 is configured to send the fourth message. Optionally, the fourth transceiver module 9401 is configured to perform at least one of the sending and / or receiving steps (for example, the steps S2108, but not limited to) performed by the third device 9400 in any of the methods described above, details of which are not described herein again.

[0627] In some embodiments, the transceiver module can include a sending module and / or a receiving module, which can be separate or integrated together. Optionally, the transceiver module can be mutually replaced with a transceiver. For example, the first transceiver module includes a first sending module and / or a first receiving module. For example, the second transceiver module includes a second sending module and / or a second receiving module.

[0628] In some embodiments, the processing module can be a module or can include multiple sub-modules. Optionally, the multiple sub-modules perform all or part of the steps required to be performed by the processing module. Optionally, the processing module can be mutually replaced with a processor.

[0629] FIG. 10A is a structural schematic diagram of a communication device 10100 according to an embodiment of the present disclosure. The communication device 10100 can be a network device (a first device, a second device, etc.), a terminal, a chip, a chip system, a processor, etc. supporting the network device to implement any of the above methods, or a chip, a chip system, a processor, etc. supporting the terminal to implement any of the above methods. The communication device 10100 can be used to implement the methods described in the above method embodiments, which can be referred to the descriptions in the above method embodiments.

[0630] As shown in FIG. 10A, the communication device 10100 includes one or more processors 10101. The processor 10101 can be a general purpose processor, a special purpose processor, or the like, for example, a baseband processor or a central processing unit. The baseband processor can be used to process communication protocols and communication data, and the central processing unit can be used to control the communication device (for example, a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute programs, and process data of the programs. Optionally, the communication device 10100 is configured to implement any of the above methods. Optionally, the one or more processors 10101 are configured to invoke instructions to enable the communication device 10100 to implement any of the above methods.

[0631] In some embodiments, the communication device 10100 further includes one or more transceivers 10102. When the communication device 10100 includes the one or more transceivers 10102, the transceiver 10102 performs at least one of the communication steps (for example, steps S2101 and / or steps S2102 and / or steps S2104 and / or steps S2105 and / or steps S2107 and / or steps S2108 and / or steps S2109, etc., but not limited to) in the above methods, and the processor 10101 performs at least one of the other steps (for example, steps S2103 and / or steps S2106, etc., but not limited to) in the above methods. In optional embodiments, the transceiver can include a receiver and / or a transmitter, which can be separate or integrated together. Optionally, the terms of transceiver, transceiving unit, transceiver, transceiving circuit, interface circuit, interface, etc. can be replaced with each other, and the terms of transmitter, transmitting unit, transmitter, transmitting circuit, etc. can be replaced with each other, and the terms of receiver, receiving unit, receiver, receiving circuit, etc. can be replaced with each other.

[0632] In some embodiments, the communication device 10100 also includes one or more memories 10103 for storing data. Optionally, all or a portion of the memory 10103 can also reside in the communication device 10100. In some embodiments, the communication device 10100 can include one or more interface circuits 10104. Optionally, the interface circuit 10104 can be used to receive data from the memory 10103 or from another device or system, or to send data to the memory 10103 or to another device or system. For example, the interface circuit 10104 can receive data in packets, each packet having a header and a payload.

[0633] The communication device 10100 described in the above embodiments can be a network device or a terminal, but the scope of the communication device 10100 described in the present disclosure is not limited thereto, and the structure of the communication device 10100 can not be limited by FIG. 10A. The communication device can be a standalone device or can be part of a larger device. For example, the communication device can be: (1) a standalone integrated circuit (IC), or a chip, or a chip system or subsystem; (2) a set of one or more ICs, which can optionally also include a storage component for storing data, programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, a terminal device, a smart terminal device, a cellular phone, a wireless device, a handset, a mobile unit, a vehicle-mounted device, a network device, a cloud device, an artificial intelligence device, etc.; (6) other devices, etc.

[0634] FIG. 10B is a structural diagram of a chip 10200 according to an embodiment of the present disclosure. For the case where the communication device 10100 is a chip or a chip system, the structural diagram of the chip 10200 shown in FIG. 10B can be referred to, but is not limited thereto.

[0635] The chip 10200 includes one or more processors 10201. The chip 10200 is configured to perform any of the above methods.

[0636] In some embodiments, the chip 10200 further includes one or more interface circuits 10202. Optionally, the terms interface circuit, interface, transceiver pin, etc. can be replaced by each other. In some embodiments, the chip 10200 further includes one or more memories 10203 for storing data. Optionally, all or part of the memory 10203 can be outside the chip 10200. Optionally, the interface circuit 10202 is connected with the memory 10203, the interface circuit 10202 can be used to receive data from the memory 10203 or other devices, the interface circuit 10202 can be used to send data to the memory 10203 or other devices. For example, the interface circuit 10202 can read the data stored in the memory 10203 and send the data to the processor 10201.

[0637] In some embodiments, the interface circuit 10202 performs at least one of the communication steps (such as steps S2101 and / or steps S2102 and / or steps S2104 and / or steps S2105 and / or steps S2107 and / or steps S2108 and / or steps S2109, etc., but not limited to) in the above method. The interface circuit 10202 performing the communication steps such as sending and / or receiving in the above method means that the interface circuit 10202 performs data interaction between the processor 10201, the chip 10200, the memory 10203 or the transceiver device. In some embodiments, the processor 10201 performs at least one of the other steps (such as steps S2103 and / or steps S2106, etc., but not limited to).

[0638] The modules and / or devices described in each embodiment of the virtual device, the physical device, the chip, etc. can be combined or separated as appropriate. Optionally, part or all of the steps can also be performed by multiple modules and / or devices, which are not limited here.

[0639] The disclosure also proposes a storage medium, and the above storage medium stores instructions, when the above instructions run on the communication device 10100, the communication device 10100 executes any one of the above methods. Optionally, the above storage medium is an electronic storage medium. Optionally, the above storage medium is a computer readable storage medium, but not limited to this, it can also be a storage medium readable by other devices. Optionally, the above storage medium can be a non-transitory storage medium, but not limited to this, it can also be a transitory storage medium.

[0640] The disclosure also proposes a program product, and the above program product is executed by the communication device 10100, so that the communication device 10100 executes any one of the above methods. Optionally, the above program product is a computer program product.

[0641] The present disclosure also proposes a computer program which, when running on a computer, causes the computer to perform any of the above methods.

Claims

1. An information processing method characterized by comprising: The method is performed by a first device, comprising: receiving a first message sent by a second device, wherein the first message comprises a first identity, the first identity being an identity of the second device, and the first message is used to request related authorization for the second device.

2. The method of claim 1, wherein, The first message is used to request the second device to request related authorization for a third device. The second device and the first device are in a first domain, and the third device is in a second domain.

3. The method according to claim 1 or 2, characterized in that, The first message further comprises at least one of: a second identity, wherein the second identity is an identity of a resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: sending a second message to a fourth device, wherein the second message comprises the first identity, and the second message is used to request related authorization for the second device; and the fourth device is in the second domain; receiving a first token sent by the fourth device, wherein the first token is generated by the fourth device based on the second message after determining that the second device is authorized, and the first token comprises at least one of the first identity, the second identity, a third identity, the service information, the service operation information, the service API information, the type information, and the purpose information; and the third identity is an identity of the fourth device; sending the first token to the second device.

5. The method of claim 4, wherein, The third identity is set as a publisher declared by the first token, and the first identity is set as a subject declared by the first token.

6. The method of claim 4, wherein, The sending of the second message to the fourth device comprises at least one of: sending the second message to the fourth device in a case where at least one of the service information, the service operation information, and the service API information matches a service API discovered from the fourth device; sending the second message to the fourth device in a case where it is determined that at least one of the service information, the service operation information, and the service API information matches a service API published by the fourth device; sending the second message to the fourth device in a case where it is determined that at least one of the service information, the service operation information, and the service API information matches a service published by the fourth device; sending the second message to the fourth device in a case where it is determined that at least one of the service information, the service operation information, and the service API information matches a service operation published by the fourth device; sending the second message to the fourth device in a case where it is determined that at least one of the type information and the purpose information corresponds to a service API that matches a service API published by the fourth device.

7. The method of claim 6, wherein, The sending of the second message to the fourth device comprises: In a case where a fifth device in the same domain as the first device cannot provide at least one of the service information, the service operation information, and the service API information, the second message is sent to the fourth device.

8. The method according to claim 6 or 7, characterized in that, The fourth device regards the first identity as an authenticated first identity.

9. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: In a case where it is determined that the second device is authorized based on the first message and authorization information, a second token is generated, wherein the authorization information is used at least to indicate that the second device corresponding to the first identity has access to at least one of service information, service operation information, and service API information; the second token comprises a fourth identity and / or a first identity, the fourth identity being an identity of the first device; The second token is sent to the second device.

10. The method of claim 9, wherein, The fourth identity is set as a publisher declared by the second token; and the first identity is set as a subject declared by the second token.

11. The method according to claim 6 or 10, characterized in that, The method further comprises at least one of: Obtaining the authorization information sent by the fourth device in a service information discovery phase Obtaining the authorization information configured by the fourth device in a service information publishing phase.

12. The method of claim 11, wherein, The method further comprises: Receiving a third message sent by the fourth device; Sending a first response to the fourth device; The third message comprises a second token, the third message is used to request verification of the second token, and the first response comprises a verification result of the second token; or The third message is used to request a key for verifying the second token, and the first response comprises the key for verifying the second token; or The third message is used to request a certificate for verifying the second token, and the first response comprises the certificate for verifying the second token.

13. An information processing method characterized by comprising: The method performed by the fourth device comprises: Receiving a second message sent by a first device, wherein the second message comprises a first identity, the first identity being an identity of a second device, and the second message is used to request related authorization of the second device.

14. The method of claim 13, wherein, The second message is used to request related authorization of the second device for a third device; The second device and the first device are in a first domain, and the third device and the fourth device are in a second domain.

15. The method according to claim 13 or 14, characterized in that, The second message further comprises at least one of: A second identity, wherein the second identity is an identity of a resource owner; Service information, wherein the service information is used to indicate a service that needs to be authorized; Service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; Service API information, wherein the service API information is used to indicate a service API that needs to be authorized; Type information, wherein the type information is used to indicate a data type that needs to be authorized; Purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

16. The method according to any one of claims 13 to 15, characterized in that, The method comprises: generate a first token in a case that it is determined that the second device is authorized based on the second message and authorization information, wherein the authorization information is used at least for indicating that the second device corresponding to the first identity has access to at least one of service information, service operation information, and service API information, and the first token comprises at least one of the first identity, the second identity, the third identity, the service information, the service operation information, the service API information, type information, and purpose information, and the third identity is an identity of the fourth device; send the first token to the first device, wherein the first token is used by the first device to send to the second device.

17. The method of claim 16, wherein, the third identity is set as an issuer declared by the first token, and the first identity is set as a subject declared by the first token.

18. An information processing method characterized by comprising: performed by a fourth device, comprising: send authorization information to a first device, wherein the authorization information is used at least for indicating that a second device corresponding to a first identity has access to at least one of service information, service operation information, and service API information; wherein the authorization information and a first message are used by the first device to determine whether the second device is authorized, the first message is sent by the second device, the first message comprises the first identity, the first identity is an identity of the second device, and the first message is used to request relevant authorization for the second device.

19. The method of claim 18, wherein, The sending of the authorization information to the first device comprises at least one of: sending the authorization information to the first device in a service information discovery phase; sending the authorization information to the first device in a service information publishing phase.

20. The method of claim 18 or 19, wherein, The method further comprises: receiving a fourth message sent by a third device; sending a third message to the first device; receiving a first response sent by the first device; sending a second response to the third device; wherein the third message or the fourth message comprises a second token, the third message or the fourth message is used to request verification of the second token, and the first response or the second response comprises a verification result of the verification of the second token; or the third message or the fourth message is used to request a key for verifying the second token, and the first response or the second response comprises the key for verifying the second token; or the third message or the fourth message is used to request a certificate for verifying the second token, and the first response or the second response comprises the certificate for verifying the second token.

21. An information processing method characterized by comprising: performed by a second device, comprising: sending a first message to a first device, wherein the first message comprises a first identity, the first identity is an identity of the second device, and the first message is used to request relevant authorization for the second device.

22. The method of claim 21, wherein, The first message is used to request relevant authorization of the second device for a third device; wherein the second device and the first device are in a first domain, and the third device is in a second domain.

23. The method of claim 21 or 22, wherein, The first message further comprises at least one of: a second identity, wherein the second identity is an identity of a resource owner; service information, wherein the service information is used to indicate a service that needs to be authorized; service operation information, wherein the service operation information is used to indicate a service operation that needs to be authorized; service API information, wherein the service API information is used to indicate a service API that needs to be authorized; type information, wherein the type information is used to indicate a data type that needs to be authorized; purpose information, wherein the purpose information is used to indicate a data processing purpose that needs to be authorized.

24. The method according to any one of claims 21 to 23, characterized in that, The method further includes one of the following: receiving a first token sent by the first device, wherein the first token is generated after the second device determines authorization, and the first token includes at least one of the following: a first identifier, a second identifier, a third identifier, service information, service operation information, service API information, type information, and purpose information; and the fourth device is in a second domain; receiving a second token sent by the first device, wherein the second token is generated after the device determines authorization, and the second token includes at least the first identifier and a fourth identifier; and the fourth identifier is an identifier of the first device.

25. The method of claim 24, wherein: the third identifier is set as a publisher declared by the first token; and the first identifier is set as a subject declared by the first token; or the fourth identifier is set as a publisher declared by the second token; and the first identifier is set as a subject declared by the second token. executed by a third device, and includes:

26. An information processing method characterized by comprising: receiving a fifth message sent by a second device, wherein the fifth message includes a first token, and the fifth message is used to request calling service information related to the first token, or the fifth message includes a second token, and the fifth message is used to request calling service information related to the second token. The method includes:

27. The method of claim 21, wherein, sending a fourth message to a fourth device; receiving a second response sent by the fourth device; wherein the fourth message includes the second token, the fourth message is used to request verifying the second token, and the second response includes a verification result of verifying the second token; or the fourth message is used to request a key for verifying the second token, and the second response includes the key for verifying the second token; or the fourth message is used to request a certificate for verifying the second token, and the second response includes the certificate for verifying the second token. The sending of the fourth message to the fourth device includes:

28. The method of claim 27, wherein, sending the fourth message to the fourth device based on a fourth identifier in the second token, wherein the fourth message is used for the fourth device to send a third message to the first device; the fourth identifier is an identifier of the first device, and the fourth identifier is set as a publisher declared by the second token. includes:

29. An information processing method characterized by comprising: a first message sent by a second device to a first device, wherein the first message includes a first identifier, the first identifier is an identifier of the second device, and the first message is used to request authorization of the second device; a second message sent by the first device to a fourth device, wherein the second message includes the first identifier, and the second message is used to request authorization of the second device. ​ 30. A first device, comprising: Comprising: The first transceiver module is configured to receive a first message sent by a second device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

31. A fourth apparatus, comprising: Comprising: The second transceiver module is configured to receive a second message sent by a first device, wherein the second message comprises a first identifier, the first identifier is an identifier of the second device, and the second message is used to request relevant authorization for the second device.

32. A fourth apparatus, comprising: Comprising: The second transceiver module is configured to send authorization information to the first device, wherein the authorization information is used to indicate that the second device corresponding to the first identifier has access to at least one of the following: service information, service operation information, and service API information; Wherein the authorization information and the first message are used by the first device to determine whether the second device is authorized; the first message is sent by the second device, the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

33. A second device, comprising: Comprising: The third transceiver module is configured to send a first message to a first device, wherein the first message comprises a first identifier, the first identifier is an identifier of the second device, and the first message is used to request relevant authorization for the second device.

34. A third device, comprising: Comprising: The fourth transceiver module is configured to receive a fifth message sent by a second device, wherein the fifth message comprises a first token and the fifth message is used to request to call service information related to the first token, or the fifth message comprises a second token and the fifth message is used to request to call service information related to the second token.

35. A communications device, characterized by Comprising: One or more processors; Wherein the communication device is configured to perform the information processing method of any one of claims 1-12, or claims 13-20, or claims 21-25, or claims 26-28, or claim 29.

36. A communication system, characterized by Comprising: The first device, the fourth device, the second device, and the third device; wherein the first device is configured to implement the information processing method of any one of claims 1-12, the fourth device is configured to implement the information processing method of any one of claims 13-20, the second device is configured to implement the information processing method of any one of claims 21-25, and the third device is configured to implement the information processing method of any one of claims 26-28.

37. A storage medium, the storage medium storing instructions, wherein, When the instructions run on the communication device, the communication device performs the information processing method of any one of claims 1-12, or claims 13-20, or claims 21-25, or claims 26-28, or claim 29.

38. A computer program product comprising a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the information processing method of any one of claims 1-12, or claims 13-20, or claims 21-25, or claims 26-28, or claim 29.

Images