WO2019196699A1 - 一种获取安全策略的方法及设备 - Google Patents

一种获取安全策略的方法及设备 Download PDF

Info

Publication number
WO2019196699A1
WO2019196699A1 PCT/CN2019/080915 CN2019080915W WO2019196699A1 WO 2019196699 A1 WO2019196699 A1 WO 2019196699A1 CN 2019080915 W CN2019080915 W CN 2019080915W WO 2019196699 A1 WO2019196699 A1 WO 2019196699A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
security policy
security
policy
vsepp
Prior art date
Application number
PCT/CN2019/080915
Other languages
English (en)
French (fr)
Inventor
何承东
李华
丁辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019196699A1 publication Critical patent/WO2019196699A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/14—Mobility data transfer between corresponding nodes

Definitions

  • the present application relates to the field of communications, and more specifically to a method and apparatus for obtaining a security policy in the field of communications.
  • service-based network architecture a network entity based on a specific network function that can be provided is called a network function.
  • Function, NF Function
  • network functions can be provided as a service.
  • any two network function modules can interact in a manner that is invoked by a network function service through a serviced interface.
  • a roaming scenario it is necessary to pay attention to the security of the message transmission between the visited network and the home network.
  • the Security Edge Protection Proxy (SEPP) function is determined in the roaming architecture.
  • the main function of SEPP is to complete the security of the visited network and home network messaging.
  • the vSEPP indicates the SEPP deployed in the visited network, and the hSEPP indicates the SEPP deployed in the home network.
  • the security mechanism between vSEPP and hSEPP can be applied to protect the security of the application layer transmission.
  • application layer security refers to how to protect some sensitive information (such as encryption) in N32 messages. How to obtain the security policy, it is especially important for vSEPP/hSEPP to protect some sensitive information in N32 messages according to the security policy.
  • the present application provides a method and a device for obtaining a security policy, and the vSEPP and the hSEPP send information to the hSEPP to enable the vSEPP and the hSEPP to transmit information according to the security policy, thereby improving the roaming scenario.
  • the security of information transmission is a method and a device for obtaining a security policy, and the vSEPP and the hSEPP send information to the hSEPP to enable the vSEPP and the hSEPP to transmit information according to the security policy, thereby improving the roaming scenario.
  • the present application provides a method for obtaining a security policy, where the method includes: when a first security edge protection proxy network element hSEPP receives a service discovery request sent by a second secure edge protection proxy network element vSEPP, The hSEPP sends a security policy request to the first policy storage device, receives the security policy sent by the first policy storage device, and sends the security policy to the vSEPP.
  • the first security edge protection proxy network element hSEPP is the security edge protection proxy network element in the home network
  • the second security edge protection proxy network element vSEPP is the security edge protection proxy network element in the visited network.
  • the first policy storage device may be a unified data management (UDM) network element, a policy control function network element (PCF), or a network function database.
  • UDM unified data management
  • PCF policy control function network element
  • NRF Network repository function
  • the first policy storage device may store a security policy corresponding to all network functions in the carrier network, and may also store a service authorization security policy.
  • the hSEPP interacts with the first policy storage network element to obtain the security policy and sends the policy to the vSEPP, the hSEPP and the vSEPP can use the security policy to transmit information, thereby improving the security of information transmission.
  • the service request includes a target service identifier
  • the security policy is a security policy corresponding to the target service identifier.
  • This security policy includes a service access security policy. It can be understood that the target service identifier can be the name of the required service, or the serial number of the service.
  • the security policy is all security policies stored by the first policy storage device.
  • the security policy includes a service access security policy.
  • all the security policies stored by the first policy storage device include a security policy corresponding to the required service
  • the hSEPP sends the security policy to the vSEPP, including:
  • the hSEPP sends a security policy corresponding to the required service to the vSEPP.
  • all the security policies stored by the first policy storage device include a service authorization security policy and a security policy corresponding to the required service
  • the hSEPP sends the security policy to the vSEPP, including:
  • the hSEPP sends the service authorization security policy and the security policy corresponding to the required service to the vSEPP.
  • the hSEPP if the hSEPP is not stored or does not receive the service authorization policy through the above interaction, the hSEPP also needs to obtain the service authorization security policy. Specifically, the acquisition request may be sent to the second policy storage device.
  • the second policy storage device is the same device as the first policy storage device. Then the hSEPP can obtain the service authorization security policy by using the foregoing security policy request.
  • the hSEPP receives the service discovery request sent by the vSEPP, and the hSEPP sends a security policy request to the first policy storage device, where the hSEPP receives the security policy sent by the first policy storage device, where the security policy includes the service.
  • Authorizing the security policy of course, the security policy further includes a security policy corresponding to the required service or a security policy corresponding to all services stored by the first policy storage device; the hSEPP sends the security policy to the vSEPP.
  • each service stored in the first policy storage device has a corresponding security policy. For example, service 1 corresponds to the security policy of service 1, and service 2 corresponds to the security policy of service 2. This is no longer an example.
  • the hSEPP may send a request message to the second policy storage device to obtain a service authorization security policy.
  • the second policy storage device may be a UDM, a PCF, or an NRF network element.
  • the hSEPP sends a first request to the second policy storage device, where the first request is used to obtain a service authorization security policy; and the service authorization security policy sent by the second policy storage device is received. Sending the service authorization security policy to the vSEPP.
  • the security policy supported by the hSEPP and the vSEPP may be the same or may be different.
  • the vSEPP may feed back The service authorization security policy is supported.
  • hSEPP also receives feedback from vSEPP. Specifically, the hSEPP receives the notification message sent by the vSEPP, where the notification message is used to indicate a security policy supported by the vSEPP or a security policy not supported by the vSEPP. It can be understood that the hSEPP and the vSEPP can perform policy negotiation if there is a security policy that is not supported by the vSEPP.
  • the hSEPP after receiving the service authorization security policy, the hSEPP encrypts some of the fields in the service response message according to the service authorization security policy.
  • the hSEPP encrypts the service authorization field in the service response message according to the service authorization security policy; the hSEPP sends the service response message to the vSEPP.
  • the service response message sent to the vSEPP should be the hSEPP processed service response message.
  • the hSEPP sends the service authorization security policy to the vSEPP, it is also possible to receive the service request message sent by the vSEPP; the hSEPP decrypts the service message by using the service authorization security policy; The hSEPP sends a decrypted service request message to the service providing device.
  • the vSEPP after the vSEPP receives the service response message and the service authorization security policy sent by the hSEPP, the vSEPP also performs some processing, including: the vSEPP receives the service response message sent by the hSEPP and the service authorization security policy; The service authorization security policy decrypts the service authorization field in the service response message; and sends the service response message to the access and mobility management network element AMF.
  • the present application provides a security device for obtaining a security policy, for performing the method in any of the foregoing first aspect or any possible implementation manner of the first aspect.
  • the security device includes:
  • a sending unit configured to: when the first security edge protection proxy network element hSEPP receives the service discovery request sent by the second security edge protection proxy network element vSEPP, the hSEPP sends a security policy request to the first policy storage device;
  • a receiving unit configured to receive a security policy sent by the first policy storage device
  • the sending unit is further configured to send the security policy to the vSEPP.
  • the service request includes a target service identifier, where the security policy includes a security policy corresponding to the target service identifier.
  • the security policy is all security policies stored by the first policy storage device.
  • the security policy includes a service access security policy.
  • the security device can obtain a service authorization security policy by request.
  • the sending unit is further configured to send a first request to the second policy storage device, where the first request is used to obtain a service authorization security policy;
  • the receiving unit is further configured to receive the service authorization security policy sent by the second policy storage device;
  • the sending unit is further configured to send the service authorization security policy to the vSEPP.
  • the service response message may be processed according to the service authorization security policy.
  • the security device further includes an encryption unit.
  • the encryption unit is further configured to perform encryption processing on the service authorization field in the service response message according to the service authorization security policy;
  • the sending unit is further configured to send the processed service response message to the vSEPP.
  • the security device after the security device sends the service authorization security policy to the vSEPP, the security device also receives the notification message sent by the vSEPP. specific:
  • the receiving unit is further configured to receive a notification message that is sent by the vSEPP, where the notification message is used to indicate a security policy supported by the vSEPP or a security policy not supported by the vSEPP.
  • the present application provides an apparatus for obtaining a security policy, the apparatus comprising: a memory, a processor, a transceiver, and a computer program stored on the memory and executable on the processor, when the computer in the memory
  • the transceiver and processor perform the method of any of the above aspects or any of the possible implementations of the first aspect when the program is executed.
  • the present application provides a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.
  • the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of any of the first aspect or the first aspect of the first aspect.
  • the present application provides a chip, including: an input interface, an output interface, at least one processor, and a memory, where the input interface, the output interface, the processor, and the memory are connected by a bus.
  • the processor is operative to execute code in the memory, the processor being operative to perform the method of any of the first aspect or the first aspect of the first aspect when the code is executed.
  • FIG. 2 is a flowchart of a service call according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a security policy corresponding to a service according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another service call according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a security edge protection proxy network element according to an embodiment of the present application.
  • FIG. 7 is a physical structural diagram of a security edge protection proxy network element according to an embodiment of the present application.
  • FIG. 1 is a schematic block diagram of a 5G roaming architecture provided by an embodiment of the present application.
  • the network architecture is based on services and obtains a plurality of different types of network function modules, and the network function modules interact with each other through a serviced interface in a manner called by a network function service.
  • the network function module in the embodiment of the present application has a specific function and a network interface, and may be a network element on dedicated hardware, a software instance running on dedicated hardware, or a related platform (such as a cloud infrastructure).
  • the virtual function example on the basis of the present application is not limited thereto.
  • Radio access network responsible for accessing user equipment (UE). It can be understood that the RAN can also be abbreviated as AN in the actual expression process.
  • the UE in this embodiment may be mobile or fixed, and the UE may refer to an access terminal, a terminal device, a mobile terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, and a remote terminal.
  • the access terminal may be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), with wireless communication.
  • 5G fifth-generation
  • NR new radio
  • Access and mobility management function (AMF) module a function similar to mobility management in an existing mobile management entity (MME) for controlling UE access to network resources And managing the movement of the UE.
  • MME mobile management entity
  • the AMF module and the RAN module communicate with each other to process the access network control plane, where N2 is not a serviced interface.
  • the authentication server function (AUSF) module responsible for key generation and two-way authentication with the UE.
  • Session management function (SMF) module responsible for managing the session of the UE, including the establishment, modification and release of the session.
  • Network exposure function (NEF) module responsible for providing network function services in the core network to external network entity services, and internal and external network information conversion.
  • Network fuction module refers to a network element that can provide network services, such as AUSF, AMF or UDM.
  • Network repository function (NRF) module responsible for service discovery and other functions.
  • NRF Network repository function
  • PCF Policy control function
  • Unified data management (UDM) modules include front end (FE) and user data repository (UDR).
  • FE front end
  • UDR user data repository
  • FE is responsible for credit rating processing, location management, subscription management and other functions, and can access user subscription data stored in the UDR.
  • UDR is a user subscription data storage server, which is responsible for providing user subscription data to the front end.
  • Application function (AF) module Provides application services.
  • a UDM can be understood as a UDM network element or a UDM function network element.
  • the NRF can be understood as an NRF network element or an NRF function network element.
  • the AMF module has a serviced interface N AMF
  • the SMF module has a serviced interface N SMF
  • the AUSF module has a serviced interface N AUSF
  • the NEF module has a serviced interface N NEF
  • the NRF module has a serviced interface N
  • the NRF and PCF modules have a serviced interface N PCF
  • the UDM module has a serviced interface N UDM
  • the AF module has a serviced interface N AF .
  • the network function providing network element Producer NF provides a security policy corresponding to the registered service while registering the service with the network function database function network element NRF.
  • the NRF receives the service discovery request message from the hSEPP, the NRF returns the service related information Service profile and the service corresponding security policy in the response message.
  • the specific process is shown in Figure 2.
  • the prefix v indicates that the network function (NF) is deployed on the visited network.
  • the prefix h indicates that the network function is deployed on the home network. The following is not explained one by one.
  • the Producer NF sends a service registration request to the hNRF, which carries the network function type NF Type, the network function identifier NF ID, the service information to be registered, and the corresponding security policy of each service.
  • the hNRF After receiving the service registration request sent by the Producer NF, the hNRF returns a response message to notify the registration success.
  • vNRF public land mobile network identity
  • PLMN public land mobile network identity
  • the vNRF After receiving the service discovery request message sent by the Consumer NF, the vNRF reaches the hNRF network element in the target network corresponding to the PLMN-ID via vSEPP and hSEPP.
  • the hNRF After receiving the service discovery request message from the hSEPP, the hNRF will return the service related information to the hSEPP, which may include the service authorization token (token) information, the network element instance type, and the network element address. In addition, hNRF will also provide the security policy corresponding to Service 1 to hSEPP.
  • service authorization token token
  • the security policy corresponding to the service 1 includes the service resource name (such as UE-authentications) provided by the service provider, the service calling method (method in http, such as POST), and the calling direction (request or response). , cell name (such as: ueID), protection method (such as: encryption enc).
  • the hSEPP After receiving the response message from the hNRF, the hSEPP forwards the message to the vSEPP, which contains the service 1 related information and the security policy corresponding to the service 1.
  • the vSEPP receives a response message from the hSEPP, which includes the service 1 related information and the security policy corresponding to the service 1.
  • the vSEPP then sends the Service 1 related information to the Consumer NF via the vNRF.
  • the Consumer NF sends a service request to the Consumer NF according to the service related information received in step 10, which may include SUPI information, and the SUPI is a permanent identifier of the user.
  • This message will be passed to the Consumer NF via vSEPP and hSEPP due to the inter-network interaction.
  • the vSEPP receives the service 1 request message initiated by the Consumer NF. According to the security policy received in step 8, the vSEPP performs an encryption operation on the SUPI cell in the message, and sends the processed request message to the hSEPP.
  • the hSEPP receives the Service 1 request message from the vSEPP, performs a decryption operation on the SUPI cell in the request message according to the security policy it received in step 7, and sends the processed request message to the Producer NF.
  • the Producer NF After the Producer NF receives the Service 1 request message, it will return the corresponding response message.
  • the response message carries the SUPI identifier and the sensitive cell AVP 1 to be encrypted.
  • the hSEPP receives the service 1 response message sent from the Producer NF, and according to the encryption policy corresponding to the service, the hSEPP performs an encryption operation on the SUPI and the AVP 1 in the response message.
  • the processed message is sent to vSEPP.
  • the vSEPP receives the service 1 response message returned from the hSEPP, and performs a decryption operation on the SUPI and the AVP 1 in the response message according to the encryption policy corresponding to the service.
  • the processed message is sent to the Consumer NF.
  • the security policy involved in the prior art refers to the security policy corresponding to the required service.
  • the important information for hNRF feedback is that there is no corresponding security policy.
  • the corresponding security policy is as shown in FIG. 3.
  • the following content in the resources involved in the service needs to perform the encryption operation: the UE ID in the Request message, the UE ID in the Response message, and the authentication vector 5gAkaData/av5gAka in the Response message.
  • r identifies the resource resource
  • m identifies the method method (such as POST)
  • d indicates the direction (such as request or response)
  • e indicates the element (such as user identifier ueId)
  • a indicates action (such as encryption).
  • the hNRF When the hNRF receives the service discovery request message from the hSEPP, it will return the service related information to the hSEPP, which may include the service authorization token (token) information. Specifically, the token has no corresponding processing policy. If the token is sent in the form of plain text, the token has a security risk.
  • the service authorization token token
  • FIG. 4 is a schematic flowchart of a method for obtaining a security policy provided by an embodiment of the present application, and the method may be applied to a network architecture as shown in FIG. 1.
  • the method includes:
  • the Consumer NF initiates a service discovery request to the vNRF, where the service name 1 and the target PLMN-ID are carried;
  • the service name 1 is a service required by the Consumer NF.
  • the Comsumer NF is the network element of the required service.
  • the vNRF sends the request message to the hNRF through the vSEPP/hSEPP, and the hNRF returns the service profile related information of the service 1, which includes the token information corresponding to the service 1.
  • the hSEPP sends a request message to the first policy storage device, the request message being used to request a security policy.
  • the first policy storage device may be an hPCF, and may be a hUDM or an hNRF.
  • the step 5 has two implementation manners, including: the request message may be a security policy corresponding to all services stored in the request policy storage device (the specific implementation manner is as shown in step 5a), or may be a request for a service.
  • the corresponding security policy (the specific implementation is as shown in step 5b).
  • the hSEPP sends a request message to the policy storage device for requesting a security policy that is available to all services;
  • the hSEPP requests the policy storage device for the security policy corresponding to the service 1; in addition, the hSEPP can also request the NRF service authorization security policy.
  • the hSEPP needs to request the service authorization security policy from the second policy storage device.
  • the second policy storage device may be an hPCF, and may be a hUDM or an hNRF.
  • the hSEPP needs to request the first storage device for the security policy corresponding to the required service and request the service from the second policy storage device.
  • Authorized security policy For example, if the first policy storage device is a UDM or a PCF and the second policy storage device is an hNRF, the hSEPP needs to request the first storage device for the security policy corresponding to the required service and request the service from the second policy storage device. Authorized security policy.
  • the security policy corresponding to the required service may be obtained by sending a request message to the first policy storage device.
  • Service authorization security policy may be obtained by sending a request message to the first policy storage device.
  • the first policy storage device can be obtained by sending a request message to the first policy storage device. All security policies. Includes the security policy and service authorization security policy for the required service.
  • Step 5 can also be performed before step 4.
  • the hSEPP returns the service authorization security policy and the security policy of the service 1 in the service discovery response message, and encrypts the token value in the service 1 related information according to the service authorization security policy;
  • the service authorization security policy and the security policy of the service 1 can be combined into one policy.
  • the 6a.vSEPP After receiving the response message from hSEPP, the 6a.vSEPP decrypts the token value in the response message according to the service authorization security policy. In addition, vSEPP accepts the acknowledgment message according to its configuration (or calls the notification service of hSEPP) to accept the security policy, and may also include vSEPP-supported (or unsupported) security policies.
  • vSEPP sends Service 1 related information to Consumer NF via vNRF.
  • step C Same as prior art step C.
  • the Consumer NF sends a service request message through vSEPP.
  • the vSEPP encrypts a specific cell in the request message, and sends the processed request message to the hSEPP, and the hSEPP decrypts the specific cell in the request message and forwards the message to the Producer NF.
  • the response message returned by Producer NF is encrypted by hSEPP according to the security policy, and vSEPP performs the decryption operation and forwards it to Consumer NF.
  • a carrier network may include multiple network elements with the same function.
  • the security policies corresponding to the same function are the same. Therefore, when a network element of the same function registers with the NRF, the security policy is transmitted every time, but the NRF can be stored once, and transmitting the same security policy multiple times wastes network bandwidth.
  • each AUSF will transmit the authentication service and the authentication service corresponding policies when registering with the NRF, but the policies of the authentication services provided by the 10 AUSFs are the same. Then the same security policy is transmitted 10 times, thus wasting bandwidth.
  • the present invention provides a method for obtaining a security policy, which may save bandwidth.
  • the method specifically includes: the NRF receiving service provides a service registration request sent by the network element, where the service registration request includes a service that needs to be registered; The NRF does not store the security policy corresponding to the service that needs to be registered, and sends a service providing response to the service providing network element; and receives the security policy sent by the service providing network element.
  • the service providing response includes a service list, so that the service providing network element provides a security policy corresponding to each service in the service list.
  • the service providing network element performs a symmetric operation, and specifically includes: the service providing network element sends a service registration request to the NRF, where the service registration request includes a service that needs to be registered; and receives the service provided by the service management network element.
  • the service providing response includes a service list; and the security management policy corresponding to each service in the service list is sent to the service management network element.
  • FIG. 5 is a schematic flowchart of a method for obtaining a security policy according to an embodiment of the present application. This method can be applied, for example, to the network architecture as shown in FIG.
  • the Producer NF sends a service registration request to the NRF, which carries information such as NF Type, NF ID, and NF Services;
  • the hNRF If the hNRF does not store the security policy corresponding to the registered service, the hNRF requests the required security policy information from the Producer NF;
  • Producer NF provides the requested security policy information to hNRF.
  • the hSEPP sends a service discovery request to the hNRF, where the carrying indication information indicates that the NRF provides the service 1 and the service authorization security policy;
  • the hNRF carries the service 1profi le in the response message, which includes the service related information such as the token, and the security policy corresponding to the service 1 and the service authorization;
  • the method for obtaining a security policy provided by the embodiment of the present application is described in detail above with reference to FIG. 3 to FIG. 5.
  • the apparatus for obtaining a security policy provided by the embodiment of the present application is described below with reference to FIG. 6 to FIG.
  • FIG. 6 shows an apparatus 600 for obtaining a security policy provided by an embodiment of the present application.
  • the apparatus 600 includes:
  • the sending unit 610 is configured to: when the first security edge protection proxy network element hSEPP receives the service discovery request sent by the second security edge protection proxy network element vSEPP, the hSEPP sends a security policy request to the first policy storage device;
  • the receiving unit 620 is configured to receive a security policy sent by the first policy storage device.
  • the sending unit 610 is further configured to send the security policy to the vSEPP.
  • the service request includes a target service identifier, where the security policy includes a security policy corresponding to the target service identifier.
  • the security policy is all security policies stored by the first policy storage device.
  • the security policy includes a service access security policy.
  • the second policy storage device needs to be requested.
  • the sending unit 610 is further configured to send the first request to the second policy storage device, where the first request is used to obtain a service authorization security policy;
  • the receiving unit 630 is further configured to receive the service authorization security policy sent by the second policy storage device.
  • the sending unit 620 is further configured to send the service authorization security policy to the vSEPP.
  • the security device further includes an encryption unit 620;
  • the encryption unit 620 is further configured to perform encryption processing on the service authorization field in the service response message according to the service authorization security policy;
  • the sending unit 630 is further configured to send the processed service response message to the vSEPP.
  • the receiving unit 610 is further configured to receive the notification message sent by the vSEPP, where the notification message is used to indicate a security policy supported by the vSEPP or a security policy not supported by the vSEPP.
  • the apparatus 600 herein is embodied in the form of a functional unit.
  • the term "unit” as used herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (eg, a shared processor, a proprietary processor, or a group) for executing one or more software or firmware programs. Processors, etc.) and memory, merge logic, and/or other suitable components that support the described functionality.
  • ASIC application specific integrated circuit
  • processor eg, a shared processor, a proprietary processor, or a group
  • memory merge logic, and/or other suitable components that support the described functionality.
  • the device 600 may be specifically the hSEPP shown in FIG. 3, and the device 600 may be used to perform the processes and/or steps performed by the hSEPP in FIG. Avoid repetition and we will not repeat them here.
  • FIG. 7 shows an apparatus 700 for invoking a network function service provided by an embodiment of the present application.
  • the apparatus 700 may be the hSEPP described in FIG. 7, and the hSEPP may adopt a hardware architecture as shown in FIG. 7.
  • the hSEPP can include a processor 710, a transceiver 720, and a memory 730 that communicate with one another via internal connection paths.
  • the processor 710 may include one or more processors, for example, including one or more central processing units (CPUs).
  • processors for example, including one or more central processing units (CPUs).
  • CPUs central processing units
  • the CPU may be a single core CPU, and It can be a multi-core CPU.
  • the transceiver 720 is configured to transmit and receive data and/or signals, as well as to receive data and/or signals.
  • the transceiver can include a transmitter and a receiver for transmitting data and/or signals, and a receiver for receiving data and/or signals.
  • the memory 730 includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), and a read only memory.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read only memory
  • CD-ROM compact disc read-only memory
  • the memory 730 is used to store program code and data of the authorization module, and may be a separate device or integrated in the processor 710.
  • the processor 710 is configured to control the transceiver to communicate with the vSEPP or hNRF.
  • the processor 710 is configured to control the transceiver to communicate with the vSEPP or hNRF.
  • Figure 7 only shows a simplified design of the authorization module.
  • the authorization module may also include other necessary components, including but not limited to any number of transceivers, processors, controllers, memories, etc., and all authorization modules that can implement the present application are protected by the present application. Within the scope.
  • the device 700 can be a chip, for example, a communication chip that can be used in an authorization module for implementing related functions of the processor 710 in the authorization module.
  • the chip can be a field programmable gate array for implementing related functions, a dedicated integrated chip, a system chip, a central processing unit, a network processor, a digital signal processing circuit, a microcontroller, and a programmable controller or other integrated chip.
  • the chip may include one or more memories for storing program code that, when executed, causes the processor to perform the corresponding functions.
  • network elements involved in FIG. 3 to FIG. 5 may be configured as shown in FIG. 7 and include components such as a processor, a transceiver, a memory, and the like, and the program code is stored in the memory. When the code is executed, each network element performs the functions shown in FIGS. 3 to 5.
  • first network function module, the second network function module, and the authorization module in the embodiment of the present application all have specific functions and network interfaces, and may be different network elements on the same dedicated hardware, or may be the same dedicated
  • the different software instances running on the hardware may also be different virtual function instances on the same related platform (such as the cloud infrastructure), which is not limited in this embodiment.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in or transmitted by a computer readable storage medium.
  • the computer instructions may be from a website site, computer, server or data center via a wired (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) Another website site, computer, server, or data center for transmission.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital versatile disc (DVD)), or a semiconductor medium (for example, an SSD).
  • the program can be stored in a computer readable storage medium, when the program is executed
  • the flow of the method embodiments as described above may be included.
  • the foregoing storage medium includes various media that can store program codes, such as a ROM or a RAM, a magnetic disk, or an optical disk.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present application which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk, and the like, which can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种获取安全策略的方法和装置，该方法包括：当归属网络中的安全边缘保护代理网元hSEPP接收到拜访网络中的安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP会从第一策略存储设备中获取安全策略，该安全策略包括服务授权安全策略；所述hSEPP根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密处理；所述hSEPP向所述vSEPP发送经过处理的服务响应消息。其中，所述服务响应消息中包括服务授权安全策略。以使得vSEPP和hSEPP根据该服务授权安全策略进行消息的加解密，从而提升消息传输的安全性。

Description

一种获取安全策略的方法及设备
本申请要求于2018年4月9日提交中国国家知识产权局、申请号为201810308968.9、发明名称为“一种获取安全策略的方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，更具体地，涉及通信领域中获取安全策略的方法及设备。
背景技术
随着通信系统的不断发展，基于服务的网络架构(service based architecture，SBA)得到的广泛的应用，在基于服务的网络架构中，根据能够提供的特定网络功能的网络实体称为网络功能(network function，NF)模块，网络功能可以以服务的方式提供。
在基于服务的网络架构中，任意两个网络功能模块可以通过服务化接口以网络功能服务调用的方式交互。但是在漫游的场景下，需要注意拜访网络和归属网络之间消息传递时的安全。
如图1所示，在漫游架构中确定了安全边界保护代理(Security Edge Protection Proxy，SEPP)功能。SEPP主要的功能是完成拜访网络和归属网络消息传递时的安全。其中vSEPP表示拜访网络中部署的SEPP，hSEPP表示归属网络中部署的SEPP。
具体的，vSEPP和hSEPP之间的安全机制可应用于保护应用层传输的安全。其中，应用层安全指的是如何对N32消息中的某些敏感信息进行保护(例如加密)。如何获取安全策略，使得vSEPP/hSEPP根据该安全策略对N32消息中的某些敏感信息进行保护显得尤为重要。
发明内容
本申请提供一种获取安全策略的方法和设备，通过vSEPP与第一策略设备的交互以获取安全策略，进而向hSEPP发送该策略，以使得vSEPP与hSEPP根据该安全策略进行信息传输从而提升漫游场景下信息传输的安全性。
第一方面，本申请提供了一种获取安全策略的方法，该方法包括：当第一安全边缘保护代理网元hSEPP接收到第二安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP向第一策略存储设备发送安全策略请求；接收所述第一策略存储设备发送的安全策略；向vSEPP发送所述安全策略。
其中，需要指出的是，第一安全边缘保护代理网元hSEPP为归属网络中的安全边缘保护代理网元；第二安全边缘保护代理网元vSEPP为拜访网络中的安全边缘保护代理网元。
其中，需要指出的是，该第一策略存储设备可以是统一数据管理(unified data management，UDM)网元，也可以是策略管控功能网元(policy control function，PCF)，还可以是网络功能数据库功能(Network repository function，NRF)网元。
其中，需要指出的是，该第一策略存储设备中可以存储该运营商网络中所有网络功能所对应的安全策略，也可以存储服务授权安全策略。hSEPP通过与第一策略存储网元交互以获 取安全策略，并向vSEPP发送该策略，那么hSEPP和vSEPP就可以利用该安全策略进行信息传输，从而提升信息传输的安全性。
结合第一方面，可选的，所述服务请求中包括目标服务标识；所述安全策略为所述目标服务标识对应的安全策略。该安全策略包括服务访问安全策略。可以理解的是，该目标服务标识可以是所需服务的名称，也可以所述服务的序列号。
结合第一方面，可选的，所述安全策略为所述第一策略存储设备所存储的所有安全策略。其中，该安全策略包括服务访问安全策略。
另外，需要指出的是，所述第一策略存储设备所存储的所有安全策略中包括所需服务所对应的安全策略；
相应的，所述hSEPP向所述vSEPP发送所述安全策略，包括：
所述hSEPP向所述vSEPP发送所需服务所对应的安全策略。
进一步，如果所述第一策略存储设备所存储的所有安全策略中包括服务授权安全策略和所需服务所对应的安全策略；
相应的，所述hSEPP向所述vSEPP发送所述安全策略，包括：
所述hSEPP向所述vSEPP发送所述服务授权安全策略和所需服务所对应的安全策略。
结合上述描述，可以理解的是，如果hSEPP没有存储或者通过上述交互没有接收到服务授权按策策略，那么hSEPP还需要获取服务授权安全策略。具体的，可以向第二策略存储设备发送获取请求。
需要指出的是，如果第二策略存储设备与所述第一策略存储设备为同一设备。那么该hSEPP可通过上述的安全策略请求来获取所述服务授权安全策略。
具体的，hSEPP接收vSEPP发送的服务发现请求；所述hSEPP向第一策略存储设备发送安全策略请求；所述hSEPP接收所述第一策略存储设备发送的安全策略，其中，该安全策略就包括服务授权安全策略；当然，该安全策略还包括所需服务对应的安全策略或所述第一策略存储设备存储的所有服务所对应的安全策略；所述hSEPP向所述vSEPP发送所述安全策略。可以理解的是，第一策略存储设备中存储的每项服务都有对应的安全策略。比如，服务1对应服务1的安全策略，服务2对应服务2的安全策略。在此不再一一例举。
另外，可以理解的是，如果第二策略存储设备与所述第一策略存储设备不是同一设备。那么该hSEPP可向所述第二策略存储设备发送请求消息来获取服务授权安全策略。其中，该第二策略存储设备可以UDM，也可以是PCF，还可以是NRF网元。具体的，所述hSEPP向所述第二策略存储设备发送第一请求，其中，所述第一请求用于获取服务授权安全策略；接收所述第二策略存储设备发送的所述服务授权安全策略；向所述vSEPP发送所述服务授权安全策略。另外，需要指出的是，所述hSEPP和所述vSEPP所支持的安全策略可能相同，也可能不同，那么，所述hSEPP向所述vSEPP发送所述服务授权安全策略之后，所述vSEPP会反馈对于所述服务授权安全策略的支持情况，当然，hSEPP也会接收到vSEPP的反馈。具体的，所述hSEPP接收所述vSEPP发送的通知消息，所述通知消息用于指示所述vSEPP所支持的安全策略或所 述vSEPP所不支持的安全策略。可以理解的是，如果存在vSEPP不支持的安全策略的话，所述hSEPP和所述vSEPP可以进行策略协商。
进一步，需要指出的是，hSEPP接收到服务授权安全策略之后，会根据该服务授权安全策略对服务响应消息中的部分字段进行加密。
具体的，所述hSEPP根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密；所述hSEPP向所述vSEPP发送所述服务响应消息。
可以理解的是，向所述vSEPP发送的所述服务响应消息应该是所述hSEPP处理过的服务响应消息。
进一步，需要指出的是，hSEPP向vSEPP发送完服务授权安全策略之后，还有可能接收到所述vSEPP发送的业务请求消息；所述hSEPP利用所述服务授权安全策略对所述业务消息进行解密；所述hSEPP向服务提供设备发送解密的业务请求消息。
可以理解的是，vSEPP接收到hSEPP发送的服务响应消息和服务授权安全策略之后，也会做一些处理，具体包括：vSEPP接收hSEPP发送的服务响应消息和服务授权安全策略；所述vSEPP根据所述服务授权安全策略对所述服务响应消息中的的服务授权字段进行解密；向接入和移动管理网元AMF发送所述服务响应消息。
第二方面，本申请提供了一种获取安全策略的安全设备，用于执行上述第一方面或第一方面的任意可能的实现方式中的方法。所述安全设备包括：
发送单元，用于当第一安全边缘保护代理网元hSEPP接收到第二安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP向第一策略存储设备发送安全策略请求；
接收单元，用于接收所述第一策略存储设备发送的安全策略；
所述发送单元，还用于向所述vSEPP发送所述安全策略。
其中，可选的，所述服务请求中包括目标服务标识；所述安全策略包括所述目标服务标识对应的安全策略。
其中，可选的，所述安全策略为所述第一策略存储设备所存储的所有安全策略。
其中，可选的，所述安全策略包括服务访问安全策略。
结合第二方面，可以理解的是，该安全设备可以通过请求来获取服务授权安全策略。具体的，所述发送单元，还用于向所述第二策略存储设备发送第一请求，其中，所述第一请求用于获取服务授权安全策略；
所述接收单元，还用于接收所述第二策略存储设备发送的所述服务授权安全策略；
所述发送单元，还用于向所述vSEPP发送所述服务授权安全策略。
可选的，收到服务授权安全策略后，可以根据服务授权安全策略对服务响应消息进行处理，具体的，所述安全设备还包括加密单元；
所述加密单元，还用于根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密处理；
所述发送单元，还用于向所述vSEPP发送经过处理的服务响应消息。
可选的，该安全设备向所述vSEPP发送所述服务授权安全策略之后，还会收到vSEPP发送的通知消息。具体的：
所述接收单元，还用于接收所述vSEPP发送的通知消息，所述通知消息用于指示所述vSEPP所支持的安全策略或所述vSEPP所不支持的安全策略。
第三方面，本申请提供了一种获取安全策略的装置，该装置包括：存储器、处理器、收发器及存储在该存储器上并可在该处理器上运行的计算机程序，当存储器中的计算机程序被执行时，该收发器和处理器执行上述第一方面或第一方面的任意可能的实现方式中的方法。
第四方面，本申请提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第五方面，本申请提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意可能的实现方式中的方法。
第六方面，本申请提供了一种芯片，包括：输入接口、输出接口、至少一个处理器、存储器，所述输入接口、输出接口、所述处理器以及所述存储器之间通过总线相连，所述处理器用于执行所述存储器中的代码，当所述代码被执行时，所述处理器用于执行上述第一方面或第一方面的任意可能的实现方式中的方法。
附图说明
图1是本申请实施例的5G漫游架构图；
图2是本申请实施例的一种服务调用流程图；
图3是本申请实施例的一种服务对应的安全策略示意图；
图4是本申请实施例的另一种服务调用流程图；
图5是本申请实施例的另一种服务调用流程图；
图6是本申请实施例的一种安全边缘保护代理网元的结构示意图；
图7是本申请实施例的一种安全边缘保护代理网元的物理结构图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
图1示出了本申请实施例提供的5G漫游架构的示意性框图。该网络架构以服务为基础，得到多种不同类型的网络功能模块，网络功能模块之间通过服务化接口以网络功能服务调用的方式进行交互。
应理解，本申请实施例中的网络功能模块具有特定功能和网络接口，可以是专用硬件上的网元，也可以是专用硬件上运行的软件实例，还可以是相关平台(如云基础设施上)上的 虚拟功能实例，本申请实施例对此不作限定。
下面将结合图1对该基于服务的网络架构中的各个模块进行介绍：
无线接入网络(radio access network，RAN)：负责用户设备(user equipment，UE)的接入。可以理解的是，在实际表述过程中，RAN也可以简写为AN。
可选地，本申请实施例中的UE可以是移动的或固定的，该UE可以指接入终端、终端设备、移动终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置等。接入终端可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备、未来的第五代(5th generation，5G)系统或新无线(new radio，NR)系统中的用户设备。
访问与移动性管理功能(access and mobility management function，AMF)模块：负责与现有的移动管理实体(mobile management entity，MME)中的移动性管理类似的功能，用于控制UE对网络资源的访问和对UE的移动进行管理。AMF模块与RAN模块互相通信，以对接入网控制面进行处理，其中，N2不是服务化接口。
鉴权服务功能(authentication server function，AUSF)模块：负责密钥的生成，以及与UE之间的双向鉴权。
会话管理功能(session management function，SMF)模块：负责管理UE的会话，包括会话的建立、修改和释放。
网络开放功能(network exposure function，NEF)模块：负责将核心网内的网络功能服务安全地提供给外部网络实体服务，以及内外网信息转换等。
网络功能(network fuction)模块：是指一个能够提供网络服务的网元，比如AUSF、AMF或UDM。
网络功能数据库功能(Network repository function，NRF)模块：负责服务发现等功能。当然，网络功能数据库的英文全称还可以是NF repository function.
策略管控功能(policy control function，PCF)模块：负责管理网络行为的统一策略框架；提供策略规则给控制平面执行等功能。
统一数据管理(unified data management，UDM)模块：包括前端(front end，FE)和用户数据库(user data repository，UDR)。其中，FE负责信用评级处理、位置管理、订阅管理等功能，并可以访问存储在UDR中的用户订阅数据，UDR是一个用户订阅数据存储服务器，负责向前端提供用户订阅数据。
应用功能(application function，AF)模块：提供应用服务。
其中，上述各个模块也可以解释为各个网元或功能网元。比如UDM可以理解为UDM网元或UDM功能网元，NRF可以理解为NRF网元或NRF功能网元。
如图1中所示，AMF模块具有服务化接口N AMF、SMF模块具有服务化接口N SMF、AUSF模块具有服务化接口N AUSF、NEF模块具有服务化接口N NEF、NRF模块具有服务化接口N NRF、PCF模块具有服务化接口N PCF、UDM模块具有服务化接口N UDM、AF模块具有服务化接口N AF。
应理解，本申请实施例中的各个网络功能模块的服务化接口的还可以为其它名称，本申 请实施例对此不作限定。
如图2所示，现有技术中提供了一种获取服务对应的安全策略的方法。具体的，网络功能提供网元Producer NF在向网络功能数据库功能网元NRF注册服务的同时，提供所注册服务对应的安全策略。当NRF收到来自hSEPP的服务发现请求消息时，则在响应消息中返回服务相关信息Service profile及服务对应安全策略。具体流程如图2所示(前缀v表示网络功能(Network Function，NF)部署在拜访网络，前缀h表示网络功能部署在归属网络，后文不再一一解释)。
步骤A)服务注册
1.Producer NF向hNRF发送服务注册请求，其中携带自身网络功能类型NF Type，网络功能标识NF ID，待注册服务信息及各服务对应安全策略；
2.hNRF收到Producer NF所发送的服务注册请求后，返回响应消息通知注册成功。
步骤B)安全策略传递
3.若拜访网络中的服务请求网元Consumer NF需调用归属网络Producer NF所提供的服务1，则向vNRF发起服务发现请求消息，其中携带目标公共陆地移动网络标识(public land mobile network identity，PLMN-ID)及服务名1，指示需查找目标网络中可提供服务1的服务相关信息，如目标网络功能实例标识NF instance id，NF Type，NF地址/域名等信息。
4-5.当vNRF收到来自Consumer NF所发送的服务发现请求消息后，则将该消息经由vSEPP和hSEPP到达PLMN-ID对应的目标网络中的hNRF网元。
6.当hNRF收到来自hSEPP的服务发现请求消息后，将返回服务相关信息至hSEPP，其中可包含服务授权令牌(token)信息，网元实例类型，网元地址等信息。此外，hNRF还将提供服务1所对应的安全策略至hSEPP。
其中，需要指出的是，该服务1对应的安全策略包括服务提供者提供的服务资源名称(如UE-authentications)，服务调用方法(http中的方法，如POST)，调用方向(请求或者响应),信元名称(如：ueID)，保护方法(如：加密enc)。
7.hSEPP收到来自hNRF的响应消息后，则将该消息转发至vSEPP，其中包含服务1相关信息及服务1所对应的安全策略。
8-10.vSEPP接收来自hSEPP的响应消息，其中包含服务1相关信息及服务1所对应的安全策略。随后vSEPP将服务1相关信息经由vNRF发送至Consumer NF。
C)服务消息传递
11.Consumer NF根据第10步中所收到的服务相关信息，向Consumer NF发送业务请求，其中可包含SUPI信息，SUPI为用户永久标识。由于涉及网间交互，该消息将经由vSEPP和hSEPP传递至Consumer NF。
12.vSEPP接收来自Consumer NF所发起的服务1请求消息，根据步骤8中所接收的安全策略，vSEPP对消息中的SUPI信元执行加密操作，并将处理后的请求消息发送至hSEPP。
13.hSEPP接收来自vSEPP的服务1请求消息，根据其在步骤7所收到的安全策略对请求消息中的SUPI信元执行解密操作，并将处理后的请求消息发送至Producer NF。
14.Producer NF接收到该服务1请求消息后，将返回相应的响应消息。响应消息中可 携带SUPI标识，及需加密的敏感信元AVP 1。
15.hSEPP接收来自Producer NF所发送的服务1响应消息，根据该服务对应的加密策略，hSEPP对响应消息中的SUPI及AVP 1执行加密操作。并将处理后的消息发送至vSEPP。
16.vSEPP接收来自hSEPP所返回的服务1响应消息，并根据该服务对应的加密策略，对响应消息中的SUPI及AVP 1执行解密操作。并将处理后的消息发送至Consumer NF。
结合图2以及步骤1-16，可以理解的是，现有技术中涉及到安全策略是指所需服务所对应的安全策略。对于hNRF反馈的重要的信息是没有对应的安全策略的。
如图3所示，当拜访网络请求的是归属网络中的AUSF所提供的Nausf_Auth服务，其对应的安全策略如图3所示。该服务所涉及资源中以下内容需执行加密操作：Request消息中的UE ID，Response消息中的UE ID；Response消息中的鉴权向量5gAkaData/av5gAka。另外，需要指出的是，图3中r标识资源resource，m标识方法method(比如POST)，d表示方向(比如请求或响应)，e表示元素(比如用户标识ueId)，a表示动作(比如加密)。当hNRF收到来自hSEPP的服务发现请求消息后，将返回服务相关信息至hSEPP，其中可包含服务授权令牌(token)信息。具体的，该token是没有对应的处理策略的，如果以明文的形式进行发送，该token会存在安全风险。
图4示出了本申请实施例提供的获取安全策略的方法的示意性流程图，该方法可以应用于如图1中所示的网络架构。所述方法包括：
1.Consumer NF向vNRF发起服务发现请求，其中携带服务名1及目标PLMN-ID；
其中，可以理解的是，服务名1为Consumer NF所需的服务。该Comsumer NF为所需服务的网元。
2-4.vNRF通过vSEPP/hSEPP发送该请求消息至hNRF，hNRF返回服务1相关信息Service profile，其中包含服务1对应token信息。
5.hSEPP向第一策略存储设备发送请求消息，该请求消息用于请求安全策略。
其中，所述第一策略存储设备可以是hPCF，可以是hUDM，也可以是hNRF。
具体的，步骤5有两种实现方式，包括：该请求消息可以是请求策略存储设备所存储的所有服务所对应的安全策略(具体实现方式如步骤5a所示)，也可以是请求某一服务所对应的安全策略(具体实现方式如步骤5b所示)。
5a.hSEPP向策略存储设备发送请求消息，用于请求所有服务可用的安全策略；
5b.hSEPP向策略存储设备请求服务1对应的安全策略；此外，hSEPP同时还可请求NRF的服务授权安全策略。
可选地，如果第一策略存储设备上没有存储服务授权安全策略，hSEPP需要向第二策略存储设备请求服务授权安全策略。其中，该第二策略存储设备可以是hPCF，可以是hUDM，也可以是hNRF。
举例来说，比如第一策略存储设备是UDM或PCF，第二策略存储设备为hNRF.那么hSEPP就需要向第一存储设备请求所需服务所对应的安全策略，向第二策略存储设备请求服务授权安全策略。
举例来说，比如第一策略存储设备是hNRF，第二策略存储设备与第一策略存储设备相同，那么，可通过向第一策略存储设备发送请求消息来获取所需服务所对应的安全策略以及服务授权安全策略。
举例来说，比如第一策略存储设备是hNRF，第二策略存储设备与第一策略存储设备相同，那么，可通过向第一策略存储设备发送请求消息来获取所述第一策略存储设备所存储的所有安全策略。包括所需服务所对应的安全策略以及服务授权安全策略。
注：步骤5也可在步骤4前执行.
6.hSEPP在服务发现响应消息中返回服务授权安全策略以及服务1的安全策略，并根据所述服务授权安全策略对服务1相关信息中的token值进行加密；
其中，服务授权安全策略以及服务1的安全策略可以合并为1个策略。
6a.vSEPP收到来自hSEPP的响应消息后，根据服务授权安全策略对响应消息中的token值进行解密。此外，vSEPP根据自身配置返回确认消息确认(或者调用hSEPP的通知服务)接受该安全策略，此处还可能包含vSEPP支持的(或者不支持的)安全策略。
7-8.vSEPP经由vNRF将服务1相关信息发送至Consumer NF。
C)同现有技术步骤C。Consumer NF通过vSEPP发送服务请求消息。vSEPP对请求消息中特定信元进行加密，并将处理过的请求消息发送至hSEPP，由hSEPP对该请求消息中的特定信元进行解密，并转发该消息至Producer NF。Producer NF所返回响应消息则由hSEPP根据安全策略进行加密，vSEPP执行解密操作并转发至Consumer NF。
结合图2可知，现有技术中，网络功能提供网元Producer NF向NRF发送服务注册请求时，需要提供服务标识以及该服务对应的安全策略。需要指出的是，一个运营商网络中可能包括多个功能相同的网元，同一个运营商网络中，相同的功能对应的安全策略是相同的。因此，相同功能的网元在NRF注册时，每次都会传输安全策略，但是NRF只要存储一次就可以了，多次传输相同的安全策略会浪费网络带宽。举例来说，A运营商网络在10个区域部署了10个AUSF，那么每个AUSF向NRF注册时都会传输认证服务以及认证服务对应的策略，但是10个AUSF提供的认证服务的策略是相同的，那么相同的安全策略就会传输10次，从而浪费的带宽。
本发明提供了一种获取安全策略的方法，该方法可节省带宽，该方法具体包括：NRF接收服务提供网元发送的服务注册请求，所述服务注册请求中包括需要注册的服务；若所述NRF中没有存储与需要注册的服务所对应的安全策略，则向所述服务提供网元发送服务提供响应；接收所述服务提供网元发送的安全策略。另外，需要指出的是，所述服务提供响应中包括服务列表；以使得所述服务提供网元提供所述服务列表中每种服务所对应的安全策略。
相应的，服务提供网元会执行对称的操作，具体包括：服务提供网元向NRF发送服务注册请求，所述服务注册请求中包括需要注册的服务；接收所述业务管理网元发送的服务提供响应，其中，所述服务提供响应中包括服务列表；向所述业务管理网元发送所述服务列表中每种服务所对应的安全策略。
具体的，如图5所示，图5示出了本申请实施例提供的获取安全策略的方法的示意性流程图。该方法例如可以应用于如图1所示的网络架构。
1.Producer NF向NRF发送服务注册请求，其中携带NF Type，NF ID，NF Services等信息；
2-3.若hNRF未存储所注册服务对应的安全策略，所述hNRF向Producer NF请求所需安全策略信息；
4.Producer NF提供所请求安全策略信息至hNRF。
5-7.同图4中步骤1-3；
8.hSEPP向hNRF发送服务发现请求，其中携带指示信息指示NRF提供服务1及服务授权安全策略；
9.hNRF在响应消息中携带服务1profi le，其中包含token等服务相关信息，及服务1与服务授权对应安全策略；
10-12.同实施例1中步骤7-9.
上面结合图3至图5详细描述了本申请实施例提供的获取安全策略的方法，下面将结合图6至图7描述本申请实施例提供的用于获取安全策略的装置。
图6示出了本申请实施例提供的用于获取安全策略的装置600，该装置600包括：
发送单元610，用于当第一安全边缘保护代理网元hSEPP接收到第二安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP向第一策略存储设备发送安全策略请求；
接收单元620，用于接收所述第一策略存储设备发送的安全策略；
发送单元610，还用于向所述vSEPP发送所述安全策略。
其中，可选的，所述服务请求中包括目标服务标识；所述安全策略包括所述目标服务标识对应的安全策略。
其中，可选的，所述安全策略为所述第一策略存储设备所存储的所有安全策略。
其中，可选的，所述安全策略包括服务访问安全策略。
其中，如果第一策略存储设备中没有存储服务授权安全策略的话，就需要向第二策略存储设备进行请求。
具体的，发送单元610，还用于向所述第二策略存储设备发送第一请求，其中，所述第一请求用于获取服务授权安全策略；
接收单元630，还用于接收所述第二策略存储设备发送的所述服务授权安全策略；
发送单元620，还用于向所述vSEPP发送所述服务授权安全策略。
进一步可选的，所述安全设备还包括加密单元620；
加密单元620，还用于根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密处理；
发送单元630，还用于向所述vSEPP发送经过处理的服务响应消息。
进一步可选的，接收单元610，还用于接收所述vSEPP发送的通知消息，所述通知消息用于指示所述vSEPP所支持的安全策略或所述vSEPP所不支持的安全策略。
应理解，这里的装置600以功能单元的形式体现。这里的术语“单元”可以指应用特有 集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置600可以具体为上述图3所示的的hSEPP，装置600可以用于执行上述图3中hSEPP为主体所执行流程和/或步骤，为避免重复，在此不再赘述。
图7示出了本申请实施例提供的用于调用网络功能服务的装置700，该装置700可以是图7中所述的hSEPP，该hSEPP可以采用如图7所示的硬件架构。该hSEPP可以包括处理器710、收发器720和存储器730，该处理器710、收发器720和存储器730通过内部连接通路互相通信。
该处理器710可以包括是一个或多个处理器，例如包括一个或多个中央处理单元(central processing unit，CPU)，在处理器是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该收发器720用于发送和接收数据和/或信号，以及接收数据和/或信号。该收发器可以包括发射器和接收器，发射器用于发送数据和/或信号，接收器用于接收数据和/或信号。
该存储器730包括但不限于是随机存取存储器(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程存储器(erasable programmable read only memory，EPROM)、只读光盘(compact disc read-only memory，CD-ROM)，该存储器730用于存储相关指令及数据。
存储器730用于存储授权模块的程序代码和数据，可以为单独的器件或集成在处理器710中。
具体地，所述处理器710用于控制收发器与vSEPP或hNRF通信。具体可参见方法实施例3中的描述，在此不再赘述。
可以理解的是，图7仅仅示出了授权模块的简化设计。在实际应用中，授权模块还可以分别包含必要的其他元件，包含但不限于任意数量的收发器、处理器、控制器、存储器等，而所有可以实现本申请的授权模块都在本申请的保护范围之内。
在一种可能的设计中，装置700可以为芯片，例如可以为可用于授权模块中的通信芯片，用于实现授权模块中处理器710的相关功能。该芯片可以为实现相关功能的现场可编程门阵列，专用集成芯片，系统芯片，中央处理器，网络处理器，数字信号处理电路，微控制器，还可以采用可编程控制器或其他集成芯片。该芯片中，可选的可以包括一个或多个存储器，用于存储程序代码，当所述代码被执行时，使得处理器实现相应的功能。
另外，需要指出的是，图3至图5所涉及的网元，其构造均可如图7所示，包括处理器，收发器，存储器等部件，存储器中存储有程序代码，当所述程序代码被执行时，各个网元执行如图3至图5所示的功能。
应理解，本申请实施例中的第一网络功能模块、第二网络功能模块和授权模块均为具有特定功能和网络接口，可以是同一个专用硬件上的不同网元，也可以是同一个专用硬件上运行的不同软件实例，还可以是同一个相关平台(如云基础设施上)上的不同虚拟功能实例，本申请实施例对此不作限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当 使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如SSD)等。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或RAM、磁碟或者光盘等各种可存储程序代码的介质。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储 介质包括：U盘、移动硬盘、ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (14)

  1. 一种获取安全策略的方法，其特征在于，所述方法包括：
    当第一安全边缘保护代理网元hSEPP接收到第二安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP向第一策略存储设备发送安全策略请求；
    所述hSEPP接收所述第一策略存储设备发送的安全策略；
    所述hSEPP向所述vSEPP发送所述安全策略。
  2. 根据权利要求1所述的方法，其特征在于，所述服务请求中包括目标服务标识；所述安全策略包括所述目标服务标识对应的安全策略。
  3. 根据权利要求1所述的方法，其特征在于，所述安全策略为所述第一策略存储设备所存储的所有安全策略；其中，所述第一策略存储设备所存储的所有安全策略中包括所需服务所对应的安全策略；
    所述hSEPP向所述vSEPP发送所述安全策略，包括：
    所述hSEPP向所述vSEPP发送所需服务所对应的安全策略。
  4. 根据权利要求1至3任一所述的方法，其特征在于，所述安全策略包括服务访问安全策略。
  5. 根据权利要求1至3任一所述的方法，其特征在于，所述方法还包括：
    所述hSEPP向所述第二策略存储设备发送第一请求，其中，所述第一请求用于获取服务授权安全策略；
    所述hSEPP接收所述第二策略存储设备发送的所述服务授权安全策略；
    所述hSEPP向所述vSEPP发送所述服务授权安全策略。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述hSEPP根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密处理；
    所述hSEPP向所述vSEPP发送经过处理的服务响应消息。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述hSEPP接收所述vSEPP发送的通知消息，所述通知消息用于指示所述vSEPP所支持的安全策略或所述vSEPP所不支持的安全策略。
  8. 一种安全设备，其特征在于，所述安全设备包括：
    发送单元，用于当第一安全边缘保护代理网元hSEPP接收到第二安全边缘保护代理网元vSEPP发送的服务发现请求时，所述hSEPP向第一策略存储设备发送安全策略请求；
    接收单元，用于接收所述第一策略存储设备发送的安全策略；
    所述发送单元，还用于向所述vSEPP发送所述安全策略。
  9. 根据权利要求8所述的安全设备，其特征在于，所述服务请求中包括目标服务标识；所述安全策略包括所述目标服务标识对应的安全策略。
  10. 根据权利要求8所述的安全设备，其特征在于，所述安全策略为所述第一策略存储设备所存储的所有安全策略；其中，所述第一策略存储设备所存储的所有安全策略中包 括服务授权安全策略以及所需服务所对应的安全策略；所述发送单元，具体用于向所述vSEPP发送所述服务授权安全策略以及所需服务所对应的安全策略。
  11. 根据权利要求8至10任一所述的安全设备，其特征在于，所述安全策略包括服务访问安全策略。
  12. 根据权利要求8至10任一所述的安全设备，其特征在于，
    所述发送单元，还用于向所述第二策略存储设备发送第一请求，其中，所述第一请求用于获取服务授权安全策略；
    所述接收单元，还用于接收所述第二策略存储设备发送的所述服务授权安全策略；
    所述发送单元，还用于向所述vSEPP发送所述服务授权安全策略。
  13. 根据权利要求12所述的安全设备，其特征在于，所述安全设备还包括加密单元；
    所述加密单元，还用于根据所述服务授权安全策略对服务响应消息中的服务授权字段进行加密处理；
    所述发送单元，还用于向所述vSEPP发送经过处理的服务响应消息。
  14. 根据权利要求13所述的安全设备，其特征在于，
    所述接收单元，还用于接收所述vSEPP发送的通知消息，所述通知消息用于指示所述vSEPP所支持的安全策略或所述vSEPP所不支持的安全策略。
PCT/CN2019/080915 2018-04-09 2019-04-02 一种获取安全策略的方法及设备 WO2019196699A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810308968.9 2018-04-09
CN201810308968.9A CN110366159B (zh) 2018-04-09 2018-04-09 一种获取安全策略的方法及设备

Publications (1)

Publication Number Publication Date
WO2019196699A1 true WO2019196699A1 (zh) 2019-10-17

Family

ID=68163002

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/080915 WO2019196699A1 (zh) 2018-04-09 2019-04-02 一种获取安全策略的方法及设备

Country Status (2)

Country Link
CN (1) CN110366159B (zh)
WO (1) WO2019196699A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022023491A1 (en) * 2020-07-31 2022-02-03 Telefonaktiebolaget Lm Ericsson (Publ) Authentication of a wireless device in a wireless communication network

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019158716A1 (en) * 2018-02-19 2019-08-22 Telefonaktiebolaget Lm Ericsson (Publ) Security negotiation in service based architectures (sba)
CN112887260A (zh) * 2019-11-30 2021-06-01 华为技术有限公司 授权方法及装置
CN113497730B (zh) * 2020-04-03 2022-11-22 大唐移动通信设备有限公司 代理的通信方法、装置及网络设备
CN114268943A (zh) * 2020-09-16 2022-04-01 华为技术有限公司 授权方法及装置
WO2022073213A1 (en) * 2020-10-09 2022-04-14 Nokia Shanghai Bell Co., Ltd. Mechanism for dynamic authorization
US11558737B2 (en) * 2021-01-08 2023-01-17 Oracle International Corporation Methods, systems, and computer readable media for preventing subscriber identifier leakage
CN115604222A (zh) * 2021-06-28 2023-01-13 中国电信股份有限公司（Cn） 移动网络边缘应用访问授权方法、系统以及介质
CN114339752A (zh) * 2021-12-30 2022-04-12 中国电信股份有限公司 安全边缘保护代理的消息发送方法、装置及相关设备
WO2024098414A1 (zh) * 2022-11-11 2024-05-16 华为技术有限公司 一种通信的方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050268092A1 (en) * 2004-04-08 2005-12-01 Texas Instruments Incorporated Methods, apparatus and systems with loadable kernel architecture for processors
US20070288989A1 (en) * 2006-06-09 2007-12-13 Nokia Corporation Method, electronic device, apparatus, system and computer program product for updating an electronic device security policy
CN107566115A (zh) * 2016-07-01 2018-01-09 华为技术有限公司 密钥配置及安全策略确定方法、装置
CN107820234A (zh) * 2016-09-14 2018-03-20 华为技术有限公司 一种网络漫游保护方法、相关设备及系统
CN107820283A (zh) * 2016-09-13 2018-03-20 华为技术有限公司 一种网络切换保护方法、相关设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050268092A1 (en) * 2004-04-08 2005-12-01 Texas Instruments Incorporated Methods, apparatus and systems with loadable kernel architecture for processors
US20070288989A1 (en) * 2006-06-09 2007-12-13 Nokia Corporation Method, electronic device, apparatus, system and computer program product for updating an electronic device security policy
CN107566115A (zh) * 2016-07-01 2018-01-09 华为技术有限公司 密钥配置及安全策略确定方法、装置
CN107820283A (zh) * 2016-09-13 2018-03-20 华为技术有限公司 一种网络切换保护方法、相关设备及系统
CN107820234A (zh) * 2016-09-14 2018-03-20 华为技术有限公司 一种网络漫游保护方法、相关设备及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022023491A1 (en) * 2020-07-31 2022-02-03 Telefonaktiebolaget Lm Ericsson (Publ) Authentication of a wireless device in a wireless communication network

Also Published As

Publication number Publication date
CN110366159A (zh) 2019-10-22
CN110366159B (zh) 2022-05-17

Similar Documents

Publication Publication Date Title
WO2019196699A1 (zh) 一种获取安全策略的方法及设备
US11956361B2 (en) Network function service invocation method, apparatus, and system
US20220052992A1 (en) Identity verification method for network function service and related apparatus
US11296877B2 (en) Discovery method and apparatus based on service-based architecture
JP6379267B2 (ja) マシンツーマシンブートストラッピング
US9154955B1 (en) Authenticated delivery of premium communication services to trusted devices over an untrusted network
KR101819556B1 (ko) 클라우드 컴퓨팅 시스템에서 패밀리 클라우드를 지원하기 위한 장치 및 방법
US8201232B2 (en) Authentication, identity, and service management for computing and communication systems
WO2020221219A1 (zh) 通信方法和通信设备
JP6936393B2 (ja) パラメータ保護方法及びデバイス、並びに、システム
EP2648392A1 (en) Application programming interface routing system and method of operating the same
JP2020527914A (ja) ネットワークセキュリティ管理方法および装置
US8990555B2 (en) Centralized key management
EP3790299A1 (en) Identity information processing method, device and system
US20220272511A1 (en) Subscription data management method and apparatus
US9154949B1 (en) Authenticated delivery of premium communication services to untrusted devices over an untrusted network
WO2022062889A1 (zh) 一种切片管理方法、装置及通信设备
JP2023527193A (ja) サービス取得方法、装置、通信機器及び可読記憶媒体
JP5466770B2 (ja) サーバにおけるスマートカード・セキュリティ機能プロファイル
US8972729B2 (en) Secure information delivery
CN114584969B (zh) 基于关联加密的信息处理方法及装置
WO2021204065A1 (zh) 一种通信方法及装置
JP2013513986A5 (zh)
EP4228303A1 (en) Communication system, communication method and communication apparatus
WO2021082558A1 (zh) 网络切片的访问控制方法、装置及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19785291

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19785291

Country of ref document: EP

Kind code of ref document: A1