WO2019071472A1 - 一种业务策略创建方法及装置 - Google Patents

一种业务策略创建方法及装置 Download PDF

Info

Publication number
WO2019071472A1
WO2019071472A1 PCT/CN2017/105728 CN2017105728W WO2019071472A1 WO 2019071472 A1 WO2019071472 A1 WO 2019071472A1 CN 2017105728 W CN2017105728 W CN 2017105728W WO 2019071472 A1 WO2019071472 A1 WO 2019071472A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
service policy
network element
key
authentication
Prior art date
Application number
PCT/CN2017/105728
Other languages
English (en)
French (fr)
Inventor
周汉
夏渊
胡翔
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/105728 priority Critical patent/WO2019071472A1/zh
Priority to CN201880066694.5A priority patent/CN111226452B/zh
Priority to PCT/CN2018/076836 priority patent/WO2019071901A1/zh
Publication of WO2019071472A1 publication Critical patent/WO2019071472A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a method and an apparatus for creating a service policy.
  • an application in the terminal device can initiate a business policy creation process to the network.
  • the data plane device such as the gateway device
  • the gateway device performs corresponding detection, accounting, and control policies on the service flow of the APP according to the service policy.
  • the service policy is abused.
  • the first service of the application A in the terminal device corresponds to the service policy A
  • the second service of the application B corresponds to the service policy B. If the application B obtains the service identifier of the first service of the application A in an illegal manner, and provides the service identifier of the first service to the network side for the policy installation in the process of creating the policy, the network side is the application.
  • the second service of B is associated with the service identifier of the service of the first service, and is charged according to the charging policy corresponding to the service policy A, so that the service policy is abused.
  • the purpose of the embodiments of the present application is to provide a method and a device for creating a service policy, which are used to solve the problem that a service policy is abused in a process in which a terminal device initiates a service policy creation process.
  • the embodiment of the present application provides a method for creating a service policy, including:
  • the SMF network element obtains the service identifier and the service policy installation authentication parameter from the terminal device, and sends the service identifier and the service policy installation authentication parameter to the service policy authentication network element; the service identifier and the service policy installation
  • the authentication parameter is used to initiate a business policy creation or a business policy update.
  • the SMF network element sends a temporary label and a key indication information to the terminal device, where the temporary label is used to identify a data packet corresponding to the service identifier, and the key indication information is used to indicate a service policy execution key.
  • the service policy execution key is used to verify the temporary label; the temporary label and the key indication information are that the service policy authentication network element performs authentication on the service policy according to the service identifier. After the parameter authentication succeeds, it is generated by the SMF network element or generated by the service policy authentication network element.
  • the terminal device before transmitting the data packet corresponding to the service identifier, the terminal device needs to send the service identifier and the service policy installation authentication parameter to the SMF network element, and determine the service identifier sent by the terminal device in the SMF network element and After the service policy is successfully authenticated, the temporary label and the key indication information are sent to the terminal device, and the terminal device can send the data packet according to the temporary label and the key indication information.
  • the terminal device initiates the service policy creation process, the authentication needs to be performed, so that the service policy corresponding to the service identifier sent by the terminal device can be prevented from being sent by other terminal devices, thereby providing security of the service policy.
  • the method further includes:
  • the service policy is used to control a data packet corresponding to the service identifier.
  • the method further includes:
  • the SMF network element sends the service policy, the temporary label, and the key indication information to a UPF network element.
  • the SMF network element sends the service policy, the temporary label, and the key indication information to the UPF network element, and the UPF network element can identify the terminal device according to the temporary label and the key indication information.
  • the data packet can be used to control the data packet according to the service policy after the data packet is identified.
  • the key indication information is sent to the SMF network element after the service policy authentication network element successfully authenticates the service policy installation authentication parameter according to the service identifier.
  • the key indication information is that the SMF network element is allocated for the service corresponding to the service identifier.
  • the key indication information is a key parameter for generating the service policy execution key; or the key indication information is the service policy execution key.
  • the temporary label is sent by the service policy authentication network element to the SMF network element after the authentication of the service policy is successfully performed according to the service identifier.
  • the temporary label is allocated by the SMF network element for the service corresponding to the service identifier.
  • the method further includes:
  • the SMF network element sends check variable indication information to the terminal device, where the check variable indication information indicates a check variable for verifying the temporary label.
  • the check variable indication information is sent after performing key encryption by using the service policy.
  • the embodiment of the present application provides a service policy creation apparatus, where the service policy creation apparatus includes a memory, a communication interface, and a processor, where: the memory is used to store an instruction; the processor is configured to execute an instruction stored in the memory, and The control communication interface performs signal reception and signal transmission, and when the processor executes the instruction stored in the memory, the service policy creation means is configured to perform the method in any one of the above first aspect or the first aspect.
  • the embodiment of the present application provides a service policy creation apparatus, which is used to implement any one of the foregoing first aspect or the first aspect, including a corresponding function module, for example, including a processing unit, a receiving unit, and a sending unit. Etc., respectively, are used to implement the steps in the above method.
  • the embodiment of the present application provides a method for creating a service policy, including:
  • the terminal device sends a service identifier and a service policy installation authentication parameter to the session management function SMF network element; the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update;
  • the terminal device receives the temporary label and the key indication information from the SMF network element, where the key indication information is used to indicate a service policy execution key; the temporary label and the key indication information are service policy authentication network elements. After the authentication of the service policy is successfully authenticated by the service identifier, generated by the SMF network element or generated by the service policy authentication network element;
  • the temporary tag is generated after verification.
  • the terminal device before transmitting the data packet corresponding to the service identifier, the terminal device needs to send the service identifier and the service policy installation authentication parameter to the SMF network element, and determine the service identifier sent by the terminal device in the SMF network element and After the service policy is successfully authenticated, the terminal device can receive the temporary label and the key indication information sent by the SMF network element, and the terminal device can send the data packet according to the temporary label and the key indication information.
  • the terminal device initiates the service policy creation process, the authentication needs to be performed, so that the service policy corresponding to the service identifier sent by the terminal device can be prevented from being sent by other terminal devices, thereby providing security of the service policy.
  • the key indication information is sent to the SMF network element after the service policy authentication network element successfully authenticates the service policy installation authentication parameter according to the service identifier.
  • the key indication information is that the SMF network element is allocated for the service corresponding to the service identifier.
  • the method before the terminal device sends the service identifier and the service policy installation authentication parameter to the session management function SMF network element, the method further includes:
  • the terminal device acquires the service identifier and the business policy installation derivative key corresponding to the service identifier from the application server;
  • the terminal device determines the service policy installation authentication parameter according to the service identifier and the service policy installation derivative key.
  • the method further includes:
  • the terminal device receives check variable indication information from the SMF network element, and the check variable indication information indicates a check variable for verifying the temporary tag.
  • the embodiment of the present application provides a service policy creation apparatus, where the service policy creation apparatus includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to execute an instruction stored in the memory, and The control transceiver performs signal reception and signal transmission, and the service policy creation means is configured to perform the method in any of the possible aspects of the fourth aspect or the fourth aspect described above when the processor executes the instruction of the memory storage.
  • the embodiment of the present application provides a service policy creation apparatus, which is used to implement any one of the foregoing fourth or fourth aspects, including a corresponding function module, for example, including a processing unit, a receiving unit, and a sending unit. Etc., respectively, are used to implement the steps in the above method.
  • the embodiment of the present application provides a method for creating a service policy, including:
  • the service policy authentication network element receives the service identifier sent by the session management function SMF network element and the service policy installation authentication parameter; the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update; The service identifier and the service policy installation authentication parameter are sent by the terminal to the SMF network element;
  • the service policy authentication network element performs authentication on the service policy installation authentication parameter according to the service identifier, and sends the service policy corresponding to the service identifier to the SMF network element after the authentication is passed.
  • the SMF network element sends at least one of a service policy, a temporary label, and a key indication information corresponding to the service identifier; the temporary label is used to identify a data packet corresponding to the service identifier, and the service policy is performed confidentially.
  • the key is used to check the temporary label; the service policy is used to control a data packet corresponding to the service identifier.
  • the terminal device before transmitting the data packet corresponding to the service identifier, the terminal device needs to send the service identifier and the service policy installation authentication parameter to the SMF network element, and send the service policy authentication network element to the terminal device. After the service identifier and the service policy installation authentication parameter are successfully authenticated, the terminal device can receive the temporary label and the key indication information sent by the SMF network element, and the terminal device can then send the data packet according to the temporary label and the key indication information.
  • the terminal device initiates the service policy creation process, the authentication needs to be performed, so that the service policy corresponding to the service identifier sent by the terminal device can be prevented from being sent by other terminal devices, thereby providing security of the service policy.
  • the service policy authentication network element performs the service policy according to the service identifier.
  • Install authentication parameters for authentication including:
  • the service policy authentication network element installs a derivative key according to the service policy installation key generation service policy, and installs a derivative key according to the service policy to authenticate the service policy installation derivative key.
  • the service policy authentication network element performs authentication on the service policy installation authentication parameter according to the service identifier, including:
  • the service policy authentication network element authenticates the service policy installation authentication parameter according to the service identifier by using the AUSF network element.
  • the embodiment of the present application provides a service policy creation apparatus, where the service policy creation apparatus includes a memory, a communication interface, and a processor, where: the memory is used to store an instruction; the processor is configured to execute an instruction stored in the memory, and The control communication interface performs signal reception and signal transmission, and the service policy creation means is configured to perform the method in any of the possible aspects of the fourth aspect or the fourth aspect described above when the processor executes the instruction stored in the memory.
  • the ninth aspect provides a service policy creation apparatus, which is used to implement any one of the foregoing fourth or fourth aspects, including a corresponding function module, for example, including a processing unit, a receiving unit, and a sending unit. Etc., respectively, are used to implement the steps in the above method.
  • the embodiment of the present application provides a computer readable storage medium, where the computer storage medium stores computer readable instructions, and when the computer reads and executes the computer readable instructions, causes the computer to perform any of the foregoing Aspect or any of the possible methods in any of the aspects.
  • the embodiment of the present application provides a computer program product, when the computer reads and executes the computer program product, causing the computer to perform any of the above aspects or any of the possible methods in any of the aspects. .
  • the embodiment of the present application provides a chip, where the chip is connected to a memory, for reading and executing a software program stored in the memory, to implement any one of the foregoing aspects or any one of the foregoing aspects. Possible methods in design.
  • FIG. 1 is a schematic diagram of a system architecture applicable to an embodiment of the present application
  • FIG. 2 is a schematic diagram of a key relationship provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a method for creating a service policy according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a method for creating a service policy according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a service policy creation apparatus according to an embodiment of the present disclosure.
  • FIG. 1 is a schematic diagram showing a system architecture applicable to the embodiment of the present application.
  • the terminal device 101 can communicate with the core network via the access network element 102, and the terminal device can Refers to User Equipment (UE), access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent or user equipment.
  • the access terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), with wireless communication.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • FIG. 1 Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminals in future 5G networks, and the like.
  • FIG. 1 for convenience of description, only one terminal is illustrated. In an actual network, multiple terminals may coexist, and details are not described herein again.
  • An access network (AN) network element 102 which may also be referred to as a radio access network (RAN) network element, is hereinafter referred to as an access network element or AN, and is mainly responsible for
  • the terminal device 101 is provided with a wireless connection to ensure reliable transmission of uplink and downlink data of the terminal device 101 and the like.
  • the access network element 102 can be a gNB (generation Node B) in a 5G system, and can be a Global System of Mobile communication (GSM) system or a base station in Code Division Multiple Access (CDMA).
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • BTS Base Transceiver Station
  • NodeB NodeB
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • An evolved base station (Evolutional Node B, eNB or eNodeB), and the like.
  • the Session Management Function (SMF) network element 103 can be used to perform part of the functions of the Mobility Management Entity (MME) in the LTE system, and is mainly responsible for establishing a session, a management session, and the like for the terminal device 101.
  • MME Mobility Management Entity
  • UPF User Plane Function
  • the UPF network element 104 is a functional network element of the user plane of the terminal device 101.
  • the main functions include packet routing and forwarding, and quality of service (QoS) processing of user plane data.
  • QoS quality of service
  • Access and Mobility Management Function network element 105, whose main functions include the endpoint of the radio access network control plane, the endpoint of non-access signaling, mobility management, lawful interception, and access Authorization or authentication, etc.
  • the Policy Control Funnel (PCF) network element 106 is mainly responsible for the establishment, release, and modification of the user plane transmission path.
  • the Authentication Server Function (AUSF) network element 107 whose main functions include user authentication and the like.
  • the service policy root key is a key configured by the network side for the terminal device, and may also be referred to as an authentication key.
  • the service subscription key is generated by the service policy root key.
  • the OTT identifier and the service policy root key may be hashed to obtain the service subscription key.
  • the service subscription parameters are generated by the service subscription key.
  • the business policy installation key is generated by the business policy root key.
  • the business policy installation derived key is generated by the business policy installation key.
  • the business policy installation authentication parameter is generated by installing a derived key through the business policy.
  • the business policy execution key is generated by the business policy installation key, or it can be generated by other means.
  • FIG. 3 a schematic flowchart of a method for creating a service policy according to an embodiment of the present application is shown. Referring to Figure 3, the method includes:
  • Step 301 The terminal device sends a service identifier and a service policy installation authentication parameter to the SMF network element.
  • the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update.
  • the granularity of the data packet identified by the service identifier may be a service granularity, for example, a data packet that identifies a certain service provided by an APP, and the APP may be a WeChat program or an Alipay program.
  • the granularity of the data packet identified by the service identifier may also be the user granularity, for example, a data packet that identifies a user or a group of users to access a certain service.
  • the service identifier can correspond to a service policy, and the network side can perform a corresponding detection, charging, and control policy on the data packet by using the service policy corresponding to the service identifier according to the service identifier in the data packet.
  • the service identifier may also identify a data packet of a user or a group of users at the user level, and the network side may adopt the service identifier according to the data packet in the data packet.
  • the service policy corresponding to the service identifier performs a corresponding detection, charging, and control policy on the data packet of a user or a group of users.
  • Step 302 The SMF network element obtains the service identifier and the service policy installation authentication parameter from the terminal device, and sends the service identifier and the service policy installation authentication parameter to the service policy authentication network element.
  • the function of the service policy authentication network element may be implemented by the PCF network element, or may be implemented by the AUSF network element, and may be implemented by any other network element, which is not limited in the embodiment of the present invention.
  • the service policy authentication network element is a logical function inside the PCF or AUSF network element.
  • Step 303 The service policy authentication network element receives the service identifier sent by the SMF network element and the service policy installation authentication parameter.
  • the service identifier and the service policy installation authentication parameter are sent by the terminal to the SMF network element.
  • Step 304 The service policy authentication network element performs authentication on the service policy installation authentication parameter according to the service identifier, and sends the service corresponding to the service identifier to the SMF network element after the authentication is passed. At least one of a policy, a temporary tag, and a key indication information.
  • the temporary label or the key indication information may be generated by the SMF network element.
  • the temporary label is used to identify a data packet corresponding to the service identifier, and the service policy execution key indicated by the key indication information is used to check the temporary label; the service policy is used to control the service identifier. Corresponding data message.
  • Step 305 The SMF network element sends the temporary label and the key indication information to the terminal device.
  • the key indication information is used to indicate a service policy execution key; the temporary label is used to identify a data packet corresponding to the service identifier, and the service policy execution key is used to verify the temporary label;
  • the temporary label and the key indication information are generated by the SMF network element or the service policy after the service policy authentication network element successfully authenticates the authentication parameter for the service policy according to the service identifier.
  • the weight of the network element is generated.
  • Step 306 The terminal device receives the temporary label and the key indication information from the SMF network element, and sends the data packet corresponding to the service identifier, where the data packet includes the temporary label and the verification parameter.
  • the verification parameter is generated after the terminal device performs verification on the temporary label according to the service policy execution key.
  • the terminal device Before the step 301, the terminal device needs to obtain the service identifier and the service policy corresponding to the service identifier, and the derivation key is obtained by using the application server (AS), and the application server needs to provide the service identifier.
  • AS application server
  • Business application server
  • the application server may obtain a service policy root key that is allocated by the network operator that provides the service to the terminal device. For details, refer to the description in the prior art, and details are not described herein.
  • the service contract key can be generated according to the service policy root key.
  • the application server is based on the Over The Top (OTT) identifier (OTT refers to the application server providing the user through the Internet).
  • OTT Over The Top
  • an OTT may include multiple services, a random number generated by an application server, and a service policy root key, perform a hash (HASH) operation, and use the hash operation result as the service subscription key, of course, application
  • the server may also generate a service subscription key by using other algorithms, which is not limited in this embodiment of the present application.
  • the service subscription authentication parameter may also be determined according to the service subscription key and the OTT identifier. For example, the application server hashes the service subscription key and the OTT identifier, and uses the hash operation result as the service subscription authentication parameter.
  • the application server may initiate a service policy subscription message to the Network Exposure Function (NEF) network element, where the service policy subscription message includes the requested service policy, the OTT identifier, the random number, and the like.
  • the service policy subscription message may further include a service identifier and the service subscription authentication parameter.
  • the service subscription authentication parameter is determined according to the service subscription key
  • the service subscription key is determined according to the service policy root key.
  • the service identifier may be pre-configured by the service policy authentication network element in the application server.
  • the NEF network element After receiving the service policy subscription message sent by the application server, the NEF network element forwards the service policy subscription message to the service policy authentication network element.
  • the service policy authentication network element may generate a service policy installation key according to the service policy root key. For example, the service policy authentication network element may perform a hash calculation on the service policy root key and the service identifier (including the service identifier in the service policy subscription message) to obtain the service policy installation key, and of course, the service policy The right network element can also generate a service policy installation key according to other methods, and will not be exemplified one by one. Further, the service policy authentication network element may also store the service policy installation key and establish a correspondence between the service identifier and the service policy installation key.
  • the service policy authentication parameter may be verified, and the service policy installation key is generated after the verification verification is passed.
  • the specific verification process may be as follows: the service policy authentication network element generates a service subscription key according to the received OTT identifier, the random number, and the service policy root key.
  • the algorithm for generating the service subscription key by the service policy authentication network element is the same as the algorithm for generating the service subscription key by the application server, and is an algorithm pre-agreed with the application server.
  • the service policy authentication network element further generates an expected service subscription authentication parameter according to the service subscription key, and the service policy authentication network element determines the expected service subscription certificate. If the weight parameter is the same as the received service subscription authentication parameter, it is determined that the service subscription authentication parameter is verified; if it is determined that the expected service subscription authentication parameter is different from the received service subscription authentication parameter, the service is determined. The subscription authentication parameter verification failed.
  • the service policy authentication network element when the service policy authentication network element is a PCF network element, the service policy authentication network element may independently verify the service subscription authentication parameter, or may forward the service policy subscription message to The AUSF network element is verified by the AUSF network element for the service subscription authentication parameter.
  • the service policy authentication network element checks the service subscription authentication parameter by the AUSF network element, the AUSF network element returns a verification result to the service policy authentication network element, and the service policy authentication network element can be returned according to the AUSF network element.
  • the verification result determines whether the service subscription authentication parameter is verified.
  • the AUSF network element After the AUSF network element determines that the service subscription authentication parameter is verified, the AUSF network element can also generate a service policy installation key and establish a correspondence between the service identifier and the service policy installation key. Optionally, the AUSF network element may further send the service policy installation key to the service policy authentication network element.
  • the service policy authentication network element After the service policy authentication network element generates the service policy installation key, it can also authorize the service policy requested by the application server.
  • the service policy authentication network may also allocate a service identifier to the service policy requested by the application server when the service policy subscription message does not include the service identifier.
  • the service contract response message is sent to the application server, and the policy subscription response message indicates information such as the authorization result of the service policy requested by the application server.
  • the policy signing response message may further include a service identifier.
  • the application server may generate a service policy installation key in the same manner as the service policy authentication network element according to the service subscription key and the service identifier.
  • the service identifier of the requested service is sent to the terminal device when the service request (for example, the service registration request) is sent by the terminal device, and the service policy corresponding to the service identifier is installed. Derived key.
  • the terminal device needs to be attached to the network before the service request is sent, and a process such as a Transmission Control Protocol (TCP) connection is established with the application server, and details are not described herein.
  • TCP Transmission Control Protocol
  • the terminal device may determine the service policy installation authentication parameter according to the service identifier and the service policy installation derivative key. Specifically, the terminal device may perform a hash calculation on the service identifier and the service policy installation derivation key, and use the result of the hash calculation as the service policy to install the authentication parameter. Of course, the terminal device may also generate the service policy installation authentication according to other methods. The parameters are not illustrated here one by one.
  • the terminal device may send the service identifier and the service policy installation authentication parameter to the SMF network element by using the service policy request message.
  • the service policy request message may be a service policy creation request message, or a service policy enable request message, or a service policy update request message, etc., which is not limited by the embodiment of the present application.
  • the terminal device may carry the service policy request message by using a non-access stratum (NAS) message, and the specific process is not described herein.
  • NAS non-access stratum
  • the SMF network element may obtain the service identifier and the service policy installation authentication parameter by using the service policy request message sent by the terminal device, and send the service identifier and the service policy to the service policy authentication network element. Install authentication parameters.
  • the service policy authentication network element determines a service policy installation key corresponding to the service identifier according to the service identifier, and then generates a service policy to install the derivative key according to the service policy installation key and the service identifier.
  • the manner in which the service policy authentication network element generates the service policy to install the derived key is the same as the method in which the terminal device generates the service policy to install the derived key, and details are not described herein again.
  • the service policy authentication network element After the service policy authentication network element generates the service policy and installs the derived key, the same method as the terminal device is used.
  • the service policy is configured to generate a desired service policy to install the authentication parameter, and if the desired service policy installation authentication parameter is determined, and the service policy installation authentication parameter received from the SMF network element is the same, the service policy installation may be determined.
  • the authentication parameter authentication is passed, otherwise the authentication of the service policy installation authentication parameter is determined to have failed.
  • the service policy authentication network element when the service policy authentication network element is a PCF network element, the service policy authentication network element can independently authenticate the service policy installation authentication parameter, and can also forward the service policy subscription message.
  • the AUSF network element is configured to authenticate the service policy installation authentication parameter according to the service identifier by using the AUSF network element.
  • the service policy authentication network element authenticates the service policy installation authentication parameter by the AUSF network element
  • the AUSF network element returns the authentication result to the service policy authentication network element, and the service policy authentication network element can be returned according to the AUSF network element.
  • the authentication result determines whether the authentication policy of the service policy installation is passed.
  • the service policy authentication network element After the service policy authentication network element determines that the service policy installation authentication parameter is authenticated, the service policy is allocated for the service corresponding to the service identifier.
  • the service policy authentication network element may further allocate a temporary label to the service corresponding to the service identifier, so that the temporary label identifies the data packet corresponding to the service identifier; the service policy authentication network element may also be The service corresponding to the service identifier generates a service policy execution key.
  • the service policy authentication network element may perform a hash calculation on the service policy installation key and the key parameter, and use the calculation result as a business policy execution key.
  • the key parameter may be a random number or the like, which is not limited by the embodiment of the present application, and may be agreed according to actual conditions.
  • the service policy authentication network element is a PCF network element
  • the service policy authentication network element authenticates the service policy installation authentication parameter by using the AUSF network element
  • the service policy execution key and the temporary label may also be AUSF.
  • the network element is allocated and sent to the service policy authentication network element.
  • the service policy may be sent to the SMF network element, and at least one of the temporary label and the key indication information may also be sent.
  • the key indication information may be a key parameter for generating the service policy execution key, or may be a key for the business policy execution.
  • the key indication information may also be allocated by the SMF network element for the service corresponding to the service identifier.
  • the temporary label may be sent to the SMF network element after the service policy authentication network element successfully authenticates the authentication parameter for the service policy according to the service identifier; or, the temporary The label may also be allocated for the service corresponding to the service identifier by the SMF network element.
  • the SMF network element may also send the service policy, the temporary label, and the key indication information to the UPF network element, and the UPF network element may execute the key according to the service policy indicated by the key indication information, and the school information in the data packet sent by the terminal device
  • the parameter is verified, and the data packet corresponding to the service identifier is determined according to the temporary label, and the data packet corresponding to the service service identifier is controlled according to the service policy.
  • the terminal may determine the service policy execution key according to the key indication information. For example, when the key indication information is the service policy execution key, the terminal device may directly The key indication information is used as the service policy execution key. When the key indication information is the key parameter, the terminal device may generate a service policy execution key according to the key parameter, and the method for generating the service policy execution key may be the SMF network element or The pre-agreed method of the service policy authentication network element is not described here.
  • the terminal device may generate a verification parameter according to the service policy execution key, the service variable, and the temporary label. For example, the terminal device may perform a hash calculation on the service policy execution key, the check variable, and the temporary label, and use the calculation result as the check parameter.
  • the check variable may be a quintuple of the data message or a part of the quintuple.
  • the check variable may be pre-agreed, or may be indicated by the check variable indication information sent by the SMF network element to the terminal device, for example, the check variable indication information may indicate that the check variable is a transmit datagram.
  • IP Internet Protocol Address
  • the check variable indication information may be sent to the terminal device by the SMF network element after performing key encryption by using the service policy.
  • the terminal device encapsulates the verification parameter and the temporary label in the data packet or the outer layer of the data packet, and then sends the data packet to the UPF network element.
  • the UPF network element After receiving the data packet, the UPF network element performs the verification of the key verification parameter according to the service policy indicated by the key indication information sent by the SMF network element. Specifically, the UPF network element can send the key according to the SMF network element.
  • the service policy execution key indicated by the indication information, the temporary label in the data packet, and the check variable are generated according to the same method of the terminal device, and the desired calibration parameter is generated, and if the desired calibration parameter and the data packet are determined, If the parameters are the same, you can confirm that the verification is successful, otherwise you can determine that the verification failed.
  • the UPF network element After the verification of the verification parameters is successful, the UPF network element performs service control on the data packet according to the service policy, and removes the temporary label and the verification parameter encapsulated in the data packet, and sends the data packet with the above parameters to the application. server.
  • FIG. 4 is a schematic diagram of a data packet transmission process provided by an embodiment of the present application.
  • Step 401 The terminal device sends a service request to the application server, where the service request is used to request service registration.
  • Step 402 After receiving the service request, the application server sends a service request response to the terminal device.
  • the service request response includes a service identifier of the service requested by the terminal device, and a service policy installation derivative key corresponding to the service identifier.
  • Step 403 After receiving the service request response, the terminal device determines the service policy installation authentication parameter according to the service identifier in the service request response and the service policy installation derivative key.
  • Step 404 The terminal device sends a service policy request message to the SMF network element.
  • the service policy request message includes a service identifier and a service policy installation authentication parameter, and the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation installation or a service policy update.
  • Step 405 After receiving the service policy request message, the SMF network element sends the service identifier and the service policy installation authentication parameter in the service policy request message to the service policy authentication network element.
  • Step 406 After receiving the service identifier and the service policy installation authentication parameter, the service policy authentication network element authenticates the service policy installation authentication parameter according to the service identifier, and the service corresponding to the service identifier after the authentication is passed. Assign business strategies.
  • the device when the service policy authentication network element determines that the service policy installation authentication parameter authentication fails, the device sends a reject message to the SMF network element, where the reject message is used to reject the request of the terminal device.
  • the SMF network element forwards the received reject message to the terminal device.
  • Step 407 The service policy authentication network element sends the service policy to the SMF network element.
  • the service policy authentication network element may further send at least one of a temporary label and a key indication information to the SMF network element.
  • Step 408 After receiving the service policy, the SMF network element sends the service policy, the temporary label, and the key indication information to the UPF network element.
  • the temporary label may be sent to the SMF network element by the service policy authentication network element, or may be allocated by the SMF network element for the service corresponding to the service identifier; the key indication information may be The service policy authentication network element is sent to the SMF network element, and the SMF network element may also be allocated for the service corresponding to the service identifier.
  • Step 409 The SMF network element sends the temporary label and the key indication information to the terminal device.
  • Step 410 The terminal device generates a verification parameter according to the service policy execution key, the service variable, and the temporary label.
  • Step 411 The terminal device encapsulates the verification parameter and the temporary label in the data packet or the outer layer of the data packet, and then sends the data packet to the UPF network element.
  • Step 412 After receiving the data packet, the UPF network element performs verification on the service policy execution key verification parameter indicated by the key indication information sent by the SMF network element, and after verifying the verification parameter successfully, according to The service policy performs service control on the data packet, and removes the temporary label and the check parameter encapsulated in the data packet, and sends the data packet that removes the parameter to the application server.
  • the service policy creation apparatus may be used to perform the action of the SMF network element in the foregoing method embodiments.
  • the service policy creation apparatus 500 includes:
  • the receiving unit 501 is configured to acquire a service identifier and a service policy installation authentication parameter from the terminal device, and send the service identifier and the service policy installation authentication parameter to the service policy authentication network element; the service identifier and the The service policy installation authentication parameter is used to initiate a business policy creation or a business policy update.
  • the sending unit 501 is configured to send the temporary label and the key indication information to the terminal device, where the temporary label is used to identify a data packet corresponding to the service identifier, where the key indication information is used to indicate that the service policy is executed.
  • a key the service policy execution key is used to check the temporary label; the temporary label and the key indication information are used by the service policy authentication network element to install the service policy according to the service identifier. After the weight parameter is successfully authenticated, it is generated by the device or generated by the service policy authentication network element.
  • the receiving unit 501 is further configured to:
  • the sending unit 502 is further configured to:
  • the key indication information is sent by the service policy authentication network element to the device after the authentication of the service policy is successfully performed according to the service identifier.
  • the key indication information is allocated by the device to a service corresponding to the service identifier.
  • the key indication information is a key parameter for generating the service policy execution key; or the key indication information is the service policy execution key.
  • the temporary label is sent to the device after the service policy authentication network element successfully authenticates the service policy installation authentication parameter according to the service identifier; or The temporary label is allocated by the device for the service corresponding to the service identifier.
  • the sending unit 502 is further configured to:
  • Checking variable indication information is sent to the terminal device, the check variable indicating information indicating a check variable for verifying the temporary tag.
  • the check variable indication information is sent after performing key encryption by using the service policy.
  • the service policy creation apparatus may be used to perform the action of the terminal device in the foregoing method embodiments.
  • the service policy creation apparatus 600 includes:
  • the transceiver unit 601 is configured to send a service identifier and a service policy installation authentication parameter to the session management function SMF network element.
  • the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update;
  • the transceiver unit 601 is configured to receive temporary label and key indication information from the SMF network element, where the key indication information is used to indicate a service policy execution key; the temporary label and the key indication information are service policies. After the authenticating network element successfully authenticates the authentication parameter of the service policy according to the service identifier, the authentication network element generates the generated by the SMF network element or the service policy authentication network element;
  • the processing unit 602 is configured to generate a check parameter after verifying the temporary label according to the service policy execution key.
  • the transceiver unit 601 is configured to send a data packet corresponding to the service identifier, where the data packet includes the temporary label and the verification parameter.
  • the key indication information is sent to the SMF network element after the service policy authentication network element successfully authenticates the service policy installation authentication parameter according to the service identifier.
  • the key indication information is that the SMF network element is allocated for the service corresponding to the service identifier.
  • the transceiver unit 601 before the sending the service identifier and the service policy installation authentication parameter to the session management function SMF network element, the transceiver unit 601 is further configured to:
  • the processing unit 602 is configured to determine the service policy installation authentication parameter according to the service identifier and the service policy installation derivative key.
  • the transceiver unit 601 is further configured to:
  • Checking variable indication information is received from the SMF network element, the check variable indicating information indicating a check variable for verifying the temporary tag.
  • the embodiment of the present application provides a structure diagram of a service policy creation apparatus, where the service policy creation apparatus can be used to perform the action of the service policy authentication network element in the foregoing method embodiments, and the service policy creation apparatus 700 includes:
  • the transceiver unit 701 is configured to receive a service identifier sent by the session management function SMF network element and a service policy installation authentication parameter; the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update; The service identifier and the service policy installation authentication parameter are sent by the terminal to the SMF network element;
  • the processing unit 702 is configured to perform authentication on the service policy installation authentication parameter according to the service identifier.
  • the transceiver unit 701 is configured to: after the authentication is passed, send the service policy corresponding to the service identifier to the SMF network element, and send the service policy, temporary label, and key corresponding to the service identifier to the SMF network element. At least one of the indication information; the temporary label is used to identify a data packet corresponding to the service identifier, the service policy execution key is used to verify the temporary label; and the service policy is used to control the The data packet corresponding to the service identifier.
  • processing unit 702 is specifically configured to:
  • processing unit 702 is specifically configured to:
  • the service policy installation authentication parameter is authenticated by the AUSF network element according to the service identifier.
  • FIG. 8 a schematic diagram of a structure of a service policy creation apparatus is provided in the embodiment of the present application.
  • the service policy creation apparatus may be used to perform an action of an SMF network element in each of the foregoing method embodiments.
  • the service policy creation device 800 includes a processor 801, a communication interface 802, and a memory 803.
  • the processor 801, the communication interface 802, and the memory 803 are connected to each other through a bus 804.
  • the processor 801 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 801 may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 803 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory.
  • RAM random-access memory
  • the memory may also include a non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid-state drive
  • the communication interface 802 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a Wireless Local Area Networks (WLAN) interface.
  • WLAN Wireless Local Area Networks
  • the bus 804 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one double-headed arrow is shown in Figure 8, but it does not mean that there is only one bus or one type of bus.
  • the memory 803 can be used to store program instructions, and the processor 801 calls the program instructions stored in the memory 803 to perform the following steps:
  • the installation authentication parameter is used to initiate a business policy creation or a business policy update.
  • the temporary label and the key indication information Transmitting, by the communication interface 802, the temporary label and the key indication information to the terminal device, where the temporary label is used to identify a data packet corresponding to the service identifier, where the key indication information is used to indicate a service policy execution key.
  • the service policy execution key is used to check the temporary label; the temporary label and the key indication information are that the service policy authentication network element installs an authentication parameter for the service policy according to the service identifier. After the authentication succeeds, the device generates or generates the service policy authentication network element.
  • the processor 801 is further configured to:
  • the processor 801 is further configured to:
  • the service policy, the temporary label, and the key indication information are sent to the UPF network element through the communication interface 802.
  • the key indication information is sent by the service policy authentication network element to the device after the authentication of the service policy is successfully performed according to the service identifier.
  • the key indication information is allocated by the device to a service corresponding to the service identifier.
  • the key indication information is a key parameter for generating the service policy execution key; or the key indication information is the service policy execution key.
  • the temporary label is the service policy authentication network element according to the service identifier pair. After the authentication of the service policy is performed, the authentication parameter is successfully sent to the device; or the temporary tag is allocated by the device to the service corresponding to the service identifier.
  • the processor 801 is further configured to:
  • Check variable indication information is transmitted to the terminal device via the communication interface 802, the check variable indication information indicating a check variable for verifying the temporary tag.
  • the check variable indication information is sent after performing key encryption by using the service policy.
  • the embodiment of the present application provides a structure diagram of a service policy creation apparatus, where the service policy creation apparatus can be used to perform the operations of the terminal equipment in the foregoing method embodiments.
  • the service policy creation device 900 includes a processor 901, a transceiver 902, and a memory 903.
  • the processor 901, the transceiver 902, and the memory 903 are connected to each other through a bus 904.
  • bus 904. For details of the foregoing modules, refer to the related modules in FIG. Description, no longer repeat here.
  • the transceiver 902 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a wireless local area network (WLAN) interface, a radio frequency (RF) interface, etc., and the RF interface can communicate with the network device.
  • the RF interface can use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM) system, General Packet Radio Service (GPRS) system, Code Division Multiple Access (Code Division). Multiple Access, CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, Long Term Evolution (LTE) system, New Radio (NR) system, and the like.
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • NR
  • the transceiver 902 is configured to send a service identifier and a service policy installation authentication parameter to the session management function SMF network element, where the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update.
  • the transceiver 902 is configured to receive temporary label and key indication information from the SMF network element, where the key indication information is used to indicate a service policy execution key; the temporary label and the key indication information are service policies. After the authenticating network element successfully authenticates the authentication parameter of the service policy according to the service identifier, the authentication network element generates the generated by the SMF network element or the service policy authentication network element;
  • the processor 901 is configured to generate a verification parameter after verifying the temporary label according to the service policy execution key.
  • the transceiver 902 is configured to send a data packet corresponding to the service identifier, where the data packet includes the temporary label and the verification parameter.
  • the key indication information is sent to the SMF network element after the service policy authentication network element successfully authenticates the service policy installation authentication parameter according to the service identifier.
  • the key indication information is that the SMF network element is allocated for the service corresponding to the service identifier.
  • the transceiver 902 before the sending the service identifier and the service policy installation authentication parameter to the session management function SMF network element, the transceiver 902 is further configured to:
  • the processor 901 is configured to determine, according to the service identifier and the service policy, a derivative key, the service policy installation authentication parameter.
  • the transceiver 902 is further configured to:
  • the check variable indication information indicating for verification The checksum variable for the temporary tag.
  • a structure of a service policy creation apparatus is provided in the embodiment of the present application.
  • the service policy creation apparatus may be used to perform the action of the service policy authentication network element in the foregoing method embodiments.
  • the service policy creation apparatus 1000 includes a processor 1001, a communication interface 1002, and a memory 1003.
  • the processor 1001, the communication interface 1002, and the memory 1003 are connected to each other through a bus 1004.
  • bus 1004. For details of the foregoing modules, refer to the related modules in FIG. Description, no longer repeat here.
  • the communication interface 1002 is configured to receive a service identifier sent by the session management function SMF network element and a service policy installation authentication parameter, where the service identifier and the service policy installation authentication parameter are used to initiate a service policy creation or a service policy update;
  • the service identifier and the service policy installation authentication parameter are sent by the terminal to the SMF network element;
  • the processor 1001 is configured to perform authentication on the service policy installation authentication parameter according to the service identifier.
  • the communication interface 1002 is configured to: after the authentication is passed, send the service policy corresponding to the service identifier to the SMF network element, and send the service policy, temporary label, and key corresponding to the service identifier to the SMF network element. At least one of the indication information; the temporary label is used to identify a data packet corresponding to the service identifier, the service policy execution key is used to verify the temporary label; and the service policy is used to control the The data packet corresponding to the service identifier.
  • the processor 1001 is specifically configured to:
  • the processor 1001 is specifically configured to:
  • the service policy installation authentication parameter is authenticated by the AUSF network element according to the service identifier.
  • the embodiment of the present application further provides a computer readable storage medium for storing computer software instructions executed by the processor 801, which includes the program executed by the processor 801.
  • the embodiment of the present application further provides a computer readable storage medium for storing computer software instructions executed by the processor 901, which includes the program executed by the processor 901.
  • the embodiment of the present application further provides a computer readable storage medium for storing computer software instructions executed by the processor 1001, which includes the program executed by the processor 1001.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) including computer usable program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种业务策略创建方法及装置。其中方法包括：SMF网元从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述SMF网元向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的。

Description

一种业务策略创建方法及装置 技术领域
本申请涉及无线通信技术领域，特别涉及一种业务策略创建方法及装置。
背景技术
在未来的5G网络架构中，终端设备中的应用程序(application，APP)可主动向网络发起业务策略创建流程。在业务策略创建流程完成后，由网络中数据面设备(如网关设备)根据业务策略对该APP的业务流执行相应的检测、计费和控制策略。
然而在终端设备发起业务策略安装流程的过程中，如果终端设备上的APP盗用其他APP的业务策略，则会导致业务策略被滥用。例如，终端设备中的应用程序A的第一业务对应业务策略A，应用程序B的第二业务对应业务策略B。如果应用程序B采用非法的方式获得应用程序A的第一业务的业务标识，并在进行策略创建的流程中，向网络侧提供第一业务的业务标识进行策略安装，那么网络侧会为应用程序B的第二业务创建与第一业务的业务标识对应业务策略A，并按照业务策略A对应的计费策略进行计费，从而导业务策略被滥用。
综上所述，如何在终端设备发起业务策略创建流程的过程中，防止业务策略被滥用，是亟待解决的问题。
发明内容
本申请实施方式的目的在于提供一种业务策略创建方法及装置，用以解决终端设备发起业务策略创建流程的过程中，业务策略被滥用的问题。
第一方面，本申请实施例提供一种业务策略创建方法，包括：
SMF网元从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
所述SMF网元向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的。
根据本申请实施例提供的方法，终端设备在发送业务标识对应的数据报文之前，需要向SMF网元发送业务标识以及业务策略安装鉴权参数，在SMF网元确定终端设备发送的业务标识以及业务策略安装鉴权参数鉴权成功后，再向终端设备发送临时标签和密钥指示信息，终端设备从而可以根据临时标签和密钥指示信息发送数据报文。由于终端设备发起业务策略创建流程的过程中，需要进行鉴权，从而可以防止终端设备发送的业务标识对应的业务策略被其他终端设备盗用等情况发送，从而可以提供业务策略的安全性。
一种可选地实施方式中，所述方法还包括：
所述SMF网元接收所述业务策略鉴权网元发送的与所述业务标识对应的业务策略； 所述业务策略用于控制所述业务标识对应的数据报文。
一种可选地实施方式中，所述方法还包括：
所述SMF网元向UPF网元发送所述业务策略、所述临时标签和所述密钥指示信息。
上述方法中，SMF网元向UPF网元发送业务策略、所述临时标签和所述密钥指示信息等信息，UPF网元从而可以根据所述临时标签和所述密钥指示信息识别终端设备发送的数据报文，从而可以在识别出数据报文后，根据业务策略控制数据报文。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述密钥指示信息为生成所述业务策略执行密钥的密钥参数；或者，所述密钥指示信息为所述业务策略执行密钥。
一种可选地实施方式中，所述临时标签为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者，所述临时标签为所述SMF网元为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述方法还包括：
所述SMF网元向所述终端设备发送校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
一种可选地实施方式中，所述校验变量指示信息为通过所述业务策略执行密钥加密后发送的。
第二方面，本申请实施例提供一种业务策略创建装置，所述业务策略创建装置包括存储器、通信接口和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制通信接口进行信号接收和信号发送，当处理器执行存储器存储的指令时，所述业务策略创建装置用于执行上述第一方面或第一方面中任一种可能的设计中的方法。
第三方面，本申请实施例提供一种业务策略创建装置，用于实现上述第一方面或第一方面中的任意一种方法，包括相应的功能模块，例如包括处理单元、接收单元、发送单元等，分别用于实现以上方法中的步骤。
第四方面，本申请实施例提供一种业务策略创建方法，包括：
终端设备向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
所述终端设备从所述SMF网元接收临时标签和密钥指示信息，所述密钥指示信息用于指示业务策略执行密钥；所述临时标签和密钥指示信息为业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的；
所述终端设备发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签以及校验参数，所述校验参数为所述终端设备根据所述业务策略执行密钥对所述临时标签进行校验后生成的。
根据本申请实施例提供的方法，终端设备在发送业务标识对应的数据报文之前，需要向SMF网元发送业务标识以及业务策略安装鉴权参数，在SMF网元确定终端设备发送的业务标识以及业务策略安装鉴权参数鉴权成功后，终端设备可以接收SMF网元发送的临时标签和密钥指示信息，终端设备从而可以根据临时标签和密钥指示信息发送数据报文。 由于终端设备发起业务策略创建流程的过程中，需要进行鉴权，从而可以防止终端设备发送的业务标识对应的业务策略被其他终端设备盗用等情况发送，从而可以提供业务策略的安全性。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述终端设备向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数之前，所述方法还包括：
所述终端设备从应用服务器获取所述业务标识以及所述业务标识对应的业务策略安装派生密钥；
所述终端设备根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。
一种可选地实施方式中，所述方法还包括：
所述终端设备从所述SMF网元接收校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
第五方面，本申请实施例提供一种业务策略创建装置，所述业务策略创建装置包括存储器、收发机和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发机进行信号接收和信号发送，当处理器执行存储器存储的指令时，所述业务策略创建装置用于执行上述第四方面或第四方面中任一种可能的设计中的方法。
第六方面，本申请实施例提供一种业务策略创建装置，用于实现上述第四方面或第四方面中的任意一种方法，包括相应的功能模块，例如包括处理单元、接收单元、发送单元等，分别用于实现以上方法中的步骤。
第七方面，本申请实施例提供一种业务策略创建方法，包括：
业务策略鉴权网元接收会话管理功能SMF网元发送的业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的；
所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，并在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
根据本申请实施例提供的方法，终端设备在发送业务标识对应的数据报文之前，需要向SMF网元发送业务标识以及业务策略安装鉴权参数，在业务策略鉴权网元对终端设备发送的业务标识以及业务策略安装鉴权参数鉴权成功后，终端设备可以接收SMF网元发送的临时标签和密钥指示信息，终端设备从而可以根据临时标签和密钥指示信息发送数据报文。由于终端设备发起业务策略创建流程的过程中，需要进行鉴权，从而可以防止终端设备发送的业务标识对应的业务策略被其他终端设备盗用等情况发送，从而可以提供业务策略的安全性。
一种可选地实施方式中，所述业务策略鉴权网元根据所述业务标识对所述业务策略 安装鉴权参数进行鉴权，包括：
所述业务策略鉴权网元根据所述业务标识确定与所述业务标识对应的业务策略安装密钥；
所述业务策略鉴权网元根据所述业务策略安装密钥生成业务策略安装派生密钥，并根据所述业务策略安装派生密钥对所述业务策略安装派生密钥进行鉴权。
一种可选地实施方式中，所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，包括：
所述业务策略鉴权网元通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。
第八方面，本申请实施例提供一种业务策略创建装置，所述业务策略创建装置包括存储器、通信接口和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制通信接口进行信号接收和信号发送，当处理器执行存储器存储的指令时，所述业务策略创建装置用于执行上述第四方面或第四方面中任一种可能的设计中的方法。
第九方面，本申请实施例提供一种业务策略创建装置，用于实现上述第四方面或第四方面中的任意一种方法，包括相应的功能模块，例如包括处理单元、接收单元、发送单元等，分别用于实现以上方法中的步骤。
第十方面，本申请实施例提供一种计算机可读存储介质，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行上述任一方面或任一方面中任一种可能的设计中的方法。
第十一方面，本申请实施例提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行上述任一方面或任一方面中任一种可能的设计中的方法。
第十二方面，本申请实施例提供一种芯片，所述芯片与存储器相连，用于读取并执行所述存储器中存储的软件程序，以实现上述任一方面或任一方面中任一种可能的设计中的方法。
附图说明
图1为适用于本申请实施例的一种系统架构示意图；
图2为本申请实施例提供的密钥关系示意图；
图3为本申请实施例提供的一种业务策略创建方法流程示意图；
图4为本申请实施例提供的一种业务策略创建方法示意图；
图5为本申请实施例提供的一种业务策略创建装置结构示意图；
图6为本申请实施例提供的一种业务策略创建装置结构示意图；
图7为本申请实施例提供的一种业务策略创建装置结构示意图；
图8为本申请实施例提供的一种业务策略创建装置结构示意图；
图9为本申请实施例提供的一种业务策略创建装置结构示意图；
图10为本申请实施例提供的一种业务策略创建装置结构示意图。
具体实施方式
下面将结合附图对本申请实施例作进一步地详细描述。
图1示例性示出了适用于本申请实施例的一种系统架构示意图，如图1所示的系统架构中，终端设备101可以经接入网网元102与核心网进行通信，终端设备可以指用户设备(User Equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。接入终端可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端等。图1中为方便描述，只示例出1个终端，实际网络中，可能存在多个终端共存，在此不再赘述。
接入网(Access Network，AN)网元102，接入网网元也可以称之为无线接入网(Radio Access Network，RAN)网元，以下统称为接入网网元或AN，主要负责为终端设备101提供无线连接，保证终端设备101的上下行数据的可靠传输等。接入网网元102可为5G系统中的gNB(generation Node B)，可以是全球移动通讯(Global System of Mobile communication，GSM)系统或码分多址(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统中的基站(NodeB，NB)，还可以是长期演进(Long Term Evolution，LTE)系统中的演进型基站(Evolutional Node B，eNB或eNodeB)等。
会话管理功能(Session Management Function，SMF)网元103，可以用于执行LTE系统中移动性管理实体(Mobility Management Entity，MME)的部分功能，主要负责为终端设备101建立会话、管理会话等。可以根据终端设备101的位置信息为终端设备101选择合适的用户面功能(User Plane Function，UPF)网元。
UPF网元104，是终端设备101用户面的功能网元，主要功能包括分组路由和转发，用户面数据的服务质量(Quality of Service，QoS)处理等。
接入和移动性管理(Access and Mobility Management Function,AMF)网元105，主要功能包括无线接入网络控制平面的终结点，非接入信令的终结点，移动性管理，合法监听，接入授权或鉴权等等。
策略控制功能(Policy Control Funtion，PCF)网元106，主要负责用户面传输路径的建立、释放和更改等功能。
鉴权服务器功能(Authentication Server Function，AUSF)网元107，其主要功能包括用户鉴权等。
在本申请实施例中涉及多种密钥，下面结合附图描述每种密钥之间的关系。具体的，如图2所示。图2中，业务策略根密钥是由网络侧为终端设备配置的密钥，也可以称为鉴权密钥。
业务签约密钥是通过业务策略根密钥生成的，例如可以根据OTT标识以及业务策略根密钥进行哈希运算，获得业务签约密钥。业务签约参数是通过业务签约密钥生成的
业务策略安装密钥是通过业务策略根密钥生成的。
业务策略安装派生密钥是通过业务策略安装密钥生成的。
业务策略安装鉴权参数是通过业务策略安装派生密钥生成的。
业务策略执行密钥是通过业务策略安装密钥生成的，也可以通过其他方式生成。
上述各种密钥的具体生成方法，以及使用方法，将在后面描述，在此不再赘述。
在本申请实施例中使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。还应当理解，本文中使用的术语“和/或”是指包含一个或多个相关联的列出项目的任何或所有可能组合。本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
结合前面的描述，如图3所示，为本申请实施例提供的一种业务策略创建方法流程示意图。参见图3，该方法包括：
步骤301：终端设备向SMF网元发送业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新。
本申请实施例中，业务标识标识的数据报文的粒度，可以是业务粒度，例如标识一个APP所提供的某种业务的数据报文，该APP可以为微信程序或支付宝程序等。业务标识标识的数据报文的粒度，还可以是用户粒度，例如标识一个用户或一组用户访问某种业务的数据报文。
业务标识可以对应一个业务策略，网络侧可以根据数据报文中的业务标识，采用与业务标识对应的业务策略对数据报文执行相应的检测、计费和控制策略。当然，业务标识标识的数据报文的粒度为是用户粒度时，业务标识也可以在用户级别上标识一个用户或一组用户的数据报文，网络侧可以根据数据报文中的业务标识，采用与业务标识对应的业务策略对一个用户或一组用户的数据报文执行相应的检测、计费和控制策略。
步骤302：SMF网元从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数。
本申请实施例中，业务策略鉴权网元的功能可以由PCF网元实现，也可以由AUSF网元实现，还可以由其它任何网元实现，本发明实施例不进行限定。。当业务策略鉴权网元的功能由PCF或AUSF实现时，业务策略鉴权网元为PCF或AUSF网元内部的一个逻辑功能。
步骤303：业务策略鉴权网元接收SMF网元发送的业务标识以及业务策略安装鉴权参数。
其中，所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的。
步骤304：所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，并在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种。
当业务策略鉴权网元未向SMF网元发送临时标签或密钥指示信息时，可以由SMF网元生成临时标签或密钥指示信息。
所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息指示的业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
步骤305：所述SMF网元向所述终端设备发送所述临时标签和所述密钥指示信息。
所述密钥指示信息用于指示业务策略执行密钥；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的。
步骤306：所述终端设备从所述SMF网元接收临时标签和密钥指示信息，并发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签以及校验参数，所述校验参数为所述终端设备根据所述业务策略执行密钥对所述临时标签进行校验后生成的。
步骤301之前，终端设备还需要通过应用服务器(application server，AS)获取业务标识以及所述业务标识对应的业务策略安装派生密钥等，需要说明的是，该应用服务器为提供所述业务标识对应的业务的应用服务器。
下面描述应用服务器如何确定业务策略安装派生密钥：
具体的，应用服务器可以获得为终端设备提供服务的网络运营商分配的业务策略根密钥，该过程的具体内容可以参考现有技术中的描述，在此不再赘述。应用服务器获得业务策略根密钥之后，可以根据业务策略根密钥生成业务签约密钥，例如，应用服务器根据过顶(Over The Top，OTT)标识(OTT是指应用服务器通过互联网向用户提供的应用服务，一个OTT可以包括多个业务)、应用服务器生成的随机数以及业务策略根密钥，进行哈希(HASH)运算，并将哈希运算结果作为所述业务签约密钥，当然，应用服务器也可以通过其他算法生成业务签约密钥，本申请实施例对此并不限定。
应用服务器生成业务签约密钥之后，还可以根据业务签约密钥和OTT标识确定业务签约鉴权参数。例如，应用服务器对业务签约密钥和OTT标识进行哈希运算，并将哈希运算结果作为所述业务签约鉴权参数。
应用服务器获得上述参数之后，应用服务器可以向网络开放功能(Network Exposure Function，NEF)网元发起业务策略签约消息，业务策略签约消息中包含请求的业务策略、所述OTT标识、所述随机数等。可选的，业务策略签约消息中还可以包含业务标识、所述业务签约鉴权参数。如前所述，所述业务签约鉴权参数为根据业务签约密钥确定的，所述业务签约密钥是根据业务策略根密钥确定的。所述业务标识可以为业务策略鉴权网元在所述应用服务器中预先配置的。
NEF网元接收到应用服务器发送的业务策略签约消息之后，将业务策略签约消息转发至业务策略鉴权网元。业务策略鉴权网元接收到业务策略签约消息之后，可以根据业务策略根密钥生成业务策略安装密钥。例如，业务策略鉴权网元可以对业务策略根密钥、业务标识(在业务策略签约消息中包括业务标识的情况下)等进行哈希计算，获得业务策略安装密钥，当然，业务策略鉴权网元也可以根据其他方法生成业务策略安装密钥，在此不再逐一举例说明。进一步的，业务策略鉴权网元还可以存储业务策略安装密钥，并建立业务标识与业务策略安装密钥的对应关系。
可选的，业务策略鉴权网元生成业务策略安装密钥之前，还可以对接收到的业务签约鉴权参数进行校验，并在确认校验通过之后生成业务策略安装密钥。具体的校验过程可以如下：业务策略鉴权网元根据接收到的OTT标识、随机数以及业务策略根密钥，生成业务签约密钥。业务策略鉴权网元生成业务签约密钥的算法，与应用服务器生成业务签约密钥的算法相同，为与应用服务器预先约定的算法。
业务策略鉴权网元再采用与应用服务器预先约定的算法，根据所述业务签约密钥生成期望的(expected)业务签约鉴权参数，业务策略鉴权网元若确定所述期望的业务签约鉴权参数与接收到的业务签约鉴权参数相同，则确定业务签约鉴权参数校验通过；若确定所述期望的业务签约鉴权参数与接收到的业务签约鉴权参数不相同，则确定业务签约鉴权参数校验未通过。
需要说明的是，上述校验过程中，业务策略鉴权网元为PCF网元时，业务策略鉴权网元可以独立对业务签约鉴权参数进行校验，也可以将业务策略签约消息转发至AUSF网元，由AUSF网元对业务签约鉴权参数进行校验。业务策略鉴权网元通过AUSF网元对业务签约鉴权参数进行校验时，AUSF网元向业务策略鉴权网元返回校验结果，业务策略鉴权网元从而可以根据AUSF网元返回的校验结果，确定业务签约鉴权参数是否校验通过。AUSF网元在确定业务签约鉴权参数校验通过后，也可以生成业务策略安装密钥，并建立业务标识与业务策略安装密钥的对应关系。可选的，AUSF网元还可以将业务策略安装密钥发送给业务策略鉴权网元。
业务策略鉴权网元生成业务策略安装密钥之后，还可以对应用服务器请求的业务策略进行授权。可选的，业务策略签约消息中不包括业务标识时，业务策略鉴权网还可以为应用服务器请求的业务策略分配业务标识。
业务策略鉴权网元对应用服务器请求的业务策略进行授权之后，向应用服务器发送策略签约响应消息，策略签约响应消息指示出应用服务器请求的业务策略的授权结果等信息。可选的，策略签约响应消息中还可以包括业务标识。
应用服务器接收到策略签约响应消息之后，可以根据业务签约密钥、业务标识等，采用与业务策略鉴权网元相同的方法，生成业务策略安装密钥。
应用服务器生成业务策略安装密钥之后，可以在接收到终端设备发送的业务请求(例如业务注册请求)时，向终端设备发送所请求的业务的业务标识，以及所述业务标识对应的业务策略安装派生密钥。需要说明的是，终端设备在发送业务请求之前，需要附着到网络，并与应用服务器建立传输控制协议(Transmission Control Protocol，TCP)连接等流程，在此不再赘述。
终端设备从应用服务器获取业务标识以及所述业务标识对应的业务策略安装派生密钥之后，可以根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。具体的，终端设备可以对业务标识以及业务策略安装派生密钥进行哈希计算，将哈希计算的结果作为业务策略安装鉴权参数，当然，终端设备也可以根据其他方法生成业务策略安装鉴权参数，在此不再逐一举例说明。
终端设备确定业务标识以及业务策略安装鉴权参数之后，可以通过业务策略请求消息向SMF网元发送业务标识以及业务策略安装鉴权参数。业务策略请求消息可以是业务策略创建请求消息，或者业务策略使能请求消息，或者业务策略更新请求消息等，本申请实施例对此并不限定。
需要说明的是，终端设备可以通过非接入层(Non-access stratum，NAS)消息承载所述业务策略请求消息，具体过程不再赘述。
相应的，步骤302中，SMF网元可以通过终端设备发送的业务策略请求消息，获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数。
步骤304中，业务策略鉴权网元接收到业务标识后，根据业务标识确定与所述业务标识对应的业务策略安装密钥，再根据业务策略安装密钥以及业务标识生成业务策略安装派生密钥，业务策略鉴权网元生成业务策略安装派生密钥的方式，与终端设备生成业务策略安装派生密钥的方式相同，在此不再赘述。
业务策略鉴权网元生成业务策略安装派生密钥之后，采用与终端设备相同的方法，根 据业务策略安装派生密钥生成期望的业务策略安装鉴权参数，若确定期望的业务策略安装鉴权参数，与从SMF网元接收到的业务策略安装鉴权参数相同，则可以确定业务策略安装鉴权参数鉴权通过，否则确定业务策略安装鉴权参数鉴权未通过。
需要说明的是，上述鉴权过程中，业务策略鉴权网元为PCF网元时，业务策略鉴权网元可以独立对业务策略安装鉴权参数进行鉴权，也可以将业务策略签约消息转发至AUSF网元，从而通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。业务策略鉴权网元通过AUSF网元对业务策略安装鉴权参数进行鉴权时，AUSF网元向业务策略鉴权网元返回鉴权结果，业务策略鉴权网元从而可以根据AUSF网元返回的鉴权结果，确定业务策略安装鉴权参数是否鉴权通过。
业务策略鉴权网元确定业务策略安装鉴权参数鉴权通过之后，为所述业务标识对应的业务分配业务策略。可选的，业务策略鉴权网元还可以为所述业务标识对应的业务分配临时标签，从而通过所述临时标签标识所述业务标识对应的数据报文；业务策略鉴权网元还可以为所述业务标识对应的业务生成业务策略执行密钥，例如，业务策略鉴权网元可以对业务策略安装密钥以及密钥参数进行哈希计算，并将计算结果作为业务策略执行密钥。密钥参数的可以为随机数等，本申请实施例对此并不限定，可以根据实际情况进行约定。
需要说明的是，业务策略鉴权网元为PCF网元，且业务策略鉴权网元通过AUSF网元对业务策略安装鉴权参数进行鉴权时，业务策略执行密钥以及临时标签也可以是AUSF网元分配并发送给业务策略鉴权网元的。
业务策略鉴权网元分配业务策略之后，可以向SMF网元发送业务策略，还可以发送临时标签以及密钥指示信息中的至少一个。密钥指示信息可以为生成所述业务策略执行密钥的密钥参数，也可以为所述业务策略执行密钥。
步骤305中，业务策略鉴权网元未向所述SMF网元发送密钥指示信息时，密钥指示信息也可以由SMF网元为所述业务标识对应的业务分配的。
相应的，所述临时标签可以为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者，所述临时标签也可以为所述SMF网元为所述业务标识对应的业务分配的。
SMF网元还可以将业务策略、临时标签和密钥指示信息发送给UPF网元，UPF网元可以根据密钥指示信息指示的业务策略执行密钥，对终端设备发送的数据报文中的校验参数进行校验，还可以根据临时标签确定所述业务标识对应的数据报文，并根据业务策略控制所述业务业务标识对应的数据报文。
步骤306中，终端设备发送业务标识对应的数据报文之前，可以根据密钥指示信息确定业务策略执行密钥，例如，密钥指示信息为所述业务策略执行密钥时，终端设备可以直接将密钥指示信息作为业务策略执行密钥；密钥指示信息为密钥参数时，终端设备可以根据密钥参数生成业务策略执行密钥，生成业务策略执行密钥的方法可以为与SMF网元或业务策略鉴权网元预先约定的方法，在此不再赘述。
终端设备确定业务策略执行密钥之后，可以根据业务策略执行密钥、业务变量、临时标签生成校验参数。例如，终端设备可以对业务策略执行密钥、校验变量、临时标签进行哈希计算，将计算结果作为所述校验参数。其中校验变量可以为数据报文的五元组，也可以为所述五元组中的一部分。校验变量可以预先约定，也可以由SMF网元向终端设备发送的校验变量指示信息进行指示，例如校验变量指示信息可以指示校验变量为发送数据报 文的数据包的五元组中的源互联网协议地址(Internet Protocol Address，IP)地址，源端口号以及目的IP地址。进一步的，所述校验变量指示信息可以为SMF网元通过所述业务策略执行密钥加密后发送给所述终端设备的。
终端设备将校验参数以及临时标签封装在数据报文中，或数据报文的外层之后，通过数据报文发送至UPF网元。
UPF网元接收到数据报文之后，根据SMF网元发送的密钥指示信息指示的业务策略执行密钥对校验参数进行校验，具体的，UPF网元可以根据SMF网元发送的密钥指示信息指示的业务策略执行密钥、数据报文中的临时标签、校验变量，按照终端设备相同的方法，生成期望的校验参数，若确定期望的校验参数与数据报文中的校验参数相同，则可以确定校验成功，否则可以确定校验失败。
UPF网元对校验参数校验成功之后，根据业务策略对数据报文执行业务控制，并把数据报文中封装的临时标签和校验参数去除，把去除上述参数的数据报文发送给应用服务器。
下面通过一个具体的实施例描述前面的过程。
如图4所示，为本申请实施例提供的一种数据报文传输流程示意图。
步骤401：终端设备向应用服务器发送业务请求，所述业务请求用于请求业务注册。
步骤402：应用服务器接收到所述业务请求之后，向终端设备发送业务请求响应。
业务请求响应中包括终端设备所请求注册的业务的业务标识，以及所述业务标识对应的业务策略安装派生密钥。
步骤403：终端设备接收到业务请求响应之后，根据业务请求响应中的业务标识以及业务策略安装派生密钥确定所述业务策略安装鉴权参数。
步骤404：终端设备向SMF网元发送业务策略请求消息。
所述业务策略请求消息中包括业务标识以及业务策略安装鉴权参数，业务标识以及业务策略安装鉴权参数用于发起业务策略创建安装或业务策略更新。
步骤405：SMF网元接收到业务策略请求消息之后，把业务策略请求消息中的业务标识以及业务策略安装鉴权参数发送至业务策略鉴权网元。
步骤406：业务策略鉴权网元接收到业务标识以及业务策略安装鉴权参数之后，根据业务标识对业务策略安装鉴权参数进行鉴权，并在鉴权通过后为所述业务标识对应的业务分配业务策略。
相应的，业务策略鉴权网元确定业务策略安装鉴权参数鉴权未通过时，向SMF网元发送拒绝消息，所述拒绝消息用于拒绝所述终端设备的请求。SMF网元将接收到的拒绝消息转发至所述终端设备。
步骤407：业务策略鉴权网元向SMF网元发送所述业务策略。
可选的，业务策略鉴权网元还可以向SMF网元发送临时标签以及密钥指示信息中的至少一个。
步骤408：SMF网元接收到所述业务策略之后，向UPF网元发送所述业务策略、临时标签以及密钥指示信息。
其中，临时标签可以为所述业务策略鉴权网元发送给所述SMF网元的，也可以为所述SMF网元为所述业务标识对应的业务分配的；密钥指示信息可以为所述业务策略鉴权网元发送给所述SMF网元的，也可以为所述SMF网元为所述业务标识对应的业务分配的。
步骤409：SMF网元向终端设备发送临时标签以及密钥指示信息。
步骤410：终端设备根据业务策略执行密钥、业务变量、临时标签生成校验参数。
步骤411：终端设备将校验参数以及临时标签封装在数据报文中，或数据报文的外层之后，向UPF网元发送所述数据报文。
步骤412：UPF网元接收到数据报文之后，根据SMF网元发送的密钥指示信息指示的业务策略执行密钥对校验参数进行校验，并在对校验参数校验成功之后，根据业务策略对数据报文执行业务控制，并把数据报文中封装的临时标签和校验参数去除，把去除上述参数的数据报文发送给应用服务器。
如图5所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中SMF网元的动作，该业务策略创建装置500包括：
接收单元501，用于从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
发送单元501，用于向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述装置生成或所述业务策略鉴权网元生成的。
一种可选地实施方式中，所述接收单元501还用于：
接收所述业务策略鉴权网元发送的与所述业务标识对应的业务策略；所述业务策略用于控制所述业务标识对应的数据报文。
一种可选地实施方式中，所述发送单元502还用于：
向UPF网元发送所述业务策略、所述临时标签和所述密钥指示信息。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者
所述密钥指示信息为所述装置为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述密钥指示信息为生成所述业务策略执行密钥的密钥参数；或者，所述密钥指示信息为所述业务策略执行密钥。
一种可选地实施方式中，所述临时标签为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者，所述临时标签为所述装置为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述发送单元502还用于：
向所述终端设备发送校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
一种可选地实施方式中，所述校验变量指示信息为通过所述业务策略执行密钥加密后发送的。
如图6所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中终端设备的动作，该业务策略创建装置600包括：
收发单元601，用于向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参 数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
所述收发单元601，用于从所述SMF网元接收临时标签和密钥指示信息，所述密钥指示信息用于指示业务策略执行密钥；所述临时标签和密钥指示信息为业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的；
处理单元602，用于根据所述业务策略执行密钥对所述临时标签进行校验后生成校验参数；
所述收发单元601，用于发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签以及所述校验参数。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数之前，所述收发单元601还用于：
从应用服务器获取所述业务标识以及所述业务标识对应的业务策略安装派生密钥；
所述处理单元602，用于根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。
一种可选地实施方式中，所述收发单元601还用于：
从所述SMF网元接收校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
如图7所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中业务策略鉴权网元的动作，该业务策略创建装置700包括：
收发单元701，用于接收会话管理功能SMF网元发送的业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的；
处理单元702，用于根据所述业务标识对所述业务策略安装鉴权参数进行鉴权；
所述收发单元701，用于在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
一种可选地实施方式中，所述处理单元702具体用于：
根据所述业务标识确定与所述业务标识对应的业务策略安装密钥；
根据所述业务策略安装密钥生成业务策略安装派生密钥，并根据所述业务策略安装派生密钥对所述业务策略安装派生密钥进行鉴权。
一种可选地实施方式中，所述处理单元702具体用于：
通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。
如图8所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中SMF网元的动作。
该业务策略创建装置800包括：处理器801、通信接口802、存储器803；其中，处理器801、通信接口802、存储器803通过总线804相互连接。
处理器801可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器801还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器803可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器803还可以包括上述种类的存储器的组合。
通信接口802可以为有线通信接入口，无线通信接口或其组合，其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网络(Wireless Local Area Networks，WLAN)接口。
总线804可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条双向箭头表示，但并不表示仅有一根总线或一种类型的总线。
存储器803可以用于存储程序指令，处理器801调用该存储器803中存储的程序指令，可以执行以下步骤：
通过通信接口802从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
通过通信接口802向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述装置生成或所述业务策略鉴权网元生成的。
一种可选地实施方式中，所述处理器801还用于：
通过通信接口802接收所述业务策略鉴权网元发送的与所述业务标识对应的业务策略；所述业务策略用于控制所述业务标识对应的数据报文。
一种可选地实施方式中，所述处理器801还用于：
通过通信接口802向UPF网元发送所述业务策略、所述临时标签和所述密钥指示信息。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者
所述密钥指示信息为所述装置为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述密钥指示信息为生成所述业务策略执行密钥的密钥参数；或者，所述密钥指示信息为所述业务策略执行密钥。
一种可选地实施方式中，所述临时标签为所述业务策略鉴权网元根据所述业务标识对 所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者，所述临时标签为所述装置为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述处理器801还用于：
通过通信接口802向所述终端设备发送校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
一种可选地实施方式中，所述校验变量指示信息为通过所述业务策略执行密钥加密后发送的。
如图9所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中终端设备的动作。
该业务策略创建装置900包括：处理器901、收发机902、存储器903；其中，处理器901、收发机902、存储器903通过总线904相互连接，上述模块的具体内容可以参考图8中相关模块的描述，在此不再赘述。
收发机902可以为有线通信接入口，无线通信接口或其组合，其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网络(Wireless Local Area Networks，WLAN)接口、射频(Radio Frequency，RF)接口等，RF接口可以通过与网络设备通信。RF接口可以使用任一通信标准或协议，包括但不限于全球移动通讯(Global System of Mobile communication，GSM)系统、通用分组无线服务(General Packet Radio Service，GPRS)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access,WCDMA)系统、长期演进(Long Term Evolution,LTE)系统、新无线(New Radio，NR)系统等。
收发机902，用于向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
所述收发机902，用于从所述SMF网元接收临时标签和密钥指示信息，所述密钥指示信息用于指示业务策略执行密钥；所述临时标签和密钥指示信息为业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的；
处理器901，用于根据所述业务策略执行密钥对所述临时标签进行校验后生成校验参数；
所述收发机902，用于发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签以及所述校验参数。
一种可选地实施方式中，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
一种可选地实施方式中，所述向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数之前，所述收发机902还用于：
从应用服务器获取所述业务标识以及所述业务标识对应的业务策略安装派生密钥；
所述处理器901，用于根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。
一种可选地实施方式中，所述收发机902还用于：
从所述SMF网元接收校验变量指示信息，所述校验变量指示信息指示出用于校验所 述临时标签的校验变量。
如图10所示，为本申请实施例提供一种业务策略创建装置结构示意图，该业务策略创建装置可以用于执行上述各方法实施例中业务策略鉴权网元的动作。
该业务策略创建装置1000包括：处理器1001、通信接口1002、存储器1003；其中，处理器1001、通信接口1002、存储器1003通过总线1004相互连接，上述模块的具体内容可以参考图8中相关模块的描述，在此不再赘述。
通信接口1002，用于接收会话管理功能SMF网元发送的业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的；
处理器1001，用于根据所述业务标识对所述业务策略安装鉴权参数进行鉴权；
所述通信接口1002，用于在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
一种可选地实施方式中，所述处理器1001具体用于：
根据所述业务标识确定与所述业务标识对应的业务策略安装密钥；
根据所述业务策略安装密钥生成业务策略安装派生密钥，并根据所述业务策略安装派生密钥对所述业务策略安装派生密钥进行鉴权。
一种可选地实施方式中，所述处理器1001具体用于：
通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。
本申请实施例还提供了一种计算机可读存储介质，用于存储上述处理器801执行的计算机软件指令，其包含上述处理器801执行的程序。
本申请实施例还提供了一种计算机可读存储介质，用于存储上述处理器901执行的计算机软件指令，其包含上述处理器901执行的程序。
本申请实施例还提供了一种计算机可读存储介质，用于存储上述处理器1001执行的计算机软件指令，其包含上述处理器1001执行的程序。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他 可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种业务策略创建方法，其特征在于，包括：
    会话管理功能SMF网元从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
    所述SMF网元向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述SMF网元接收所述业务策略鉴权网元发送的与所述业务标识对应的业务策略；所述业务策略用于控制所述业务标识对应的数据报文。
  3. 根据权利要求1或2所述的方法，其特征在于，所述SMF网元确定临时标签和密钥指示信息之后，所述方法还包括：
    所述SMF网元向用户面功能UPF网元发送所述业务策略、所述临时标签和所述密钥指示信息。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
    所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述密钥指示信息为生成所述业务策略执行密钥的密钥参数；或者，所述密钥指示信息为所述业务策略执行密钥。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述临时标签为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者，所述临时标签为所述SMF网元为所述业务标识对应的业务分配的。
  7. 根据权利要求1至6任一所述的方法，其特征在于，所述方法还包括：
    所述SMF网元向所述终端设备发送校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
  8. 根据权利要求7所述的方法，其特征在于，所述校验变量指示信息为通过所述业务策略执行密钥加密后发送的。
  9. 一种业务策略创建方法，其特征在于，包括：
    终端设备向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
    所述终端设备从所述SMF网元接收临时标签和密钥指示信息，所述密钥指示信息用于指示业务策略执行密钥；所述临时标签和密钥指示信息为业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的；
    所述终端设备发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签 以及校验参数，所述校验参数为所述终端设备根据所述业务策略执行密钥对所述临时标签进行校验后生成的。
  10. 根据权利要求9所述的方法，其特征在于，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
    所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
  11. 根据权利要求9或10所述的方法，其特征在于，所述终端设备通过SMF网元向PCF网元发送业务标识以及业务策略安装鉴权参数之前，所述方法还包括：
    所述终端设备从应用服务器获取所述业务标识以及所述业务标识对应的业务策略安装派生密钥；
    所述终端设备根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。
  12. 根据权利要求9至11任一所述的方法，其特征在于，所述方法还包括：
    所述终端设备从所述SMF网元接收校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量；
    所述校验参数为所述终端设备根据所述业务策略执行密钥、所述校验变量对所述临时标签进行校验后生成的。
  13. 一种业务策略创建方法，其特征在于，包括：
    业务策略鉴权网元接收会话管理功能SMF网元发送的业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的；
    所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，并在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
  14. 根据权利要求13所述的方法，其特征在于，所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，包括：
    所述业务策略鉴权网元根据所述业务标识确定与所述业务标识对应的业务策略安装密钥；
    所述业务策略鉴权网元根据所述业务策略安装密钥生成业务策略安装派生密钥，并根据所述业务策略安装派生密钥对所述业务策略安装派生密钥进行鉴权。
  15. 根据权利要求13所述的方法，其特征在于，所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权，包括：
    所述业务策略鉴权网元通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。
  16. 一种业务策略创建装置，其特征在于，包括：
    接收单元，用于从终端设备获取业务标识以及业务策略安装鉴权参数，并向业务策略鉴权网元发送所述业务标识以及所述业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
    发送单元，用于向所述终端设备发送临时标签和密钥指示信息，所述临时标签用于标识所述业务标识对应的数据报文，所述密钥指示信息用于指示业务策略执行密钥，所述业务策略执行密钥用于校验所述临时标签；所述临时标签和所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述装置生成或所述业务策略鉴权网元生成的。
  17. 根据权利要求16所述的装置，其特征在于，所述接收单元还用于：
    接收所述业务策略鉴权网元发送的与所述业务标识对应的业务策略；所述业务策略用于控制所述业务标识对应的数据报文。
  18. 根据权利要求16或17所述的装置，其特征在于，所述发送单元还用于：
    向用户面功能UPF网元发送所述业务策略、所述临时标签和所述密钥指示信息。
  19. 根据权利要求16至18任一所述的装置，其特征在于，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者
    所述密钥指示信息为所述装置为所述业务标识对应的业务分配的。
  20. 根据权利要求16至19任一所述的装置，其特征在于，所述密钥指示信息为生成所述业务策略执行密钥的密钥参数；或者，所述密钥指示信息为所述业务策略执行密钥。
  21. 根据权利要求16至20任一所述的装置，其特征在于，所述临时标签为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述装置的；或者，所述临时标签为所述装置为所述业务标识对应的业务分配的。
  22. 根据权利要求16至21任一所述的装置，其特征在于，所述发送单元还用于：
    向所述终端设备发送校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
  23. 根据权利要求22所述的装置，其特征在于，所述校验变量指示信息为通过所述业务策略执行密钥加密后发送的。
  24. 一种业务策略创建装置，其特征在于，包括：
    收发单元，用于向会话管理功能SMF网元发送业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；
    所述收发单元，用于从所述SMF网元接收临时标签和密钥指示信息，所述密钥指示信息用于指示业务策略执行密钥；所述临时标签和密钥指示信息为业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，由所述SMF网元生成或所述业务策略鉴权网元生成的；
    处理单元，用于根据所述业务策略执行密钥对所述临时标签进行校验后生成校验参数；
    所述收发单元，用于发送所述业务标识对应的数据报文，所述数据报文中包括所述临时标签以及所述校验参数。
  25. 根据权利要求24所述的装置，其特征在于，所述密钥指示信息为所述业务策略鉴权网元根据所述业务标识对所述业务策略安装鉴权参数鉴权成功后，发送给所述SMF网元的；或者
    所述密钥指示信息为所述SMF网元为所述业务标识对应的业务分配的。
  26. 根据权利要求24或25所述的装置，其特征在于，所述向会话管理功能SMF网 元发送业务标识以及业务策略安装鉴权参数之前，所述收发单元还用于：
    从应用服务器获取所述业务标识以及所述业务标识对应的业务策略安装派生密钥；
    所述处理单元，用于根据所述业务标识以及所述业务策略安装派生密钥确定所述业务策略安装鉴权参数。
  27. 根据权利要求24至26任一所述的装置，其特征在于，所述收发单元还用于：
    从所述SMF网元接收校验变量指示信息，所述校验变量指示信息指示出用于校验所述临时标签的校验变量。
  28. 一种业务策略创建装置，其特征在于，包括：
    收发单元，用于接收会话管理功能SMF网元发送的业务标识以及业务策略安装鉴权参数；所述业务标识以及所述业务策略安装鉴权参数用于发起业务策略创建或业务策略更新；所述业务标识以及所述业务策略安装鉴权参数为所述终端发送给所述SMF网元的；
    处理单元，用于根据所述业务标识对所述业务策略安装鉴权参数进行鉴权；
    所述收发单元，用于在鉴权通过后，向所述SMF网元发送所述业务标识对应的业务策略向所述SMF网元发送所述业务标识对应的业务策略、临时标签和密钥指示信息中的至少一种；所述临时标签用于标识所述业务标识对应的数据报文，所述业务策略执行密钥用于校验所述临时标签；所述业务策略用于控制所述业务标识对应的数据报文。
  29. 根据权利要求28所述的装置，其特征在于，所述处理单元具体用于：
    根据所述业务标识确定与所述业务标识对应的业务策略安装密钥；
    根据所述业务策略安装密钥生成业务策略安装派生密钥，并根据所述业务策略安装派生密钥对所述业务策略安装派生密钥进行鉴权。
  30. 根据权利要求28所述的装置，其特征在于，所述处理单元具体用于：
    通过AUSF网元根据所述业务标识对所述业务策略安装鉴权参数进行鉴权。
PCT/CN2017/105728 2017-10-11 2017-10-11 一种业务策略创建方法及装置 WO2019071472A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/CN2017/105728 WO2019071472A1 (zh) 2017-10-11 2017-10-11 一种业务策略创建方法及装置
CN201880066694.5A CN111226452B (zh) 2017-10-11 2018-02-14 一种业务策略创建方法及装置
PCT/CN2018/076836 WO2019071901A1 (zh) 2017-10-11 2018-02-14 一种业务策略创建方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/105728 WO2019071472A1 (zh) 2017-10-11 2017-10-11 一种业务策略创建方法及装置

Publications (1)

Publication Number Publication Date
WO2019071472A1 true WO2019071472A1 (zh) 2019-04-18

Family

ID=66100165

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2017/105728 WO2019071472A1 (zh) 2017-10-11 2017-10-11 一种业务策略创建方法及装置
PCT/CN2018/076836 WO2019071901A1 (zh) 2017-10-11 2018-02-14 一种业务策略创建方法及装置

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/076836 WO2019071901A1 (zh) 2017-10-11 2018-02-14 一种业务策略创建方法及装置

Country Status (2)

Country Link
CN (1) CN111226452B (zh)
WO (2) WO2019071472A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114285908B (zh) * 2021-12-09 2023-10-31 中国联合网络通信集团有限公司 网元适配方法、装置、设备和计算机可读存储介质
CN114423029B (zh) * 2022-02-08 2023-12-19 深圳艾灵网络有限公司 服务质量参数调整方法、设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107018542A (zh) * 2017-03-27 2017-08-04 中兴通讯股份有限公司 网络系统中状态信息的处理方法、装置及存储介质
US20170289046A1 (en) * 2016-04-04 2017-10-05 Qualcomm Incorporated Quality of service (qos) management in wireless networks
WO2017171365A2 (ko) * 2016-03-31 2017-10-05 엘지전자(주) 6ghz 이하 대역을 지원하는 무선 통신 시스템에서 신호를 송수신하기 위한 방법 및 이를 위한 장치

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101227309B (zh) * 2008-01-30 2010-12-08 中兴通讯股份有限公司 下一代网络组播业务接纳控制方法
CN102726077B (zh) * 2011-12-31 2014-09-03 华为技术有限公司 Pcc架构下对报文的处理方法和设备
US9231820B2 (en) * 2012-09-28 2016-01-05 Juniper Networks, Inc. Methods and apparatus for controlling wireless access points
CN105471611A (zh) * 2014-09-05 2016-04-06 中兴通讯股份有限公司 用户服务提供的处理方法、装置及系统
CN106559917A (zh) * 2015-09-30 2017-04-05 中国移动通信集团公司 用户设备初始附着方法及系统
CN106937351B (zh) * 2015-12-29 2020-04-17 中国移动通信集团公司 一种会话实现方法及核心网元

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017171365A2 (ko) * 2016-03-31 2017-10-05 엘지전자(주) 6ghz 이하 대역을 지원하는 무선 통신 시스템에서 신호를 송수신하기 위한 방법 및 이를 위한 장치
US20170289046A1 (en) * 2016-04-04 2017-10-05 Qualcomm Incorporated Quality of service (qos) management in wireless networks
CN107018542A (zh) * 2017-03-27 2017-08-04 中兴通讯股份有限公司 网络系统中状态信息的处理方法、装置及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI: "TS 23.501: Align PDU session establishment with AF influence on traffic routing and update to DN authorization of PDU session establi- shment", 3GPP TSG SA WG2 MEETING #122 S2-174435, 30 June 2017 (2017-06-30), XP055591995 *

Also Published As

Publication number Publication date
CN111226452B (zh) 2021-10-19
CN111226452A (zh) 2020-06-02
WO2019071901A1 (zh) 2019-04-18

Similar Documents

Publication Publication Date Title
US11310266B2 (en) Mobile communication method, apparatus, and device
CN109428717B (zh) 管理具有多个证书颁发者的嵌入式通用集成电路卡调配
JP6759232B2 (ja) 完全前方秘匿性を有する認証および鍵共有
TWI625951B (zh) 使用用於服務ｃ平面方法的網路符記的高效策略實施
US9942210B2 (en) Key derivation method and apparatus for local access under control of a cellular network
CN110891269B (zh) 一种数据保护方法、设备及系统
JP2018508146A (ja) サービス−ユーザプレーン手法のためのネットワークトークンを使用した効率的なポリシー施行
CN112514436B (zh) 发起器和响应器之间的安全的、被认证的通信
TW201345217A (zh) 具區域功能性身份管理
CN109788480B (zh) 一种通信方法及装置
US11140545B2 (en) Method, apparatus, and system for protecting data
CN110351725B (zh) 通信方法和装置
CN110583036A (zh) 网络认证方法、网络设备及核心网设备
US11316670B2 (en) Secure communications using network access identity
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
WO2019071472A1 (zh) 一种业务策略创建方法及装置
CN113498055B (zh) 接入控制方法及通信设备
US20230354028A1 (en) Method, system, and apparatus for generating key for inter-device communication
US20240073212A1 (en) Communication method and apparatus
CN117997541A (zh) 通信方法和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17928573

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17928573

Country of ref document: EP

Kind code of ref document: A1