WO2019029327A1 - 网络功能服务的发现方法及设备 - Google Patents

网络功能服务的发现方法及设备 Download PDF

Info

Publication number
WO2019029327A1
WO2019029327A1 PCT/CN2018/095974 CN2018095974W WO2019029327A1 WO 2019029327 A1 WO2019029327 A1 WO 2019029327A1 CN 2018095974 W CN2018095974 W CN 2018095974W WO 2019029327 A1 WO2019029327 A1 WO 2019029327A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
domain name
name
nrf
target service
Prior art date
Application number
PCT/CN2018/095974
Other languages
English (en)
French (fr)
Inventor
韩霆军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18844908.6A priority Critical patent/EP3648432B1/en
Publication of WO2019029327A1 publication Critical patent/WO2019029327A1/zh
Priority to US16/781,251 priority patent/US11258822B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1073—Registration or de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a method and device for discovering network function services.
  • NF Network Function
  • NRF NF Repository Function
  • NF can register one or more on the NRF.
  • the address of the service, the address of the registered service can take many forms, it can be an IP address or a URL address, and the name of the service is defined as ⁇ service name>. ⁇ NF name>. ⁇ PLMN>, for example: session-manager. SMF. ⁇ PLMN>. All NFs are located in a fully interoperable network topology to decouple the physical deployment locations between specific services. Therefore, this serviced network architecture facilitates the rapid deployment of new NFs to realize network service innovation.
  • FIG. 1 is a public land mobile network (Public Land Mobile) Network, PLMN) network slice and NF distribution of different network slices, as shown in Figure 1, the user equipment accesses the PLMN through the radio access network node, the PLMN is divided into three network slices, each network slice contains A set of NFs with a specific function, one NF consists of at least one service, and NF1 located in different network slices is the same type of NF (such as NF1 in network slice A and NF1 in network slice B), NF2 located in different network slices. For the same type of NF.
  • PLMN Public Land Mobile Network
  • the NFs located in different network slices are isolated from each other even if they are the same type of NF. Because of implementation constraints, there are also NFs that need to be shared between multiple network slices (such as NF3 in Figure 1). Moreover, the network slice is dynamically deployed according to the customer's ordering requirement, that is, the life cycle of the NF in a certain network slice is uncertain, so the NF in different network slices is also isolated in service, such as the network slice A in FIG. The NF1 can only perform business interaction with the NF2 of the network slice A, and cannot access the same type of NF2 except the network slice A.
  • NFs located in different network slices need to be isolated from each other, and NFs between different network slices need to be isolated from each other in the service, so that dynamically deployed NFs can be discovered, that is, It is necessary to find out between NF services that service consumers need to be able to query the address of the service provider. How to realize the discovery between NF services is an urgent problem to be solved.
  • the present application provides a method and device for discovering network function services to implement discovery between NF services.
  • the present application provides a method for discovering an NF service, including: a network function storage function NRF establishes a communication connection with an NF, and obtains a digital certificate of the NF through a secure transport layer protocol TLS or a data secure transport layer protocol DTLS two-way authentication process.
  • the NF digital certificate carries the service name of the NF, the list of service names on which the NF depends, and the list of service names that the NF depends on; the NRF receives the query request of the address of the query target service sent by the NF, and the complete request carries the target service.
  • the domain name, the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF, or the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF where the target service is located by the NF.
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs; the NRF verifies according to the service name of the target service and the digital certificate of the NF, and verifies the address of the target service to the NF when the verification succeeds.
  • the discovery between the NF services is realized, and in the discovery process of the NF service, the service name of the target service is known by the NF, and if the service is found in the network slice, When sending the query request, the NF queries the service name of the target service and its own management domain name to form the complete domain name of the target service. If the service is found between different network slices, the NF queries the service name and NF of the target service when sending the query request.
  • the management domain name of the NF where the target service is located constitutes the complete domain name of the target service
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs, and the network slice identifier is managed by the management network element, so that the NF and the NF can be implemented.
  • Network slice decoupling on the other hand, the dependencies between different services are placed in the extension field of the digital certificate of the service.
  • the extension field of the digital certificate only refers to the service name of the NF, and does not involve the management of the NF.
  • the NRF verifies according to the service name of the target service and the digital certificate of the NF, including: the NRF verifies that the service name of the target service is the service name that the NF depends on in the extension field of the digital certificate of the NF.
  • the NF-dependent service name list carried in the extension field of the digital certificate corresponding to the full domain name of the registered target service has the service name of the NF.
  • the method before the NRF receives the query request of the address of the query target service sent by the NF, the method further includes: the NRF receiving the first service registration request sent by the NF, where the first service registration request includes the complete domain name of the first service And the first service address, the complete domain name of the first service is a domain name composed of the service name of the NF and the management domain name of the NF, and the NRF is served according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF. registered.
  • the registration of the NF service is achieved by the method provided by this embodiment.
  • the NRF performs service registration according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF, including: the NRF verifies the service of the NF in the complete domain name of the first service. Whether the name is the same as the service name of the NF carried in the extension field of the digital certificate. If yes, the registration is successful, and the service of the NF dependent on the full domain name, the first service address, and the extension field of the digital certificate is saved. The name list and the correspondence between the list of service names that the NF is dependent on.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the image of the NF in the process of managing the network element requesting the NF in the network slice of the PaaS.
  • the NF's managed domain name and NF's digital certificate are configured after the NF is started.
  • the present application provides a method for discovering an NF service, including: obtaining, by the NF, a management domain name of the NF and a digital certificate of the NF, a service certificate carrying the NF in the digital certificate of the NF, a list of service names on which the NF depends, and an NF being The list of dependent service names, the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs, and the NF establishes a communication connection with the NRF, and sends the communication connection to the NRF through the secure transport layer protocol TLS or the data secure transport layer protocol DTLS mutual authentication process.
  • NF sends a query request for querying the address of the target service to the NRF, the query request carries the complete domain name of the target service, and the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF, or the target
  • the complete domain name of the service is the service name of the target service and the domain name composed of the management domain name of the NF where the target service is located by the NF, and is used for the NRF to verify according to the service name of the target service and the digital certificate of the NF.
  • the discovery between the NF services is realized, and in the discovery process of the NF service, the service name of the target service is known by the NF, and if the service is found in the network slice, When sending the query request, the NF queries the service name of the target service and its own management domain name to form the complete domain name of the target service. If the service is found between different network slices, the NF queries the service name and NF of the target service when sending the query request.
  • the management domain name of the NF where the target service is located constitutes the complete domain name of the target service
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs, and the network slice identifier is managed by the management network element, so that the NF and the NF can be implemented.
  • Network slice decoupling on the other hand, the dependencies between different services are placed in the extension field of the digital certificate of the service.
  • the extension field of the digital certificate only refers to the service name of the NF, and does not involve the management of the NF.
  • the method before the NF sends a query request for querying the address of the target service to the NRF, the method further includes: the NF composing the complete domain name of the target service according to the service name of the target service and the management domain name of the NF.
  • the method before the NF sends a query request for querying the address of the target service to the NRF, the method further includes: the NF sending a query request to the management network element to query the management domain name of the NF where the target service is located, where the query request carries the target service.
  • the service name after receiving the management domain name of the NF where the target service is sent by the management network element, the NF forms the complete domain name of the target service according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the method further includes: the NF receiving the address of the target service sent by the NRF when the verification is passed.
  • the method before the NF sends a query request for querying the address of the target service to the NRF, the method further includes: the NF forms a complete domain name of the first service according to the service name of the NF and the management domain name of the NF, and sends the first service to the NRF.
  • a registration request the first service registration request includes a complete domain name and a first service address of the first service, and the NRF performs service registration according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF. .
  • the registration of the NF service is achieved by the method provided by this embodiment.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the image of the NF in the process of managing the network element requesting the NF in the network slice of the PaaS.
  • the NF's managed domain name and NF's digital certificate are configured after the NF is started.
  • the present application provides an NRF, including: an obtaining module, configured to acquire a digital certificate of an NF, a NF number through a secure transport layer protocol TLS or a data secure transport layer protocol DTLS two-way authentication process after establishing a communication connection with the NF.
  • the certificate carries the service name of the NF, the service name list that the NF depends on, and the service name list that the NF depends on;
  • the receiving module is configured to receive the query request of the address of the query target service sent by the NF, and the query request carries the complete service of the target service.
  • the domain name, the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF, or the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF where the target service is located by the NF.
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs.
  • the verification module is configured to perform verification according to the service name of the target service and the digital certificate of the NF, and verify the address of the target service sent to the NF when passing the verification.
  • the verification module is configured to: verify whether the service name of the target service is in the service name list that the NF depends on in the extension field of the digital certificate of the NF, and the complete domain name of the target service that has been registered and saved corresponds to The extension of the digital certificate carries the NF-dependent service name list that contains the service name of the NF.
  • the receiving module is further configured to: before receiving the query request of the address of the query target service sent by the NF, receive the first service registration request sent by the NF, where the first service registration request includes the first service The complete domain name and the first service address, the complete domain name of the first service is the domain name composed of the service name of the NF and the management domain name of the NF; the NRF further includes: a registration module for extending the full domain name of the first service and the digital certificate of the NF The service name of the NF carried in the field is registered for the service.
  • the registration module is configured to: verify whether the service name of the NF in the complete domain name of the first service is the same as the service name of the NF carried in the extension field of the digital certificate, and if so, the registration is successful and saved.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the image of the NF in the process of managing the network element requesting the NF in the network slice of the PaaS.
  • the NF's managed domain name and NF's digital certificate are configured after the NF is started.
  • the application provides an NF, including: an obtaining module, configured to obtain a management domain name of the NF and a digital certificate of the NF, a service name of the NF carrying the NF, a service name list that the NF depends on, and an NF
  • the list of dependent service names, the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs;
  • the first sending module is configured to establish a communication connection with the NRF, and through the secure transport layer protocol TLS or the data secure transport layer protocol DTLS
  • the two-way authentication process sends a digital certificate of the NF to the NRF.
  • the query module is configured to send a query request for querying the address of the target service to the NRF.
  • the query request carries the complete domain name of the target service, and the complete domain name of the target service is the service name and NF of the target service.
  • the domain name consisting of the management domain name, or the full domain name of the target service is the service name of the target service and the domain name of the NF management domain name of the target service where the NF is queried, and the NRF is used for the service name of the target service and the digital certificate of the NF. authenticating.
  • the query module is further configured to: before sending the query request for querying the address of the target service to the NRF, composing the complete domain name of the target service according to the service name of the target service and the management domain name of the NF.
  • the query module is further configured to: before sending the query request for querying the address of the target service to the NRF, send a query request to the management network element to query the management domain name of the NF where the target service is located, and the query request carries the target The service name of the service; after receiving the management domain name of the NF where the target service is sent by the management network element, the complete domain name of the target service is formed according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the method further includes: a receiving module, configured to receive an address of the target service that is sent by the NRF when the verification succeeds.
  • the query module is further configured to: before sending the query request for querying the address of the target service to the NRF, composing the complete domain name of the first service according to the service name of the NF and the management domain name of the NF, and sending the first domain name to the NRF a service registration request, where the first service registration request includes a full domain name and a first service address of the first service, and is used by the NRF to serve according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF. registered.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the image of the NF in the process of managing the network element requesting the NF in the network slice of the PaaS.
  • the NF's managed domain name and NF's digital certificate are configured after the NF is started.
  • the application provides an NRF, including: a memory and a processor;
  • the memory is used to store program instructions
  • the processor is configured to invoke program instructions in the memory to perform the discovery method of the NF service in any of the possible aspects of the first aspect and the first aspect.
  • the application provides an NF, including: a memory and a processor;
  • the memory is used to store program instructions
  • the processor is configured to invoke program instructions in the memory to perform the discovery method of the NF service in any of the possible aspects of the second aspect and the second aspect.
  • the present application provides a readable storage medium, where a computer program is stored, and when at least one processor of the discovery device of the NF service executes the computer program, the discovery device of the NF service performs the first aspect. And the method of any of the possible aspects of the first aspect or the method of discovering the NF service in any of the possible designs of the second aspect and the second aspect.
  • the application provides a program product, the program product comprising a computer program stored in a readable storage medium.
  • At least one processor of the discovery device of the NF service can read the computer program from a readable storage medium, the at least one processor executing the computer program to cause the discovery device of the NF service to implement the first aspect and any one of the possible aspects of the first aspect
  • the method of the present invention or the discovery method of the NF service in any of the possible designs of the second aspect and the second aspect.
  • FIG. 1 is a schematic diagram of a network slice of a PLMN and a distribution of NFs of different network slices;
  • FIG. 2 is a schematic diagram of a possible network architecture provided by the present application.
  • FIG. 3 is a flowchart of an embodiment of a method for discovering an NF service provided by the present application
  • FIG. 4 is a schematic flow chart of a customer ordering slice, digital certificate generation, NF deployment in a network slice, and service registration and service discovery;
  • Figure 5 is an interaction flowchart corresponding to Figure 4.
  • FIG. 6 is a flowchart of an embodiment of a method for registering an NF service according to the present application
  • FIG. 7 is a flowchart of an embodiment of a method for discovering an NF service according to the present application.
  • FIG. 8 is a flowchart of an embodiment of a method for discovering an NF service according to the present application.
  • FIG. 10 is a schematic structural diagram of an NRF embodiment provided by the present application.
  • FIG. 11 is a schematic structural diagram of an NF embodiment provided by the present application.
  • FIG. 12 is a schematic structural diagram of an NF embodiment provided by the present application.
  • FIG. 13 is a schematic diagram of an NRF provided by the present application.
  • FIG. 14 is a schematic diagram of an NF provided by the present application.
  • the network architecture and the service scenario described in this application are for the purpose of more clearly explaining the technical solutions of the present application, and do not constitute a limitation of the technical solutions provided by the present application.
  • Those skilled in the art may know that with the evolution of the network architecture and new business scenarios, The technical solution provided by the present application is equally applicable to similar technical problems.
  • Network Slice refers to a collection of logical network function instances that support specific communication service requirements, mainly through Software Defined Network (SDN) technology and Network Function Virtualization (NFV) technology.
  • SDN technology can realize the mapping of the underlying physical resources to virtualized resources, build virtual machines and load NF; SDN technology can realize the logical connection between virtual machines and construct the path of carrying signaling and data flow.
  • the network segmentation finally implements a dynamic connection between the access network (RAN) and the NF instance of the core network, and configures an end-to-end service chain to implement flexible networking, thereby implementing network-customizable services.
  • the operator can determine the network slice according to the requirements of key performance indicators such as capacity, coverage, rate, delay, and reliability of each specific communication service.
  • the network slice includes the NF instance set and the network resources required to run the NF instance, thereby serving the user. Provide the required telecommunications services and network capabilities services to meet specific market scenarios and needs.
  • each network slice contains a set of NFs of a specific function, and one NF is composed of at least one service, each NF is a service provider, and provides an application programming interface (API) for other NF calls.
  • each NF is also a service consumer, they also call other NF APIs.
  • Each service provider needs to register information (including the address of the service) on the NRF. When the NRF registration interface is called, it is the service registrant. When the NRF service discovery interface is called, it is the service finder. The discovery between NF is that the service consumer should be able to query the service provider's registration information (such as the address of the service).
  • the technical solution provided by the present application can be applied to a mobile communication system such as a 5G communication system or an LTE system, and is mainly applied to a scenario that can be found between different network slices or NFs of the same network slice under the NF-centric service network architecture. .
  • FIG. 2 is a schematic diagram of a possible network architecture provided by the present application.
  • FIG. 2 is a network architecture of a core network, and Network Exposure Function (NEF) and Policy Control Function (Policy Control Function) in FIG. PCF), Unified Data Management (UDM), Application Function (AF), Authentication Server Function (AUSF), Access and Mobility Management Function (AMF) ), Session Managent Function (SMF), User Plan Function (UPF) are different NFs.
  • NRF provides service registration and service discovery functions for all NFs. NF can be registered on NRF. The address of one or more services. All NFs are located in a fully interoperable network topology to achieve decoupling of physical deployment locations between specific services.
  • N1, N2, N3, N4, and N6 are interfaces between the network elements.
  • Each NF API includes: Service-based interface exhibit by AMF (Namf), SMF service interface (Service-based interface exhibit by SMF, Nsmf), and NEF service interface (Service-based interface. , Nnef), Service-based interface (by NRF, Nnrf), Service-based interface (by PCF, Npcf), Service-based interface (by UDM, Nudm) ), Service-based interface exhibit by AUSF (Nausf), AF-service interface (AF-Naf).
  • the present application provides a method and a device for discovering an NF service, which can be found between NF services of different network slices or the same network slice, and the service consumer can query the registration information of the service provider, such as a service address, this application
  • the network domain identifier is embedded in the complete domain name of the service, and the complete domain name of the service is composed of the service name of the NF and the management domain name of the NF.
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs.
  • the management domain name of the meta-management NF that is, the management network element management network slice identifier, can implement NF and network slice decoupling.
  • the so-called decoupling is that NF is not changed because of the deployment of new network slices.
  • the services are a flat, fully interoperable simplified physical topology.
  • the service communication between services must be secure.
  • the service security mechanism is necessary.
  • the security transmission is adopted through the bottom layer.
  • TLS Layered Protocol
  • DTLS Data Transport Layer Security
  • the security rule of the NF service discovery is placed in the extension field of the digital certificate of the service, and the security rule is a dependency relationship between different services, and the extension field of the digital certificate only refers to the service name of the NF (such as ⁇ NF service>. ⁇ NF name>), does not involve the NF management domain name (such as ⁇ Slice id>. ⁇ PLMN>), so it can guarantee that the digital certificate of all services needs to be updated because of the dynamically deployed slice.
  • the NF and the service security mechanism are decoupled.
  • the network slicing and service security mechanism can be compatible with the existing TLS/Domain Name System (DNS) standard mechanism.
  • DNS TLS/Domain Name System
  • FIG. 3 is a flowchart of an embodiment of a method for discovering an NF service according to the present application. As shown in FIG. 3, the method in this embodiment may include:
  • the NF obtains the management domain name of the NF and the digital certificate of the NF.
  • the extension field of the digital certificate of the NF carries the service name of the NF, the service name list that the NF depends on, and the NF is dependent on.
  • the service name list, the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs.
  • the management domain name of the NF is, for example, ⁇ Slice id>. ⁇ PLMN>, the Slice id is a network slice identifier, and the PLMN is an identifier of a network to which the network slice belongs.
  • the NF acquires its own management domain name and its own digital certificate and the address of the NRF that provides the registration and service discovery function for the NF.
  • one NRF manages the NF in the same network slice, or an NRF. Manage NFs in multiple different network slices.
  • the three information of the NF management domain name, the NF digital certificate, and the NRF address may be mirrored and stored in the disk file during the process of deploying the NF in the network slice, specifically, the NF
  • the management domain name is a process in which the management network element requests the platform-as-a-service (PaaS) to deploy the NF in the network slice, and the management network element is dynamically generated according to the network slice identifier, and the PaaS is in the NF.
  • the digital certificate of the NF and the address of the NRF injected in the image are injected into the image of the NF in the process of requesting the network element in the PaaS deployment network slice by the management network element, and the NF can pass the reading system.
  • the name server configuration file obtains these three pieces of information
  • the management network element may be a network slice management function (NSMF) or an operation support system (OSS).
  • the three pieces of information may also be configured after the NF is started, and the NF obtains the three pieces of information by reading the configuration file.
  • the digital certificate of NF and the type of NF correspond one-to-one
  • the digital certificate of the same type of NF is the same
  • multiple instances of the same type of NF use the same digital certificate.
  • the list of service names on which the NF depends may include a service name or a plurality of service names
  • the list of service names that the NF is dependent on may include one service name or multiple service names.
  • the list of service names on which the NF depends refers to the list of target service names that the NF needs to query the service address through the NRF as a service consumer.
  • the list of service names that the NF depends on refers to the service address that the NF registers as a service provider to the NRF.
  • the NF establishes a communication connection with the NRF, and sends the digital certificate of the NF to the NRF through a TLS or DTLS two-way authentication process.
  • the NF establishes a communication connection with the NRF according to the address of the NRF.
  • the TLS or DTLS two-way authentication process can be initiated by either the NF or the NRF.
  • the NF initiates the TLS in the TLS mutual authentication process.
  • the NF sends a TLS handshake message to the NRF, and the NRF receives the TLS.
  • the NF handshake message is sent to the NF, indicating that the client is authenticated, and then the NF sends its own digital certificate to the NRF.
  • the TLS or DTLS two-way authentication process is an existing security authentication process. The detailed process is not described here.
  • the NF sends a query request for querying the address of the target service to the NRF, where the query request carries the complete domain name of the target service, and the complete domain name of the target service is the service name of the target service and the domain name composed of the management domain name of the NF, or the target service.
  • the complete domain name is the domain name composed of the service name of the target service and the management domain name of the NF where the target service is located by the NF.
  • the method further includes: the NF forming a complete domain name of the target service according to the service name of the target service and the management domain name of the NF.
  • the service name of the target service is, for example, ⁇ NF service name>. ⁇ NF name> (the NF of the target service has multiple services), and the full domain name of the target service is ⁇ NF service name>. ⁇ NF name>. Slice id>. ⁇ PLMN>, or the service name of the target service is, for example, ⁇ NF name> (the NF where the target service is located has only one service for the target service), and the full domain name of the target service is ⁇ NF name>. ⁇ Slice id>. ⁇ PLMN>.
  • the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF.
  • the NF and the NF where the target service is located belong to the same network slice.
  • the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF where the target service is located.
  • the NF and the NF where the target service is located belong to different network slices.
  • the method may further include:
  • the NF sends a query request for the management domain name of the NF where the target service is located to the management network element, and the service name of the target service is carried in the query request.
  • the query request may carry the service name of the target service, such as ⁇ NF service name>. ⁇ NF 1 name>, and the management network element may query the NF where the target service is located according to the service name of the target service, and may query NF1.
  • the target network slice is located, and the managed domain name of the NF where the target service is located can be queried.
  • the management network element is, for example, NSMF.
  • the NF After receiving the management domain name of the NF where the target service is sent by the management network element, the NF forms the complete domain name of the target service according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the NRF performs verification according to the service name of the target service and the digital certificate of the NF, and verifies the address of the target service sent to the NF by the verification.
  • the NRF sends a message that the query fails to the NF.
  • the NRF in the S104 is verified according to the service name of the target service and the digital certificate of the NF, and specifically includes:
  • the service name of the NRF verification target service is in the service name list of the NF that is carried in the extension field of the digital certificate of the NF, and the extension field of the digital certificate corresponding to the complete domain name of the registered target service is carried.
  • the NF is dependent on the service name list contains the service name of the NF, and if so, the verification is passed, and if not, the verification fails.
  • NF1 can query the service address registered by NF2; NF1 will be rejected by NRF when querying the service address of NF3, because the service name dependent on the digital certificate of NF1 does not contain NF3; the service address of NF3 query NF2 will also be NRF. Rejected because the service name that is dependent on the NF2 digital certificate does not contain NF3.
  • the above process is a discovery process of the NF service. It can be understood that before the discovery between the NF services, registration is required, and the NF can register the address of one or more services on the NRF. On the basis of the embodiment shown in FIG. 3, further, before S103, the method may further include:
  • the NF forms a complete domain name of the first service according to the service name of the NF and the management domain name of the NF, and sends a first service registration request to the NRF, where the first service registration request includes the complete domain name and the first service address of the first service.
  • the first service address may be an IP address or a URL address.
  • the NRF After receiving the first service registration request, the NRF performs service registration according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF.
  • the NRF verifies whether the service name of the NF in the complete domain name of the first service is the same as the service name of the NF carried in the extension field of the digital certificate, and if yes, the registration is successful, and the first service is saved.
  • the complete domain name, the first service address, and the correspondence between the list of service names on which the NF is carried and the list of service names on which the NF is carried are carried in the extension field of the digital certificate; if not, the registration fails.
  • the saved correspondence is as shown in Table 1 below:
  • the NF service discovery method obtained by this embodiment obtains its own management domain name and its own digital certificate through the NF, then establishes a communication connection with the NRF, and sends the NF digital certificate to the NRF through the TLS or DTLS two-way authentication process, NF Sending a query request for querying the address of the target service to the NRF, the query request carrying the complete domain name of the target service consisting of the service name of the target service and the management domain name of the NF, and finally the NRF is performed according to the service name of the target service and the digital certificate of the NF. Verification, the address of the target service is sent to the NF when the verification is passed. Thus, the discovery between the NF services is realized.
  • the service name of the target service is known by the NF. If the service is found in the network slice, the NF will serve the target service when sending the query request. The name and its own management domain name constitute the complete domain name of the target service for query. If the service discovery is between different network slices, the NF combines the service name of the target service and the management domain name of the NF where the target service is located by the NF when sending the query request. The complete domain name of the service is queried.
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs, and the network slice identifier is managed by the management network element, so that NF and network slice decoupling can be realized, on the other hand, different The dependencies between services are placed in the extension field of the digital certificate of the service.
  • the extension field of the digital certificate only refers to the service name of the NF, and does not involve the management domain name of the NF, so it can be guaranteed that there will be no dynamic deployment.
  • Slices cause the digital certificates of all services to be updated, decoupling NF and service security mechanisms,
  • the network slicing and service security mechanism can be compatible with the existing TLS/DNS standard mechanism.
  • the existing NF can be accessed without modification, and the existing NF is not affected regardless of how the NF is dynamically deployed.
  • FIG. 4 is a schematic diagram of a process of ordering a slice, digital certificate generation, NF deployment, service registration, and service discovery in a network slice, as shown in FIG. 4, including:
  • the client sends a request for ordering a network slice to the NSMF.
  • the NSMF After receiving the request, the NSMF applies for a digital certificate to a digital certificate issuing authority (Certificate Authority, CA).
  • a digital certificate issuing authority (Certificate Authority, CA).
  • the NSMF sends a deployment request to the PaaS.
  • S204 and PaaS perform an image injection process to start the image.
  • S205 and NF perform service registration and service discovery on the NRF.
  • FIG. 5 is an interaction flowchart corresponding to FIG. 4, as shown in FIG. 5, including:
  • the client sends a subscription network slice request to the NSMF.
  • the NSMF After receiving the request, the NSMF generates a dynamic management domain name ⁇ Slice id>. ⁇ PLMN> according to the network slice identifier (ID).
  • the NSMF obtains a mirrored address of all NFs in the network slice corresponding to the network slice ID according to the network slice design.
  • the digital certificate of NF and the type of NF correspond one-to-one
  • the digital certificate of the same type of NF is the same
  • multiple instances of the same type of NF use the same digital certificate.
  • the NSMF defines the content to be injected in the image description file of each NF, including: a dynamically generated management domain name, a digital certificate of the NF, and an IP address of the NRF.
  • the NSMF sends a deployment request to the PaaS, where the deployment request carries the mirror address of the NF and the image description file of the NF.
  • the PaaS obtains the image according to the mirroring address of the NF, applies for the virtual resource according to the image description file of the NF, and performs content injection according to the image description file of the NF.
  • S309 and NF perform service processing, and perform service registration and service discovery on the NRF.
  • the image injection technology is the basic function provided by all cloud platforms, that is, the file content of the specified directory in the image can be modified before the image is started. Of course, a file can be added in the specified directory.
  • FIG. 6 is a flowchart of an embodiment of a method for registering an NF service according to the present application. As shown in FIG. 6, the method in this embodiment includes:
  • the NF acquires the management domain name of the NF, the digital certificate of the NF, and the address of the NRF.
  • the extension field of the digital certificate of the NF carries the service name of the NF, the service name list that the NF depends on, and the The list of service names that the NF is dependent on.
  • the management domain name of the NF contains the network slice identifier and the identifier of the network to which the network slice belongs.
  • the NF obtains three pieces of information of the management domain name of the NF, the digital certificate of the NF, and the address of the NRF by reading a system name server (nameserver) configuration file (that is, a file injected by the NSMF image).
  • nameserver system name server
  • the NF establishes a communication connection with the NRF according to the address of the NRF, and sends the digital certificate of the NF to the NRF through a TLS or DTLS two-way authentication process.
  • the NF forms a complete domain name of the first service according to the service name of the NF and the management domain name of the NF.
  • the NF sends a first service registration request to the NRF, where the first service registration request includes a complete domain name and a first service address of the first service.
  • the NRF After receiving the first service registration request, the NRF performs service registration according to the complete domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF.
  • FIG. 7 is a flowchart of an embodiment of a method for discovering an NF service provided by the present application.
  • a discovery between NF services located in the same network slice is taken as an example, as shown in FIG. 7 .
  • the method of this embodiment includes:
  • S501 ⁇ S502 is the same as the process of S401 ⁇ S402 shown in FIG. 6, and details are not described herein again.
  • the NF sends a query request for querying the address of the target service to the NRF, where the query request carries the complete domain name of the target service, and the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF.
  • the NRF performs verification according to the service name of the target service and the digital certificate of the NF.
  • the NRF sends the address of the target service to the NF when the verification succeeds, and sends a message that the query fails to the NF when the verification fails.
  • the service name of the NRF verification target service is in the service name list that the NF depends on in the extension field of the digital certificate of the NF, and the extension of the digital certificate corresponding to the complete domain name of the registered target service is registered. Whether the service name of the NF is included in the list of service names that the NF is carried in the field, and if so, the verification is passed, and if not, the verification fails.
  • the NRF is configured as the name server address of the NF, it supports the service discovery through the DNS protocol, the DNS message exchange based on TLS for security requirements, and the non-TLS DNS message unless the registered server is used.
  • the digital certificate indicates that the service provider can obtain the address by any service consumer, otherwise the search fails.
  • the NF obtains its own management domain name, its own digital certificate, and the address of the NRF of the registration and service discovery function serving the NF, and then establishes a communication connection with the NRF according to the address of the NRF, and through TLS or The DTLS two-way authentication process sends the digital certificate of the NF to the NRF, and the NF sends a query request for querying the address of the target service to the NRF.
  • the query request carries the complete domain name of the target service consisting of the service name of the target service and the management domain name of the NF itself.
  • the NRF verifies according to the service name of the target service and the digital certificate of the NF, and verifies the address of the target service sent to the NF when passing.
  • FIG. 8 is a flowchart of a method for discovering an NF service according to the present application.
  • the discovery between the NF services of different network slices is taken as an example, and the management network element is NSMF, as shown in FIG. 8 .
  • the method of this embodiment includes:
  • S601 ⁇ S602 is the same as the process of S401 ⁇ S402 shown in FIG. 6, and details are not described herein again.
  • the NF service consumer is shared by multiple network slices. If multiple network slice services need to be discovered, the management domain name of each network slice is obtained through the management channel, for example, from NSMF, that is, the NF management domain name described above. For example, ⁇ Slice id>. ⁇ PLMN>, and then combine the service name of the service to be discovered into a complete domain name to the NRF to obtain the service address, as described in steps S603 to S604.
  • the NF sends a query request for querying the management domain name of the NF where the target service is located to the NSMF, where the query request carries the service name of the target service.
  • the NF After receiving the management domain name of the NF where the target service is sent by the NSMF, the NF forms the complete domain name of the target service according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the NF sends a query request for querying the address of the target service to the NRF, where the query request carries the complete domain name of the target service.
  • the service consumer and the service finder may be located in different management domains, and the method further includes:
  • the NRF queries the address of the NRF to which the target service belongs, and sends the address of the NRF to which the queried target service belongs to the NF.
  • the two management domains may be one NRF or two different NRFs. If it is two different NRFs, then it is DNS.
  • the iterative query process is similar. After multiple iterations of the query, a secure channel is established with the NRF of the management domain of the target service for service discovery.
  • the discovery process of the NRF of the final NF and other administrative domains is consistent with the service discovery process within the network slice.
  • the NF establishes a communication connection with the NRF to which the target service belongs according to the address of the NRF to which the target service belongs, and sends the digital certificate of the NF to the NRF through a TLS or DTLS two-way authentication process.
  • the NRF to which the target service belongs is verified according to the service name of the target service and the digital certificate of the NF.
  • the NRF to which the target service belongs sends an address of the target service to the NF when the verification succeeds, and sends a message that the query fails to the NF when the verification fails.
  • the service name of the NRF verification target service is in the service name list that the NF depends on in the extension field of the digital certificate of the NF, and the extension of the digital certificate corresponding to the complete domain name of the registered target service is registered. Whether the service name of the NF is included in the list of service names that the NF is carried in the field, and if so, the verification is passed, and if not, the verification fails.
  • the NF obtains its own management domain name and its own digital certificate, then establishes a communication connection with the NRF, and sends the NF digital certificate to the NRF through the TLS or DTLS two-way authentication process, and the NF sends the query target service to the NSMF.
  • the NF receives the management domain name of the NF where the target service is sent by the NSMF, and forms the complete domain name of the target service according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the NF sends a query request for querying the address of the target service to the NRF, and the query request carries the complete domain name of the target service.
  • the NRF verifies according to the service name of the target service and the digital certificate of the NF, and sends a target to the NF when the verification succeeds.
  • the address of the service Thereby, the discovery between NF services located in different network slices is realized, and NF and network slice decoupling, NF and service security mechanism are decoupled.
  • the application may divide the function module of the NF service discovery device (NF or NRF) according to the above method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one process.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the modules in the embodiments of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • FIG. 9 is a schematic structural diagram of an NRF embodiment provided by the present application.
  • the NRF in this embodiment may include: an obtaining module 11 , a receiving module 12 , and a verification module 13 , where the obtaining module 11 is used to After establishing the communication connection, the NF obtains the digital certificate of the NF through the TLS or DTLS two-way authentication process.
  • the digital certificate of the NF carries the service name of the NF, the list of service names on which the NF depends, and the list of service names on which the NF is dependent.
  • the receiving module 12 is configured to receive a query request for the address of the query target service sent by the NF, where the query request carries the complete domain name of the target service, and the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF, or the target
  • the complete domain name of the service is the domain name composed of the service name of the target service and the management domain name of the NF where the target service is located by the NF.
  • the management domain name of the NF includes the network slice identifier and the identifier of the network to which the network slice belongs.
  • the verification module 13 is configured to perform verification according to the service name of the target service and the digital certificate of the NF, and verify the address of the target service sent to the NF when passing.
  • the verification module 13 is configured to: verify whether the service name of the target service is in the service name list that the NF depends on in the extension field of the digital certificate of the NF, and the digital certificate corresponding to the complete domain name of the target service that has been registered and saved.
  • the extension field contains the service name of the NF in the list of service names that the NF is dependent on.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 3, FIG. 7 or FIG. 8.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • the NRF of this embodiment may further include: a registration module 14, where The receiving module 12 is further configured to: before receiving the query request of the address of the query target service sent by the NF, receive the first service registration request sent by the NF, where the first service registration request includes the complete domain name and the first service address of the first service.
  • the complete domain name of the first service is the domain name composed of the service name of the NF and the management domain name of the NF.
  • the registration module 14 is configured to perform service registration according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF.
  • the registration module 14 is configured to: verify that the service name of the NF in the complete domain name of the first service is the same as the service name of the NF carried in the extension field of the digital certificate, and if yes, the registration is successful, and the first service is saved.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the NF image during the process of managing the network element requesting PaaS to deploy the NF in the network slice.
  • the NF management domain name and the NF digital certificate are configured after the NF is started.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 6.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 11 is a schematic structural diagram of an NF embodiment provided by the present application.
  • the NF of the embodiment may include: an obtaining module 21, a first sending module 22, and a query module 23, and the obtaining module 21 is configured to obtain NF management domain name and NF digital certificate, NF digital certificate carries NF service name, NF depends service name list and NF depends service name list, NF management domain name contains network slice identifier and network slice belongs to The identity of the network.
  • the first sending module 22 is configured to establish a communication connection with the NRF, and send the digital certificate of the NF to the NRF through a secure transport layer protocol TLS or a data secure transport layer protocol DTLS two-way authentication process.
  • the query module 23 is configured to send a query request for querying the address of the target service to the NRF, where the query request carries the complete domain name of the target service, and the complete domain name of the target service is the domain name composed of the service name of the target service and the management domain name of the NF, or the target service.
  • the complete domain name is the service name of the target service and the domain name composed of the management domain name of the NF where the target service is located by the NF, and is used for the NRF to verify according to the service name of the target service and the digital certificate of the NF.
  • the query module 23 is further configured to: before sending the query request for querying the address of the target service to the NRF, composing the complete domain name of the target service according to the service name of the target service and the management domain name of the NF.
  • the querying module 23 is further configured to: before sending the query request for querying the address of the target service to the NRF, send a query request for the management domain name of the NF where the target service is located to the management network element, and the service that carries the target service in the query request After receiving the management domain name of the NF where the target service is sent by the management network element, the complete domain name of the target service is formed according to the service name of the target service and the management domain name of the NF where the target service is located.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 3, FIG. 7 or FIG. 8.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 12 is a schematic structural diagram of an NF embodiment according to the present application. As shown in FIG. 12, on the basis of the NF shown in FIG. 11, the NF of the embodiment may further include: a receiving module 24, a receiving module. 24 is used to receive the address of the target service sent by the NRF when the verification is passed.
  • a receiving module 24 is used to receive the address of the target service sent by the NRF when the verification is passed.
  • the query module 23 is further configured to: before sending the query request for querying the address of the target service to the NRF, composing the complete domain name of the first service according to the service name of the NF and the management domain name of the NF, and sending the first service registration request to the NRF
  • the first service registration request includes a complete domain name and a first service address of the first service, and is used by the NRF to perform service registration according to the full domain name of the first service and the service name of the NF carried in the extension field of the digital certificate of the NF.
  • the management domain name of the NF is in the process of managing the NF of the network element requesting platform, that is, the service PaaS deploys the network slice, and the management network element is dynamically generated according to the network slice identifier, and is injected by the PaaS in the image of the NF.
  • the NF digital certificate is injected into the NF image during the process of managing the network element requesting PaaS to deploy the NF in the network slice.
  • the NF management domain name and the NF digital certificate are configured after the NF is started.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 6.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 13 is a schematic diagram of an NRF provided by the present application, where the NRF 1100 includes:
  • the memory 1103 is configured to store program instructions, and the memory may also be a flash memory.
  • the processor 1102 is configured to invoke and execute program instructions in the memory to implement various steps in the method shown in FIG. 3, FIG. 6, FIG. 7, or FIG. For details, refer to the related description in the foregoing method embodiments.
  • the memory 1103 can be either stand-alone or integrated with the processor 1102.
  • the device 1100 may further include:
  • the bus 1104 is configured to connect the memory 1103 and the processor 1102.
  • the apparatus can be used to perform the various steps and/or processes corresponding to the NRF in the above method embodiments.
  • FIG. 14 is a schematic diagram of an NF provided by the present application, where the NF 1200 includes:
  • the memory 1203 is configured to store program instructions, and the memory may also be a flash memory.
  • the processor 1202 is configured to call and execute program instructions in the memory to implement various steps in the method shown in FIG. 3, FIG. 6, FIG. 7, or FIG. For details, refer to the related description in the foregoing method embodiments.
  • the memory 1203 can be either independent or integrated with the processor 1202.
  • the device 1200 may further include:
  • the bus 1204 is used to connect the memory 1203 and the processor 1202.
  • the NF can be used to perform the various steps and/or processes corresponding to the NF in the above method embodiments.
  • the application further provides a readable storage medium in which a computer program is stored, and when at least one processor of the NF service discovery device (NRF or NF) executes the computer program, the discovery device of the NF service performs the above Various embodiments provide a method of discovering NF services.
  • NRF NF service discovery device
  • the application also provides a program product comprising a computer program stored in a readable storage medium.
  • At least one processor of the discovery device of the NF service may read the computer program from a readable storage medium, and the at least one processor executes the computer program such that the discovery device of the NF service implements the discovery method of the NF service provided by the various embodiments described above .
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种网络功能服务的发现方法及设备。该方法包括：NRF与NF建立通信连接后，通过TLS或DTLS双向认证过程获取NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表。NRF接收NF发送的查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，NRF根据目标服务的服务名与NF的数字证书进行验证，验证通过时向NF发送目标服务的地址。从而实现了NF服务之间的发现，且NF和网络切片解耦，NF和服务安全机制解耦。

Description

网络功能服务的发现方法及设备
本申请要求于2017年8月8日提交中国专利局、申请号为201710671849.5、发明名称为“网络功能服务的发现方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种网络功能服务的发现方法及设备。
背景技术
随着第五代移动通信技术(5th-generation，简称：5G)的发展，在5G网络的核心网网络架构的演进过程中，提出了基于云和虚拟化技术、以网络功能(Network Function，NF)为中心的服务化网络架构，在该架构中，网络功能仓储功能(NF Repository Function，NRF)是一种为NF提供服务的注册和发现功能的网络功能，NF可以在NRF上注册一个或者多个服务的地址，注册的服务的地址有多种形式，可以是IP地址也可以是URL地址，服务的名称定义为<service name>.<NF name>.<PLMN>，比如：session-manager.SMF.<PLMN>。所有NF位于全互通的网络拓扑中，以实现具体服务之间物理部署位置解耦，因此这种服务化网络架构有利于快速部署新的NF实现网络业务的创新。
5G网络切片技术支持在一个物理网络上提供满足不同服务等级协议(Service-LevelAgreement，SLA)等级的多种业务，比如车联网、虚拟现实等，图1为一种公共陆地移动网络(Public Land Mobile Network，PLMN)的网络切片及不同网络切片的NF的分布示意图，如图1所示，用户设备通过无线接入网节点接入PLMN，PLMN被切分为三个网络切片，每个网络切片包含一组特定功能的NF，一个NF由至少一个服务组成，位于不同网络切片的NF1为同一种类型的NF(如网络切片A中的NF1和网络切片B中的NF1)，位于不同网络切片的NF2为同一种类型的NF。为满足所在切片的业务的SLA有不同的资源述求和性能指标，位于不同网络切片的NF之间是相互隔离的，即便它们是同一种类型的NF。因为实现上的约束，也存在需要在多个网络切片之间共享的NF(如图1中的NF3)。而且，网络切片根据客户的定购需求动态部署，即某个网络切片中的NF的生命周期是不确定的，因此不同网络切片中的NF在业务上也是隔离的，如图1中的网络切片A的NF1只能和网络切片A的NF2进行业务交互，而不能访问网络切片A外的同类型的NF2。
因此，在上述服务化网络架构中，位于不同网络切片的NF之间需要相互隔离，且不同网络切片之间的NF在业务上需要相互隔离，因此动态部署的NF之间要能够发现，即就是NF服务之间要能够发现，服务消费者要能够查询到服务提供者的地址，如何实现NF服务之间的发现，是一个亟需解决的问题。
发明内容
本申请提供一种网络功能服务的发现方法及设备，以实现NF服务之间的发现。
第一方面，本申请提供一种NF服务的发现方法，包括：网络功能仓储功能NRF与NF建立通信连接后，通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程获取NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表；NRF接收NF发送的查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，NF的管理域名包含网络切片标识与网络切片所属的网络的标识；NRF根据目标服务的服务名与NF的数字证书进行验证，验证通过时向NF发送目标服务的地址。
通过第一方面提供的NF服务的发现方法，实现了NF服务之间的发现，而且，在NF服务的发现过程中，目标服务的服务名是NF已知的，若是网络切片内的服务发现，NF在发送查询请求时将目标服务的服务名和自身的管理域名组成目标服务的完整域名进行查询，若是不同网络切片之间的服务发现，NF在发送查询请求时将目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成目标服务的完整域名进行查询，NF的管理域名包含网络切片标识与网络切片所属的网络的标识，而网络切片标识通过管理网元管理，因此可实现NF和网络切片解耦，另一方面，将不同服务之间的依赖关系放置在服务的数字证书的扩展字段中，数字证书的扩展字段中只会涉及到NF的服务名，不会涉及到NF的管理域名，因此可保证不会因为有动态部署的切片导致所有服务的数字证书需要更新，实现NF和服务安全机制解耦，网络切片和服务安全机制可以兼容已有的TLS/DNS标准机制，现有NF无需改造即可接入系统，不论NF如何动态部署，现有的NF不受影响。
在一种可能的设计中，NRF根据目标服务的服务名与NF的数字证书进行验证，包括：NRF验证目标服务的服务名是否在NF的数字证书的扩展字段中携带的NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含NF的服务名。
在一种可能的设计中，NRF接收NF发送的查询目标服务的地址的查询请求之前，还包括：NRF接收NF发送的第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，第一服务的完整域名为NF的服务名和NF的管理域名组成的域名，NRF根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
通过该实施方式提供的方法，实现了NF服务的注册。
在一种可能的设计中，NRF根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册，包括：NRF验证第一服务的完整域名中的NF的服务名是否与数字证书的扩展字段中携带的NF的服务名相同，若是，则注册成功，并保存第一服务的完整域名、第一服务地址与数字证书的扩展字段中携带的NF所依赖的服务名列表、NF被依赖的服务名列表的对应关系。
在一种可能的设计中，NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
在一种可能的设计中，NF的管理域名和NF的数字证书是在NF启动之后配置的。
第二方面，本申请提供一种NF服务的发现方法，包括：NF获取NF的管理域名和NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名 列表，NF的管理域名包含网络切片标识与网络切片所属的网络的标识，NF与NRF建立通信连接，并通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程向NRF发送NF的数字证书，NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，用于NRF根据目标服务的服务名与NF的数字证书进行验证。
通过第二方面提供的NF服务的发现方法，实现了NF服务之间的发现，而且，在NF服务的发现过程中，目标服务的服务名是NF已知的，若是网络切片内的服务发现，NF在发送查询请求时将目标服务的服务名和自身的管理域名组成目标服务的完整域名进行查询，若是不同网络切片之间的服务发现，NF在发送查询请求时将目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成目标服务的完整域名进行查询，NF的管理域名包含网络切片标识与网络切片所属的网络的标识，而网络切片标识通过管理网元管理，因此可实现NF和网络切片解耦，另一方面，将不同服务之间的依赖关系放置在服务的数字证书的扩展字段中，数字证书的扩展字段中只会涉及到NF的服务名，不会涉及到NF的管理域名，因此可保证不会因为有动态部署的切片导致所有服务的数字证书需要更新，实现NF和服务安全机制解耦，网络切片和服务安全机制可以兼容已有的TLS/DNS标准机制，现有NF无需改造即可接入系统，不论NF如何动态部署，现有的NF不受影响。
在一种可能的设计中，NF向NRF发送查询目标服务的地址的查询请求之前，还包括：NF根据目标服务的服务名和NF的管理域名组成目标服务的完整域名。
在一种可能的设计中，NF向NRF发送查询目标服务的地址的查询请求之前，还包括：NF向管理网元发送查询目标服务所在的NF的管理域名的查询请求，查询请求中携带目标服务的服务名，NF接收到管理网元发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。
在一种可能的设计中，还包括：NF接收NRF在验证通过时发送的目标服务的地址。
在一种可能的设计中，NF向NRF发送查询目标服务的地址的查询请求之前，还包括：NF根据NF的服务名和NF的管理域名组成第一服务的完整域名，并向NRF发送第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，用于NRF根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
通过该实施方式提供的方法，实现了NF服务的注册。
在一种可能的设计中，NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
在一种可能的设计中，NF的管理域名和NF的数字证书是在NF启动之后配置的。
第三方面，本申请提供一种NRF，包括：获取模块，用于与NF建立通信连接后，通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程获取NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表；接收模块，用于接收NF发送的查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，NF的管 理域名包含网络切片标识与网络切片所属的网络的标识；验证模块，用于根据目标服务的服务名与NF的数字证书进行验证，验证通过时向NF发送目标服务的地址。
在一种可能的设计中，验证模块用于：验证目标服务的服务名是否在NF的数字证书的扩展字段中携带的NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含NF的服务名。
在一种可能的设计中，接收模块还用于：在接收NF发送的查询目标服务的地址的查询请求之前，接收NF发送的第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，第一服务的完整域名为NF的服务名和NF的管理域名组成的域名；NRF还包括：注册模块，用于根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
在一种可能的设计中，注册模块用于：验证第一服务的完整域名中的NF的服务名是否与数字证书的扩展字段中携带的NF的服务名相同，若是，则注册成功，并保存第一服务的完整域名、第一服务地址与数字证书的扩展字段中携带的NF所依赖的服务名列表、NF被依赖的服务名列表的对应关系。
在一种可能的设计中，NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
在一种可能的设计中，NF的管理域名和NF的数字证书是在NF启动之后配置的。
上述第三方面以及上述第三方面的各可能的设计中所提供的NRF，其有益效果可以参见上述第一方面和第一方面的各可能的设计中所带来的有益效果，在此不再赘述。
第四方面，本申请提供一种NF，包括：获取模块，用于获取NF的管理域名和NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表，NF的管理域名包含网络切片标识与网络切片所属的网络的标识；第一发送模块，用于与NRF建立通信连接，并通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程向NRF发送NF的数字证书；查询模块，用于向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，用于NRF根据目标服务的服务名与NF的数字证书进行验证。
在一种可能的设计中，查询模块还用于：向NRF发送查询目标服务的地址的查询请求之前，根据目标服务的服务名和NF的管理域名组成目标服务的完整域名。
在一种可能的设计中，查询模块还用于：向NRF发送查询目标服务的地址的查询请求之前，向管理网元发送查询目标服务所在的NF的管理域名的查询请求，查询请求中携带目标服务的服务名；接收到管理网元发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。
在一种可能的设计中，还包括：接收模块，用于接收NRF在验证通过时发送的目标服务的地址。
在一种可能的设计中，查询模块还用于：向NRF发送查询目标服务的地址的查询请求之前，根据NF的服务名和NF的管理域名组成第一服务的完整域名，并向NRF发送第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，用于NRF根据第一 服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
在一种可能的设计中，NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
在一种可能的设计中，NF的管理域名和NF的数字证书是在NF启动之后配置的。
上述第四方面以及上述第四方面的各可能的设计中所提供的NRF，其有益效果可以参见上述第二方面和第二方面的各可能的设计中所带来的有益效果，在此不再赘述。
第五方面，本申请提供一种NRF，包括：存储器和处理器；
存储器用于存储程序指令；
处理器用于调用存储器中的程序指令执行第一方面及第一方面任一种可能的设计中的NF服务的发现方法。
第六方面，本申请提供一种NF，包括：存储器和处理器；
存储器用于存储程序指令；
处理器用于调用存储器中的程序指令执行第二方面及第二方面任一种可能的设计中的NF服务的发现方法。
第七方面，本申请提供一种可读存储介质，可读存储介质中存储有计算机程序，当NF服务的发现设备的至少一个处理器执行该计算机程序时，NF服务的发现设备执行第一方面及第一方面任一种可能的设计中的方法或者第二方面及第二方面任一种可能的设计中的NF服务的发现方法。
第八方面，本申请提供一种程序产品，该程序产品包括计算机程序，该计算机程序存储在可读存储介质中。NF服务的发现设备的至少一个处理器可以从可读存储介质读取该计算机程序，至少一个处理器执行该计算机程序使得NF服务的发现设备实施第一方面及第一方面任一种可能的设计中的方法或者第二方面及第二方面任一种可能的设计中的NF服务的发现方法。
附图说明
图1为一种PLMN的网络切片及不同网络切片的NF的分布示意图；
图2为本申请提供的一种可能的网络架构示意图；
图3为本申请提供的一种NF服务的发现方法实施例的流程图；
图4为客户订购切片、数字证书生成、网络切片中的NF部署及服务注册与服务发现的流程示意图；
图5为与图4对应的交互流程图；
图6为本申请提供的一种NF服务的注册方法实施例的流程图；
图7为本申请提供的一种NF服务的发现方法实施例的流程图；
图8为本申请提供的一种NF服务的发现方法实施例的流程图；
图9为本申请提供的一种NRF实施例的结构示意图；
图10为本申请提供的一种NRF实施例的结构示意图；
图11为本申请提供的一种NF实施例的结构示意图；
图12为本申请提供的一种NF实施例的结构示意图；
图13为本申请提供的一种NRF示意图；
图14为本申请提供的一种NF示意图。
具体实施方式
本申请描述的网络架构以及业务场景是为了更加清楚的说明本申请的技术方案，并不构成对本申请提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
网络切片是指支持特定通信业务需求的逻辑网络功能实例的集合，主要借助软件定义网络(Software Defined Network，SDN)技术与网络功能虚拟化(Network Function Virtualization，NFV)技术。NFV技术可实现底层物理资源到虚拟化资源的映射、构建虚拟机和加载NF；SDN技术可实现虚拟机之间的逻辑连接、构建承载信令和数据流的通路。网路切片最终实现接入网(Residential Access Network，RAN)与核心网的NF实例之间的动态连接，配置端到端的业务链，实现灵活组网，从而实现网络可定制化的服务。运营商可以根据各个具体通信业务对容量、覆盖、速率、时延以及可靠性等关键性能指标的需求确定网络切片，网络切片包括NF实例集合和运行这些NF实例所需的网络资源，从而为用户提供所需的电信服务业务和网络能力服务，满足特定的市场场景以及需求。
需要说明的是，每个网络切片包含一组特定功能的NF，一个NF由至少一个服务组成，每个NF都是服务提供者，提供应用程序编程接口(Application Programming Interface，API)供其他NF调用；同时每个NF也都是服务消费者，它们也调用其他NF的API。每个服务提供者都需要在NRF上注册信息(包括服务的地址)，调用NRF注册接口的时候就是服务注册者，调用NRF服务发现接口时就是服务发现者。NF之间的发现，即就是服务消费者要能够查询到服务提供者的注册信息(如服务的地址)。
本申请提供的技术方案可以应用于5G通信系统或者LTE系统等移动通信系统，主要应用于以NF为中心的服务化网络架构下，位于不同网络切片或者同一网络切片的NF之间能够发现的场景。
图2为本申请提供的一种可能的网络架构示意图，如图2所示为核心网的网络架构，图2中的网络开放功能(Network Exposure Function，NEF)、策略控制功能(Policy Control Function，PCF)、统一数据管理(Unified Data Management，UDM)、应用功能(Application Function，AF)、鉴权服务器功能(Authentication Server Function，AUSF)、接入与移动性管理功能(Access and Mobility Management Function，AMF)、会话管理功能(Session Managent Function，SMF)、用户面功能(User Plan Function，UPF)均是不同的NF，NRF为所有的NF提供服务的注册和服务的发现功能，NF可以在NRF上注册一个或者多个服务的地址。所有NF位于全互通的网络拓扑中，以实现具体服务之间物理部署位置解耦。N1、N2、N3、N4和N6为各网元之间的接口。各个NF的API包括：AMF服务化接口(Service-based interface exhibited by AMF，Namf)、SMF服务化接口(Service-based interface exhibited by SMF，Nsmf)、NEF服务化接口(Service-based interface exhibited by NEF，Nnef)、NRF服务化接口(Service-based interface exhibited by NRF，Nnrf)、PCF服务化接口(Service-based interface exhibited by PCF，Npcf)、UDM服务化接口(Service-based interface exhibited by UDM，Nudm)、AUSF服务化接口(Service-based interface exhibited  by AUSF，Nausf)、AF服务化接口(Service-based interface exhibited by AF，Naf)。
本申请提供一种NF服务的发现方法及设备，可实现位于不同网络切片或同一网络切片的NF服务之间能够发现，服务消费者能够查询到服务提供者的注册信息，如服务地址，本申请中，一方面，通过将网络切片标识嵌入服务的完整域名，服务的完整域名由NF的服务名和NF的管理域名组成，NF的管理域名包含网络切片标识与网络切片所属的网络的标识，管理网元管理NF的管理域名，即管理网元管理网络切片标识，可实现NF和网络切片解耦，所谓解耦就是NF不因为要部署新的网络切片都改变实现。另一方面，在服务化网络架构中，服务之间是一个扁平的、全互通的简化物理拓扑，服务之间的业务通信一定需要安全保障，服务安全机制是必须的，一般通过底层采用安全传输层协议(Transport Layer Security，TLS)或者数据安全传输层协议(Data Transport Layer Security，DTLS)的安全通道，NF与NRF建立通信连接后，NF与NRF之间通过TLS或DTLS双向认证过程进行认证以满足安全性的要求，在TLS双向认证过程中，NF会将自身的数字证书发送给NRF。本申请中，将NF服务发现的安全规则放置在服务的数字证书的扩展字段中，安全规则为不同服务之间的依赖关系，数字证书的扩展字段中只会涉及到NF的服务名(如<NF service>.<NF name>)，不会涉及到NF的管理域名(如<Slice id>.<PLMN>)，因此可保证不会因为有动态部署的切片导致所有服务的数字证书需要更新，实现NF和服务安全机制解耦，网络切片和服务安全机制可以兼容已有的TLS/域名系统(DomainNameSystem，DNS)标准机制，现有NF无需改造即可接入系统。下面结合附图详细说明本申请的技术方案。
图3为本申请提供的一种NF服务的发现方法实施例的流程图，如图3所示，本实施例的方法可以包括：
S101、NF获取所述NF的管理域名和所述NF的数字证书，NF的数字证书的扩展字段中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表，NF的管理域名包含网络切片标识与网络切片所属的网络的标识。
其中，NF的管理域名例如为<Slice id>.<PLMN>，Slice id为网络切片标识，PLMN为网络切片所属的网络的标识。具体地，NF获取自身的管理域名和自身的数字证书以及为该NF提供服务的注册和服务的发现功能的NRF的地址，一般地，一个NRF管理同一个网络切片中的NF，或者，一个NRF管理多个不同网络切片中的NF。其中，可选的，NF的管理域名、NF的数字证书和NRF的地址这三个信息可以是在部署网络切片中的NF的过程中镜像注入并存储在磁盘文件中的，具体地，NF的管理域名是管理网元请求平台即服务(Platform-as-a-Service，PaaS)部署网络切片中的NF的过程中，所述管理网元根据网络切片标识动态生成，由所述PaaS在NF的镜像中注入的，所述NF的数字证书和所述NRF的地址是所述管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的，此时NF可通过读取系统命名服务器(nameserver)配置文件(磁盘文件)获取这三个信息，其中的管理网元可以是网络切片管理功能(Network slice management function，NSMF)或者运维支撑系统(Operation Support Systems，OSS)。可选的，这三个信息还可以是在NF启动之后配置的，NF通过读取配置文件获取这三个信息。
其中，NF的数字证书和NF的类型一一对应，同一类型的NF的数字证书相同，同一类NF的多个实例使用的是同一个数字证书。所述NF所依赖的服务名列表可以包含一个服务名或多个服务名，所述NF被依赖的服务名列表可以包含一个服务名或多个服务名。
其中，NF所依赖的服务名列表是指此NF作为服务消费者需要通过NRF查询服务地址的 目标服务名列表，NF被依赖的服务名列表是指此NF作为服务提供者注册到NRF的服务地址可以被服务消费者获取到的所有服务消费者的服务名列表。
S102、NF与NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书。
其中，NF根据NRF的地址与NRF建立通信连接，TLS或DTLS双向认证过程可由NF或NRF任一方发起，以TLS双向认证过程中NF发起为例，NF向NRF发送TLS握手消息，NRF接收到TLS握手消息后，向NF发送TLS握手消息，指示进行客户端认证，接着NF向NRF发送自身的数字证书。TLS或DTLS双向认证过程为现有的安全认证过程，详细过程此处不再赘述。
S103、NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和所述NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和所述NF查询到的目标服务所在的NF的管理域名组成的域名。
可选的，在S103之前，还可以包括：NF根据目标服务的服务名和所述NF的管理域名组成目标服务的完整域名。
其中，目标服务的服务名例如为<NF service name>.<NF name>(目标服务所在的NF有多个服务)，目标服务的完整域名则为<NF service name>.<NF name>.<Slice id>.<PLMN>，或者目标服务的服务名例如为<NF name>(目标服务所在的NF只有目标服务一个服务)，目标服务的完整域名则为<NF name>.<Slice id>.<PLMN>。
其中，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，此时NF与目标服务所在的NF属于同一网络切片。目标服务的完整域名为目标服务的服务名和所述NF查询到的目标服务所在的NF的管理域名组成的域名，此时NF与目标服务所在的NF属于不同的网络切片。
NF与目标服务所在的NF属于不同的网络切片时，也就是不同网络切片之间的服务发现时，进一步地，S103之前，还可以包括：
NF向管理网元发送查询目标服务所在的NF的管理域名的查询请求，查询请求中携带目标服务的服务名。
其中，查询请求中可携带目标服务的服务名，如<NF service name>.<NF 1 name>，管理网元根据目标服务的服务名可以查询到目标服务所在的NF为NF1，可以查询到NF1所在的目标网络切片，就可以查询到目标服务所在的NF的管理域名。管理网元例如为NSMF。
NF接收到管理网元发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。
S104、NRF根据目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送目标服务的地址。
进一步地，验证不通过时，NRF向所述NF发送查询失败的消息。
可选的，S104中NRF根据目标服务的服务名与所述NF的数字证书进行验证，具体可以包括：
NRF验证目标服务的服务名是否在所述NF的数字证书的扩展字段中携带的所述NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含所述NF的服务名，若是，则验证通过，若否，则验证不通过。
例如：NF1的数字证书的扩展字段中携带如下内容：NF的服务名＝*.NF1，NF1所依赖的服务名＝*.NF2，NF1被依赖的服务名＝*.NF3；NF2的数字证书的扩展字段中携带如下内容：NF的服务名＝*.NF2，NF2所依赖的服务名＝*.NF4，NF2被依赖的服务名＝*.NF1；NF3的数字证书的扩展字段中携带如下内容：NF的服务名＝*.NF3，NF3所依赖的服务名＝*.NF2，NF3被依赖的服务名＝*.NF4。
则NF1可以查询到NF2注册的服务地址；NF1查询NF3的服务地址的时候会被NRF拒绝，因为NF1的数字证书中所依赖的服务名并未包含NF3；NF3查询NF2的服务地址也会被NRF拒绝，因为NF2的数字证书中被依赖的服务名并未包含NF3。
上述过程为NF服务的发现过程，可以理解，在NF服务之间的发现之前，需要注册，NF可在NRF上注册一个或者多个服务的地址。在图3所示实施例的基础上，进一步地，在S103之前，还可以包括：
NF根据所述NF的服务名和所述NF的管理域名组成第一服务的完整域名，并向NRF发送第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址。其中，第一服务地址可以是IP地址也可以是URL地址，
NRF接收到第一服务注册请求后，根据第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
具体地，NRF验证第一服务的完整域名中的所述NF的服务名是否与所述数字证书的扩展字段中携带的所述NF的服务名相同，若是，则注册成功，并保存第一服务的完整域名、第一服务地址与所述数字证书的扩展字段中携带的所述NF所依赖的服务名列表、所述NF被依赖的服务名列表的对应关系；若否，则注册失败。注册成功时，例如保存的对应关系如下表一所示：
表一
Figure PCTCN2018095974-appb-000001
本实施例提供的NF服务的发现方法，通过NF获取自身的管理域名和自身的数字证书，接着与NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书，NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带由目标服务的服务名和NF的管理域名组成的目标服务的完整域名，最后NRF根据目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送目标服务的地址。从而实现了NF服务之间的发现，而且，在NF服务的发现过程中，目标服务的服务名是NF已知的，若是网络切片内的服务发现，NF在发送查询请求时将目标服务的服务名和自身的管理域名组成目标服务的完整域名进 行查询，若是不同网络切片之间的服务发现，NF在发送查询请求时将目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成目标服务的完整域名进行查询，NF的管理域名包含网络切片标识与网络切片所属的网络的标识，而网络切片标识通过管理网元管理，因此可实现NF和网络切片解耦，另一方面，将不同服务之间的依赖关系放置在服务的数字证书的扩展字段中，数字证书的扩展字段中只会涉及到NF的服务名，不会涉及到NF的管理域名，因此可保证不会因为有动态部署的切片导致所有服务的数字证书需要更新，实现NF和服务安全机制解耦，网络切片和服务安全机制可以兼容已有的TLS/DNS标准机制，现有NF无需改造即可接入系统，不论NF如何动态部署，现有的NF不受影响。
下面采用几个具体的实施例，对图3所示方法实施例的技术方案进行详细说明。
下面以NF的管理域名、NF的数字证书和NRF的地址这三个信息是在部署网络切片中的NF的过程中镜像注入的为例进行说明，详细说明服务部署过程、服务注册过程和服务发现过程。图4为客户订购切片、数字证书生成、网络切片中的NF部署及服务注册与服务发现的流程示意图，如图4所示，包括：
S201、客户向NSMF发送订购网络切片的请求。
S202、NSMF接收到请求后，向数字证书签发机构(Certificate Authority，CA)申请数字证书。
S203、NSMF向PaaS发送部署请求。
S204、PaaS进行镜像注入过程，启动镜像。
S205、NF在NRF上进行服务注册与服务发现。
图5为与图4对应的交互流程图，如图5所示，包括：
S301、客户向NSMF发送订购网络切片请求。
S302、NSMF接收到请求后，根据网络切片标识(ID)生成动态的管理域名<Slice id>.<PLMN>。
S303、NSMF根据网络切片设计，获取该网络切片ID对应的网络切片内所有NF的镜像地址。
S304、向CA申请每类NF的数字证书。
其中，NF的数字证书和NF的类型一一对应，同一类型的NF的数字证书相同，同一类NF的多个实例使用的是同一个数字证书。
S305、NSMF在每个NF的镜像描述文件中定义需注入的内容，包括：动态生成的管理域名、NF的数字证书和NRF的IP地址。
S306、NSMF向PaaS发送部署请求，部署请求中携带NF的镜像地址和NF的镜像描述文件。
S307、PaaS根据NF的镜像地址获取镜像，根据NF的镜像描述文件申请虚拟资源，根据NF的镜像描述文件实施内容注入。
S308、PaaS启动镜像。
S309、NF进行业务处理，在NRF上进行服务注册与服务发现。
其中，镜像注入技术是所有云平台提供的基本功能，就是在启动镜像前就可以修改镜像中指定目录的文件内容，当然也可以在指定目录下增加某个文件。
接下来是服务注册过程，图6为本申请提供的一种NF服务的注册方法实施例的流程图，如图6所示，本实施例的方法包括：
S401、NF获取所述NF的管理域名、所述NF的数字证书和NRF的地址，NF的数字证书的扩展字段中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表，NF的管理域名包含网络切片标识与网络切片所属的网络的标识。
具体地，NF通过读取系统命名服务器(nameserver)配置文件(即就是NSMF镜像注入的文件)获取所述NF的管理域名、所述NF的数字证书和NRF的地址这三个信息。
S402、NF根据NRF的地址与NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书。
S403、NF根据所述NF的服务名和所述NF的管理域名组成第一服务的完整域名。
S404、NF向NRF发送第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址。
S405、NRF接收到第一服务注册请求后，根据第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
具体的注册过程可参见图3所示实施例中相同部分的描述，此处不再赘述。
接下来是服务发现过程，图7为本申请提供的一种NF服务的发现方法实施例的流程图，本实施例中以位于同一网络切片的NF服务之间的发现为例，如图7所示，本实施例的方法包括：
S501ˉS502的过程与图6所示的S401ˉS402的过程相同，此处不再赘述。
S503、NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和所述NF的管理域名组成的域名。
S504、NRF根据目标服务的服务名与所述NF的数字证书进行验证。
S505、NRF在验证通过时向NF发送目标服务的地址，验证不通过时向NF发送查询失败的消息。
具体地，NRF验证目标服务的服务名是否在所述NF的数字证书的扩展字段中携带的所述NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含所述NF的服务名，若是，则验证通过，若否，则验证不通过。
需要说明的是，因为NRF配置为NF的命名服务器(nameserver)地址，因此是支持通过DNS协议实现服务发现，为了安全要求基于TLS的DNS消息交互，对于非TLS的DNS消息， 除非注册的服务端的数字证书中说明本服务提供者可以被任何服务消费者获取地址，否则返回查找失败。
本实施例中，通过NF获取自身的管理域名、自身的数字证书和为该NF提供服务的注册和服务的发现功能的NRF的地址，接着根据NRF的地址与NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书，NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带由目标服务的服务名和NF自身的管理域名组成的目标服务的完整域名，最后NRF根据目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送目标服务的地址。从而实现了位于同一网络切片的NF服务之间的发现，且NF和网络切片解耦，NF和服务安全机制解耦。
图8为本申请提供的一种NF服务的发现方法实施例的流程图，本实施例中以位于不同网络切片的NF服务之间的发现为例，管理网元为NSMF，如图8所示，本实施例的方法包括：
S601ˉS602的过程与图6所示的S401ˉS402的过程相同，此处不再赘述。
NF服务消费者是多网络切片共享的，需要发现多个网络切片的服务，则先通过管理渠道，例如从NSMF获取每个网络切片的管理域名，也就是上文所述的NF的管理域名，如<Slice id>.<PLMN>，然后和需要发现的服务的服务名组合为一个完整域名到NRF获取服务地址，如下S603ˉS604所执行的步骤。
S603、NF向NSMF发送查询目标服务所在的NF的管理域名的查询请求，查询请求中携带目标服务的服务名。
S604、NF接收到NSMF发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。
S605、NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名。
一个NRF管理同一个网络切片中的NF时，也就是服务消费者和服务发现者可能位于不同的管理域，此时方法还包括：
S606、NRF查询目标服务所属的NRF的地址，向NF发送查询到的目标服务所属的NRF的地址。
需要说明的是，因为服务消费者和服务发现者可能位于不同的管理域，这两个管理域可能是一个NRF也有可能是两个不同的NRF，如果是两个不同的NRF，那么就和DNS的迭代查询流程类似，经过多次迭代查询，最终会和目标服务的管理域的NRF建立安全通道，进行服务发现。最终NF和其他管理域的NRF的发现过程同网络切片内的服务发现过程是一致的。
S607、NF根据目标服务所属的NRF的地址与目标服务所属的NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书。
S608、目标服务所属的NRF根据目标服务的服务名与所述NF的数字证书进行验证。
S609、目标服务所属的NRF在验证通过时向所述NF发送目标服务的地址，验证不通过时向所述NF发送查询失败的消息。
具体地，NRF验证目标服务的服务名是否在所述NF的数字证书的扩展字段中携带的所述 NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含所述NF的服务名，若是，则验证通过，若否，则验证不通过。
本实施例中，通过NF获取自身的管理域名和自身的数字证书，接着与NRF建立通信连接，并通过TLS或DTLS双向认证过程向NRF发送所述NF的数字证书，NF向NSMF发送查询目标服务所在的NF的管理域名的查询请求，NF接收到NSMF发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。NF向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，最后NRF根据目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送目标服务的地址。从而实现了位于不同网络切片的NF服务之间的发现，且NF和网络切片解耦，NF和服务安全机制解耦。
本申请可以根据上述方法示例对NF服务的发现设备(NF或NRF)进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请各实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
图9为本申请提供的一种NRF实施例的结构示意图，如图9所示，本实施例的NRF可以包括：获取模块11、接收模块12和验证模块13，其中，获取模块11用于与NF建立通信连接后，通过TLS或DTLS双向认证过程获取NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表。接收模块12用于接收NF发送的查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，NF的管理域名包含网络切片标识与网络切片所属的网络的标识。验证模块13用于根据目标服务的服务名与NF的数字证书进行验证，验证通过时向NF发送目标服务的地址。
可选的，验证模块13用于：验证目标服务的服务名是否在NF的数字证书的扩展字段中携带的NF所依赖的服务名列表中，已注册保存的目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含NF的服务名。
本实施例的装置，可以用于执行图3、图7或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图10为本申请提供的一种NRF实施例的结构示意图，如图10所示，在图9所示NRF的基础上，进一步地，本实施例的NRF还可以包括：注册模块14，其中，接收模块12还用于：在接收NF发送的查询目标服务的地址的查询请求之前，接收NF发送的第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，第一服务的完整域名为NF的服务名和NF的管理域名组成的域名。注册模块14用于根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
可选的，注册模块14用于：验证第一服务的完整域名中的NF的服务名是否与数字证书的扩展字段中携带的NF的服务名相同，若是，则注册成功，并保存第一服务的完整域名、第 一服务地址与数字证书的扩展字段中携带的NF所依赖的服务名列表、NF被依赖的服务名列表的对应关系。
其中，可选的，述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
可选的，NF的管理域名和NF的数字证书是在NF启动之后配置的。
本实施例的装置，可以用于执行图6所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图11为本申请提供的一种NF实施例的结构示意图，如图11所示，本实施例的NF可以包括：获取模块21、第一发送模块22和查询模块23，获取模块21用于获取NF的管理域名和NF的数字证书，NF的数字证书中携带NF的服务名、NF所依赖的服务名列表和NF被依赖的服务名列表，NF的管理域名包含网络切片标识与网络切片所属的网络的标识。第一发送模块22用于与NRF建立通信连接，并通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程向NRF发送NF的数字证书。查询模块23用于向NRF发送查询目标服务的地址的查询请求，查询请求中携带目标服务的完整域名，目标服务的完整域名为目标服务的服务名和NF的管理域名组成的域名，或者，目标服务的完整域名为目标服务的服务名和NF查询到的目标服务所在的NF的管理域名组成的域名，用于NRF根据目标服务的服务名与NF的数字证书进行验证。
可选的，查询模块23还用于：向NRF发送查询目标服务的地址的查询请求之前，根据目标服务的服务名和NF的管理域名组成目标服务的完整域名。
可选的，查询模块23还用于：向NRF发送查询目标服务的地址的查询请求之前，向管理网元发送查询目标服务所在的NF的管理域名的查询请求，查询请求中携带目标服务的服务名，接收到管理网元发送的目标服务所在的NF的管理域名后，根据目标服务的服务名和目标服务所在的NF的管理域名组成目标服务的完整域名。
本实施例的装置，可以用于执行图3、图7或图8所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图12为本申请提供的一种NF实施例的结构示意图，如图12所示，在图11所示NF的基础上，进一步地，本实施例的NF还可以包括：接收模块24，接收模块24用于接收NRF在验证通过时发送的目标服务的地址。
可选的，查询模块23还用于：向NRF发送查询目标服务的地址的查询请求之前，根据NF的服务名和NF的管理域名组成第一服务的完整域名，并向NRF发送第一服务注册请求，第一服务注册请求中包括第一服务的完整域名和第一服务地址，用于NRF根据第一服务的完整域名和NF的数字证书的扩展字段中携带的NF的服务名进行服务注册。
其中，可选的，述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，管理网元根据网络切片标识动态生成，由PaaS在NF的镜像中注入的，NF的数字证书是管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
可选的，NF的管理域名和NF的数字证书是在NF启动之后配置的。
本实施例的装置，可以用于执行图6所示方法实施例的技术方案，其实现原理和技术效 果类似，此处不再赘述。
图13为本申请提供的一种NRF示意图，该NRF1100包括：
存储器1103，用于存储程序指令，该存储器还可以是flash(闪存)。
处理器1102，用于调用并执行存储器中的程序指令，以实现图3、图6、图7或图8所示的方法中的各个步骤。具体可以参见前面方法实施例中的相关描述。
可选地，存储器1103既可以是独立的，也可以跟处理器1102集成在一起。
当存储器1103是独立于处理器1102之外的器件时，装置1100还可以包括：
总线1104，用于连接存储器1103和处理器1102。
该装置可以用于执行上述方法实施例中NRF对应的各个步骤和/或流程。
图14为本申请提供的一种NF示意图，该NF1200包括：
存储器1203，用于存储程序指令，该存储器还可以是flash(闪存)。
处理器1202，用于调用并执行存储器中的程序指令，以实现图3、图6、图7或图8所示的方法中的各个步骤。具体可以参见前面方法实施例中的相关描述。
可选地，存储器1203既可以是独立的，也可以跟处理器1202集成在一起。
当存储器1203是独立于处理器1202之外的器件时，装置1200还可以包括：
总线1204，用于连接存储器1203和处理器1202。
该NF可以用于执行上述方法实施例中NF对应的各个步骤和/或流程。
本申请还提供一种可读存储介质，可读存储介质中存储有计算机程序，当NF服务的发现设备(NRF或NF)的至少一个处理器执行该计算机程序时，NF服务的发现设备执行上述的各种实施方式提供的NF服务的发现方法。
本申请还提供一种程序产品，该程序产品包括计算机程序，该计算机程序存储在可读存储介质中。NF服务的发现设备的至少一个处理器可以从可读存储介质读取该计算机程序，至少一个处理器执行该计算机程序使得NF服务的发现设备实施上述的各种实施方式提供的NF服务的发现方法。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (30)

  1. 一种网络功能NF服务的发现方法，其特征在于，包括：
    网络功能仓储功能NRF与NF建立通信连接后，通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程获取所述NF的数字证书，所述NF的数字证书中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表；
    所述NRF接收所述NF发送的查询目标服务的地址的查询请求，所述查询请求中携带目标服务的完整域名，所述目标服务的完整域名为所述目标服务的服务名和所述NF的管理域名组成的域名，或者，所述目标服务的完整域名为所述目标服务的服务名和所述NF查询到的目标服务所在的NF的管理域名组成的域名，所述NF的管理域名包含网络切片标识与网络切片所属的网络的标识；
    所述NRF根据所述目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送所述目标服务的地址。
  2. 根据权利要求1所述的方法，其特征在于，所述NRF根据所述目标服务的服务名与所述NF的数字证书进行验证，包括：
    所述NRF验证所述目标服务的服务名是否在所述NF的数字证书的扩展字段中携带的所述NF所依赖的服务名列表中，已注册保存的所述目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含所述NF的服务名。
  3. 根据权利要求1或2所述的方法，其特征在于，所述NRF接收所述NF发送的查询目标服务的地址的查询请求之前，还包括：
    所述NRF接收所述NF发送的第一服务注册请求，所述第一服务注册请求中包括第一服务的完整域名和第一服务地址，所述第一服务的完整域名为所述NF的服务名和所述NF的管理域名组成的域名；
    所述NRF根据所述第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
  4. 根据权利要求3所述的方法，其特征在于，所述NRF根据所述第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册，包括：
    所述NRF验证所述第一服务的完整域名中的所述NF的服务名是否与所述数字证书的扩展字段中携带的所述NF的服务名相同，若是，则注册成功，并保存所述第一服务的完整域名、所述第一服务地址与所述数字证书的扩展字段中携带的所述NF所依赖的服务名列表、所述NF被依赖的服务名列表的对应关系。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，所述管理网元根据网络切片标识动态生成，由所述PaaS在NF的镜像中注入的，所述NF的数字证书是所述管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
  6. 根据权利要求1-4任一项所述的方法，其特征在于，所述NF的管理域名和所述NF的数字证书是在所述NF启动之后配置的。
  7. 一种网络功能NF服务的发现方法，其特征在于，包括：
    NF获取所述NF的管理域名和所述NF的数字证书，所述NF的数字证书中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表，所述NF的管理域名包 含网络切片标识与网络切片所属的网络的标识；
    所述NF与NRF建立通信连接，并通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程向所述NRF发送所述NF的数字证书；
    所述NF向所述NRF发送查询目标服务的地址的查询请求，所述查询请求中携带目标服务的完整域名，所述目标服务的完整域名为所述目标服务的服务名和所述NF的管理域名组成的域名，或者，所述目标服务的完整域名为所述目标服务的服务名和所述NF查询到的所述目标服务所在的NF的管理域名组成的域名，用于所述NRF根据所述目标服务的服务名与所述NF的数字证书进行验证。
  8. 根据权利要求7所述的方法，其特征在于，所述NF向所述NRF发送查询所述目标服务的地址的查询请求之前，还包括：
    所述NF根据所述目标服务的服务名和所述NF的管理域名组成所述目标服务的完整域名。
  9. 根据权利要求7所述的方法，其特征在于，所述NF向所述NRF发送查询所述目标服务的地址的查询请求之前，还包括：
    所述NF向管理网元发送查询所述目标服务所在的NF的管理域名的查询请求，所述查询请求中携带所述目标服务的服务名；
    所述NF接收到所述管理网元发送的目标服务所在的NF的管理域名后，根据所述目标服务的服务名和所述目标服务所在的NF的管理域名组成所述目标服务的完整域名。
  10. 根据权利要求7-9任一项所述的方法，其特征在于，还包括：
    所述NF接收所述NRF在验证通过时发送的所述目标服务的地址。
  11. 根据权利要求7-9任一项所述的方法，其特征在于，所述NF向所述NRF发送查询所述目标服务的地址的查询请求之前，还包括：
    所述NF根据所述NF的服务名和所述NF的管理域名组成第一服务的完整域名，并向所述NRF发送第一服务注册请求，所述第一服务注册请求中包括所述第一服务的完整域名和第一服务地址，用于所述NRF根据所述第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
  12. 根据权利要求7所述的方法，其特征在于，所述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，所述管理网元根据网络切片标识动态生成，由所述PaaS在NF的镜像中注入的，所述NF的数字证书是所述管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
  13. 根据权利要求7所述的方法，其特征在于，所述NF的管理域名和所述NF的数字证书是在所述NF启动之后配置的。
  14. 一种网络功能仓储功能NRF，其特征在于，包括：
    获取模块，用于与NF建立通信连接后，通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程获取所述NF的数字证书，所述NF的数字证书中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表；
    接收模块，用于接收所述NF发送的查询目标服务的地址的查询请求，所述查询请求中携带目标服务的完整域名，所述目标服务的完整域名为所述目标服务的服务名和所述NF的管理域名组成的域名，或者，所述目标服务的完整域名为所述目标服务的服务名和所述NF查询到的目标服务所在的NF的管理域名组成的域名，所述NF的管理域名包含网络切片标识与网络切片所属的网络的标识；
    验证模块，用于根据所述目标服务的服务名与所述NF的数字证书进行验证，验证通过时向所述NF发送所述目标服务的地址。
  15. 根据权利要求14所述的NRF，其特征在于，所述验证模块用于：
    验证所述目标服务的服务名是否在所述NF的数字证书的扩展字段中携带的所述NF所依赖的服务名列表中，已注册保存的所述目标服务的完整域名对应的数字证书的扩展字段中携带的NF被依赖的服务名列表中是否包含所述NF的服务名。
  16. 根据权利要求14或15所述的NRF，其特征在于，所述接收模块还用于：
    在接收所述NF发送的查询目标服务的地址的查询请求之前，接收所述NF发送的第一服务注册请求，所述第一服务注册请求中包括第一服务的完整域名和第一服务地址，所述第一服务的完整域名为所述NF的服务名和所述NF的管理域名组成的域名；
    所述NRF还包括：
    注册模块，用于根据所述第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
  17. 根据权利要求16所述的NRF，其特征在于，所述注册模块用于：
    验证所述第一服务的完整域名中的所述NF的服务名是否与所述数字证书的扩展字段中携带的所述NF的服务名相同，若是，则注册成功，并保存所述第一服务的完整域名、所述第一服务地址与所述数字证书的扩展字段中携带的所述NF所依赖的服务名列表、所述NF被依赖的服务名列表的对应关系。
  18. 根据权利要求14-17任一项所述的NRF，其特征在于，所述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，所述管理网元根据网络切片标识动态生成，由所述PaaS在NF的镜像中注入的，所述NF的数字证书是所述管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
  19. 根据权利要求14-17任一项所述的NRF，其特征在于，所述NF的管理域名和所述NF的数字证书是在所述NF启动之后配置的。
  20. 一种网络功能NF，其特征在于，包括：
    获取模块，用于获取所述NF的管理域名和所述NF的数字证书，所述NF的数字证书中携带所述NF的服务名、所述NF所依赖的服务名列表和所述NF被依赖的服务名列表，所述NF的管理域名包含网络切片标识与网络切片所属的网络的标识；
    第一发送模块，用于与NRF建立通信连接，并通过安全传输层协议TLS或数据安全传输层协议DTLS双向认证过程向所述NRF发送所述NF的数字证书；
    查询模块，用于向所述NRF发送查询目标服务的地址的查询请求，所述查询请求中携带目标服务的完整域名，所述目标服务的完整域名为所述目标服务的服务名和所述NF的管理域名组成的域名，或者，所述目标服务的完整域名为所述目标服务的服务名和所述NF查询到的所述目标服务所在的NF的管理域名组成的域名，用于所述NRF根据所述目标服务的服务名与所述NF的数字证书进行验证。
  21. 根据权利要求20所述的NF，其特征在于，所述查询模块还用于：
    向所述NRF发送查询所述目标服务的地址的查询请求之前，根据所述目标服务的服务名和所述NF的管理域名组成所述目标服务的完整域名。
  22. 根据权利要求20所述的NF，其特征在于，所述查询模块还用于：
    向所述NRF发送查询所述目标服务的地址的查询请求之前，向管理网元发送查询所述目 标服务所在的NF的管理域名的查询请求，所述查询请求中携带所述目标服务的服务名；
    接收到所述管理网元发送的目标服务所在的NF的管理域名后，根据所述目标服务的服务名和所述目标服务所在的NF的管理域名组成所述目标服务的完整域名。
  23. 根据权利要求20-22任一项所述的NF，其特征在于，还包括：
    接收模块，用于接收所述NRF在验证通过时发送的所述目标服务的地址。
  24. 根据权利要求20-22任一项所述的NF，其特征在于，所述查询模块还用于：
    向所述NRF发送查询所述目标服务的地址的查询请求之前，根据所述NF的服务名和所述NF的管理域名组成第一服务的完整域名，并向所述NRF发送第一服务注册请求，所述第一服务注册请求中包括所述第一服务的完整域名和第一服务地址，用于所述NRF根据所述第一服务的完整域名和所述NF的数字证书的扩展字段中携带的所述NF的服务名进行服务注册。
  25. 根据权利要求20所述的NF，其特征在于，所述NF的管理域名是管理网元请求平台即服务PaaS部署网络切片中的NF的过程中，所述管理网元根据网络切片标识动态生成，由所述PaaS在NF的镜像中注入的，所述NF的数字证书是所述管理网元请求PaaS部署网络切片中的NF的过程中在NF的镜像中注入的。
  26. 根据权利要求20所述的NF，其特征在于，所述NF的管理域名和所述NF的数字证书是在所述NF启动之后配置的。
  27. 一种网络功能仓储功能，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述网络功能仓储功能运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述网络功能仓储功能执行如权利要求1-6任一项所述的网络功能服务的发现方法。
  28. 一种网络功能，包括：处理器和存储器；所述存储器用于存储计算机执行指令，当所述网络功能运行时，所述处理器执行所述存储器存储的该计算机执行指令，以使所述网络功能执行如权利要求7-13任一项所述的网络功能服务的发现方法。
  29. 一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求1-6任一项所述的网络功能服务的发现方法。
  30. 一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行如权利要求7-13任一项所述的网络功能服务的发现方法。
PCT/CN2018/095974 2017-08-08 2018-07-17 网络功能服务的发现方法及设备 WO2019029327A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18844908.6A EP3648432B1 (en) 2017-08-08 2018-07-17 Discovery method and device for network function service
US16/781,251 US11258822B2 (en) 2017-08-08 2020-02-04 Network function service discovery method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710671849.5 2017-08-08
CN201710671849.5A CN109391592B (zh) 2017-08-08 2017-08-08 网络功能服务的发现方法及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/781,251 Continuation US11258822B2 (en) 2017-08-08 2020-02-04 Network function service discovery method and device

Publications (1)

Publication Number Publication Date
WO2019029327A1 true WO2019029327A1 (zh) 2019-02-14

Family

ID=65270823

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/095974 WO2019029327A1 (zh) 2017-08-08 2018-07-17 网络功能服务的发现方法及设备

Country Status (4)

Country Link
US (1) US11258822B2 (zh)
EP (1) EP3648432B1 (zh)
CN (1) CN109391592B (zh)
WO (1) WO2019029327A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110061864A (zh) * 2019-03-26 2019-07-26 网宿科技股份有限公司 一种域名配置自动化验证的方法和系统

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210092103A1 (en) * 2018-10-02 2021-03-25 Arista Networks, Inc. In-line encryption of network data
EP4054241A1 (en) * 2019-03-22 2022-09-07 Ntt Docomo, Inc. Network function database, mobile communication network component, method for selecting a network function and method for registering a network function
JP7412419B2 (ja) * 2019-04-11 2024-01-12 株式会社Ｎｔｔドコモ ネットワークノード
CN111835802B (zh) * 2019-04-18 2021-08-27 大唐移动通信设备有限公司 一种通信方法及装置
US11070476B2 (en) * 2019-04-26 2021-07-20 Intel Corporation Migration from a legacy network appliance to a network function virtualization (NFV) appliance
CN112104468B (zh) * 2019-06-17 2021-12-03 华为技术有限公司 一种管理服务的发现方法及装置
MX2021013986A (es) * 2019-07-17 2022-01-04 Ericsson Telefon Ab L M Tecnica para el manejo de certificados en un dominio de red central.
CN111163473B (zh) * 2020-01-02 2020-11-13 广州爱浦路网络技术有限公司 一种基于nrf权限等级的5g核心网数据防护方法
CN114039874B (zh) * 2020-07-21 2022-08-30 大唐移动通信设备有限公司 一种网络功能的查询方法及装置
WO2022069247A1 (de) * 2020-09-29 2022-04-07 Siemens Aktiengesellschaft Gerät und verfahren zur einrichtung einer dienstbezogenen authentisierung
CN112367666B (zh) * 2020-11-05 2021-08-17 广州爱浦路网络技术有限公司 一种5G核心网中pNF通过NRF认证cNF的方法、装置及系统
CN112671567B (zh) * 2020-12-16 2023-02-21 中盈优创资讯科技有限公司 一种基于服务化接口的5g核心网拓扑发现方法及装置
CN114257440B (zh) * 2021-12-17 2023-12-22 中国电信股份有限公司 网络功能服务发现方法、系统以及存储介质
US12095671B2 (en) * 2022-08-25 2024-09-17 Charter Communications Operating, Llc Apparatus and method for network function signaling latency reduction

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104734955A (zh) * 2013-12-19 2015-06-24 华为技术有限公司 网络功能虚拟化的实现方法、宽带网络网关以及控制装置
WO2016127436A1 (zh) * 2015-02-15 2016-08-18 华为技术有限公司 数据上载的方法、装置及系统
US20160301668A1 (en) * 2015-03-02 2016-10-13 Sprint Communications Company L.P. Border gateway protocol (bgp) communications over trusted network function virtualization (nfv) hardware
US20170012865A1 (en) * 2015-07-09 2017-01-12 Cisco Technology, Inc. Service Bitmask-Based Service Application in Service Function Chaining
CN107005580A (zh) * 2014-11-04 2017-08-01 瑞典爱立信有限公司 网络功能虚拟化服务链接

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100631708B1 (ko) * 2004-06-16 2006-10-09 엘지전자 주식회사 푸쉬 투 토크 서비스를 제공하는 단말기, 푸쉬 투 토크 서비스를 이용한 친구 소개 시스템 및 그 방법
US20180198717A1 (en) * 2014-08-21 2018-07-12 Zte Corporation (China) A smart flow classification method/system for network and service function chaining
US9838272B2 (en) * 2015-04-13 2017-12-05 Ciena Corporation Service enhancement discovery for connectivity traits and virtual network functions in network services
CN106817236B (zh) * 2015-11-30 2020-09-18 华为技术有限公司 虚拟网络功能的配置方法和装置
WO2017143047A1 (en) * 2016-02-16 2017-08-24 Idac Holdings, Inc. Network slicing operation
US10142994B2 (en) * 2016-04-18 2018-11-27 Electronics And Telecommunications Research Institute Communication method and apparatus using network slicing
US10849186B2 (en) * 2017-01-09 2020-11-24 Huawei Technologies Co., Ltd. System and methods for session management
TWI655877B (zh) * 2017-02-06 2019-04-01 財團法人工業技術研究院 用以選擇網路切片的使用者設備註冊方法、及使用此方法的網路控制器與網路通訊系統
CN108632312B (zh) * 2017-03-20 2020-01-17 中国移动通信有限公司研究院 网络功能信息交互方法及装置
JP6698587B2 (ja) * 2017-06-19 2020-05-27 シャープ株式会社 Ｕｅ及びｕｅの通信制御方法
EP3656108B1 (en) * 2017-07-21 2022-03-02 Telefonaktiebolaget LM Ericsson (PUBL) Unstructured data storage function (udsf) services
CN109379206B (zh) * 2017-08-07 2022-04-22 华为技术有限公司 网络功能信息的管理方法及相关设备
CN109586941B (zh) * 2017-09-29 2021-11-26 华为技术有限公司 一种基于服务化架构的业务处理方法及装置
WO2019076801A1 (en) * 2017-10-17 2019-04-25 Telefonaktiebolaget Lm Ericsson (Publ) RECORDING AND DISCOVERING SERVICE IN A COMMUNICATION NETWORK
US20190230556A1 (en) * 2018-01-19 2019-07-25 Electronics And Telecommunications Research Institute Apparatus and method for network function profile management
US11019668B2 (en) * 2018-04-09 2021-05-25 Ofinno, Llc PDU session establishment for cellular IoT

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104734955A (zh) * 2013-12-19 2015-06-24 华为技术有限公司 网络功能虚拟化的实现方法、宽带网络网关以及控制装置
CN107005580A (zh) * 2014-11-04 2017-08-01 瑞典爱立信有限公司 网络功能虚拟化服务链接
WO2016127436A1 (zh) * 2015-02-15 2016-08-18 华为技术有限公司 数据上载的方法、装置及系统
US20160301668A1 (en) * 2015-03-02 2016-10-13 Sprint Communications Company L.P. Border gateway protocol (bgp) communications over trusted network function virtualization (nfv) hardware
US20170012865A1 (en) * 2015-07-09 2017-01-12 Cisco Technology, Inc. Service Bitmask-Based Service Application in Service Function Chaining

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
"Technical Specification Group Service and System Aspects; Telecommunication management; Study on network manage- ment of virtualized networks(Release 13", 3GPP TR 32. 842, 31 March 2015 (2015-03-31), XP055574852 *
See also references of EP3648432A4
ZHANG H ET AL : "Service Chain Header; draft-zhang-sfc-sch-03", INTERNET -DRAFT, 23 December 2014 (2014-12-23), XP015103723 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110061864A (zh) * 2019-03-26 2019-07-26 网宿科技股份有限公司 一种域名配置自动化验证的方法和系统
CN110061864B (zh) * 2019-03-26 2022-07-26 网宿科技股份有限公司 一种域名配置自动化验证的方法和系统

Also Published As

Publication number Publication date
US20200177632A1 (en) 2020-06-04
EP3648432B1 (en) 2021-09-08
CN109391592B (zh) 2021-12-24
CN109391592A (zh) 2019-02-26
EP3648432A4 (en) 2020-05-27
EP3648432A1 (en) 2020-05-06
US11258822B2 (en) 2022-02-22

Similar Documents

Publication Publication Date Title
WO2019029327A1 (zh) 网络功能服务的发现方法及设备
EP3804282B1 (en) Native blockchain platform for improving workload mobility in telecommunication networks
US11258667B2 (en) Network management method and related device
JP6834033B2 (ja) ネットワークスライス管理方法、ユニット、及びシステム
EP3512233B1 (en) Method for managing network slice and management unit
WO2022033121A1 (zh) 一种kubernetes中资源暴露方法、系统、设备以及介质
EP3723325B1 (en) Network service management method, related device and system
CN114025021B (zh) 一种跨Kubernetes集群的通信方法、系统、介质和电子设备
WO2018000394A1 (zh) 网络资源的编排方法和设备
WO2017066931A1 (zh) 网络功能虚拟化架构中证书的管理方法及装置
WO2016070609A1 (zh) 实现vnf实例化的方法、系统及nfvo和vnfm
US20210097476A1 (en) Container Management Method, Apparatus, and Device
WO2019057015A1 (zh) 一种网络切片管理方法及装置
KR20230069088A (ko) 컨테이너 클러스터 관리 방법 및 그 시스템
US20190028880A1 (en) Method for accessing context data by network service component, apparatus, and system
WO2015117278A1 (zh) 时钟中断信号的获取方法和nfv功能实体
AU2020470364B2 (en) Method and apparatus for establishing secure communication
JP6445715B2 (ja) Ｖｎｆｍ間のインターフェースを確立するための方法及び装置、並びにシステム
CN115134800A (zh) 5g专网接入方法、专网网关、5gc系统以及存储介质
WO2023216856A1 (zh) 业务管理方法和装置
WO2018120222A1 (zh) 一种管理vnffg的方法、装置和系统
US20240364681A1 (en) Method for Processing Cloud Service in Cloud System and Related Apparatus
JP7450072B2 (ja) 仮想化ネットワーク・サービス配備方法及び装置
WO2023202412A1 (zh) 一种通信方法及装置
EP4340297A1 (en) Service function authorization

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18844908

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018844908

Country of ref document: EP

Effective date: 20200131