WO2020147663A1 - 一种令牌处理方法及装置 - Google Patents

一种令牌处理方法及装置 Download PDF

Info

Publication number
WO2020147663A1
WO2020147663A1 PCT/CN2020/071539 CN2020071539W WO2020147663A1 WO 2020147663 A1 WO2020147663 A1 WO 2020147663A1 CN 2020071539 W CN2020071539 W CN 2020071539W WO 2020147663 A1 WO2020147663 A1 WO 2020147663A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
token
network element
function
service
Prior art date
Application number
PCT/CN2020/071539
Other languages
English (en)
French (fr)
Inventor
李飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020147663A1 publication Critical patent/WO2020147663A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/14—Mobility data transfer between corresponding nodes

Definitions

  • the embodiments of the present application relate to the field of communication technology, and in particular to a token processing method and device.
  • 3GPP defines a service-oriented network architecture. Based on this architecture, network functions are divided into several services.
  • the network function (NF) can present a general service interface to the outside, and can be called by other authorized network functions or services.
  • NF service consumer when a network function service consumer network element (NF service consumer) needs to access a certain network function service, it can apply for a token from the network storage function network element; the NRF network element is the network function
  • the service consumption network element generates a token for accessing the network function service, and sends the token to the network function service consumption network element; the network function service consumption network element provides the network function service network element according to the token ( NF service producer) requests to access network function services.
  • network function service consumption network elements will frequently apply for tokens from network storage function network elements, which results in a large workload for network storage function network elements and network function service Low efficiency.
  • the embodiments of the application provide a token processing method and device, so that multiple network function consuming network elements of the same network function type can use the same token to access network function services, thereby reducing the number of times the network function consuming network element applies for tokens , Reduce the workload of network storage function network element, improve the efficiency of network function service.
  • an embodiment of the present application provides a token processing method, which may include: a first network function service consuming network element sending first token request information to a network storage function network element.
  • the first token request information is used to request to obtain the first token of the first network function type to which the first network function service consumption network element belongs.
  • the first token is used to access the first network function service.
  • the first network function service consuming network element may receive a first token sent by the network storage function network element, the first token includes the first network function type, and the first token is suitable for a network belonging to the first network function type Functional service consumption network element.
  • the first network function service consumption network element may obtain a first token based on the first network function type from the network storage function network element, and the first token may be applicable to the service consumption network of the first network function type Therefore, multiple service consumption network elements of the first network function type can access the first network function service through the first token, thereby reducing the number of times that service consumption network elements apply for tokens to network storage function network elements , Reduce the workload of network storage function network element, improve the efficiency of network function service.
  • the first token further includes the identity information of the network function service providing network element that provides the first network function service.
  • the method further includes: the first network function service consuming network element sends first service request information to the network function service providing network element according to the identity information of the network function service providing network element, and the first service request information is used to request access to the first network Functional service; the first service request information includes the first token.
  • the first network function service consuming network element receives first response information sent by the network function service providing network element, where the first response information is used to indicate acceptance of an access request for the first network function service.
  • the first network function service consuming network element may access the first network function service provided by the network function service providing network element according to the token based on the first network function type acquired from the network storage function network element.
  • the first token request information includes a client id field in the form of a wildcard.
  • the first network function service consuming network element requested to obtain the first token based on the first network function type.
  • the wildcard may include at least one of the character "*” or the character "?".
  • the first token request information does not include the client id field.
  • the first network function service consuming network element requested to obtain the first token based on the first network function type.
  • the subject field of the first token includes the first network function type, and does not include the service function instance identifier of the network function service consumer network element NF Instance Id of the NF Service consumer.
  • the first token is based on the first network function type, and the first token can be authorized to all service consumption network elements of the first network function type.
  • the subject field of the first token includes the service function instance identifier of the network function service consumer network element in the form of a wildcard NF Instance Id of the NF Service consumer, and the other fields of the first token include The first type of network function.
  • the first token is based on the first network function type, and the first token can be authorized to all service consumption network elements of the first network function type.
  • the method before the first network function service consumption network element sends the first token request information to the network storage function network element, the method further includes: the first network function service consumption network element sends the network storage function The network element sends registration request information, and the registration request information includes the first network function type.
  • the first network function service consuming network element receives at least one token sent by the network storage function network element, the at least one token includes the first network function type, and the at least one token is used to access the at least one network function service.
  • the first network function service consuming network element can directly use the at least one token to make a request to the network function service providing network element, instead of applying for a token from the network storage function network element, thereby reducing service consumption network element applications.
  • the number of tokens reduces the workload of network storage function network elements.
  • the method further includes: the first network function service consuming network element sends subscription request information to the network storage function network element, and the subscription request information is used for a request to subscribe to the token of the first network function type event.
  • the first network function service consuming network element receives a second token sent by the network storage function network element, the second token includes the first network function type, and the second token is used to access the second network function service.
  • the first network function service consuming network element can access other network function services based on the token based on the first network function type applied by other service consuming network elements, without the need to apply for a token from the network storage function network element. It can reduce the number of token applications and reduce the workload of network storage function network elements.
  • the method further includes: the first network function service consumption network element receives another network device The sent switching request information is used to request to switch the first network function service consuming network element.
  • the first network function service consumption network element determines the second network function service consumption network element to be switched.
  • the first network function service consuming network element sends the first token to the second network function service consuming network element.
  • the second network function service consumption network element after the handover can request access to the first network function service through the first token sent by the first network function service consumption network element, without the need to apply for the second network storage function network element.
  • One token can reduce the number of times the service consumption network element applies for a token to the network storage function network element, and reduces the workload of the network storage function network element.
  • the method further includes: the first network function service consumption network element receives the third network A user information request message sent by a functional service consumption network element.
  • the first network function service consumption network element sends the first token to the third network function service consumption network element.
  • the third network function service consuming network element can request access to the first network function service through the first token sent by the first network function service consuming network element, without the need to apply for the first token from the network storage function network element. Therefore, the number of times that the service consumption network element applies for a token from the network storage function network element can be reduced, and the workload of the network storage function network element can be reduced.
  • the method further includes: the first network function service consumption network element sends the first order The cards are stored on the functional network elements of the unstructured data storage network.
  • the method further includes: the first network function service consumption network element obtains a third token from the unstructured data storage network function network element, the third token includes the first network function type, and The three tokens are used to request access to the third network function service.
  • the first network function service consumption network element can obtain other tokens (such as the third token) stored by other service consumption network elements based on the first network function type from the unstructured data storage network function network element, thereby It is possible to request access to other network function services through this other token, without the need to apply for a token from the network storage function network element, thereby reducing the number of times that service consumption network elements apply for tokens to the network storage function network element and reducing network storage The workload of functional network elements.
  • other tokens such as the third token
  • the first token further includes scope information, and the scope information is used to indicate that the first network function service can be accessed through the first token and belongs to the network function service consumption network element of the first network function type. range.
  • the range may specifically be a range set by the operator according to a preset policy, or may be a range defined in a token based on the network function type.
  • the network elements defined in this range can be considered as safe and legal service consumption network elements. Only a number of specific network elements within this range can access the corresponding network function service through the token based on the network function type, which can reduce the workload and improve the token and network function service. safety.
  • the range information is a network slice identifier, or the range information is a region region identifier.
  • the network function type may include access and mobility management function type, network slice selection function type, network open function type, network storage function type, policy control function type, unified data management type, application Function type, authentication server function type, or session management function type, etc.
  • the technical solution of the present application provides a token processing method, the method includes: a network storage function network element receives first token request information sent by a first network function service consumption network element, and the first token request information It is used to request to obtain a first token of the first network function type to which the first network function service consumption network element belongs, and the first token is used to access the first network function service.
  • the network storage function network element generates a first token, and the first token includes the first network function type; the first token is applicable to the network function service consumption network element belonging to the first network function type.
  • the network storage function network element sends the first token to the first network function service consumption network element.
  • the network storage function network element may provide the first network function service consumption network element with a first token based on the first network function type, and the first token may be applicable to the service consumption network of the first network function type Therefore, multiple service consumption network elements of the first network function type can access the first network function service through the first token, thereby reducing the number of times that service consumption network elements apply for tokens to network storage function network elements , Reduce the workload of network storage function network element, improve the efficiency of network function service.
  • the first token request information includes a client id field in the form of a wildcard.
  • the first token request information does not include the client id field.
  • the subject field of the first token includes the first network function type, and does not include the service function instance identifier of the network function service consumer network element NF Instance Id of the NF Service consumer.
  • the subject field of the first token includes the service function instance identifier of the network function service consumer network element in the form of a wildcard, NF Instance Id of the NF Service consumer.
  • the method before the network storage function network element generates the first token, the method further includes: the network storage function network element determines the network function service providing network element that provides the first network function service, and the first order The card also includes the identity information of the network element that provides the network function service.
  • the method before the network storage function network element receives the first token request information sent by the first network function service consumption network element, the method further includes: the network storage function network element receives the first network function service The registration request information sent by the consuming network element, where the registration request information includes the first network function type to which the first network function service consuming network element belongs.
  • the network storage function network element sends at least one token to the first network function service consumption network element, and the at least one token is other network function service consumption network elements belonging to the first network function type other than the first network function service consumption network element The requested token.
  • the at least one token includes the first network function type, and the at least one token is used to access at least one network function service.
  • the method further includes: the network storage function network element receives the subscription request information sent by the first network function service consumption network element, and the subscription request information is used to request subscription to the token of the first network function type. Request event.
  • the network storage function network element receives the second token request information sent by the fourth network function service consumption network element, and the second token request information is used to request the acquisition of the first network function type of the fourth network function service consumption network element. Two tokens, the second token is used to access the second network function service.
  • the network storage function network element generates a second token, the second token includes the first network function type; the second token is applicable to the network function service consumption network element belonging to the first network function type.
  • the network storage function network element sends the second token to the fourth network function service consumption network element and the first network function service consumption network element.
  • an embodiment of the present application provides a service providing method, including: a network function service providing network element receiving first service request information sent by a first network function service consuming network element.
  • the first service request information includes a first token
  • the first token includes a first network function service type
  • the first network function consuming network element belongs to the first network function service type. If the first token is successfully verified, the network function service providing network element sends first response information to the first network function service consuming network element, where the first response information is used to indicate that the access request for the first network function service is accepted.
  • the first network function service consuming network element may access the first network function service provided by the network function service providing network element according to the token based on the first network function type obtained from the network storage function network element.
  • the method further includes: the network function service providing network element receiving second service request information sent by the fifth network function service consuming network element, the second service request information including the first token, and the first order
  • the card includes the first network function service type, and the fifth network function consumption network element belongs to the first network function service type. If the second token is successfully verified, the network function service providing network element sends second response information to the fifth network function service consuming network element, where the second response information is used to indicate acceptance of the access request for the second network function service.
  • other service consuming network elements belonging to the first network function type may also request access to the first network function service through the first token based on the first network function type.
  • the embodiments of the present application provide a communication device for implementing the foregoing various methods.
  • the communication device may be the aforementioned first network function service consumption network element, or a device containing the aforementioned first network function service consumption network element; or, the communication device may be the aforementioned network storage function network element, or the aforementioned network storage function network element.
  • the communication device may provide a network element for the aforementioned network function service, or a device that includes the aforementioned network function service provider network element.
  • the communication device includes a module, unit, or means corresponding to the foregoing method, and the module, unit, or menas can be implemented by hardware, software, or hardware execution of corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above functions.
  • the communication device when the communication device is the aforementioned network storage function network element, or a device containing the aforementioned network storage function network element, the communication device may include a receiving unit, a processing unit, and a sending unit.
  • the receiving unit is configured to receive the first token request information sent by the first network function service consumption network element, and the first token request information is used to request to obtain the first network function to which the first network function service consumption network element belongs Type of the first token, the first token is used to access the first network function service.
  • the processing unit is configured to generate a first token, where the first token includes a first network function type; the first token is applicable to network function service consumption network elements belonging to the first network function type.
  • the sending unit is configured to send the first token to the first network function service consumption network element.
  • the processing unit is further configured to determine a network function service providing network element that provides the first network function service before generating the first token.
  • the first token also includes the identity information of the network element providing the network function service.
  • the receiving unit is further configured to: before receiving the first token request information sent by the first network function service consumption network element, receive the registration request information sent by the first network function service consumption network element, The registration request information includes the first network function type to which the first network function service consumption network element belongs.
  • the sending unit is further configured to send at least one token to the first network function service consumption network element, where the at least one token is a token applied for by other network function service consumption network elements of the first network function type; the at least one command
  • the card includes a first network function type, and the at least one token is used to access at least one network function service.
  • the receiving unit is further configured to receive subscription request information sent by the first network function service consuming network element, where the subscription request information is used to request a request event for subscribing to the token of the first network function type.
  • the receiving unit is further configured to receive second token request information sent by the fourth network function service consuming network element, where the second token request information is used to request to obtain information about the first network function type to which the fourth network function service consuming network element belongs.
  • the second token is used to access the second network function service.
  • the processing unit is further configured to generate a second token, the second token including the first network function type.
  • the second token is applicable to network function service consumption network elements belonging to the first network function type.
  • the sending unit is further configured to send the second token to the fourth network function service consumption network element and the first network function service consumption network element.
  • an embodiment of the present application provides a communication device, including: a processor and a memory; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device can perform any of the foregoing method.
  • the communication device may be the aforementioned first network function service consumption network element, or a device containing the aforementioned first network function service consumption network element; or, the communication device may be the aforementioned network storage function network element, or the aforementioned network storage function network element.
  • the communication device may provide a network element for the aforementioned network function service, or a device that includes the aforementioned network function service provider network element.
  • an embodiment of the present application provides a communication device, including: a processor; the processor is configured to couple with a memory, and after reading an instruction in the memory, execute the method according to any one of the foregoing aspects according to the instruction.
  • the communication device may be the aforementioned first network function service consumption network element, or a device containing the aforementioned first network function service consumption network element; or, the communication device may be the aforementioned network storage function network element, or the aforementioned network storage function network element.
  • the communication device may provide a network element for the aforementioned network function service, or a device that includes the aforementioned network function service provider network element.
  • the embodiments of the present application provide a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute any of the above aspects and any of the possibilities. Method of design.
  • the embodiments of the present application provide a computer program product containing instructions, which when run on a computer, enable the computer to execute any of the above-mentioned aspects and any possible design method.
  • the embodiments of the present application provide a communication device (for example, the communication device may be a chip or a chip system).
  • the communication device includes a processor for implementing any of the above aspects and any possible design. The functions involved.
  • the communication device further includes a memory for storing necessary program instructions and data.
  • the communication device is a chip system, it may be composed of chips, or may include chips and other discrete devices.
  • an embodiment of the present application provides a communication system that includes one or more of a first network function service consumption network element, a network storage function network element, and a network function service provision network element.
  • the first network The function service consuming network element, the network storage function network element, and the network function service providing network element are used to perform any of the foregoing aspects and any possible design method.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • Figure 2 is a flowchart of accessing a network function service provided by an embodiment of the application
  • FIG. 3 is a schematic diagram of a network architecture in a 5G communication system provided by an embodiment of this application.
  • FIG. 4 is a schematic structural diagram of a communication device provided by an embodiment of this application.
  • FIG. 5A is a flowchart of accessing another network function service provided by an embodiment of this application.
  • 5B is a flowchart of accessing another network function service provided by an embodiment of this application.
  • FIG. 6 is a flowchart of accessing another network function service provided by an embodiment of this application.
  • FIG. 7 is a flowchart of accessing another network function service provided by an embodiment of this application.
  • FIG. 8 is a flowchart of a token interaction method provided by an embodiment of the application.
  • FIG. 9 is a flowchart of another token interaction method provided by an embodiment of the application.
  • FIG. 10 is a flowchart of another token interaction method provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of another communication device provided by an embodiment of this application.
  • Network function service The service-oriented network architecture divides the network function NF into several services, which are called network function services. For example, there may be access and mobility management services, session creation, update, and release services, authentication services, and user data management services.
  • NF service consumer a network element requesting access to a network function service.
  • the network function service consumption network element will be referred to as the service consumption network element in the following uniformly.
  • NF service producer A network element that requests to provide network function services.
  • the network element when requesting access to network function services provided by other network elements, the network element may be a service consumption network element; when providing network function services for other network elements, the network element It can also be a service providing network element.
  • Network function type The type of network function corresponding to the network element that carries the network function.
  • the network function type may include access and mobility management function (AMF) type, network slice selection function (NSSF) type, network exposure function (NEF) type , Network storage function (network repository function, NRF) type, policy control function (policy control function, PCF) type, unified data management (unified data management, UDM) type, application function (application function, AF) type, authentication server function (authentication server function, AUSF) type, and session management function (session management function, SMF) type, etc.
  • AMF access and mobility management function
  • NSSF network slice selection function
  • NEF network exposure function
  • PCF Policy control function
  • UDM application function
  • application function application function, AF
  • authentication server function authentication server function
  • SMF session management function
  • network functions specific network elements that carry network functions.
  • Network slice A network used to support the logical isolation of specific network capabilities and network characteristics, which can be end-to-end (E2E) including the entire network, or part of the network functions can be shared in multiple network slices .
  • E2E end-to-end
  • the network characteristics of different network slices are not the same, and the network slices are required to be isolated from each other without affecting each other.
  • At least one of the following or similar expressions refers to any combination of these items, including any combination of single items or plural items.
  • at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.
  • words such as “first” and “second” are used to distinguish the same or similar items whose functions and functions are basically the same. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the quantity and execution order, and the words “first” and “second” do not limit the difference.
  • the token processing method provided in the embodiment of the present application can be applied to the communication system 100 shown in FIG. 1.
  • the communication system 100 may include a service consumption network element 101, a network storage function network element 102, and a service provision network element 103.
  • the service consuming network element 101 may request a token (or access token) from the network storage function network element 102, and request the service providing network element 103 to access the network function service based on the token.
  • the access authorization mechanism for network function services defined between service consumption network elements, network storage function network elements, and service provision network elements Based on OAuth 2.0.
  • the network storage function network element corresponds to the authorization server in OAuth 2.0
  • the service consumption network element corresponds to the client in OAuth 2.0
  • the service provision network element corresponds to the resource server in OAuth 2.0.
  • the access authorization process can mainly include: 1. The service consumption network element registers on the network storage function network element; 2. The service provision network element registers on the network storage function network element; 3. The service consumption network element Send a token request message to the network storage function network element to request to obtain (or apply for) a token; 4. The network storage function network element generates a token based on the service consumption network element; 5. The network storage function network element sends the service The consumer network element sends the token; 6. The service consumer network element requests the service provider network element to access network function services based on the token; 7. The service provider network element verifies the integrity and digital signature of the token sent by the service consumer network element 8. After the token verification is successful, the service providing network element sends response information to the service consuming network element to accept the service access request.
  • the token request message sent by the service consumer network element to the network storage function network element carries the expected service name (expected service name), the consumer network function type (consumer NF type), and the customer identifier (client id) and other information.
  • the customer identifier is used to indicate the identity of the service consuming network element requesting the token, for example, it may be a serial number assigned to the network element by the operator, for example, the customer identifier is AMF_5438.
  • the issuer field includes the network function instance identifier (NF Instance Id of NRF) of the network storage function network element
  • the subject field includes the network function instance of the service consumption network element Identity (NF Instance Id of the NF Service consumer) (that is, the identifier of the service consumer network element requesting the token)
  • the audience field includes the network function type of the network element
  • the scope field includes the desired service The name (expected service name(s))
  • the expiration (expiration) field includes an expiration time (expiration time).
  • the network storage function network element generates a token based on a specific service consumption network element, and only the service consumption network element authorized by the NF Instance Id of the NF Service consumer in the subject field of the token can be used. Use the token to request the service provider network element to access the network function service.
  • the service consumption network element frequently requests the token from the network storage function network element.
  • network function virtualization NFV
  • service switching and dynamic online and offline of network elements frequently occur.
  • the switching of services often leads to the switching of service consumption network elements, which causes the service consumption network elements to frequently request tokens from the network storage function network elements.
  • the frequent occurrence of dynamic online and offline service consumption network elements will also cause the service consumption network elements to frequently request tokens from the network storage function network elements.
  • not only the efficiency of the network function service itself is reduced, but also the workload of the network storage function network element is also larger.
  • the network storage function network element can generate a token based on the network function type, that is, the generated token can be authorized to multiple service consumption network elements of the same network function type, so that the same Multiple service consuming network elements of the network function type can use the token of the network function type to access the network function service, so that even when the switching of services and the dynamic on-line and off-line of the network element occur frequently, it can Reduce the number of times service consumption network elements apply for tokens, reduce the workload of network storage function network elements, and improve the efficiency of business and network function services to obtain authorization.
  • the token processing method provided by the embodiment of the present application is applicable to a variety of service-oriented network architectures. Such as 5G communication system, future evolution system or network architecture of multiple communication convergence systems.
  • the network architecture and business scenarios described in the embodiments of the present application are to more clearly explain the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. With the evolution of the architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.
  • FIG. 3 shows a schematic diagram of a specific possible network architecture to which the embodiments of the present application are applicable.
  • the network architecture may include user equipment (UE), (radio) access network ((radio) access network, (R) AN) equipment, data network (DN), access and mobility management functions AMF network element, user plane function UPF network element, network slice selection function NSSF network element, network opening function NEF network element, network storage function NRF network element, policy control function PCF network element, unified data management UDM network element, application function AF One or more of the network element, the authentication server function AUSF network element, the session management function SMF network element, etc., which are not specifically limited in the embodiment of the present application.
  • UE user equipment
  • R radio access network
  • DN data network
  • AMF network element user plane function UPF network element
  • network slice selection function NSSF network element network slice selection function NSSF network element
  • network opening function NEF network element network storage function NRF network element
  • policy control function PCF network element unified data management
  • Each network function network element can have one or more network element instances.
  • NSSF network elements, NEF network elements, PCF network elements, UDM network elements, AF network elements, AUSF network elements, AMF network elements and SMF network elements can be used as service consumption network elements and service provision network elements; These network elements can call each other's network functions and services provided by each other by applying for tokens from the NRF network elements.
  • AMF network elements can call SMF session creation, update, release and other network function services, AMF can also call AUSF authentication and other network function services, SMF can also call AMF UE access and mobility management and other network functions Service, AUSF network element can call the user data management and other network function services provided by UDM network element.
  • the UE is a device with wireless transceiver functions, such as an access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile device, wireless For communication equipment, terminal agents, or terminal devices, the UE may be mobile or fixed.
  • the access network equipment is a device that provides wireless communication functions for terminals.
  • the access network equipment includes, but is not limited to, the next-generation base station (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (RNC), and node B (node B) in 5G, for example.
  • B, NB base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • AMF network elements can be used for mobility management in mobile networks, such as user location update, user registration network, user handover, etc.
  • UPF network element can be used for forwarding user data.
  • DN can be used to provide network services, such as WeChat service, QQ service, etc.
  • AF network elements can be used to provide and call application services.
  • NSSF network element used to select network slices for the terminal, etc.
  • NEF network elements can be used to provide services so that the 3GPP network can safely provide network service capabilities to network devices.
  • PCF network elements can be used to guide a unified policy framework for network behavior, and provide policy rule information for control plane functional network elements (such as AMF network elements, etc.).
  • UDM network elements can be used to process user identification, access authentication, registration, or mobility management.
  • the UDM may include a unified data repository (UDR) function, and the UDR may be used to store and query structured data.
  • SMF network elements can be used to provide services such as session creation, update, and release.
  • AUSF network elements can be used to provide services such as authentication and authentication.
  • the network element shown in FIG. 3 does not constitute a limitation on the applicable network architecture of this application.
  • the network architecture may also include other network elements, for example, may also include an unstructured data storage function (unstructured data storage network). function, UDSF).
  • UDSF unstructured data storage network
  • Network function network elements can store and obtain unstructured data from UDSF.
  • network function network elements of the same network function type can share the same UDSF.
  • the N1 interface in Figure 3 is the reference point between the terminal and the AMF network element;
  • the N2 interface is the reference point between the (R)AN equipment and the AMF network element, and is used in the non-access stratum (NAS) Message and next generation application protocol (NGAP) message sending, etc.
  • N3 interface is the reference point between (R)AN equipment and UPF network element, used to transmit user plane data, etc.
  • N4 interface is SMF The reference point between the network element and the UPF network element is used to transmit information such as the tunnel identification information of the N3 connection, the data buffer indication information, and the downlink data notification message;
  • the N6 interface is the reference point between the UPF network element and the DN, Used to transmit user plane data;
  • N9 interface is the reference point between two UPFs.
  • control plane network elements such as AUSF network elements, AMF network elements, SMF network elements, NSSF network elements, NEF network elements, PCF network elements, or UDM network elements shown in FIG. 3 can also interact with service-oriented interfaces.
  • the servicing interface provided by the AUSF network element can be Nausf
  • the servicing interface provided by the AMF network element can be Namf
  • the servicing interface provided by the SMF network element can be Nsmf
  • the servicing interface provided by the PCF network element can also interact with service-oriented interfaces.
  • the servicing interface provided by the AUSF network element can be Nausf
  • the servicing interface provided by the AMF network element can be Namf
  • the servicing interface provided by the SMF network element can be Nsmf
  • the servicing interface provided by the PCF network element can also interact with service-oriented interfaces.
  • the service interface provided by UDM network elements can be Nudm
  • the service interface provided by NEF network elements can be Nnef
  • the service interface provided by NSSF network elements can be Nnssf
  • the service provided by NRF network elements externally The standard interface can be Nnrf
  • the external service interface provided by the AF network element can be naf.
  • 5G system architecture 5G system architecture
  • the aforementioned network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (for example, a cloud platform).
  • the above-mentioned network elements or functions can be divided into one or more services, and further, there may be services independent of the network functions.
  • an instance of the above-mentioned function, an instance of a service included in the above-mentioned function, or an instance of a service that exists independently of a network function may be referred to as a service instance.
  • FIG. 4 shows a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application.
  • the communication device 400 includes a processor 401, a communication line 402, a memory 403, and at least one communication interface (in FIG. 4, the communication interface 404 is included as an example for illustration).
  • the processor 401 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 402 may include a path to transmit information between the aforementioned components.
  • Communication interface 404 which uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 403 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (Including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can be used by a computer Any other media accessed, but not limited to this.
  • the memory can exist independently and is connected to the processor through the communication line 402. The memory can also be integrated with the processor.
  • the memory 403 is used to store computer-executed instructions for executing the solution of the present application, and the processor 401 controls the execution.
  • the processor 401 is configured to execute computer-executable instructions stored in the memory 403, so as to implement the token processing method provided in the following embodiments of the present application.
  • the computer execution instructions in the embodiments of the present application may also be called application program codes, which are not specifically limited in the embodiments of the present application.
  • the processor 401 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 4.
  • the communication device 400 may include multiple processors, such as the processor 401 and the processor 408 in FIG. 4. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the communication device 400 may further include an output device 405 and an input device 406.
  • the output device 405 communicates with the processor 401, and can display information in a variety of ways.
  • the output device 405 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 406 communicates with the processor 401 and can receive user input in a variety of ways.
  • the input device 406 may be a mouse, a keyboard, a touch screen device, or a sensor device.
  • the aforementioned communication device 400 may be a general-purpose device or a dedicated device.
  • the communication device 400 may be a desktop computer, a portable computer, a network server, a palmtop computer (personal digital assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a similar structure in FIG. equipment.
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the communication device 400.
  • embodiments of the present application are not limited to the 5G network architecture shown in FIG. 3, and can also be applied to other future communication systems, such as 6G network architectures.
  • the names of the various network elements used in the embodiments of the present application may maintain the same function in the future communication system, but the names will change.
  • the embodiment of the present application provides a token processing method.
  • the method may include:
  • the service consumption network element 1 (that is, the first service consumption network element) sends first token request information to the network storage function network element;
  • the first token request information is used to request to obtain the first token of the first network function type to which the service consumption network element 1 belongs, and the first token is used to access the first network function service.
  • the first token of the first network function type refers to that the first token is applicable to the service consumption network element of the first network function type, and the first token can be authorized to the service consumption network element of the first network function type. Yuan, the service consumption network element of the first network function type can share the first token. That is, multiple service consuming network elements of the first network function type can all use the first token to request access to the first network function service.
  • the service consumption network element 1 may be a network element instance of the AMF shown in FIG. 3, the network storage function network element may be the NRF network element shown in FIG. 3, and the service providing network element may be the network element shown in FIG. 3.
  • An example of a network element of SMF is shown.
  • the first network function type may be the AMF type to which the service consumption network element 1 belongs.
  • the first network function service may be a network function service that creates a session.
  • the service consuming network element 1 may request information through the first token, and request to obtain the first token based on the AMF type for accessing the network function service of creating a session. All service consumption network elements of the AMF type (for example, AMF service consumption network element 1, service consumption network element 2, etc.) can use the first token to request access to the first network function service.
  • All service consumption network elements of the AMF type for example, AMF service consumption network element 1, service consumption network element 2, etc.
  • the first token request information may also include description information of the first network function service, such as the name or service number of the first network function service, so that the network storage function network element can be based on the first network function service.
  • the description information of the network function service generates a first token for accessing the first network function service.
  • the network storage function network element After receiving the first token request information sent by the service consumption network element 1, the network storage function network element generates a first token, the first token includes the first network function type, and the first token is suitable for the first token A service consumption network element of a network function type.
  • the network storage function network element After the network storage function network element receives the first token request information sent by the service consumption network element 1, it may generate a first token based on the first network function type.
  • the first token based on the first network function type includes the first network function type, which can indicate that the first token can be authorized to service consumption network elements of the first network function type, and all service consumption of the first network function type All network elements can use the first token to request access to the first network function service.
  • the claim of the first token includes the first network function type. It should be noted that the embodiment of the present application does not specifically limit which field in the first token the first network function type is located.
  • the network storage function network element sends the first token to the service consumption network element 1.
  • the network storage function network element sends a first token based on the first network function type to the service consumption network element 1.
  • the first token includes the first network function type, so that the service consumption network belonging to the first network function type Element 1, can use the first token to request access to the first network function service.
  • the service consumption network element 1 requests and obtains a first token based on the first network function type from the network storage function network element, and the first token may be applicable to the first network function type
  • the service consumption network element of the first network function type so that multiple service consumption network elements of the first network function type can access the first network function service through the first token, instead of each service consumption as shown in Figure 2
  • Each network element applies to the network storage function network element for a token based on the service consumption network element, which can reduce the number of times the service consumption network element applies for a token to the network storage function network element and reduces the workload of the network storage function network element. Improve the efficiency of network function services.
  • the first token request information for requesting to obtain the first token based on the first network function type may include a client id field in the form of a wildcard.
  • the wildcard may include the character "*" and/or the character "?".
  • the first token request information may include the client id field in the form of a wildcard to indicate service consumption
  • the network element 1 requests to obtain the first token based on the first network function type.
  • the network storage function network element After the network storage function network element receives the client id field including the client ID in the form of a wildcard, it learns that the service consumption network element 1 requests to obtain the first token based on the first network function type, thereby generating the corresponding first token.
  • the first token request information for requesting to obtain the first token based on the first network function type does not include the client id field.
  • the first token request message may not include the client id field to indicate the service consumption network element 1 Request to obtain the first token based on the first network function type.
  • the network storage function network element After the network storage function network element receives the first token request information that does not include the client id field, it learns that the service consumption network element 1 requests the first token based on the first network function type, thereby generating the corresponding first order brand.
  • the subject field of the first token includes the first network function type, and does not include the service function instance identifier NF Instance Id of the NF Service consumer of the service consumption network element. That is, in the subject field, the first network function type replaces NF Instance Id of the NF Service consumer.
  • the subject field of the first token includes the first network function type, it may indicate that the first token can be authorized to multiple service consumption network elements of the first network function type.
  • the subject field of the token includes the NF Instance Id of the NF Service consumer.
  • the subject field of the first token includes the first network function type. And does not include NF Instance Id of the NF Service consumer. In this way, it can be indicated that the first token is based on the first network function type and is suitable for multiple service consumption network elements of the first network function type.
  • the subject field of the first token includes the first network function type and the NF Instance Id of the NF Service consumer in the form of a wildcard.
  • the subject field of the first token includes a wildcard NF Instance Id of the NF Service consumer, and other fields of the first token include the first network function type.
  • the subject field of the first token includes the first network function type, and other fields of the first token include the NF Instance Id of the NF Service consumer in the form of a wildcard.
  • other fields in the first token claim include the first network function type and the NF Instance Id of the NF Service consumer in the form of a wildcard.
  • the embodiment of this application does not specifically limit which field in the first token the NF Instance Id of the NF Service consumer in the form of the first network function and the wildcard is located.
  • the first token in the embodiment of the present application is based on the first network function type and can be applied to multiple service consumption network elements of the first network function type. .
  • the service consumption network element 1 can use the first token to request access to the first network function service.
  • the method may further include:
  • the network storage function network element determines a service providing network element that provides the first network function service.
  • the service providing network element may be registered on the network storage function network element in advance, and the network storage network element may include the corresponding relationship between the service providing network element and the provided network function service.
  • the network storage network element After the network storage network element receives the first token request information sent by the service consumption network element 1, it may determine the service provider network that provides the first network function service according to the first network function service description information in the first token request information. yuan.
  • the first token generated in step 502 may also include the identity information of the service providing network element. In this way, after step 503, the service consuming network element 1 can learn the identity of the service providing network element from the first token.
  • the method may further include:
  • the service consumption network element 1 sends first service request information to the service provider network element according to the identity information of the service provider network element, where the first service request information is used to request access to the first network function service, and the first service request information Including the first token.
  • the service consumption network element 1 After the service consumption network element 1 receives the first token sent by the network storage function network element, it can send a first service request to the service provider network element according to the identity information of the service provider network element in the first token to request access to the service Provide the first network function service provided by the network element.
  • the service providing network element After the service providing network element receives the first service request information sent by the service consuming network element 1, if the first token is successfully verified, the service providing network element sends the first response information to the service consuming network element 1.
  • the response information is used to indicate acceptance of the access request for the first network function service.
  • the service providing network element After the service providing network element receives the first service request information sent by the service consuming network element 1, it verifies the first token. For example, the signature in the first token can be verified (also called integrity verification); and in the claim field of the first token, whether each field is legal or not can be verified. If the first token is successfully verified, it can indicate that the service consumption network element 1 is legal, and the service consumption network element 1 is allowed to access the first network function service.
  • the signature in the first token can be verified (also called integrity verification); and in the claim field of the first token, whether each field is legal or not can be verified. If the first token is successfully verified, it can indicate that the service consumption network element 1 is legal, and the service consumption network element 1 is allowed to access the first network function service.
  • the first service request information may also include the network function type 1 to which the service consumption network element 1 belongs.
  • the verification of the first token further includes verifying whether the network function type 1 in the first service request information is consistent with the first network function type in the first token. Only when the network function type 1 in the first service request information is consistent with the first network function type in the first token, the service consuming network element 1 is allowed to access the first network function service.
  • the service consumption network element 1 may access the first network function service provided by the service providing network element according to the token based on the first network function type obtained from the network storage function network element.
  • the method may further include:
  • the service providing network element receives second service request information sent by the service consumption network element 2 (that is, the fifth service consumption network element), where the second service request information includes the first token, and the first token includes the first network Function service type.
  • the service consumption network element 2 belongs to the first network function service type.
  • the service providing network element sends second response information to the service consuming network element 2, where the second response information is used to indicate acceptance of the access request for the second network function service.
  • the service consumption network element 2 belonging to the first network function type may also request to access the first network function service through the first token based on the first network function type. That is, multiple service consuming network elements of the first network function type can request access to the first network function service through the first token based on the first network function.
  • the service consumption network element 1 needs to register on the network storage network element first, and then can apply for the first token from the network storage network element. For example, when the network function service provided by the service consumption network element is online, the service consumption network element 1 may register on the network storage network element, and the network storage function network element may apply for other service consumption network elements in the first network function type The token based on the first network function type is issued to the service consumption network element 1.
  • the method may further include:
  • the service consumption network element 1 sends registration request information to the network storage function network element, where the registration request information includes the first network function type.
  • the network storage function network element can learn the network function type to which the service consumption network element belongs.
  • the registration request information includes the network function configuration NF profile information of the service consuming network element 1, and the NF profile information includes the first network function type to which the service consuming network element 1 belongs.
  • the network storage function network element After receiving the registration request information sent by the service consumption network element 1, the network storage function network element sends at least one token to the service consumption network element 1.
  • the at least one token is excluding the service consumption network element 1 and belongs to the first A token applied for by a network element of another service consumption of a network function type; the at least one token includes the first network function type, and the at least one token is used to access at least one network function service.
  • the network storage function network element determines at least one token based on the first network function type applied for by other service consumption network elements according to the first network function type to which the service consumption network element belongs, and sends these tokens Give service consumption network element 1.
  • the network storage function network element may send the at least one token to the service consumption network element 1 through the Nnrf_NFManagement_NF Register response message.
  • the service consumption network element 1 when it needs to access other network function services, it can directly use these tokens to make a request to the service providing network element, instead of applying for tokens from the network storage function network element, thereby reducing service consumption.
  • the number of times that network elements apply for tokens reduces the workload of network storage function network elements.
  • the service consumption network element 1 may also subscribe to the network storage function network element for the request event of the token of the first network function type, thereby obtaining requests from other service consumption network elements from the network storage function network element, based on The token of the first network function type.
  • the method may further include:
  • the service consumption network element 1 sends subscription request information to a network storage function network element, where the subscription request information is used to request a request event for subscribing to a token of the first network function type.
  • the network storage function network element receives the second token request information sent by the service consumption network element 3 (that is, the fourth service consumption network element), and the second token request information is used to request to obtain the first token to which the service consumption network element 3 belongs.
  • a second token of a network function type the second token is used to access the second network function service.
  • the network storage function network element generates a second token, where the second token includes the first network function type, and the second token is applicable to the service consumption network element belonging to the first network function type.
  • the network storage function network element sends the second token to the service consumption network element 3 and the service consumption network element 1.
  • the network storage function network element receives the subscription request information sent by the service consumption network element 1, if it receives a token triggered by another service consumption network element (for example, service consumption network element 3)
  • the token based on the first network function type applied by other service consumption network elements is also notified to the service consumption network element 1 that has subscribed to the token request event.
  • the service consumption network element 1 can access other network function services according to the tokens based on the first network function type applied by other service consumption network elements, without the need to apply for tokens from the network storage function network element, thus reducing the number of orders.
  • the number of license applications reduces the workload of network storage function network elements.
  • multiple network functions NF may be online at the same time, and none of the newly online service consumption network elements have applied for tokens from the network storage function network elements.
  • the service consumption network element may subscribe to the network storage function network element for the token request event. Later, when a certain service consumption network element applies for a token based on the first network function type, other service consumption network elements that request a subscription to the token request event can also receive tokens pushed by the network storage function network element, thereby reducing The number of token applications reduces the workload of network storage function network elements.
  • the service before switching The consuming network element may send a token based on the network type to the service consuming network element to be switched.
  • the method may further include:
  • the service consuming network element 1 receives switching request information sent by other network devices, where the switching request information is used to request the switching of the service consuming network element 1.
  • the other network device that sends the handover request information may be an access network device.
  • the handover request information may be a handover required message sent by the eNB to the AMF type service consuming network element 1.
  • the service consumption network element 1 determines the service consumption network element 4 to be switched (that is, the second service consumption network element).
  • the service consumption network element 1 may determine the service consumption network element 4 to be switched according to information such as user location information update or user service update.
  • the service consumption network element 4 to be switched may be another service consumption network element of the AMF type.
  • the service consumption network element 1 sends the first token to the service consumption network element 4.
  • the AMF type service consumption network element 1 is used as the source network element, and the Namf_Communication_CreateUEContextTransfer message can be transferred through the user switching context to the AMF type destination network element service consumption network element 4 (ie, the network element to be switched ) Send the first token.
  • the service consumption network element 1 is switched to the service consumption network element 4.
  • the service consumption network element 4 after the handover can request access to the first network function service through the first token sent by the service consumption network element 1, without the need to apply for the first token from the network storage function network element.
  • steps 801-804 are only described by taking the service consumption network element 1 acquiring the first token based on the first network function type as an example. If the service consumption network element 1 acquires multiple network function types Tokens (such as SMF-type tokens, UDM-type tokens, etc.), the service consumption network element 1 can send multiple tokens to the service consumption network element 4, so as to reduce the service consumption network element 4 applying for tokens The number of times.
  • Tokens such as SMF-type tokens, UDM-type tokens, etc.
  • the method may further include:
  • Other network devices send registration request information to the service consumption network element 5 (that is, the third service consumption network element), where the registration request information is used to request registration to the service consumption network element 5.
  • the other network device that sends the handover request information may be an access network device, and the registration request information is used to request registration of the UE to the service consumption network element 5.
  • the service consumption network element 5 sends a user information request message to the service consumption network element 1.
  • the service consumption network element 1 sends the globally unique temporary UE identity (GUTI) information to the UE, and the GUTI information includes service consumption Identification information of network element 1.
  • GUI globally unique temporary UE identity
  • the access network device can send the identification information of the service consumption network element 1 to the service consumption network element 5, and the service consumption network element 5 can send information to the service consumption network element 5 according to the identification information.
  • the service consumption network element 1 sends a user information request message.
  • the user information request message may transfer the Namf_Communication_UEContextTransfer message for the user switching context.
  • the service consumption network element 1 After receiving the user information request message, the service consumption network element 1 sends the first token to the service consumption network element 5.
  • the service consumption network element 1 of the AMF type may send the first token based on the first network function type to the service consumption network element 5 of the AMF type through the user switching context transfer response Namf_Communication_UEContextTransfer response message.
  • the UE registers with the service consumption network element 5.
  • the service consumption network element 5 can request access to the first network function service through the first token sent by the service consumption network element 1, without the need to apply for the first token from the network storage function network element, thereby reducing service consumption.
  • the number of times that the network element applies for a token from the network storage function network element reduces the workload of the network storage function network element.
  • steps 901-904 are only described by taking the service consumption network element 1 acquiring the first token based on the first network function type as an example. If the service consumption network element 1 acquires multiple network function types Tokens such as SMF type tokens, UDM type tokens, etc.), the service consumption network element 1 can send multiple tokens to the service consumption network element 5, so as to reduce the service consumption network element 5’s application for tokens. frequency.
  • Tokens such as SMF type tokens, UDM type tokens, etc.
  • the method may further include:
  • the service consumption network element 1 stores the first token on an unstructured data storage network function UDSF network element.
  • the other service consuming network element obtains the first token from the UDSF network element.
  • the functional network element applies for the first token, thereby reducing the number of times that the service consumption network element applies for a token from the network storage function network element, and reduces the workload of the network storage function network element.
  • steps 1001-1002 are only described by taking the service consumption network element 1 storing the first token based on the first network function type on the UDSF network element as an example. If the service consumption network element 1 has multiple If the token based on the first network function type is stored on the UDSF network element, other service consuming network elements can obtain multiple tokens from the UDSF, thereby reducing the number of times that other service consuming network elements apply for tokens.
  • the method may further include:
  • the service consumption network element 1 obtains a third token from an unstructured data storage network function network element, where the third token includes the first network function type, and the third token is used to request access to the third network function service.
  • the service consumption network element 1 can obtain other tokens (such as the third token) stored in other service consumption network elements based on the first network function type from the UDSF network element, and can request access to other tokens through the other tokens.
  • the network function service does not need to apply for a token from the network storage function network element, thereby reducing the number of times the service consumption network element applies for a token from the network storage function network element and reduces the workload of the network storage function network element.
  • the token based on the network function type is not applicable to all service consumption network elements in the network function type, but only applicable to service consumption network elements within a specified range in the network function type.
  • the range may specifically be a range set by the operator according to a preset policy, or may be a range defined in a token based on the network function type.
  • the network elements defined in this range can be considered as safe and legal service consumption network elements. Only a number of specific network elements within this range can access the corresponding network function service through the token based on the network function type, which can reduce the workload and improve the token and network function service. safety.
  • the first token may include scope information
  • the scope information is used to indicate the scope of service consumption network elements that can access the first network function service through the first token and belong to the first network function type.
  • the range information is a network slice identifier.
  • the range information is a region identifier, and the region identifier may be a province/region identifier.
  • the service consumption network element 1 requests the network storage function network element to obtain the first token based on the first network function type. It should be noted that, in the embodiment of the present application, as shown in FIG. 2, the service consumption network element 1 may also request to obtain a token based on the service consumption network element 1. The service consumption network element 1 may specifically determine whether to request the first token based on the first network function type or to request the service consumption network element according to the operator's preset security policy or deployment strategy, or according to business requirements and other factors. 1 token.
  • the above description is mainly based on the service consumption network element 1, the first network function service, and the first network function type as examples.
  • the access to the network function service can also be performed in the above manner, which is not repeated in the embodiment of this application.
  • the above-mentioned service consumption network elements, network storage function network elements, and service-providing network elements include hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
  • the embodiments of the present application may divide the service consumption network element, the network storage function network element, and the service provision network element into functional modules according to the foregoing method examples.
  • each function module may be divided corresponding to each function, or two or two
  • the above functions are integrated in a processing module.
  • the above integrated modules can be implemented in the form of hardware or software function modules. It should be noted that the division of the modules in the embodiments of the present application is schematic, and is only a division of logical functions. In actual implementation, there may be another division manner.
  • FIG. 11 shows a schematic structural diagram of a communication device 1100.
  • the communication device may be a service consumption network element or a chip or a system on a chip in a service consumption network element, and may also be a chip or a system on a chip in a network storage function network element or a network storage function network element; it may also provide a service network element or
  • the chip or system-on-chip in the service providing network element the communication device may be used to perform the functions of the network device involved in the foregoing embodiments.
  • the communication device 1100 shown in FIG. 11 may include a sending unit 1101, a receiving unit 1102, and a processing unit 1103.
  • the communication device 1100 is a service consumption network element or a chip or a system on a chip in a service consumption network element.
  • the sending unit 1101 may be configured to support the communication device 1100 to send first token request information to a network storage function network element, where the first token request information is used to request to obtain the first token of the first network function type to which the communication device belongs, The first token is used to access the first network function service.
  • the receiving unit 1102 may be configured to support the communication device 1100 to receive a first token sent by a network storage function network element, where the first token includes a first network function type; the first token is suitable for service consumption belonging to the first network function type Network element.
  • the sending unit 1101 may be specifically used to support the communication device 1100 to perform step 501, step 505, step 601, step 701, step 803, etc. in FIGS. 5A-10, and/or other technologies used in the technology described herein. process.
  • the receiving unit 1102 may be specifically used to support the communication device 1100 to perform step 503, step 506, step 602, step 704, step 801, step 804, step 902, etc. in FIGS. 5A-10, and/or for the description herein Other processes of the technology.
  • the processing unit 1103 may be specifically used to support the communication device 1100 to perform step 802, step 1001, step 1003, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the communication device 1100 is a network storage function network element or a chip or a system on a chip in a network storage function network element.
  • the receiving unit 1102 may be configured to support the communication device 1100 to receive the first token request information sent by the first service consumption network element, where the first token request information is used to request to obtain the first network function type to which the first service consumption network element belongs The first token, the first token is used to access the first network function service.
  • the processing unit 1103 may be configured to support the communication device 1100 to generate a first token, where the first token includes a first network function type; the first token is suitable for service consumption network elements belonging to the first network function type.
  • the sending unit 1101 may be configured to support the communication device 1100 to send the first token to the first service consumption network element.
  • the receiving unit 1102 may be specifically used to support the communication device 1100 to perform step 501, step 601, step 701, step 702, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the processing unit 1103 may be specifically configured to support the communication device 1100 to perform steps 504, 502, and 703 in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the sending unit 1101 may be specifically used to support the communication device 1100 to perform step 503, step 602, step 704, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the communication device 1100 is a service providing network element or a chip or a system on a chip in a service providing network element.
  • the sending unit 1101 may be configured to support the communication device 1100 to send first token request information to a network storage function network element, where the first token request information is used to request to obtain the first token of the first network function type to which the communication device belongs, The first token is used to access the first network function service.
  • the receiving unit 1102 may be configured to receive a first token sent by a network storage function network element, where the first token includes a first network function type; the first token is applicable to a service consumption network element belonging to the first network function type.
  • the supporting communication device 1100 performs step 504, step 502, step 703, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the receiving unit 1102 may be specifically used to support the communication device 1100 to perform step 505, step 507, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the sending unit 1101 may be specifically used to support the communication device 1100 to execute steps 506, 508, etc. in FIGS. 5A-10, and/or other processes used in the technology described herein.
  • the processing unit 1103 may be specifically configured to support the communication device 1100 to control the sending unit 1101 and the receiving unit 1102 to perform the above-mentioned corresponding steps.
  • the communication device 1100 is presented in the form of dividing various functional modules in an integrated manner.
  • the "module” herein may refer to a specific ASIC, circuit, processor and memory that execute one or more software or firmware programs, integrated logic circuits, and/or other devices that can provide the above-mentioned functions.
  • the communication device 1100 may adopt the form shown in FIG. 4.
  • the processor 401 in FIG. 4 may invoke the computer-executable instructions stored in the memory 403 to cause the communication device 1100 to execute the token processing method in the foregoing method embodiment.
  • the functions/implementation process of the sending unit 1101, the receiving unit 1102, and the processing unit 1103 in FIG. 11 may be implemented by the processor 401 in FIG. 4 calling the computer execution instructions stored in the memory 403.
  • the function/implementation process of the processing unit 1103 in FIG. 11 can be implemented by the processor 401 in FIG. 4 calling a computer execution instruction stored in the memory 403, and the functions/implementation of the sending unit 1101 and the receiving unit 1102 in FIG. 11
  • the process can be implemented through the communication interface 404 in FIG. 4.
  • the communication device 1100 provided in this embodiment can perform the above-mentioned token processing method, the technical effects that can be obtained can refer to the above-mentioned method embodiment, and will not be repeated here.
  • the embodiment of the present application also provides a computer storage medium, the computer storage medium stores computer instructions, when the computer instructions run on the communication device, the communication device executes the above-mentioned related method steps to implement the token in the above-mentioned embodiment Approach.
  • the embodiments of the present application also provide a computer program product, which when the computer program product runs on a computer, causes the computer to execute the above-mentioned related steps, so as to realize the token processing method executed by the communication device in the above-mentioned embodiment.
  • the embodiments of the present application also provide a device (for example, the device may be a chip, a component, or a module).
  • the device includes a processor for supporting the communication device to implement the token processing method described above, such as obtaining network-based function types. Token.
  • the device also includes a memory.
  • the memory is used to store program instructions and data necessary for the communication device. Of course, the memory may not be in the device.
  • the device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in the embodiment of the present application.
  • the device, computer storage medium, computer program product, or chip provided in this embodiment are all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the corresponding method provided above The beneficial effects in the process will not be repeated here.
  • the embodiments of the present application also provide a communication system, which may include the service consumption network element, network storage function network element, and service provision network element provided above, and can be used to execute the token processing method provided in the above embodiment .
  • the disclosed device and method can be implemented in other ways.
  • the device embodiments described above are only illustrative, for example, the division of modules or units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another device, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or software function unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the existing technology, or all or part of the technical solutions can be embodied in the form of software products, which are stored in a storage medium. It includes several instructions to make a device (which may be a single-chip microcomputer, a chip, etc.) or a processor (processor) execute all or part of the steps of the methods of the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read only memory (read only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种令牌处理方法及装置，涉及通信技术领域，使得同一网络功能类型的网络功能消费网元，能够使用同一令牌访问网络功能服务，从而可以降低网络存储功能网元的工作量。具体方案为：网络存储功能网元接收第一网络功能服务消费网元发送的第一令牌请求信息，所述第一令牌请求信息用于请求获取所述第一网络功能服务消费网元所属的第一网络功能类型的第一令牌，所述第一令牌用于访问第一网络功能服务；所述网络存储功能网元生成所述第一令牌，所述第一令牌包括所述第一网络功能类型；所述第一令牌适用于属于所述第一网络功能类型的网络功能服务消费网元；所述网络存储功能网元将所述第一令牌发送给所述第一网络功能服务消费网元。

Description

一种令牌处理方法及装置
本申请要求于2019年1月14日提交国家知识产权局、申请号为201910033422.1、申请名称为“一种令牌处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种令牌处理方法及装置。
背景技术
3GPP定义了服务化的网络架构，基于该架构，网络功能划分为若干个服务。网络功能(network function，NF)对外可呈现通用的服务化接口，可被授权的其他网络功能或服务调用。
在服务化网络架构中，网络功能服务消费网元(NF service consumer)在需要访问某项网络功能服务时，可以向网络存储功能网元申请一个令牌(token)；NRF网元为该网络功能服务消费网元生成一个用于访问该网络功能服务的令牌，并将令牌发送给该网络功能服务消费网元；该网络功能服务消费网元根据该令牌向网络功能服务提供网元(NF service producer)请求访问网络功能服务。
其中，由于网络功能服务消费网元的数量较多，网络功能服务消费网元会频繁地向网络存储功能网元申请令牌，从而导致网络存储功能网元的工作量较大，网络功能服务的效率较低。
发明内容
本申请实施例提供一种令牌处理方法及装置，使得同一网络功能类型的多个网络功能消费网元能够使用同一令牌访问网络功能服务，从而可以降低网络功能消费网元申请令牌的次数，降低网络存储功能网元的工作量，提高网络功能服务的效率。
为达到上述目的，本申请实施例采用如下技术方案：
一方面，本申请实施例提供了一种令牌处理方法，可以包括：第一网络功能服务消费网元向网络存储功能网元发送第一令牌请求信息。其中，该第一令牌请求信息用于请求获取第一网络功能服务消费网元所属的第一网络功能类型的第一令牌。并且，该第一令牌用于访问第一网络功能服务。而后，第一网络功能服务消费网元可以接收网络存储功能网元发送的第一令牌，第一令牌包括第一网络功能类型，该第一令牌适用于属于第一网络功能类型的网络功能服务消费网元。
在该方案中，第一网络功能服务消费网元可以从网络存储功能网元获取基于第一网络功能类型的第一令牌，该第一令牌可以适用于第一网络功能类型的服务消费网元，从而使得第一网络功能类型的多个服务消费网元，均可以通过该第一令牌访问第一网络功能服务，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量，提高网络功能服务的效率。
在一种可能的设计中，第一令牌还包括提供第一网络功能服务的网络功能服务提供网 元的身份信息。该方法还包括：第一网络功能服务消费网元根据网络功能服务提供网元的身份信息，向网络功能服务提供网元发送第一服务请求信息，第一服务请求信息用于请求访问第一网络功能服务；第一服务请求信息包括第一令牌。第一网络功能服务消费网元接收网络功能服务提供网元发送的第一响应信息，第一响应信息用于表示接受第一网络功能服务的访问请求。
也就是说，第一网络功能服务消费网元可以根据从网络存储功能网元获取的基于第一网络功能类型的令牌，访问网络功能服务提供网元提供的第一网络功能服务。
在另一种可能的设计中，第一令牌请求信息包括通配符形式的客户标识client id字段。
这样，可以表明第一网络功能服务消费网元请求获取的是基于第一网络功能类型的第一令牌。
例如，该通配符可以包括字符“*”或字符“？”中的至少一种。
在另一种可能的设计中，第一令牌请求信息未包括客户标识client id字段。
这样，可以表明第一网络功能服务消费网元请求获取的是基于第一网络功能类型的第一令牌。
在另一种可能的设计中，第一令牌的主体subject字段包括第一网络功能类型，且未包括网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。
这样，可以表明第一令牌是基于第一网络功能类型的，该第一令牌可授权给第一网络功能类型的所有服务消费网元。
在另一种可能的设计中，第一令牌的主体subject字段包括通配符形式的网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer，且第一令牌的其他字段包括第一网络功能类型。
这样，可以表明第一令牌是基于第一网络功能类型的，该第一令牌可授权给第一网络功能类型的所有服务消费网元。
在另一种可能的设计中，在第一网络功能服务消费网元向网络存储功能网元发送第一令牌请求信息之前，该方法还包括：第一网络功能服务消费网元向网络存储功能网元发送注册请求信息，注册请求信息包括第一网络功能类型。第一网络功能服务消费网元接收网络存储功能网元发送的至少一个令牌，至少一个令牌包括第一网络功能类型，至少一个令牌用于访问至少一个网络功能服务。
这样，第一网络功能服务消费网元可以直接使用该至少一个令牌向网络功能服务提供网元提出请求，而不需要再向网络存储功能网元申请令牌，从而可以减少服务消费网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一种可能的设计中，该方法还包括：第一网络功能服务消费网元向网络存储功能网元发送订阅请求信息，订阅请求信息用于请求订阅第一网络功能类型的令牌的请求事件。第一网络功能服务消费网元接收网络存储功能网元发送的第二令牌，第二令牌包括第一网络功能类型，第二令牌用于访问第二网络功能服务。
这样，第一网络功能服务消费网元可以根据其他服务消费网元申请的基于第一网络功能类型的令牌，访问其他网络功能服务，而不需要再向网络存储功能网元申请令牌，因而可以减少令牌申请次数，降低网络存储功能网元的工作量。
在另一种可能的设计中，在第一网络功能服务消费网元接收到网络存储功能网元发送 的第一令牌之后，该方法还包括：第一网络功能服务消费网元接收其他网络设备发送的切换请求信息，切换请求信息用于请求切换第一网络功能服务消费网元。第一网络功能服务消费网元确定待切换的第二网络功能服务消费网元。第一网络功能服务消费网元向第二网络功能服务消费网元发送第一令牌。
这样，切换后的第二网络功能服务消费网元可以通过第一网络功能服务消费网元发送的第一令牌，请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一种可能的设计中，在第一网络功能服务消费网元接收到网络存储功能网元发送的第一令牌之后，该方法还包括：第一网络功能服务消费网元接收第三网络功能服务消费网元发送的用户信息请求消息。第一网络功能服务消费网元向第三网络功能服务消费网元发送第一令牌。
这样，第三网络功能服务消费网元可以通过第一网络功能服务消费网元发送的第一令牌，请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一种可能的设计中，在第一网络功能服务消费网元接收到网络存储功能网元发送的第一令牌之后，该方法还包括：第一网络功能服务消费网元将第一令牌存储在非结构化数据存储网络功能网元上。
这样，第一网络功能类型中的其他服务消费网元可以从非结构化数据存储网络功能网元上获取该第一令牌，从而可以通过该第一令牌请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一种可能的设计中，该方法还包括：第一网络功能服务消费网元从非结构化数据存储网络功能网元获取第三令牌，第三令牌包括第一网络功能类型，第三令牌用于请求访问第三网络功能服务。
这样，第一网络功能服务消费网元可以从非结构化数据存储网络功能网元上获取其他服务消费网元存储的，基于第一网络功能类型的其他令牌(例如第三令牌)，从而可以通过该其他令牌请求访问其他的网络功能服务，而不需要再向网络存储功能网元申请令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一种可能设计中，第一令牌还包括范围信息，范围信息用于表示可以通过第一令牌访问第一网络功能服务，且属于第一网络功能类型的网络功能服务消费网元的范围。
其中，该范围具体可以是运营商根据预设策略设置的范围，也可以是基于网络功能类型的令牌中限定的范围。该范围内所限定的网元可以认为是安全的、合法的服务消费网元。该范围内所限定内的多个特定的网元，才可以通过基于网络功能类型的令牌访问对应的网络功能服务，从而可以在降低工作量的同时，还可以提高令牌和网络功能服务的安全性。
例如，该范围信息为网络切片标识，或者，该范围信息为地区region标识。
在另一种可能的设计中，网络功能类型可以包括接入与移动性管理功能类型，网络切 片选择功能类型，网络开放功能类型，网络存储功能类型，策略控制功能类型，统一数据管理类型，应用功能类型，认证服务器功能类型，或会话管理功能类型等。
另一方面，本申请技术方案提供了一种令牌处理方法，该方法包括：网络存储功能网元接收第一网络功能服务消费网元发送的第一令牌请求信息，第一令牌请求信息用于请求获取第一网络功能服务消费网元所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。网络存储功能网元生成第一令牌，第一令牌包括第一网络功能类型；第一令牌适用于属于第一网络功能类型的网络功能服务消费网元。网络存储功能网元将第一令牌发送给第一网络功能服务消费网元。
在该方案中，网络存储功能网元可以为第一网络功能服务消费网元提供基于第一网络功能类型的第一令牌，该第一令牌可以适用于第一网络功能类型的服务消费网元，从而使得第一网络功能类型的多个服务消费网元，均可以通过该第一令牌访问第一网络功能服务，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量，提高网络功能服务的效率。
在一种可能的设计中，第一令牌请求信息包括通配符形式的客户标识client id字段。
在另一种可能的设计中，第一令牌请求信息未包括客户标识client id字段。
在另一种可能的设计中，第一令牌的主体subject字段包括第一网络功能类型，且未包括网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。
在另一种可能的设计中，第一令牌的主体subject字段包括通配符形式的网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。
在另一种可能的设计中，在网络存储功能网元生成第一令牌之前，该方法还包括：网络存储功能网元确定提供第一网络功能服务的网络功能服务提供网元，第一令牌还包括网络功能服务提供网元的身份信息。
在另一种可能的设计中，在网络存储功能网元接收第一网络功能服务消费网元发送的第一令牌请求信息之前，该方法还包括：网络存储功能网元接收第一网络功能服务消费网元发送的注册请求信息，注册请求信息包括第一网络功能服务消费网元所属的第一网络功能类型。网络存储功能网元向第一网络功能服务消费网元发送至少一个令牌，至少一个令牌为第一网络功能服务消费网元以外的，属于第一网络功能类型的其他网络功能服务消费网元所申请的令牌。该至少一个令牌包括第一网络功能类型，至少一个令牌用于访问至少一个网络功能服务。
在另一种可能的设计中，该方法还包括：网络存储功能网元接收第一网络功能服务消费网元发送的订阅请求信息，订阅请求信息用于请求订阅第一网络功能类型的令牌的请求事件。网络存储功能网元接收第四网络功能服务消费网元发送的第二令牌请求信息，第二令牌请求信息用于请求获取第四网络功能服务消费网元所属的第一网络功能类型的第二令牌，第二令牌用于访问第二网络功能服务。网络存储功能网元生成第二令牌，第二令牌包括第一网络功能类型；第二令牌适用于属于第一网络功能类型的网络功能服务消费网元。网络存储功能网元将第二令牌发送给第四网络功能服务消费网元和第一网络功能服务消费网元。
另一方面，本申请实施例提供了一种服务提供方法，包括：网络功能服务提供网元接收第一网络功能服务消费网元发送的第一服务请求信息。该第一服务请求信息包括第一令 牌，第一令牌包括第一网络功能服务类型，第一网络功能消费网元属于第一网络功能服务类型。若第一令牌验证成功，则网络功能服务提供网元向第一网络功能服务消费网元发送第一响应信息，第一响应信息用于表示接受第一网络功能服务的访问请求。
在该方案中，第一网络功能服务消费网元可以根据从网络存储功能网元获取的基于第一网络功能类型的令牌，访问网络功能服务提供网元提供的第一网络功能服务。
在一种可能的设计中，该方法还包括：网络功能服务提供网元接收第五网络功能服务消费网元发送的第二服务请求信息，第二服务请求信息包括第一令牌，第一令牌包括第一网络功能服务类型，第五网络功能消费网元属于第一网络功能服务类型。若第二令牌验证成功，则网络功能服务提供网元向第五网络功能服务消费网元发送第二响应信息，第二响应信息用于表示接受第二网络功能服务的访问请求。
也就是说，属于第一网络功能类型的其他服务消费网元，也可以通过基于第一网络功能类型的第一令牌请求访问第一网络功能服务。
另一方面，本申请实施例提供了一种通信装置用于实现上述各种方法。该通信装置可以为上述第一网络功能服务消费网元，或者包含上述第一网络功能服务消费网元的装置；或者，该通信装置可以为上述网络存储功能网元，或者包含上述网络存储功能网元的装置；或者，该通信装置可以为上述网络功能服务提供网元，或者包含上述网络功能服务提供网元的装置。通信装置包括实现上述方法相应的模块、单元、或手段(means),该模块、单元、或menas可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
在一种可能的设计中，当该通信装置为上述网络存储功能网元，或者包含上述网络存储功能网元的装置时，该通信装置可以包括接收单元、处理单元和发送单元。其中，接收单元，用于接收第一网络功能服务消费网元发送的第一令牌请求信息，该第一令牌请求信息用于请求获取第一网络功能服务消费网元所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。处理单元，用于生成第一令牌，第一令牌包括第一网络功能类型；第一令牌适用于属于第一网络功能类型的网络功能服务消费网元。发送单元，用于将第一令牌发送给第一网络功能服务消费网元。
在另一种可能的设计中，处理单元还用于，在生成第一令牌之前，确定提供第一网络功能服务的网络功能服务提供网元。第一令牌还包括网络功能服务提供网元的身份信息。
在另一种可能的设计中，接收单元还用于，在接收第一网络功能服务消费网元发送的第一令牌请求信息之前，接收第一网络功能服务消费网元发送的注册请求信息，该注册请求信息包括第一网络功能服务消费网元所属的第一网络功能类型。发送单元还用于，向第一网络功能服务消费网元发送至少一个令牌，该至少一个令牌为第一网络功能类型的其他网络功能服务消费网元所申请的令牌；该至少一个令牌包括第一网络功能类型，该至少一个令牌用于访问至少一个网络功能服务。
在另一种可能的设计中，接收单元还用于，接收第一网络功能服务消费网元发送的订阅请求信息，该订阅请求信息用于请求订阅第一网络功能类型的令牌的请求事件。接收单元还用于，接收第四网络功能服务消费网元发送的第二令牌请求信息，第二令牌请求信息用于请求获取第四网络功能服务消费网元所属的第一网络功能类型的第二令牌，第二令牌用于访问第二网络功能服务。处理单元还用于，生成第二令牌，第二令牌包括第一网络功 能类型。第二令牌适用于属于第一网络功能类型的网络功能服务消费网元。发送单元还用于，将第二令牌发送给第四网络功能服务消费网元和第一网络功能服务消费网元。
另一方面，本申请实施例提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机指令，当该处理器执行该指令时，以使该通信装置执行上述任一方面的方法。该通信装置可以为上述第一网络功能服务消费网元，或者包含上述第一网络功能服务消费网元的装置；或者，该通信装置可以为上述网络存储功能网元，或者包含上述网络存储功能网元的装置；或者，该通信装置可以为上述网络功能服务提供网元，或者包含上述网络功能服务提供网元的装置。
另一方面，本申请实施例提供了一种通信装置，包括：处理器；处理器用于与存储器耦合，并读取存储器中的指令之后，根据指令执行如上述任一方面的方法。该通信装置可以为上述第一网络功能服务消费网元，或者包含上述第一网络功能服务消费网元的装置；或者，该通信装置可以为上述网络存储功能网元，或者包含上述网络存储功能网元的装置；或者，该通信装置可以为上述网络功能服务提供网元，或者包含上述网络功能服务提供网元的装置。
另一方面，本申请实施例提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述任一方面及任一种可能的设计中的方法。
另一方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述任一方面及任一种可能的设计中的方法。
另一方面，本申请实施例提供了一种通信装置(例如，该通信装置可以是芯片或芯片系统)，该通信装置包括处理器，用于实现上述任一方面及任一种可能的设计中所涉及的功能。在一种可能的设计中，该通信装置还包括存储器，该存储器，用于保存必要的程序指令和数据。该通信装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
另一方面，本申请实施例提供了一种通信系统，该通信系统包括第一网络功能服务消费网元、网络存储功能网元和网络功能服务提供网元中的一个或多个，第一网络功能服务消费网元、网络存储功能网元和网络功能服务提供网元用于执行上述任一方面及任一种可能的设计中的方法。
可以理解的是，上述提供的通信装置或计算机可读存储介质或计算机程序产品或通信系统等均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考对应的方法中的有益效果，此处不再赘述。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请实施例提供的一种通信系统的架构示意图；
图2为本申请实施例提供的一种网络功能服务的访问流程图；
图3为本申请实施例提供的一种5G通信系统下的网络架构示意图；
图4为本申请实施例提供的一种通信装置的结构示意图；
图5A为本申请实施例提供的另一种网络功能服务的访问流程图；
图5B为本申请实施例提供的另一种网络功能服务的访问流程图；
图6为本申请实施例提供的一种另一种网络功能服务的访问流程图；
图7为本申请实施例提供的一种另一种网络功能服务的访问流程图；
图8为本申请实施例提供的一种令牌交互方法流程图；
图9为本申请实施例提供的另一种令牌交互方法流程图；
图10为本申请实施例提供的另一种令牌交互方法流程图；
图11为本申请实施例提供的另一种通信装置的结构示意图。
具体实施方式
为了便于理解，示例的给出了部分与本申请实施例相关概念的说明以供参考。如下所示：
网络功能服务(NF service)：服务化网络架构将网络功能NF划分为若干个服务，称为网络功能服务。例如可以有接入和移动性管理服务，会话创建、更新、释放服务，认证鉴权服务，以及用户数据管理服务等。
网络功能服务消费网元(NF service consumer)：请求访问网络功能服务的网元。为方便描述，以下统一将网络功能服务消费网元简称为服务消费网元。
网络功能服务提供网元(NF service producer)：请求提供网络功能服务的网元。为方便描述，以下统一将网络功能服务提供网元简称为服务提供网元。
需要注意的是，对于同一个网元来说，在请求访问其他网元提供的网络功能服务时，该网元可以是服务消费网元；在为其他网元提供网络功能服务时，该网元也可以是服务提供网元。
网络功能类型(NF type)：承载网络功能的网元所对应的网络功能的类型。例如，网络功能类型可以包括接入与移动性管理功能(access and mobility management function，AMF)类型，网络切片选择功能(network slice selection function，NSSF)类型，网络开放功能(network exposure function，NEF)类型，网络存储功能(network repository function，NRF)类型，策略控制功能(policy control function，PCF)类型，统一数据管理(unified data management，UDM)类型，应用功能(application function，AF)类型，认证服务器功能(authentication server function，AUSF)类型，以及会话管理功能(session management function，SMF)类型等。
网络功能实例：承载网络功能的具体网元。
网络切片(network slice)：用于支持特定网络能力与网络特性的逻辑隔离的网络，可以端到端(end to end，E2E)的包括整个网络，也可以部分网络功能在多个网络切片中共享。通常，不同网络切片的网络特征并不相同，且要求网络切片之间相互隔离，互不影响。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A，B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项”或其类似表达，是指的这些项中的任意组合，包括单项或复数项的任意组合。例如，a，b，或c中的至少一 项，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
本申请实施例提供的令牌处理方法可以应用于如图1所示的通信系统100。该通信系统100可以包括服务消费网元101、网络存储功能网元102以及服务提供网元103。其中，服务消费网元101可以向网络存储功能网元102请求获取令牌(或称访问令牌(access token))，并根据该令牌向服务提供网元103请求访问网络功能服务。
目前，根据第三代合作伙伴计划(3rd generation partnership project，3GPP)TS33.501协议的规定，服务消费网元、网络存储功能网元以及服务提供网元之间定义的网络功能服务的访问授权机制基于OAuth 2.0。网络存储功能网元对应OAuth 2.0中的授权服务器(authorization server)，服务消费网元对应OAuth 2.0中的客户端(client)，服务提供网元对应OAuth 2.0中的资源服务器(resource server)。
参见图2，该访问授权流程主要可以包括：1、服务消费网元在网络存储功能网元上进行注册；2、服务提供网元在网络存储功能网元上进行注册；3、服务消费网元向网络存储功能网元发送令牌请求消息，以请求获取(或称申请)令牌；4、网络存储功能网元生成基于该服务消费网元的令牌；5、网络存储功能网元向服务消费网元发送令牌；6、服务消费网元根据令牌向服务提供网元请求访问网络功能服务；7、服务提供网元对服务消费网元发送的令牌进行完整性、数字签名等验证；8、服务提供网元在令牌验证成功后，向服务消费网元发送响应信息，以接受该服务访问请求。
在上述步骤3中，服务消费网元向网络存储功能网元发送的令牌请求消息中，携带有期望的服务名称(expected service name),消费网元网络功能类型(consumer NF type)，客户标识(client id)等信息。其中，客户标识用于表示请求令牌的服务消费网元的身份，例如可以是运营商给网元分配的序列号，比如客户标识为AMF_5438等。
在上述步骤4中，网络存储功能网元对服务消费网元认证完后，生成相应的令牌(token)。在令牌的声明(claim)字段中，发行者(issuer)字段包括网络存储功能网元的网络功能实例标识(NF Instance Id of NRF)，主体(subject)字段包括服务消费网元的网络功能实例标识(NF Instance Id of the NF Service consumer)(即请求该令牌的服务消费网元的标识)，读者(audience)字段包括提供网元的网络功能类型，范围(scope)字段包括期望的服务的名称(expected service name(s))，超期(expiration)字段包括超期期限(expiration time)。并将该令牌在响应消息中携带给NF service consumer。
也就是说，网络存储功能网元生成了基于某个具体的服务消费网元的令牌，令牌主体(subject)字段中NF Instance Id of the NF Service consumer所授权的服务消费网元，才可以使用该令牌向服务提供网元请求访问网络功能服务。
这样，由于生成的令牌是基于申请令牌的一个服务消费网元的，而服务消费网元的数量较多，从而导致服务消费网元频繁地向网络存储功能网元请求令牌。而且，在网络功能虚拟化(network function virtualization，NFV)以后，业务的切换和网元的动 态上、下线也频繁发生。而业务的切换也经常会导致服务消费网元的切换，从而导致服务消费网元会频繁地向网络存储功能网元请求令牌。服务消费网元的动态上、下线的频繁发生，也会导致服务消费网元频繁地向网络存储功能网元请求令牌。从而，不仅降低了网络功能服务本身的效率，同时也使得网络存储功能网元的工作量也较大。
在本申请实施例提供的令牌处理方法中，网络存储功能网元可以生成基于网络功能类型的令牌，即生成的令牌可以授权给同一网络功能类型的多个服务消费网元，使得同一网络功能类型的多个服务消费网元均能够使用该网络功能类型的令牌访问网络功能服务，从而即便在业务的切换以及网元的动态上、下线都是频繁发生的情况下，也可以降低服务消费网元申请令牌的次数，降低网络存储功能网元的工作量，提高业务和网络功能服务获得授权的效率。
本申请实施例提供的令牌处理方法可适用于多种服务化的网络架构。如5G通信系统，未来演进系统或多种通信融合系统等的网络架构。本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
以5G通信系统为例，图3示出了本申请实施例适用的一种具体可能的网络架构示意图。该网络架构可以包括用户设备(user equipment，UE)、(无线)接入网((radio)access network，(R)AN)设备、数据网络(data network，DN)、接入与移动性管理功能AMF网元、用户面功能UPF网元、网络切片选择功能NSSF网元、网络开放功能NEF网元、网络存储功能NRF网元、策略控制功能PCF网元、统一数据管理UDM网元、应用功能AF网元、认证服务器功能AUSF网元、会话管理功能SMF网元等中的一个或多个，本申请实施例对此不作具体限定。
在图3所示的网络架构中，NSSF网元、NEF网元、NRF网元、PCF网元、UDM网元、AF网元、AUSF网元、AMF网元、SMF网元等承载的网络功能可以服务化，可以称为网络功能网元，每种网络功能网元都可以有一个或多个网元实例。其中，NSSF网元、NEF网元、PCF网元、UDM网元、AF网元、AUSF网元、AMF网元和SMF网元等既可以作为服务消费网元，也可以作为服务提供网元；这些网元通过向NRF网元申请令牌，可以相互之间调用对方提供的网络功能服务。例如，AMF网元可以调用SMF的会话创建、更新、释放等网络功能服务，AMF还可以调用AUSF的认证鉴权等网络功能服务，SMF也可以调用AMF的UE接入和移动性管理等网络功能服务，AUSF网元可以调用UDM网元提供的用户数据管理等网络功能服务。
在图3所示的网络架构中，UE是一种具有无线收发功能的设备，例如可以是接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等，UE可以是移动的，也可以是固定的。
(R)AN设备，是一种为终端提供无线通信功能的设备。接入网设备例如包括但不限于：5G中的下一代基站(gnodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand  unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
AMF网元，可以用于移动网络中的移动性管理，如用户位置更新、用户注册网络、用户切换等。UPF网元，可以用于用户数据的转发。DN可以用于提供网络服务，如微信服务、QQ服务等。AF网元，可以用于应用服务的提供和调用。NSSF网元，用于为终端选择网络切片等。NEF网元，可以用于提供服务以使得3GPP网络能够安全地向网络设备提供网络业务能力。PCF网元，可以用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF网元等)提供策略规则信息等。UDM网元，可以用于处理用户标识、接入鉴权、注册、或移动性管理等。在一实施例中，UDM可以包括统一数据存储库(unified data repository，UDR)功能，UDR可以用于存储和查询结构化数据。SMF网元，可以用于提供会话创建，更新，释放等服务。AUSF网元，可以用于提供认证鉴权等服务。
可以理解的是，图3所示的网元并不构成对本申请可适用的网络架构的限定，该网络架构还可以包括其他网元，例如还可以包括非结构化数据存储功能(unstructured data storage network function，UDSF)。网络功能网元可以向UDSF存储和获取非结构化数据。一般的，同一网络功能类型的网络功能网元可以共享相同的UDSF。
其中，图3中的N1接口为终端与AMF网元之间的参考点；N2接口为(R)AN设备和AMF网元的参考点，用于非接入层(non-access stratum，NAS)消息和下一代应用协议(next generation application protocol，NGAP)消息的发送等；N3接口为(R)AN设备和UPF网元之间的参考点，用于传输用户面的数据等；N4接口为SMF网元和UPF网元之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF网元和DN之间的参考点，用于传输用户面的数据；N9接口为两个UPF之间的参考点。
此外，图3所示的AUSF网元、AMF网元、SMF网元、NSSF网元、NEF网元、PCF网元或者UDM网元等控制面网元也可以采用服务化接口进行交互。比如，AUSF网元对外提供的服务化接口可以为Nausf；AMF网元对外提供的服务化接口可以为Namf；SMF网元对外提供的服务化接口可以为Nsmf；PCF网元对外提供的服务化接口可以为Npcf；UDM网元对外提供的服务化接口可以为Nudm；NEF网元对外提供的服务化接口可以为Nnef；NSSF网元对外提供的服务化接口可以为Nnssf；NRF网元对外提供的服务化接口可以为Nnrf；AF网元对外提供的服务外接口可以为naf。相关描述可以参考23501标准中的5G系统架构(5G system architecture)图，在此不予赘述。
可以理解的是，上述网元或功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能的实例、或上述功能中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
例如，上述网元或功能可以通过图4中的通信设备(也可以称之为通信装置)来实现。图4所示为本申请实施例提供的通信设备的硬件结构示意图。该通信设备400 包括处理器401，通信线路402，存储器403以及至少一个通信接口(图4中仅是示例性的以包括通信接口404为例进行说明)。
处理器401可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路402可包括一通路，在上述组件之间传送信息。
通信接口404，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器403可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路402与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器403用于存储执行本申请方案的计算机执行指令，并由处理器401来控制执行。处理器401用于执行存储器403中存储的计算机执行指令，从而实现本申请下述实施例提供的令牌处理方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器401可以包括一个或多个CPU，例如图4中的CPU0和CPU1。
在具体实现中，作为一种实施例，通信设备400可以包括多个处理器，例如图4中的处理器401和处理器408。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，通信设备400还可以包括输出设备405和输入设备406。输出设备405和处理器401通信，可以以多种方式来显示信息。例如，输出设备405可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备406和处理器401通信，可以以多种方式接收用户的输入。例如，输入设备406可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的通信设备400可以是一个通用设备或者是一个专用设备。在具体实现中，通信设备400可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图4中类似结构的设备。本申请实施例不限定通信设备400的类型。
下面将结合图1至图4对本申请实施例提供的令牌处理方法进行具体阐述。
需要说明的是，本申请实施例并不限定于图3所示的5G网络架构，还可以应用于未来其他的通信系统，例如6G网络架构等。并且，本申请实施例所使用的各个网元的名称，在未来通信系统中，可能保持功能相同，但名称会改变。
本申请实施例提供了一种令牌处理方法，参见图5A，该方法可以包括：
501、服务消费网元1(即第一服务消费网元)向网络存储功能网元发送第一令牌请求信息；
其中，该第一令牌请求信息用于请求获取服务消费网元1所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。
其中，第一网络功能类型的第一令牌是指，该第一令牌适用于第一网络功能类型的服务消费网元，该第一令牌可授权给第一网络功能类型的服务消费网元，第一网络功能类型的服务消费网元可以共享该第一令牌。即，第一网络功能类型的多个服务消费网元均可以使用该第一令牌，请求访问第一网络功能服务。
示例性的，服务消费网元1可以是图3中所示的AMF的一个网元实例，网络存储功能网元可以是图3中所示的NRF网元，服务提供网元可以是图3中所示的SMF的一个网元实例。第一网络功能类型可以为服务消费网元1所属的AMF类型。第一网络功能服务可以是创建会话的网络功能服务。
服务消费网元1可以通过第一令牌请求信息，请求获取用于访问创建会话这一网络功能服务且基于AMF类型的第一令牌。AMF类型的所有服务消费网元(例如AMF类型的服务消费网元1、服务消费网元2等)都可以使用第一令牌，请求访问第一网络功能服务。
在本申请实施例中，第一令牌请求信息还可以包括第一网络功能服务的描述信息，例如第一网络功能服务的名称或服务编号等，以使得网络存储功能网元能够根据该第一网络功能服务的描述信息，生成用于访问第一网络功能服务的第一令牌。
502、网络存储功能网元接收到服务消费网元1发送的第一令牌请求信息后，生成第一令牌，第一令牌包括第一网络功能类型，该第一令牌适用于属于第一网络功能类型的服务消费网元。
网络存储功能网元接收到服务消费网元1发送的第一令牌请求信息后，可以生成基于第一网络功能类型的第一令牌。其中，基于第一网络功能类型的第一令牌包括第一网络功能类型，可以表明该第一令牌可授权给第一网络功能类型的服务消费网元，第一网络功能类型的所有服务消费网元均可以使用该第一令牌请求访问第一网络功能服务。
例如，第一令牌的claim中包括第一网络功能类型。需要注意的是，本申请实施例对第一网络功能类型具体位于第一令牌中的哪个字段不作具体限定。
503、网络存储功能网元将第一令牌发送给服务消费网元1。
网络存储功能网元将基于第一网络功能类型的第一令牌发送给服务消费网元1，该第一令牌中包括第一网络功能类型，以使得属于第一网络功能类型的服务消费网元1，可以使用该第一令牌请求访问第一网络功能服务。
在步骤501-503描述的方案中，服务消费网元1向网络存储功能网元请求并获取 到了基于第一网络功能类型的第一令牌，该第一令牌可以适用于第一网络功能类型的服务消费网元，从而使得第一网络功能类型的多个服务消费网元，均可以通过该第一令牌访问第一网络功能服务，而不需要像图2所示的那样每个服务消费网元都分别向网络存储功能网元申请一个基于服务消费网元的令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量，提高网络功能服务的效率。
在本申请的实施例中，用于请求获取基于第一网络功能类型的方式可以有多种。
例如，在一实施例中，用于请求获取基于第一网络功能类型的第一令牌的第一令牌请求信息，可以包括通配符形式的客户标识client id字段。例如，该通配符可以包括字符“*”和/或字符“？”。
与图2所示的步骤3中令牌请求消息包括客户标识client id字段不同，在本申请的实施例中，第一令牌请求信息可以包括通配符形式的客户标识client id字段，以表明服务消费网元1请求获取基于第一网络功能类型的第一令牌。网络存储功能网元接收到包括通配符形式的客户标识client id字段后，获知服务消费网元1请求获取基于第一网络功能类型的第一令牌，从而生成相应的第一令牌。
在另一实施例中，用于请求获取基于第一网络功能类型的第一令牌的第一令牌请求信息，未包括客户标识client id字段。
与图2所示的步骤3中令牌请求消息包括客户标识client id字段不同，在本申请的实施例中，第一令牌请求信息可以不包括客户标识client id字段，以表明服务消费网元1请求获取基于第一网络功能类型的第一令牌。网络存储功能网元接收到未包括客户标识client id字段的第一令牌请求信息后，获知服务消费网元1请求获取基于第一网络功能类型的第一令牌，从而生成相应的第一令牌。
在本申请的实施例中，用于表示第一令牌为基于第一网络功能类型的令牌可以有多种。
例如，在一实施例中，第一令牌的主体subject字段包括第一网络功能类型，且未包括服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。即在subject字段中，第一网络功能类型替换了NF Instance Id of the NF Service consumer。当第一令牌的主体subject字段包括第一网络功能类型时，可以表明该第一令牌可授权给第一网络功能类型的多个服务消费网元。
与图2所示的步骤5中，令牌的主体subject字段包括NF Instance Id of the NF Service consumer不同，在本申请的实施例中，第一令牌的主体subject字段包括第一网络功能类型，且未包括NF Instance Id of the NF Service consumer。这样，可以表明第一令牌为基于第一网络功能类型的，适用于第一网络功能类型的多个服务消费网元。
在另一实施例中，第一令牌的主体subject字段包括第一网络功能类型，以及通配符形式的NF Instance Id of the NF Service consumer。
在另一实施例中，第一令牌的主体subject字段包括通配符形式的NF Instance Id of the NF Service consumer，第一令牌的其他字段包括第一网络功能类型。
在另一实施例中，第一令牌的主体subject字段包括第一网络功能类型，第一令牌的其他字段包括通配符形式的NF Instance Id of the NF Service consumer。
在另一实施例中，第一令牌claim中的其他字段包括第一网络功能类型，以及通配符形式的NF Instance Id of the NF Service consumer。
需要说明的是，本申请实施例对第一网络功能类型以及通配符形式的NF Instance Id of the NF Service consumer具体位于第一令牌中的哪个字段不作具体限定。
这样，与图2所示的步骤5中的令牌不同，本申请实施例中的第一令牌为基于第一网络功能类型的，可以适用于第一网络功能类型的多个服务消费网元。
进一步地，服务消费网元1在获取到第一令牌后，可以使用第一令牌请求访问第一网络功能服务。
具体的，参见图5A，在步骤502之前，该方法还可以包括：
504、网络存储功能网元确定提供第一网络功能服务的服务提供网元。
在本申请实施例中，服务提供网元可以预先在网络存储功能网元上进行注册，网络存储网元可以包括服务提供网元与所提供的网络功能服务的对应关系。网络存储网元在接收到服务消费网元1发送的第一令牌请求信息后，可以根据第一令牌请求信息中第一网络功能服务描述信息，确定提供第一网络功能服务的服务提供网元。
基于步骤504，步骤502中生成的第一令牌还可以包括服务提供网元的身份信息。这样，在步骤503之后，服务消费网元1可以从第一令牌中获知服务提供网元的身份。
在步骤503之后，该方法还可以包括：
505、服务消费网元1根据服务提供网元的身份信息，向服务提供网元发送第一服务请求信息，该第一服务请求信息用于请求访问第一网络功能服务，该第一服务请求信息包括第一令牌。
服务消费网元1接收到网络存储功能网元发送的第一令牌后，可以根据第一令牌中服务提供网元的身份信息，向服务提供网元发送第一服务请求，以请求访问服务提供网元提供的第一网络功能服务。
506、服务提供网元在接收到服务消费网元1发送的第一服务请求信息之后，若第一令牌验证成功，则服务提供网元向服务消费网元1发送第一响应信息，第一响应信息用于表示接受第一网络功能服务的访问请求。
服务提供网元接收到服务消费网元1发送的第一服务请求信息后，对第一令牌进行验证。例如，可以对第一令牌中的签名进行验证(也称完整性验证)；以及对第一令牌的claim字段中，每个字段是否合法进行验证等。若第一令牌验证成功，则可以表明服务消费网元1是合法的，允许服务消费网元1访问第一网络功能服务。
在一实施例中，第一服务请求信息中还可以包括服务消费网元1所属的网络功能类型1。对第一令牌进行验证还包括，验证第一服务请求信息中的网络功能类型1与第一令牌中的第一网络功能类型是否一致。在第一服务请求信息中的网络功能类型1与第一令牌中的第一网络功能类型一致时，才允许服务消费网元1访问第一网络功能服务。
在步骤501-506描述的方案中，服务消费网元1可以根据从网络存储功能网元获取的基于第一网络功能类型的令牌，访问服务提供网元提供的第一网络功能服务。
进一步地，参见图5B，该方法还可以包括：
507、服务提供网元接收服务消费网元2(即第五服务消费网元)发送的第二服务 请求信息，该第二服务请求信息包括第一令牌，该第一令牌包括第一网络功能服务类型，该服务消费网元2属于第一网络功能服务类型。
508、若第一令牌验证成功，则服务提供网元向服务消费网元2发送第二响应信息，该第二响应信息用于表示接受第二网络功能服务的访问请求。
也就是说，属于第一网络功能类型的服务消费网元2，也可以通过基于第一网络功能类型的第一令牌请求访问第一网络功能服务。即，第一网络功能类型的多个服务消费网元，均可以通过基于第一网络功能的第一令牌请求访问第一网络功能服务。
在一实施例中，服务消费网元1需要先在网络存储网元上进行注册，而后才可以向网络存储网元申请第一令牌。例如，在服务消费网元提供的网络功能服务上线时，服务消费网元1可以在网络存储网元上进行注册，网络存储功能网元可以将第一网络功能类型中的其他服务消费网元申请的基于第一网络功能类型的令牌，下发给服务消费网元1。
具体的，参见图6，在步骤501之前，该方法还可以包括：
601、服务消费网元1向网络存储功能网元发送注册请求信息，该注册请求信息包括第一网络功能类型。
这样，网络存储功能网元可以获知服务消费网元所属的网络功能类型。例如，注册请求信息中包括服务消费网元1的网络功能配置NF profile信息，该NF profile信息中包括服务消费网元1所属的第一网络功能类型。
602、网络存储功能网元在接收到服务消费网元1发送的注册请求信息之后，向服务消费网元1发送至少一个令牌，该至少一个令牌为服务消费网元1以外的，属于第一网络功能类型的其他服务消费网元所申请的令牌；该至少一个令牌包括第一网络功能类型，至少一个令牌用于访问至少一个网络功能服务。
在该步骤中，网络存储功能网元根据服务消费网元所属的第一网络功能类型，确定其他服务消费网元申请过的基于第一网络功能类型的至少一个令牌，并将这些令牌发送给服务消费网元1。例如，网络存储功能网元可以通过Nnrf_NFManagement_NF Register response消息，将该至少一个令牌发送给服务消费网元1。
这样，当服务消费网元1需要访问其他网络功能服务时，就可以直接使用这些令牌向服务提供网元提出请求，而不需要再向网络存储功能网元申请令牌，从而可以减少服务消费网元申请令牌的次数，降低网络存储功能网元的工作量。
在另一实施例中，服务消费网元1还可以向网络存储功能网元订阅第一网络功能类型的令牌的请求事件，从而从网络存储功能网元获取其他服务消费网元申请的，基于第一网络功能类型的令牌。
在以上实施例描述的方法的基础上，参见图7，该方法还可以包括：
701、服务消费网元1向网络存储功能网元发送订阅请求信息，该订阅请求信息用于请求订阅第一网络功能类型的令牌的请求事件。
702、网络存储功能网元接收服务消费网元3(即第四服务消费网元)发送的第二令牌请求信息，该第二令牌请求信息用于请求获取服务消费网元3所属的第一网络功能类型的第二令牌，第二令牌用于访问第二网络功能服务。
703、网络存储功能网元生成第二令牌，该第二令牌包括第一网络功能类型，该第 二令牌适用于属于第一网络功能类型的服务消费网元。
704、网络存储功能网元将第二令牌发送给服务消费网元3和服务消费网元1。
在步骤701-704描述的方案中，网络存储功能网元在接收到服务消费网元1发送的订阅请求信息之后，若接收到其他服务消费网元(例如服务消费网元3)触发的令牌请求事件，则将其他服务消费网元申请的基于第一网络功能类型的令牌，也通知给已订阅该令牌请求事件的服务消费网元1。这样，服务消费网元1可以根据其他服务消费网元申请的基于第一网络功能类型的令牌，访问其他网络功能服务，而不需要再向网络存储功能网元申请令牌，因而可以减少令牌申请次数，降低网络存储功能网元的工作量。
在一种应用场景中，在网络部署时，可能多个网络功能NF同时上线，新上线的服务消费网元均未向网络存储功能网元申请令牌。此时，服务消费网元可以向网络存储功能网元订阅令牌请求事件。后续，在某个服务消费网元申请基于第一网络功能类型的令牌时，请求订阅令牌请求事件的其他服务消费网元也可以接收到网络存储功能网元推送的令牌，从而可以减少令牌申请次数，降低网络存储功能网元的工作量。
在另一实施例中，在以上实施例描述的方法的基础上，在业务发生变化或者在服务消费网元需要上、下线变化，从而需要切换服务消费网元的场景下，切换前的服务消费网元可以将基于网络类型的令牌发送给待切换的服务消费网元。
参见图8，在服务消费网元1接收到网络存储功能网元发送的第一令牌之后，该方法还可以包括：
801、服务消费网元1接收其他网络设备发送的切换请求信息，该切换请求信息用于请求切换服务消费网元1。
例如，发送切换请求信息的其他网络设备可以是接入网设备。示例性的，在N2切换场景中，即切换AMF网元实例的情况下，该切换请求信息可以是eNB发送给AMF类型的服务消费网元1的handover required消息。
802、服务消费网元1确定待切换的服务消费网元4(即第二服务消费网元)。
服务消费网元1可以根据用户位置信息更新或者用户服务更新等信息确定待切换的服务消费网元4。示例性的，在N2切换场景中，待切换的服务消费网元4可以为AMF类型的另一个服务消费网元。
803、服务消费网元1向服务消费网元4发送第一令牌。
示例性的，在N2切换场景中，AMF类型的服务消费网元1作为源网元，可以通过用户切换上下文传递Namf_Communication_CreateUEContextTransfer消息，向AMF类型的目的网元服务消费网元4(即待切换网元)发送第一令牌。
804、服务消费网元1切换为服务消费网元4。
这样，切换后的服务消费网元4可以通过服务消费网元1发送的第一令牌，请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
需要说明的是，步骤801-804仅是以服务消费网元1获取到了基于第一网络功能类型的第一令牌为例进行说明的，若服务消费网元1获取到了多个基于网络功能类型 的令牌(例如SMF类型的令牌、UDM类型的令牌等)，则服务消费网元1可以将多个令牌都发送给服务消费网元4，以减少服务消费网元4申请令牌的次数。
在另一实施例中，在以上实施例描述的方法的基础上，在业务发生变化或者在服务消费网元需要上、下线变化，使得UE等网络设备注册到的服务消费网元发生变化时，UE等网络设备之前注册到的旧的服务消费网元可以将基于网络类型的令牌发送给新的服务消费网元。
参见图9，在服务消费网元1接收到网络存储功能网元发送的第一令牌之后，该方法还可以包括：
901、其他网络设备向服务消费网元5(即第三服务消费网元)发送注册请求信息，该注册请求信息用于请求注册到服务消费网元5。
例如，发送切换请求信息的其他网络设备可以是接入网设备，该注册请求信息用于请求将UE注册到服务消费网元5。
902、服务消费网元5向服务消费网元1发送用户信息请求消息。
举例来说，若UE原先注册在AMF类型的服务消费网元1上，服务消费网元1向UE发送全球唯一临时UE标识(globally unique temporary UE identity，GUTI)信息，该GUTI信息中包括服务消费网元1的标识信息。在UE需要注册到新的AMF类型的服务消费网元5时，接入网设备可以将服务消费网元1的标识信息发送给服务消费网元5，服务消费网元5可以根据该标识信息向服务消费网元1发送用户信息请求消息。示例性的，该用户信息请求消息可以为用户切换上下文传递Namf_Communication_UEContextTransfer消息。
903、服务消费网元1接收到用户信息请求消息后，向服务消费网元5发送第一令牌。
示例性的，AMF类型的服务消费网元1可以通过用户切换上下文传递响应Namf_Communication_UEContextTransfer response消息，将基于第一网络功能类型的第一令牌发送给AMF类型的服务消费网元5。
904、UE注册到服务消费网元5。
这样，服务消费网元5可以通过服务消费网元1发送的第一令牌，请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
需要说明的是，步骤901-904仅是以服务消费网元1获取到了基于第一网络功能类型的第一令牌为例进行说明的，若服务消费网元1获取到了多个基于网络功能类型的令牌例如SMF类型的令牌、UDM类型的令牌等)，则服务消费网元1可以将多个令牌都发送给服务消费网元5，以减少服务消费网元5申请令牌的次数。
在另一实施例中，在以上实施例描述的方法的基础上，参见图10，在服务消费网元1接收网络存储功能网元发送的第一令牌之后，该方法还可以包括：
1001、服务消费网元1将第一令牌存储在非结构化数据存储网络功能UDSF网元上。
1002、其他服务消费网元从UDSF网元上获取第一令牌。
这样，第一网络功能类型中的其他服务消费网元可以从UDSF网元上获取该第一 令牌，从而可以通过该第一令牌请求访问第一网络功能服务，而不需要再向网络存储功能网元申请第一令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
需要说明的是，步骤1001-1002仅是以服务消费网元1将基于第一网络功能类型的第一令牌存储到了UDSF网元上为例进行说明的，若服务消费网元1将多个基于第一网络功能类型的令牌存储到了UDSF网元上，则其他服务消费网元可以从UDSF上获取到多个令牌，从而可以减少其他服务消费网元申请令牌的次数。
在另一实施例中，在以上实施例描述的方法的基础上，参见图10，该方法还可以包括：
1003、服务消费网元1从非结构化数据存储网络功能网元获取第三令牌，该第三令牌包括第一网络功能类型，该第三令牌用于请求访问第三网络功能服务。
这样，服务消费网元1可以从UDSF网元上获取其他服务消费网元存储的，基于第一网络功能类型的其他令牌(例如第三令牌)，从而可以通过该其他令牌请求访问其他的网络功能服务，而不需要再向网络存储功能网元申请令牌，因而可以减少服务消费网元向网络存储功能网元申请令牌的次数，降低网络存储功能网元的工作量。
在本申请的其他实施例中，基于网络功能类型的令牌并不适用于该网络功能类型中的所有服务消费网元，而仅适用于该网络功能类型中指定范围内的服务消费网元。其中，该范围具体可以是运营商根据预设策略设置的范围，也可以是基于网络功能类型的令牌中限定的范围。该范围内所限定的网元可以认为是安全的、合法的服务消费网元。该范围内所限定内的多个特定的网元，才可以通过基于网络功能类型的令牌访问对应的网络功能服务，从而可以在降低工作量的同时，还可以提高令牌和网络功能服务的安全性。
举例来说，第一令牌可以包括范围信息，该范围信息用于表示可以通过第一令牌访问第一网络功能服务，且属于第一网络功能类型的服务消费网元的范围。示例性的，该范围信息为网络切片标识。再示例性的，该范围信息为地区region标识，该region标识可以为省区标识。
以上实施例主要描述了服务消费网元1向网络存储功能网元请求获取基于第一网络功能类型的第一令牌。需要说明的是，在本申请的实施例中，如图2所示，服务消费网元1还可以请求获取基于服务消费网元1的令牌。服务消费网元1具体可以根据运营商的预设的安全策略或部署策略，或者根据业务需求等因素，确定请求获取基于第一网络功能类型的第一令牌，还是请求获取基于服务消费网元1的令牌。
还需要说明的是，以上主要是以服务消费网元1、第一网络功能服务、第一网络功能类型为例进行说明的，对于其他服务消费网元，其他网络功能服务和其他网络功能类型，也可以采用上述方式进行网络功能服务访问，本申请实施例不再赘述。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述服务消费网元、网络存储功能网元、服务提供网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件 驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对服务消费网元、网络存储功能网元、服务提供网元进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，以采用集成的方式划分各个功能模块的情况下，图11示出了一种通信装置1100的结构示意图。该通信装置可以为服务消费网元或者服务消费网元中的芯片或者片上系统，还可以为网络存储功能网元或者网络存储功能网元中的芯片或者片上系统；也可以为服务提供网元或者服务提供网元中的芯片或者片上系统，该通信装置可以用于执行上述实施例中涉及的网络设备的功能。作为一种可实现方式，图11所示通信装置1100可以包括：发送单元1101、接收单元1102和处理单元1103。
在一实施例中，该通信装置1100为服务消费网元或者服务消费网元中的芯片或者片上系统。发送单元1101可以用于，支持通信装置1100向网络存储功能网元发送第一令牌请求信息，第一令牌请求信息用于请求获取通信装置所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。接收单元1102可以用于，支持通信装置1100接收网络存储功能网元发送的第一令牌，第一令牌包括第一网络功能类型；第一令牌适用于属于第一网络功能类型的服务消费网元。
例如，发送单元1101具体可以用于，支持通信装置1100执行图5A-图10中的步骤501、步骤505、步骤601、步骤701、步骤803等，和/或用于本文所描述的技术的其他过程。
接收单元1102具体可以用于，支持通信装置1100执行图5A-图10中的步骤503、步骤506、步骤602、步骤704、步骤801、步骤804、步骤902等，和/或用于本文所描述的技术的其他过程。
处理单元1103具体可以用于，支持通信装置1100执行图5A-图10中的步骤802、步骤1001、步骤1003等，和/或用于本文所描述的技术的其他过程。
在另一实施例中，该通信装置1100为网络存储功能网元或者网络存储功能网元中的芯片或者片上系统。接收单元1102可以用于，支持通信装置1100接收第一服务消费网元发送的第一令牌请求信息，第一令牌请求信息用于请求获取第一服务消费网元所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。处理单元1103可以用于，支持通信装置1100生成第一令牌，第一令牌包括第一网络功能类型；第一令牌适用于属于第一网络功能类型的服务消费网元。发送单元1101可以用于，支持通信装置1100将第一令牌发送给第一服务消费网元。
例如，接收单元1102具体可以用于，支持通信装置1100执行图5A-图10中的步骤501、步骤601、步骤701、步骤702等，和/或用于本文所描述的技术的其他过程。
处理单元1103具体可以用于，支持通信装置1100执行图5A-图10中的步骤504、 步骤502、步骤703等，和/或用于本文所描述的技术的其他过程。
发送单元1101具体可以用于，支持通信装置1100执行图5A-图10中的步骤503、步骤602、步骤704等，和/或用于本文所描述的技术的其他过程。
在另一实施例中，该通信装置1100为服务提供网元或者服务提供网元中的芯片或者片上系统。发送单元1101可以用于，支持通信装置1100向网络存储功能网元发送第一令牌请求信息，第一令牌请求信息用于请求获取通信装置所属的第一网络功能类型的第一令牌，第一令牌用于访问第一网络功能服务。接收单元1102可以用于，接收网络存储功能网元发送的第一令牌，第一令牌包括第一网络功能类型；第一令牌适用于属于第一网络功能类型的服务消费网元。支持通信装置1100执行图5A-图10中的步骤504、步骤502、步骤703等，和/或用于本文所描述的技术的其他过程。
例如，接收单元1102具体可以用于，支持通信装置1100执行图5A-图10中的步骤505、步骤507等，和/或用于本文所描述的技术的其他过程。
发送单元1101具体可以用于，支持通信装置1100执行图5A-图10中的步骤506、步骤508等，和/或用于本文所描述的技术的其他过程。
处理单元1103具体可以用于，支持通信装置1100控制发送单元1101和接收单元1102执行上述相应步骤。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在本实施例中，该通信装置1100以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定ASIC，电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到该通信装置1100可以采用图4所示的形式。
比如，图4中的处理器401可以通过调用存储器403中存储的计算机执行指令，使得通信装置1100执行上述方法实施例中的令牌处理方法。
具体的，图11中的发送单元1101、接收单元1102和处理单元1103的功能/实现过程可以通过图4中的处理器401调用存储器403中存储的计算机执行指令来实现。或者，图11中的处理单元1103的功能/实现过程可以通过图4中的处理器401调用存储器403中存储的计算机执行指令来实现，图11中的发送单元1101和接收单元1102的功能/实现过程可以通过图4中的通信接口404来实现。
由于本实施例提供的通信装置1100可执行上述令牌处理方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
本申请的实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机指令，当该计算机指令在通信装置上运行时，使得通信装置执行上述相关方法步骤实现上述实施例中的令牌处理方法。
本申请的实施例还提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述相关步骤，以实现上述实施例中通信装置执行的令牌处理方法。
另外，本申请实施例还提供了一种装置(例如，该装置可以是芯片，组件或模块)，该装置包括处理器，用于支持通信装置实现上述令牌处理方法，例如获取基于网络功 能类型的令牌。在一种可能的设计中，该装置还包括存储器。该存储器，用于保存通信装置必要的程序指令和数据。当然，存储器也可以不在该装置中。该装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
其中，本实施例提供的装置、计算机存储介质、计算机程序产品或芯片均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
本申请实施例还提供了一种通信系统，该通信系统可以包括上文中提供的服务消费网元、网络存储功能网元以及服务提供网元，可以用于执行以上实施例提供的令牌处理方法。
通过以上实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其他的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其他的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上内容，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (10)

  1. 一种令牌处理方法，其特征在于，包括：
    网络存储功能网元接收第一网络功能服务消费网元发送的第一令牌请求信息；
    所述网络存储功能网元生成第一令牌，所述第一令牌包括第一网络功能类型；所述第一令牌适用于属于所述第一网络功能类型的网络功能服务消费网元；
    所述网络存储功能网元将所述第一令牌发送给所述第一网络功能服务消费网元。
  2. 根据权利要求1所述的方法，其特征在于，所述第一令牌请求信息包括通配符形式的客户标识client id字段。
  3. 根据权利要求1所述的方法，其特征在于，所述第一令牌请求信息未包括客户标识client id字段。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一令牌的主体subject字段包括所述第一网络功能类型，且未包括网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。
  5. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一令牌的主体subject字段包括通配符形式的网络功能服务消费网元的服务功能实例标识NF Instance Id of the NF Service consumer。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，在所述网络存储功能网元生成所述第一令牌之前，所述方法还包括：
    所述网络存储功能网元确定提供所述第一网络功能服务的网络功能服务提供网元，所述第一令牌还包括所述网络功能服务提供网元的身份信息。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，在所述网络存储功能网元接收第一网络功能服务消费网元发送的第一令牌请求信息之前，所述方法还包括：
    所述网络存储功能网元接收所述第一网络功能服务消费网元发送的注册请求信息，所述注册请求信息包括所述第一网络功能服务消费网元所属的第一网络功能类型；
    所述网络存储功能网元向所述第一网络功能服务消费网元发送至少一个令牌，所述至少一个令牌为所述第一网络功能类型的其他网络功能服务消费网元所申请的令牌；所述至少一个令牌包括所述第一网络功能类型，所述至少一个令牌用于访问至少一个网络功能服务。
  8. 根据权利要求1-7任一项所述的方法，其特征在于，所述方法还包括：
    所述网络存储功能网元接收所述第一网络功能服务消费网元发送的订阅请求信息，所述订阅请求信息用于请求订阅所述第一网络功能类型的令牌的请求事件；
    所述网络存储功能网元接收第四网络功能服务消费网元发送的第二令牌请求信息，所述第二令牌请求信息用于请求获取所述第四网络功能服务消费网元所属的第一网络功能类型的第二令牌，所述第二令牌用于访问第二网络功能服务；
    所述网络存储功能网元生成所述第二令牌，所述第二令牌包括所述第一网络功能类型；所述第二令牌适用于属于所述第一网络功能类型的网络功能服务消费网元；
    所述网络存储功能网元将所述第二令牌发送给所述第四网络功能服务消费网元和所述第一网络功能服务消费网元。
  9. 一种通信装置，其特征在于，所述通信装置为网络存储功能网元，或者所述通 信装置为网络存储功能网元中的芯片或片上系统；所述通信装置包括：
    接收单元，用于接收第一网络功能服务消费网元发送的第一令牌请求信息，所述第一令牌请求信息用于请求获取所述第一网络功能服务消费网元所属的第一网络功能类型的第一令牌，所述第一令牌用于访问第一网络功能服务；
    处理单元，用于生成所述第一令牌，所述第一令牌包括所述第一网络功能类型；所述第一令牌适用于属于所述第一网络功能类型的网络功能服务消费网元；
    发送单元，用于将所述第一令牌发送给所述第一网络功能服务消费网元。
  10. 根据权利要求9所述的通信装置，其特征在于，所述通信装置用于实现权利要求1-8中任一项所述的方法。
PCT/CN2020/071539 2019-01-14 2020-01-10 一种令牌处理方法及装置 WO2020147663A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910033422.1 2019-01-14
CN201910033422.1A CN111435932B (zh) 2019-01-14 2019-01-14 一种令牌处理方法及装置

Publications (1)

Publication Number Publication Date
WO2020147663A1 true WO2020147663A1 (zh) 2020-07-23

Family

ID=71579999

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/071539 WO2020147663A1 (zh) 2019-01-14 2020-01-10 一种令牌处理方法及装置

Country Status (2)

Country Link
CN (1) CN111435932B (zh)
WO (1) WO2020147663A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115396892A (zh) * 2021-05-09 2022-11-25 华为技术有限公司 一种通信方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AR123190A1 (es) * 2020-08-10 2022-11-09 Ericsson Telefon Ab L M Método y aparato de comunicación de seguridad
CN114528540A (zh) * 2020-10-30 2022-05-24 华为技术有限公司 一种服务授权方法、通信装置及系统
WO2022147827A1 (en) * 2021-01-11 2022-07-14 Nokia Technologies Oy Access token handling for indirect communication
FI129556B (en) * 2021-01-13 2022-04-29 Nokia Technologies Oy Handling an error in a network function call
CN115396867A (zh) * 2021-05-24 2022-11-25 华为技术有限公司 通信方法和网络设备
CN116419229A (zh) * 2022-01-05 2023-07-11 华为技术有限公司 集成可信度量的通信方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018137352A1 (zh) * 2017-01-24 2018-08-02 华为技术有限公司 一种网络认证方法、用户设备、网络认证节点及系统
CN108650125A (zh) * 2018-05-09 2018-10-12 清华大学 一种面向b5g的基于非栈式协议的核心网系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103209160B (zh) * 2012-01-13 2018-05-08 中兴通讯股份有限公司 一种面向异构网络的认证方法及系统
CN102739405A (zh) * 2012-07-06 2012-10-17 深圳市远行科技有限公司 一种面向服务架构服务消费者的认证方法
WO2014146259A1 (en) * 2013-03-20 2014-09-25 Nokia Corporation An identification token
US20170109751A1 (en) * 2014-05-02 2017-04-20 Nok Nok Labs, Inc. System and method for carrying strong authentication events over different channels
CN105991514B (zh) * 2015-01-28 2019-10-01 阿里巴巴集团控股有限公司 一种业务请求认证方法及装置
CN106936570B (zh) * 2015-12-31 2021-08-20 华为技术有限公司 一种密钥配置方法及密钥管理中心、网元

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018137352A1 (zh) * 2017-01-24 2018-08-02 华为技术有限公司 一种网络认证方法、用户设备、网络认证节点及系统
CN108650125A (zh) * 2018-05-09 2018-10-12 清华大学 一种面向b5g的基于非栈式协议的核心网系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "3 Generation Partnership Project; Technical Specification Group Services and System Aspects; Security architecture and procedures for 5G system (Release 15)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 33.501, no. V15.3.1, 31 December 2018 (2018-12-31), pages 1 - 181, XP051591577 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115396892A (zh) * 2021-05-09 2022-11-25 华为技术有限公司 一种通信方法及装置

Also Published As

Publication number Publication date
CN111435932A (zh) 2020-07-21
CN111435932B (zh) 2021-10-01

Similar Documents

Publication Publication Date Title
WO2020147663A1 (zh) 一种令牌处理方法及装置
EP3592012B1 (en) Subscription update method, device and system
US11445569B2 (en) Session establishment method and system, and device
EP3709707B1 (en) Slice information update method and apparatus
US20210306940A1 (en) Network slice selection method, device, and system
US20210218585A1 (en) Local area network communication method, device, and system
US11304052B2 (en) Subscription update method, device, and system
EP3790315A1 (en) Switching method, device, and system
EP3700252B1 (en) Communication method and device
US10897699B2 (en) Subscription update method, device, and system
US20200186526A1 (en) Secure access method, device, and system
WO2020164290A1 (zh) 策略控制方法、装置及系统
US20220377653A1 (en) Slice information update method and apparatus
WO2021088882A1 (zh) 数据共享的方法、设备及系统
CN113472724B (zh) 一种网络认证方法、设备及系统
WO2019184723A1 (zh) 策略和计费控制规则获取方法、装置及系统
CN112105026B (zh) 一种授权控制的方法、装置以及存储介质
WO2023016255A1 (zh) 一种网络功能服务授权方法及装置
US20220360586A1 (en) Apparatus, methods, and computer programs
US11533596B2 (en) API publish method and apparatus
WO2023216856A1 (zh) 业务管理方法和装置
US11595817B2 (en) Authentication method, device, and system
WO2023246584A1 (zh) 算力处理方法、装置及通信设备
WO2019105156A1 (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20741741

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20741741

Country of ref document: EP

Kind code of ref document: A1