WO2020220783A1

WO2020220783A1 - Proxy subscription authorization method and device

Info

Publication number: WO2020220783A1
Application number: PCT/CN2020/074251
Authority: WO
Inventors: 赵绪文; 张博
Original assignee: 华为技术有限公司
Priority date: 2019-04-29
Filing date: 2020-02-04
Publication date: 2020-11-05
Also published as: CN115361183A; CN111865888B; CN111865888A

Abstract

The present application provides a proxy subscription authorization method and device, used for improving the security of a proxy subscription process. The method comprises: a network repository function (NRF) receiving a token request from a first network function (NF), said token request comprising the identity of the first NF and the identity of the second NF; the NRF generating a first token on the basis of the token request, said first token being used for indicating that the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and is used for indicating that the second NF has the authority to receive a network function service provided by the third NF; the NRF sending the first token to the first NF.

Description

Authorization method and device for proxy subscription

Technical field

The embodiments of the present application relate to the field of communication technology, and in particular, to an authorization method and device for proxy subscription.

Background technique

The fifth generation mobile communication system (the fifth generation, 5G) adopts a service-based architecture (SBA). The 3rd generation partnership project (3GPP) also proposed enhancement of service-based architecture (eSBA). In SBA or eSBA, the communication between network functions (network fuction, NF) in the core network adopts a service invocation method. For example, a "subscription-notification" interaction method is adopted between two NFs. NF_A subscribes services to NF_B, and NF_B notifies NF_A of related services after the corresponding conditions are met.

In addition, SBA or eSBA architecture also supports proxy subscriptions. In the proxy subscription scenario, NF_A can also subscribe to NF_B on behalf of NF_C, and NF_B directly notifies NF_C of related services after the corresponding conditions are met. In the proxy subscription scenario, service subscription, modification and cancellation are all done by NF_A on behalf of NF_C, and NF_C only receives service notifications from NF_B.

However, how to ensure the security of proxy subscription in the proxy subscription scenario is a problem that needs to be resolved.

Summary of the invention

The embodiment of the present application provides a proxy subscription authorization method and device to solve the problem of how to ensure the security of proxy subscription in the proxy subscription scenario.

In a first aspect, a proxy subscription authorization method is provided, which can be executed by a network function storage function NRF, and the method includes the following steps: the network function storage function NRF receives a token request from a first network function NF, and the command The card request includes the identity of the first NF and the identity of the second NF; the NRF generates a first token based on the token request, and the first token is used to indicate that the first NF has a proxy The second NF has the right to subscribe to the network function service from the third NF, and is used to indicate that the second NF has the right to receive the network function service provided by the third NF; the NRF sends the The first token. In the proxy subscription scenario, NRF is used to authorize and judge the permissions of the two service requesters subscribed by the proxy, and indicate through the token, which can help ensure the security of proxy subscription in the proxy subscription scenario.

In a possible design, the NRF receives a token request from the first network function NF; the NRF performs authorization based on the token request, and if the authorization is successful, sends the first token to the first NF; wherein, The authorization includes: determining whether the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and determining whether the second NF has the authority to receive network function services provided by the third NF Permissions. In the proxy subscription scenario, NRF is used to authorize and judge the permissions of the two service requesters subscribed by the proxy, and indicate through the token, which can help ensure the security of proxy subscription in the proxy subscription scenario.

In a possible design, the token request includes first indication information, and the indication information is used to instruct the first NF to subscribe to the third NF for the network function service on behalf of the second NF; The NRF determines according to the indication information that it needs to be generated for the first token.

In a possible design, the first token includes an identifier of the second NF, which is used to determine the information of the second NF after the third NF successfully verifies the token.

In a possible design, the first token includes the second indication information, which is used to indicate to the third NF that the first token is the first NF to proxy the second NF Subscribe to the third NF for network function services.

In a possible design, the first token is used to indicate that the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and is used to indicate that the second NF has the right to receive The authority of the network function service provided by the third NF. Tokens are used to characterize permissions.

In a possible design, the NRF receives a verification request from the third NF, the verification request includes a second token, and the verification request is used to request verification of the second token. Verification; The NRF verifies the second token and returns a verification result to the third NF. The third NF here is the service provider, and NRF can verify the token provided by the service provider to further ensure the security of proxy subscription.

In a possible design, the verification includes one or more of the following: performing integrity verification on the second token, and verifying whether the second token is used to indicate that the second NF has Receiving the authority of the network function service provided by the third NF, verifying the validity of the second token, verifying whether the identity of the service provider contained in the token is the same as the identity of the third NF, and Check whether the second token is consistent with the first token.

In a second aspect, a proxy subscription authorization method is provided. The method can be executed by a first network function NF. The method includes the following steps: the first network function NF sends a token request to the network function storage function NRF, and the command The card request includes the identity of the first NF and the identity of the second NF; the first NF receives a token from the NRF, and the token is used to indicate that the first NF has a proxy for the second NF. The NF has the right to subscribe to the network function service from the third NF, and is used to indicate that the second NF has the right to receive the network function service provided by the third NF. In the proxy subscription scenario, the first NF requests the NRF to perform authorization judgment on the service requester subscribed by the proxy, and indicates through the token, which can help ensure the security of the proxy subscription in the proxy subscription scenario.

In a possible design, the first network function NF sends a token request to the network function storage function NRF, the token request is used to request the NRF to perform authorization, and the authorization includes: determining whether the first NF has Acting for the second NF to subscribe to the third NF for the right to subscribe to the network function service, and to determine whether the second NF has the right to receive the network function service provided by the third NF; the first NF receives the order from the NRF brand. In the proxy subscription scenario, the first NF requests the NRF to perform authorization judgment on the service requester subscribed by the proxy, and indicates through the token, which can help ensure the security of the proxy subscription in the proxy subscription scenario.

In a possible design, the token request includes the identification of the first NF and the identification of the second NF. The identification of the two service requesters can represent the proxy subscription scenario.

In a possible design, the token request includes first indication information, and the first indication information is used to instruct the first NF to proxy the second NF to subscribe to the third NF for network function services. The proxy subscription scenario is characterized by the indication information.

In a possible design, the token includes the identifier of the second NF, and is used for determining the information of the second NF after the third NF successfully verifies the token.

In a possible design, the first token includes the second indication information for indicating the third NF, and the first token is the proxy of the second NF to the first NF for the first NF. Three NFs subscribe to network function services.

In a possible design, the token is used to indicate that the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and is used to indicate that the second NF has the right to receive third The authority of network function services provided by NF. Tokens are used to characterize permissions.

In a possible design, the first NF sends a subscription request to the third NF, and the subscription request carries the token. By carrying the token in the subscription request, it indicates that the two service requesters in the proxy subscription scenario are authorized.

In a possible design, the first NF receives a subscription response from the third NF, the subscription response carries the token or authorization result, and the authorization result includes: the second NF has the The authority of the network function service provided by the third NF, and the authority of the first NF to subscribe the network function service from the third NF on behalf of the second NF. If the subscription response carries the token, it can indicate that the token carried in the subscription request has passed the verification or the verification succeeded. If the subscription response carries the authorization result, it can indicate that the service requester subscribed by the proxy has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a possible design, the first NF receives a notification from the third NF, and the notification carries the token or authorization result, and the authorization result includes that the first NF has a proxy for the second NF. The NF has the right to subscribe to the network function service from the third NF, and the second NF has the right to receive the network function service provided by the third NF. If the notification carries a token, it can indicate that the token carried in the subscription request passed the verification or the verification succeeded. If the notification carries the authorization result, it can indicate that the service requester subscribed by the agent has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a third aspect, a proxy subscription authorization method is provided. The method can be executed by a third network function NF. The method includes the following steps: the third network function NF receives a subscription request from the first NF, and the subscription request carries Token; the third NF verifies the token contained in the subscription request to obtain a verification result, wherein, if the verification is successful, the first NF has the agent of the second NF to the The third NF has the right to subscribe to the network function service, and the second NF has the right to receive the network function service provided by the third NF; if the verification is unsuccessful, the first NF does not have the authority to proxy the second NF The NF has the right to subscribe to the network function service from the third NF, and the second NF does not have the right to receive the network function service provided by the third NF; the third NF sends a subscription response to the first NF , The subscription response carries the verification result. After the third NF receives the subscription request, it is determined according to the token carried in the subscription request that it is a proxy subscription scenario, and the token is verified, which can further improve the authorization effect of the proxy subscription scenario and ensure the security of proxy subscription .

In a possible design, the token carries the identity of the second NF. After the token is successfully verified by the third NF, the information of the second NF is determined.

In a possible design, the third NF obtains the identity of the second NF from the token when the verification succeeds.

In a possible design, the token carries indication information, and the indication information is used to instruct the first NF to subscribe to the third NF for the network function service on behalf of the second NF, so that the third NF can It is learned that the first token is a token used by the first NF to subscribe the network function service from the third NF on behalf of the second NF.

In a possible design, the third NF sends an authorization notification to the second NF when the verification succeeds, the authorization notification includes an authorization result, and the authorization result includes that the second NF has received the first 3. Permission of network function services provided by NF. The authorization notification can convey the authorization result to the second NF.

In a possible design, the verification includes one or more of the following: performing integrity verification on the token, and verifying whether the token is used to indicate that the second NF has received the information provided by the third NF. Network function service authority, verify the validity of the token, verify whether the identity of the service provider contained in the token is the same as the identity of the third NF, and verify that the token and the first Whether the tokens stored in the three NFs are consistent.

In a possible design, the subscription request also carries the identifier of the first NF and the identifier of the second NF. The identification of the two service requesters can be used to characterize the subscription request as a proxy subscription scenario.

In a possible design, the subscription response also carries the token or authorization result, and the authorization result includes that the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and The second NF has the right to receive the network function service provided by the third NF. If the subscription response carries the token, it can indicate that the token carried in the subscription request has passed the verification or the verification succeeded. If the subscription response carries the authorization result, it can indicate that the service requester subscribed by the proxy has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a possible design, the third NF sends a notification to the first NF, and the notification carries the token or the authorization result, and the authorization result includes that the first NF has a proxy for the second NF to The third NF has the right to subscribe to the network function service and the second NF has the right to receive the network function service provided by the third NF. If the notification carries a token, it can indicate that the token carried in the subscription request passed the verification or the verification succeeded. If the notification carries the authorization result, it can indicate that the service requester subscribed by the agent has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a fourth aspect, a proxy subscription system is provided. The system includes: first network functions NF and NRF. Wherein, the first network function NF is used to send a token request to the network function storage function NRF, and the token request includes the identity of the first NF and the identity of the second NF; the NRF is used to receive The first NF receives the token request, generates a token based on the token request, and sends a token to the first NF, where the token is used to indicate whether the first NF has a proxy for the The second NF has the right to subscribe to the network function service from the third NF, and is used to indicate whether the second NF has the right to receive the network function service provided by the third NF. Through the first NF in the proxy subscription scenario, request the NRF to authorize the service requester subscribed by the proxy, and in the proxy subscription scenario through the first NF, request the NRF to perform authorization judgment on the service requester subscribed by the proxy, through NRF In the proxy subscription scenario, the authorization judgment is made on the permissions of the two service requesters subscribed by the proxy, and the token is used to indicate, which can help ensure the security of the proxy subscription in the proxy subscription scenario.

In a possible design, the first network function NF is used to send a token request to the network function storage function NRF, where the token request includes the identity of the first NF and the identity of the second NF; NRF is used to receive the token request from the first NF, perform authorization based on the token request, and if the authorization is successful, send a token to the first NF; wherein the authorization includes: judgment Whether the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and whether the second NF has the authority to receive network function services provided by the third NF. Through the first NF in the proxy subscription scenario, request the NRF to authorize the service requester subscribed by the proxy, and in the proxy subscription scenario through the first NF, request the NRF to perform authorization judgment on the service requester subscribed by the proxy, through NRF In the proxy subscription scenario, the authorization judgment is made on the permissions of the two service requesters subscribed by the proxy, and the token is used to indicate, which can help ensure the security of the proxy subscription in the proxy subscription scenario.

In a possible design, the token request includes first indication information, and the first indication information is used to instruct the first NF to subscribe for the network function service from the third NF on behalf of the second NF; Make the NRF determine according to the instruction information that the token needs to be generated.

In a possible design, the first NF is further configured to send a subscription request to the third NF, and the subscription request carries the token. By carrying the token in the subscription request, it indicates that the two service requesters in the proxy subscription scenario are authorized.

In a possible design, the second indication information is included, and the second indication information is used to instruct the first NF to subscribe for the network function service from the third NF on behalf of the second NF.

In a possible design, the system further includes the third NF, and the third NF is configured to receive a subscription request from the first NF, and verify the token carried in the subscription request to obtain The verification result; wherein, if the verification is successful, the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and the second NF has the right to receive the third NF The authority of the provided network function service; if the verification is unsuccessful, the first NF does not have the authority to subscribe to the third NF for the network function service on behalf of the second NF, and the second NF does not have the authority to receive The authority of the network function service provided by the third NF. After the third NF receives the subscription request, it is determined according to the token carried in the subscription request that it is a proxy subscription scenario, and the token is verified, which can further improve the authorization effect of the proxy subscription scenario and ensure the security of proxy subscription .

In a possible design, the third NF is also used to send a subscription response to the first NF, and the subscription response carries the token or authorization result; the authorization result includes that the first NF has a proxy The second NF has the right to subscribe to the network function service from the third NF and the second NF has the right to receive the network function service provided by the third NF; the first NF is also used to subscribe from the third NF The three NFs receive the subscription response.

In a possible design, the third NF is further configured to send an authorization notification to the second NF when the verification succeeds, the authorization notification includes an authorization result, and the authorization result includes that the second NF has received The authority of the network function service provided by the third NF. The second NF is also used to receive the authorization notification from the third NF. If the subscription response carries the token, it can indicate that the token carried in the subscription request has passed the verification or the verification succeeded. If the subscription response carries the authorization result, it can indicate that the service requester subscribed by the proxy has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a possible design, the third NF is also used to send a notification to the first NF, and the notification carries the token or authorization result, and the authorization result includes that the second NF has a receiving first An NF has the authority to subscribe network function services to the third NF on behalf of the second NF and the authority to subscribe network function services provided by the third NF; the first NF is also used to receive from the third NF The notice. If the notification carries a token, it can indicate that the token carried in the subscription request passed the verification or the verification succeeded. If the notification carries the authorization result, it can indicate that the service requester subscribed by the agent has completed the authorization. Further, after receiving the token or authorization result, the first NF may also forward the token or authorization result to the third NF, so as to achieve the purpose of notifying the second NF of whether the authorization is successful.

In a fifth aspect, a proxy subscription authorization method is provided. The execution subject of the method may be a service communication agent SCP. The method may be executed by the following steps: SCP receives a subscription request from a first network function NF, and the subscription request is used for The first NF requests the proxy second NF to subscribe to the third NF for network function services; the SCP determines that the second NF has the authority to receive the network function services provided by the third NF; The second NF sends an authorization notification, where the authorization notification is used to indicate that the second NF has the right to receive the network function service provided by the third NF. In the proxy subscription scenario, the SCP is used to judge the permissions of the two service requesters subscribed by the proxy, which can help ensure the security of the proxy subscription in the proxy subscription scenario.

In a possible design, the subscription request includes one or more tokens; the SCP determines that the second NF has the right to receive the network function service provided by the third NF, which is implemented in the following manner: Based on the one or more tokens, the SCP determines that the second NR has the right to receive the network function service provided by the third NF. One token may indicate that the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and the second NF has the authority to receive network function services provided by the third NF. The multiple tokens may be, for example, two tokens. Such a token is used to indicate that the first NF has the authority to subscribe to the third NF on behalf of the second NF, and the other token is used to indicate the third NF. The second NF has the right to receive the network function service provided by the third NF.

In a possible design, the SCP verifies the token; the verification includes one or more of the following: integrity verification of the token, verification of whether the token is used to indicate the second The NF has the authority to receive the network function service provided by the third NF and verify the validity of the token. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF. It is also necessary to verify whether the identifier of the service producer (service producer) included in the audience claim in the token is the same as the identifier of the third NF queried by the SCP. Specifically, the SCP can obtain the identity of the third NF by querying based on locally configured information, and can also obtain the identity of the third NF by querying based on the information obtained from the NRF. It can also verify whether the third NF can provide the subscribed network function service.

In a possible design, if the verification is successful, the SCP sends an authorization notification to the second NF, the authorization notification includes the authorization result, and the authorization result includes that the first NF has a proxy for the second NF to subscribe to the third NF The authority of the network function service, and the second NF has the authority to receive the network function service provided by the third NF. Or, if the verification is successful, the SCP sends a token to the second NF, indicating through the token that the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and that the second NF has the right to receive the third NF. The authority of network function services provided by NF.

In a possible design, the one or more tokens include a first token and a second token; the first token is used to indicate that the first NF has proxy for the second NF to the The third NF has the right to subscribe to the network function service; the second token is used to indicate that the second NF has the right to receive the network function service provided by the third NF.

In a possible design, the SCP determines that the second NF has the authority to receive network function services provided by the third NF, which is implemented in the following manner: the SCP sends an authorization request to the NRF; The NRF receives a response to the authorization request, where the response is used to indicate that the second NF has the right to receive the network function service provided by the third NF. Performing authorization judgment through NRF and returning the authorization result to SCP can improve the security in the proxy subscription scenario.

In a sixth aspect, an authorization method for proxy subscription is provided. The method can be executed by a third network function NF. The method includes: the third NF receives a subscription request from the first NF, and the subscription request is used for the first NF. The NF acts for the second NF to subscribe to the third NF for network function services; the third NF determines that the second NF has the authority to receive the network function services provided by the third NF; the third NF subscribes to the second NF The NF sends an authorization notification, where the authorization notification is used to indicate that the second NF has the right to receive the network function service provided by the third NF. Judging the authority of the two service requesters in the subscription request through the third NF can improve the security of proxy subscription.

In a possible design, the third NF determines whether the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and determines whether the second NF has the right to receive the first NF. For the authority of the network function service provided by the third NF, if both of the judgment results are yes, the authorization result obtained by the third NF is yes.

In a possible design, the subscription request includes one or more tokens; the third NF verifies the tokens included in the subscription request, and when the verification succeeds, determines the second NF Have the authority to receive network function services provided by the third NF, wherein the verification includes one or more of the following: integrity verification of the token, and verification of whether the token is used to indicate that the second NF has Receive the authority of the network function service provided by the third NF and verify the validity of the token. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF.

In a possible design, the subscription request includes a first token and a second token; the first token is used to indicate that the first NF has a proxy for the second NF to subscribe to the third NF The authority of the network function service; the second token is used to indicate that the second NF has the authority to receive the network function service provided by the third NF.

In a seventh aspect, an authorization device for proxy subscription is provided, which has the function of realizing the NRF behavior in any possible design of the first aspect and the first aspect. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In one possible design, the device can be a chip or an integrated circuit.

In a possible design, the device includes a memory and a processor, the memory stores a set of programs, and the processor is used to execute the programs stored in the memory. When the programs are executed, the device can execute the first aspect and the first aspect. Any of the possible designs described in the method.

In a possible design, the device also includes a transceiver for communication between the device and other functions.

In one possible design, the device is NRF.

In an eighth aspect, an authorization device for proxy subscription is provided, which has the function of implementing the first NF behavior in any possible design of the second aspect and the second aspect. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In one possible design, the device can be a chip or an integrated circuit.

In a possible design, the device includes a memory and a processor, the memory stores a set of programs, and the processor is used to execute the programs stored in the memory. When the programs are executed, the device can execute the second aspect and the second aspect. Any of the possible designs described in the method.

In one possible design, the device is NF.

In a ninth aspect, an authorization device for proxy subscription is provided. The device has the function of realizing the third NF behavior in any possible design of the third aspect and the third aspect. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In one possible design, the device can be a chip or an integrated circuit.

In a possible design, the device includes a memory and a processor. The memory stores a set of programs. The processor is used to execute the programs stored in the memory. When the programs are executed, the device can execute the third aspect and the third aspect. Any of the possible designs described in the method.

In one possible design, the device is NF.

In a tenth aspect, an authorization device for proxy subscription is provided, which has the function of realizing SCP behavior in any possible design of the fifth aspect and the fifth aspect. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In one possible design, the device can be a chip or an integrated circuit.

In a possible design, the device includes a memory and a processor. The memory stores a set of programs. The processor is used to execute the programs stored in the memory. When the programs are executed, the device can execute the fifth aspect and the fifth aspect. Any of the possible designs described in the method.

In one possible design, the device is an SCP.

In an eleventh aspect, an authorization device for proxy subscription is provided, which has the function of realizing the third NF behavior in any possible design of the sixth aspect and the sixth aspect. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In one possible design, the device can be a chip or an integrated circuit.

In a possible design, the device includes a memory and a processor. The memory stores a set of programs. The processor is used to execute the programs stored in the memory. When the programs are executed, the device can execute the sixth aspect and the sixth aspect. Any of the possible designs described in the method.

In one possible design, the device is NF.

In an eleventh aspect, a chip is provided, the chip is connected to a memory or the chip includes a memory, and is used to read and execute a software program stored in the memory, so as to realize the above aspects and any possible The method described in the design.

In a twelfth aspect, a computer storage medium is provided, and a computer program is stored. The computer program includes instructions for executing the foregoing aspects and any possible design method in each aspect.

In a thirteenth aspect, a computer program product is provided. When the computer reads and executes the computer program product, the computer executes the above aspects and the methods described in any possible design of the aspects.

Description of the drawings

Figure 1a is one of the schematic diagrams of the servicing architecture system in an embodiment of the application;

Figure 1b is the second schematic diagram of the service-oriented architecture system in the embodiment of the application;

Figure 2 is a schematic flow diagram of one of the authorization methods for proxy subscription in an embodiment of the application;

FIG. 3 is a schematic diagram of the second flow of the authorization method for proxy subscription in an embodiment of the application;

FIG. 4 is a schematic diagram of the third process of the authorization method for proxy subscription in an embodiment of the application;

Figure 5 is a schematic diagram of the fourth process of the proxy subscription authorization method in an embodiment of the application;

Fig. 6 is a schematic diagram of the fifth process of the authorization method for proxy subscription in an embodiment of the application;

7 is a schematic diagram of the sixth process of the authorization method for proxy subscription in an embodiment of the application;

FIG. 8 is one of the structural diagrams of the authorization device for proxy subscription in an embodiment of the application;

Figure 9 is the second structural diagram of the authorization device for proxy subscription in an embodiment of the application;

10 is a schematic flowchart of another subscription authorization method in an embodiment of the application;

Fig. 11 is a schematic flowchart of another subscription authorization method in an embodiment of the application.

Detailed ways

The embodiments of the application provide a proxy subscription authorization method, device, and system, which are used to realize the security of proxy subscription. Among them, the method and the device are based on the same inventive concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated. In the description of the embodiments of the present application, "and/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, and both A and B exist at the same time. There are three cases of B. The character "/" generally indicates that the associated objects are in an "or" relationship. At least one involved in this application refers to one or more; multiple refers to two or more. In addition, it should be understood that in the description of this application, words such as “first” and “second” are only used for the purpose of distinguishing description, and cannot be understood as indicating or implying relative importance, nor can it be understood as indicating Or imply the order.

The communication method provided in the embodiments of the present application can be applied to a 5G communication system or various future communication systems.

The embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

Figure 1a shows a possible service-oriented architecture system to which the proxy subscription authorization method provided in an embodiment of the present application is applicable. As shown in FIG. 1a, the service-oriented architecture system 100 includes at least three NF101. This application takes three NFs as examples, which can be denoted as NF_A, NF_B and NF_C. NF_A, NF_B, and NF_C are denoted by reference numerals 101_a, 101_b, and 101_c. Optionally, the service-oriented architecture 100 further includes a network repository function (NRF) 102. Optionally, the service-oriented architecture 100 further includes a service communication proxy (SCP) 103.

among them:

NF101 is a network function in the core network, and each NF adopts a service-oriented interface to realize communication through service invocation. NRF102 is used for registration and discovery of NF101, saves the registration information of each NF in the same PLMN, acts as an authorization server to complete authorization and generate tokens, and verify tokens.

SCP103 is used for forwarding communication between NFs, realizing load balancing and NF selection, as well as having NF registration, discovery and authorization functions.

The NF in this application can be any NF. For example, FIG. 1b shows a possible architecture of a communication system based on a service-oriented interface in a non-roaming scenario. In the system architecture shown in Figure 1b, NF_A can be NEF, NF_B can be AMF, and NF_C can be UDM. Of course, it can also be other functions. In addition, in Figure 1b, the system architecture includes network open function network elements, policy control function network elements, data management network elements, application function network elements, core network access and mobility management function network elements, session management function network elements, Terminal equipment, access network equipment, user plane function network element UPF and data network. Core network access and mobility management function network elements and terminal equipment can be connected through N1 interface, core network access and mobility management function network elements and access network equipment can be connected through N2 interface, access network equipment It can be connected to the user plane function network element through the N3 interface, the session management function network element and the user plane function network element can be connected through the N4 interface, and the user plane function network element and the data network can be connected through the N6 interface. The interface name is just an example.

In Figure 1b above, the data network, such as a data network (DN), can be the Internet, an IP Multi-media Service (IMS) network, or a local network (ie, a local network, such as mobile edge computing). (mobile edge computing, MEC) network) and so on. The data network includes an application server, and the application server provides business services for the terminal device by performing data transmission with the terminal device.

The core network access and mobility management function network element can be used to manage the access control and mobility of the terminal device. In practical applications, it includes the mobile network framework in the long term evolution (LTE). The mobility management function in the management entity (mobility management entity, MME), and the access management function is added, which can be specifically responsible for the registration of the terminal equipment, mobility management, tracking area update procedures, reachability detection, and session management Selection of functional network elements, mobile state transition management, etc. For example, in 5G, the core network access and mobility management function network element may be an AMF (access and mobility management function) network element. In future communications, such as 6G, the core network access and mobility management function network elements may still be AMF network elements or have other names, which are not limited by this application. When the core network access and mobility management function network element is an AMF network element, the AMF may provide Namf service.

The session management function network element can be used to be responsible for the session management of the terminal device (including the establishment, modification and release of the session), the selection and reselection of the user plane function network element, and the Internet protocol (IP) of the terminal device. ) Address allocation, quality of service (QoS) control, etc. For example, in 5G, the session management function network element may be an SMF (session management function) network element. In future communications, such as 6G, the session management function network element may still be an SMF network element, or there may be other The name is not limited in this application. When the session management function network element is an SMF network element, the SMF can provide the Nsmf service.

The policy control function network element can be used to be responsible for policy control decision-making, to provide functions such as service data flow and application detection, gating, QoS, and flow-based charging control. For example, in 5G, the policy control function network element may be a PCF (policy control function) network element. In future communications, such as 6G, the policy control function network element may still be a PCF network element, or there may be other The name is not limited in this application. When the policy control function network element is a PCF network element, the PCF network element may provide Npcf service.

The main function of the application function network element is to interact with the 3rd generation partnership project (3GPP) core network to provide services to influence service flow routing, access network capability opening, policy control, etc. For example, in 5G, the application function network element may be an AF (application function) network element. In future communications, such as 6G, the application function network element may still be an AF network element or have other names. The application is not limited. When the application function network element is an AF network element, the AF network element may provide Naf services.

The data management network element can be used to manage the contract data of the terminal device, the registration information related to the terminal device, and the like. For example, in 5G, the data management network element may be a unified data management network element (unified data management, UDM). In future communications, such as 6G, the data management network element may still be a UDM network element, or Other names are not limited in this application. When the data management network element is a UDM network element, the UDM network element may provide Nudm services.

Network open function network elements can be used to enable 3GPP to securely provide network service capabilities to third-party AFs (for example, Service Capability Server (SCS), Application Server (AS), etc.). For example, in 5G, the network opening function network element may be NEF (network exposure function). In future communications, such as 6G, the network opening function network element may still be a NEF network element or have other names. This application is not limited. When the network opening function network element is NEF, the NEF may provide Nnef services to other network function network elements.

Namf is a service-based interface presented by AMF. Nsmf is a service-based interface presented by SMF. Nnef is a service-based interface presented by NEF. Npcf is a service-based interface presented by PCF. Nudm is a service-based interface presented by UDM. Naf is a service-based interface presented by AF. Nnrf is a service-based interface presented by NRF. Nausf is the service-based interface presented by AUSF.

The system architecture may also include other network elements, such as network slice selection function (NSSF), authentication server function (authentication server function, AUSF), etc., which are not listed here.

The network elements described in Figure 1b may also be called functional entities or functions. Each network element may be a network element implemented on dedicated hardware, or an instance of software running on dedicated hardware, or an instance of virtualized function on an appropriate platform.

Based on the service-oriented architecture system of FIG. 1a and FIG. 1b, the following describes in detail the proxy subscription authorization method provided by the embodiment of the present application.

First introduce the concept of proxy subscription. Taking NF_A, NF_B, and NF_C as examples, suppose NF_B is a service provider, and NF_A and NF_C are service consumers. NF_A proxying NF_C to subscribe to NF_B means: NF_A sends a subscription request to NF_B, and NF_B determines that NF_A proxy NF_C subscribes to NF_B after receiving the subscription request. When the conditions are met, NF_B directly sends a notification to NF_C. The notification is used to provide Subscription service. In this way, NF_A proxy NF_C to subscribe service to NF_B. In this application, proxy subscription can also be implemented in a request-response manner. For example, NF_A proxying NF_C to subscribe to NF_B can also be understood as NF_A proxying NF_C to request service from NF_B. The proxy subscription scenario can be extended to NF_A proxy NF_C request to NF_B to use network function services.

The NF identifiers involved in this application include: the instance ID of the NF, and/or the Uniform Resource Identifier (URI) of the NF, and/or the notification endpoint of the NF, and/or Or NF's Notification Target Address, and/or Notification Correlation ID, and/or Notification Uniform Resource Locator (Notification URL), and/or Notification Uniform Resource ID ( Notification Uniform Resource Identifier, Notification URI), and/or Callback Uniform Resource Locator (Callback URL), and/or Callback Reference (Callback Reference), and/or other forms that can uniquely identify NF ID or address information. The following embodiments take the instance ID of the NF and/or the URI of the NF as an example to describe the authorization method of proxy subscription.

The token concept involved in this application. The token is used to indicate the calling authority of the network function service. Any one or more of the following information can be included in the token:

Service requester NF ID, service provider NF ID, service provider NF type, service provider NF service type, service requester NF service type, service name (Service Name(s)), NRF ID , Public Land Mobile Network ID (Public Land Mobile Network ID, PLMN ID), Expiration Time (Expiration Time), single network slice selection assistance information (S-NSSAI), NF set identification (NF set ID), service instance set ID, service zone ID, service area, data network name (Data Network Name, DNN), tracking area ID (Tracking Area ID, TAI) ), public land mobile network ID (Public Land Mobile Network ID, PLMN ID), location information of the target network function or network function service (location information of the target NF or NF service), event ID (Event ID(s)), Event List, Subscription Change Notification Uniform Resource Identifier, Subscription Change Notification Correlation ID, Subscription Permanent Identifier (SUPI), Group ID (Group ID), Generic Public Subscription Identifier (GPSI), Permanent Equipment Identifier (PEI). Different tokens can also be distinguished by token identification.

In the embodiment of this application, an authorization process is added during the proxy subscription process to ensure the security of the proxy subscription.

The embodiments described below involve interactions between multiple NFs. The multiple NFs include a first NF, a second NF, a third NF, NRF, and SCP. Among them, the first NF corresponds to the aforementioned NF_A, the second NF corresponds to the aforementioned NF_C, and the third NF corresponds to the aforementioned NF_B. The first NF acts for the second NF to subscribe services to the third NF. The network function service provided by the service provider or service producer in this application may also be referred to as service for short.

One of the following authorization methods for proxy subscription and the second method for proxy subscription is based on the interaction between four network functions, including the first NF, NRF, second NF, and third NF.

As shown in Figure 2, the process of one of the proxy subscription authorization methods provided by the embodiment of the present application is as follows.

S201. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

This token request is used to request execution authorization. The process of performing authorization includes: determining whether the first NF has the authority to send a subscription request to the third NF, for example, whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. The authorization process also includes: determining whether the second NF has the authority to receive the network function service provided by the third NF.

The token request carries the identity of the service consumer (service consumer), that is, the identity of the first NF and the identity of the second NF. For example, it carries the instance ID and/or uniform resource identifier (URI) of the first NF, and the instance ID and/or uniform resource identifier (URI) of the second NF. The token request may also carry the network function service for which the subscription is requested, the type of service producer and/or the service producer's identifier. In this embodiment, the service provider is the third NF. For example, the instance ID and/or uniform resource identifier (URI) of the third NF are carried, and/or the type of the third NF (NF type). The token request can also carry an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI). The token request may also carry other parameters required for authorization and token generation.

Optionally, the token request may also carry an indication information, which is used to indicate that the first NF is requesting a token in the proxy subscription scenario, that is, indicating that the NRF needs to determine whether the second NF has the ability to receive the third NF. Provides the authority of the network function service, and instructs the NRF to determine whether the first NF has the authority to send a subscription request to the third NF, specifically whether the first NF has the authority to subscribe to the third NF for the network function service on behalf of the second NF.

Optionally, S200 is further included before S201.

S200. The second NF sends NF information to the first NF, and the first NF receives the NF information from the second NF.

The NF information includes the identifier of the second NF, such as the instance ID and/or the uniform resource identifier (URI) of the second NF. Optionally, the NF information further includes an event identifier (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/ Or subscription change notification related uniform resource identifier (Subscription Change Notification Correlation ID), and/or subscription permanent identifier (Subscription Permanent Identifier, SUPI), and/or group identifier (Group ID), and/or general public subscription identifier (Generic Public Subscription Identifier, GPSI), and/or Permanent Equipment Identifier (PEI). In addition, it should be pointed out that if the first NF has been configured or stored in the second NF, there is no need to perform S200.

Through S200, the first NF can obtain the information of the second NF. The identification of the second NF carried in the token request in S201 may be derived from S200, or may be pre-configured or stored by the first NF.

S202. The NRF generates a token based on the received token request.

The NRF first determines according to the token request that what the first NF requests is a token in the proxy subscription scenario. Specifically, the NRF can be determined according to the service invocation name of the token request. The service invocation name of the token request in this application is different from the service invocation name of the token request in the prior art; or, the NRF is based on the token The indication information carried in the request is determined; or NRF is determined according to the identifiers (instance ID and/or URI) of the two service requesters carried in the token request; or NRF determines the current first NF request according to other methods It is the token in the proxy subscription scenario.

When performing authorization, the NRF can determine whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and determine whether the second NF has the authority to receive network function services provided by the third NF. The method for judging authority can be, for example, the NRF can be based on the identity of the first NF, the identity of the second NF, the identity and/or type of the service provider (that is, the third NF), and/or the token carried in the token request. Other information in the request is combined with locally configured policies or authorization information to determine permissions.

If the NRF determines that the second NF has the right to receive the network function service provided by the third NF, and the first NF has the right to subscribe to the third NF for the network function service on behalf of the second NF, it generates a token.

The generated token contains the identifications of the first NF and the second NF. The specific NF identification may be the NF Instance ID, and/or the URI of the NF, and/or other forms of ID or address information that can uniquely identify the NF. The token may also include an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI), and/or other parameters required for authorization and token generation.

The identifiers of the first NF and the second NF in the token are included in the subject claim, specifically, it can be subject claim the extended length, the first half of the subject claim fills in the identity of the first NF, and the second half of the subject claim fills in the second NF. Or the first half of the subject claim is to fill in the identification of the second NF, and the second half of the subject claim is to fill in the identification of the first NF. It can also be a newly defined subject claim, for example, subject claim-new, where subject claim fills in the identification of the first NF, and subject claim-new fills in the identification of the second NF; or the subject claim fills in the identification of the second NF, subject Fill in the identification of the first NF in claim-new. This application does not restrict how the token carries the identity of the first NF and the identity of the second NF.

The other information in the token may be included in the Token Claim, and this application does not restrict how the token carries other information in the token.

Optionally, the token may also carry an indication information, the indication information is used to indicate that the token is a token in a proxy subscription scenario, for example, the indication information is used to instruct the first NF to proxy the second NF Subscribe to the third NF for network function services.

After the token is generated, S203 is executed.

If it is determined that the second NF does not have the authority to receive network function services provided by the third NF, or it is determined that the first NF does not have the authority to subscribe network function services to the third NF on behalf of the second NF, or it is determined that the second NF does not have the authority to receive network function services from the third NF. When the third NF has the authority of the network function service and it is determined that the first NF does not have the authority to subscribe to the third NF for the network function service on behalf of the second NF, the process ends, and a message may also be sent to the first NF to indicate the determination result.

S203. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

The token response is used to respond to the token request in S201. The token response carries the token generated by NRF. The token is used to indicate that the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF and indicates that the second NF has the authority to receive network function services provided by the third NF.

Through S201~S203, NRF can determine the authority of agent subscription and improve the security of agent subscription.

After S203, the following steps may also be included.

S204: The first NF sends a subscription request (subscribe request) to the third NF, and the third NF receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the above token, the instance ID and/or uniform resource identifier (URI) of the first NF, and the instance ID and/or uniform resource identifier (URI) of the second NF. The subscription request may also carry the network function service for which the subscription is requested, the type of service producer, and/or the identifier of the service producer. In this embodiment, the service provider is the third NF. For example, the instance ID and/or uniform resource identifier (URI) of the third NF are carried, and/or the type of the third NF (NF type). The subscription request may also carry an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI).

Specifically, according to the token response sent by the NRF, the first NF determines that the first NF has the authority to subscribe the network function service to the third NF on behalf of the second NF, and then sends a subscription request to the third NF.

S205. The third NF verifies the token included in the subscription request, and if the verification succeeds, then executes S206; otherwise, if the token verification fails, the third NF ends the process, or sends a subscription response to the first NF , The subscription response contains subscription failure, or token verification failure information, or other information indicating that the process failed.

Specifically, if the token verification is successful, the third NF determines that the second NF has the authority to receive network function services provided by the third NF, and determines that the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. Permissions.

Wherein, token verification includes one or more of the following: integrity verification of the token, verification of whether the token is used to indicate that the second NF has the authority to receive network function services provided by the third NF, and verification order The validity of the card. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF. It is also necessary to verify whether the identifier and/or type of the service producer (service producer) included in the Audience Claim in the token is the same as the identifier and/or type of the third NF. It can also verify whether the third NF can provide the network function service in the subscription request. For example, the network function services that the third NF can provide include service 1, service 2, and service 3. However, if the token indicates that the authorized service is service 4, the verification fails. The token has a validity period. When the token is within the validity period, it is valid. After the validity period, the token becomes invalid. The verification succeeds only when the token is within the validity period. It can also verify whether the information contained in the token is consistent with the corresponding information in the subscription request.

The above description of the verification token is applicable to the process of verifying the token in the full text.

Optionally, the third NF may verify the token through NRF. Specifically, after receiving the subscription request, the third NF sends a verification request to the NRF. The NRF receives the verification request from the third NF, and verifies the token contained in the verification request. The NRF replies the verification result to the third NF. If the verification is successful, the third NF executes S206 and S207. Otherwise, the third NF process ends, or a subscription response is replies to the first NF, and the subscription response includes subscription failure or token verification failure information, or other information indicating that the process fails. Among them, when NRF verifies the token, in addition to the above-mentioned token verification, it can also verify whether the token is consistent with the stored token, or whether the token is consistent with the first NF The token contained in the sent token response is consistent. If they are consistent, the verification is successful, otherwise the verification fails. Consistency means that the information indicated by the instruction board is the same.

The process of calibrating the token through NRF can replace S205.

S206. The third NF sends an authorization notification to the second NF, and the second NF receives the authorization notification from the third NF.

The authorization notification carries the authorization result, and the authorization notification is used to indicate whether the second NF has the authority to receive the network function service provided by the third NF. The second NF can save the authorization result in the authorization notification.

Alternatively, the authorization notification may also include a token. The second NF learns the authorization result through the token. That is, the second NF learns from the token whether the second NF has the right to receive the network function service provided by the third NF, and it can also be known that the first NF has the right to subscribe to the third NF for the network function service on behalf of the second NF.

S207. The third NF sends a subscription response (subscribe response) to the first NF, and the first NF receives the subscription response from the third NF.

The subscription response may carry the authorization result, which is used to indicate that the first NF has the authority to subscribe to the third NF for the network function service from the second NF.

Optionally, if S206 is not performed, the following operations may be used instead: the third NF may also carry the authorization result in the subscription response, and the authorization result includes: the first NF has a proxy, the second NF subscribes to the network from the third NF The authority of the functional service, and whether the second NF has the authority to receive the network function service provided by the third NF; or, the third NF carries a token that is successfully verified in the subscription response. The first NF determines that the authorization is successful according to the token carried in the subscription response or the authorization result. Further, the first NF may also notify the second NF of the token or authorization result. Of course, these operations may also be included in the case of performing S206.

If the third NF fails to verify the token, the third NF may also send the authorization result that the authorization is unsuccessful to the first NF, that is, indicate that the first NF does not have the authority to subscribe to the third NF for network function services on behalf of the second NF, Or indicate that the second NF does not have the right to receive the network function service provided by the third NF. In this case, S206 is omitted.

S206 and S207 do not have a strict execution order and can be executed in an exchange order.

S208. The third NF provides network function services to the second NF according to the subscribed network function services.

Specifically, when the subscription condition is met, the third NF sends a notification (notify) to the second NF, and the notification includes the network function service provided by the third NF.

Optionally, since the first NF performs service subscription to the third NF on behalf of the second NF, the third NF may also send a notification to the first NF, and the notification carries information such as service modification or unsubscription.

One of the authorization methods for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different public land mobile networks (PLMN). The interaction between NFs is forwarded through the SCP serving it. The token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The generation and authorization of the token is completed by the NRF in the PLMN where the third NF is located. In the manner in which the third NF can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the third NF is located. Other processing procedures are the same as those described in one of the authorization methods for proxy subscription.

Based on the same inventive concept, the embodiment of this application provides the second method for authorization of proxy subscription. The main content includes: the first NF and the second NF respectively send a token request to the NRF, and the NRF generates two tokens for the token request respectively sent by the first NF and the second NF. For example, the first token and the second token are used to represent these two tokens. The first token is requested by the first NF and sent to the first NF by the NRF. The second token is requested by the second NF and sent by the NRF to the second NF. The first token is used to indicate that the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF; the second token is used to indicate that the second NF has the authority to receive network function services provided by the third NF.

As shown in Figure 3, a possible process of the second authorization method for proxy subscription is as follows.

S301. The first NF sends a notification message to the second NF, and the second NF receives the notification message from the first NF.

The notification message is used to instruct the second NF to request a token. For example, instruct the second NF to send a token request to the NRF to obtain the token.

The notification message can carry the following information:

The identity of the first NF, such as the instance ID and/or URI of the first NF. The notification also carries the type of service producer (service producer) and/or the identifier of the service producer (service producer). In this embodiment, the service provider is the third NF. The notification also carries other parameters required for authorization and token generation.

Optionally, the notification message further includes an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/ Or subscription change notification related uniform resource identifier (Subscription Change Notification Correlation ID), and/or subscription permanent identifier (Subscription Permanent Identifier, SUPI), and/or group identifier (Group ID), and/or general public subscription identifier (Generic Public Subscription Identifier, GPSI), and/or Permanent Equipment Identifier (PEI).

S302. The second NF sends a token request to the NRF, and the NRF receives the token request from the second NF.

The token request is used to request execution authorization, and the execution authorization process includes: judging whether the second NF has the authority to receive the network function service provided by the third NF. The token request carries the identifier of the service consumer (service consumer), that is, the identifier of the second NF. For example, the instance ID and/or the uniform resource identifier (URI) of the second NF are carried. The token request also carries the network function service for which subscription is requested, the type of service producer and/or the identifier and/or type of service producer. In this embodiment, the service provider is the third party. NF. The token request also carries other parameters required for authorization and token generation. Please refer to the relevant description of the parameters included in the token request in S201, which will not be repeated here.

S303. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

The token request is used to request execution authorization. The process of performing authorization includes: determining whether the first NF has the authority to send a subscription request to the third NF, for example, whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. The token request carries the identity of the service consumer (service consumer), that is, the identity of the first NF, and also carries the identity of the second NF, which represents a proxy subscription scenario. For example, it carries the instance ID and/or uniform resource identifier (URI) of the first NF, and the instance ID and/or uniform resource identifier (URI) of the second NF. The token request also carries the network function service for which the subscription is requested, the type of service producer and/or the identifier of the service producer. In this embodiment, the service provider is the third NF. The notification also carries other parameters required for authorization and token generation. Please refer to the relevant description of the parameters included in the token request in S201, which will not be repeated here.

To facilitate the distinction, the token request sent by the first NF to the NRF is recorded as the first token request, and the token request sent by the second NF to the NRF is recorded as the second token request.

Optionally, both the first token request and the second token request may also carry an indication information, and the indication information is used to indicate the token in the scenario of requesting proxy subscription.

There is no strict execution sequence between S302 and S303, and they can be exchanged.

The first token request is used to obtain the calling authority of the network function service provided by the third NF. For example, it is requested to obtain whether the first NF has the authority to send a subscription request to the third NF, or whether the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF.

The second token request is used to obtain the calling authority of the network function service provided by the third NF. For example, it is requested to obtain whether the second NF has the authority to receive the network function service provided by the third NF.

Similar to the embodiment in FIG. 2, optionally, S300 is further included before S301.

S300, same as S200.

S304. Based on the received first token request, the NRF determines whether the first NF has the authority to subscribe to the third NF for the network function service on behalf of the second NF, and if so, generates the first token;

The NRF determines whether the second NF has the authority to receive the network function service provided by the third NF based on the received second token request, and if so, generates the second token.

Optionally, the first token request received by the NRF from the first NF may also carry an indication information, and the indication information is used to instruct the first NF to subscribe for the network function service from the third NF on behalf of the second NF.

Optionally, the second token request received by the NRF from the second NF may also carry an indication information, and the indication information is used to instruct the first NF to subscribe to the third NF for the network function service on behalf of the second NF.

NRF determines that the current first NF request is the token in the proxy subscription scenario. Specifically, the NRF may be determined according to the service call name of the first token request and/or the second token request, where the service call name of the token request is different from the service call name of the token request in the prior art; Alternatively, the NRF is determined according to the indication information carried in the first token request and/or the second token request; or the NRF determines according to other methods that the current first NF request is a token in the proxy subscription scenario.

Specifically, the NRF may carry the identification of the first NF in the first token request, the identification or type of the service provider (that is, the third NF), and/or other information in the first token request in combination with locally configured Policy or authorization information to determine the authority, that is, to determine whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. If it is determined that the first NF has the authority to subscribe to the network function service from the third NF on behalf of the second NF, the NRF generates the first token.

The first token contains the identifiers of the first NF and the second NF. The specific NF identifier may be the NF Instance ID, and/or the URI of the NF, and/or other forms of ID or address information that can uniquely identify the NF . The token may also include an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI), and/or other parameters required for authorization and token generation.

The NRF can also combine the local configuration based on the identity of the second NF carried in the second token request, the identity and/or type of the service provider (that is, the third NF), and/or other information in the second token request. Policy or authorization information to determine the authority, that is, determine whether the second NF has the authority to receive the network function service provided by the third NF. If it is determined that the second NF has the authority to receive the network function service provided by the third NF, the NRF generates a second token.

The second token includes the identification of the second NF. The specific NF identification may be the NF Instance ID, and/or the URI of the NF, and/or other forms of ID or address information that can uniquely identify the NF. The token may also include an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI), and/or other parameters required for authorization and token generation.

For how to carry the NF identifier and other information in the token in the above first token and second token, please refer to the relevant description of S202.

After the NRF generates the first token and the second token, S305 is executed.

If it is determined that the second NF does not have the authority to receive network function services provided by the third NF, or it is determined that the first NF does not have the authority to subscribe network function services to the third NF on behalf of the second NF, or it is determined that the second NF does not have the authority to receive network function services from the third NF. When the third NF has the authority to provide network function services, and it is determined that the first NF does not have the authority to subscribe to the third NF on behalf of the second NF, the NRF ends the process, and the NRF may also send a message to the first NF to indicate the determination result.

S305. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

The token response carries the first token and the second token. Because the NRF knows that the first NF acts as a proxy for the second NF to subscribe to the third NF for network function services, the NRF only needs to send a token response to the first NF. The token response may also carry the identity of the first NF and the identity of the second NF.

Through S301~S305, NRF can determine the authority of agent subscription and improve the security of agent subscription.

After S305, the following steps may also be included.

S306: The first NF sends a subscription request (subscribe request) to the third NF, and the third NF receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the first token and the second token. For other parameters included in the subscription request, please refer to the relevant description of S204.

S307. The third NF verifies the first token and the second token contained in the subscription request, and if the verification is successful, execute S308; otherwise, the third NF terminates the process, or replies a subscription response to the first NF, The subscription response contains the subscription failure, or token verification failure information, or other information indicating the failure of the process.

If the verification of the first token is successful, it is determined that the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF; The permission of the network function service.

The content and manner of token verification can be a parameter of the description of the embodiment shown in FIG. 2, which will not be repeated here.

Similarly, optionally, the third NF can verify the token through NRF. Specifically, after receiving the subscription request, the third NF sends a verification request to the NRF, and the NRF receives the verification request from the third NF, and verifies the first token and the second token included in the verification request. The NRF replies the verification result to the third NF. If the verification is successful, the third NF executes S308, otherwise the third NF ends the process, or replies a subscription response to the first NF, the subscription response contains the subscription failure, or token verification failure information, or other information indicating that the process failed .

The process of verifying the token by the third NF through the NRF can replace S307.

The description of S308 to S310 is the same as that of S206 to S208, and will not be repeated here.

The second authorization method for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. The interaction between NFs is forwarded through the SCP serving it. The first token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The second token request sent by the second NF is forwarded by the NRF in the PLMN where the second NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The generation and authorization of the token is completed by the NRF in the PLMN where the third NF is located. In the way that the third NF can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the third NF is located. Other processing procedures are the same as those described in the second authorization method for proxy subscription.

Based on the same inventive concept, the embodiment of this application provides the third method for authorization of proxy subscription. The third method of authorization for proxy subscription described below is based on the interaction between three network functions. The three network functions include a first NF, a second NF, and a third NF.

As shown in FIG. 4, the process of the third method for authorizing proxy subscription provided by the embodiment of the present application is as follows.

S401: The first NF sends a subscription request (subscribe request) to the third NF, and the third NF receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the third NF for network function services. The subscription request carries the identification of the first NF and the identification of the second NF. For other parameters included in the subscription request, please refer to the relevant description of S204.

Optionally, S400 is further included before S401.

S400. The second NF sends NF information to the first NF, and the first NF receives the NF information from the second NF.

The NF information includes the identification of the second NF. For example, the instance ID and/or uniform resource identifier (URI) of the second NF. If the first NF has already configured or stored the information of the second NF, S400 does not need to be executed.

Optionally, the NF information further includes an event identifier (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/ Or subscription change notification related uniform resource identifier (Subscription Change Notification Correlation ID), and/or subscription permanent identifier (Subscription Permanent Identifier, SUPI), and/or group identifier (Group ID), and/or general public subscription identifier (Generic Public Subscription Identifier, GPSI), and/or Permanent Equipment Identifier (PEI).

Through S400, the first NF can obtain the information of the second NF. The identification of the second NF carried in the subscription request in S401 may be derived from S400, or may be pre-configured or stored by the first NF.

S402. The third NF performs authorization based on the received subscription request.

The authorization operation performed includes: determining whether the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and determining whether the second NF has the authority to receive network function services provided by the third NF.

The method for determining the authority may be, for example, that the third NF may determine the authority based on information such as the identity of the first NF, the identity of the second NF, and the type of service provider carried in the subscription request, combined with locally configured policies or authorization information.

If the third NF determines that the second NF has the right to receive the network function service provided by the third NF, S403 is executed, or the third NF determines that the second NF has the right to receive the network function service provided by the third NF, and the first If the NF has the authority to subscribe to the network function service from the third NF on behalf of the second NF, then S403 is executed.

If it is determined that the second NF does not have the authority to receive network function services provided by the third NF, or it is determined that the first NF does not have the authority to subscribe network function services to the third NF on behalf of the second NF, or it is determined that the second NF does not have the authority to receive network function services from the third NF. When the third NF has the authority to provide network function services, and it is determined that the first NF does not have the authority to subscribe to the third NF on behalf of the second NF, the third NF ends the process, and the third NF may also send to the first NF Message to indicate the determination result.

S403. The third NF sends an authorization notification to the second NF, and the second NF receives the authorization notification from the third NF.

The authorization notification carries the authorization result, and the authorization notification is used to indicate that the second NF has the right to receive the network function service provided by the third NF. The second NF can save the authorization result in the authorization notification.

S404. The third NF sends a subscription response (subscribe response) to the first NF, and the first NF receives the subscription response from the third NF.

Optionally, if S403 is not performed, the third NF may also carry the authorization result in the subscription response. The authorization result includes: the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and the first NF The second NF has the authority to receive the network function service provided by the third NF. The first NF determines that the authorization is successful according to the authorization result carried in the subscription response. Further, the first NF may also notify the second NF of the authorization result. Of course, in the case of performing S403, these operations may also be included.

S403 and S404 do not have a strict execution order and can be executed in an exchange order.

S405. The third NF provides network function services to the second NF according to the subscribed network function services.

The third authorization method for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. Other processing procedures are the same as those described in the third authorization method for proxy subscription.

The third NF determines the authority after receiving the proxy subscription request, which can ensure the security of the proxy subscription.

Based on the same inventive concept, the embodiments of the present application provide the fourth method for authorizing proxy subscription, the fifth method for proxy subscription and the sixth method for proxy subscription. The fourth method of authorization for proxy subscription, the fifth method of authorization for proxy subscription, and the sixth method of authorization for proxy subscription described below are all based on the interaction between five network functions. The five network functions include the first NF, the second NF, the third NF, NRF and SCP.

Among them, SCP is used to play the role of service call forwarding between NFs, or SCP can independently complete the authorization of requesting services, or SCP can cooperate with NRF to complete the authorization of requesting services.

As shown in FIG. 5, the process of the fourth method for authorizing proxy subscription provided by the embodiment of the present application is as follows. This method uses tokens to ensure the security of proxy subscriptions.

S501. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

This step is the same as S201, and the detailed description can refer to S201, which will not be repeated here.

Optionally, S500 is also included before S501.

S500. The second NF sends NF information to the first NF, and the first NF receives the NF information from the second NF.

This step is the same as S200, and the detailed description can refer to S200, which will not be repeated here.

S502. The NRF determines whether the second NF has the authority to receive the network function service provided by the third NF based on the received token request.

This step is the same as S202. For detailed description, please refer to S202, which will not be repeated here.

S503. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

This step is the same as S203. For detailed description, please refer to S203, which will not be repeated here.

The description of S501 to S503 is the same as the description of S201 to S203, and you can refer to the related description of one of the authorization methods for proxy subscription.

After S503, the following steps may also be included.

S504. The first NF sends a subscription request (subscribe request) to the SCP, and the SCP receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the above token. For other information included in the subscription request, refer to the relevant description in S204.

S505. The SCP verifies the token included in the subscription request, and if the verification succeeds, then executes S508; otherwise, if the verification fails, the SCP ends the process, or replies to the first NF with a subscription response, and the subscription response contains subscription failure. Or token verification failure information, or other information indicating process failure.

If the verification is successful, the SCP determines that the first NF has the authority to subscribe to the network function service from the third NF on behalf of the second NF, and that the second NF has the authority to receive the network function service provided by the third NF.

Wherein, the verification includes one or more of the following: integrity verification of the token, verification of whether the token is used to indicate that the second NF has the right to receive network function services provided by the third NF, and the verification of the token Effectiveness. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF. It is also necessary to verify whether the identity and/or type of the service producer (service producer) contained in the audience claim in the token is the same as the identity and/or type of the third NF queried by the SCP. Specifically, the SCP can be configured according to the local configuration. The identity of the third NF can be obtained by querying the information of the third NF, and the identity of the third NF can also be obtained by querying the information obtained from the NRF. It can also verify whether the third NF can provide the subscribed network function service. For example, the network function services that the third NF can provide include service 1, service 2, and service 3. However, if the token indicates that the authorized service is service 4, the verification fails. The token has a validity period. When the token is within the validity period, it is valid. After the validity period, the token becomes invalid. The verification succeeds only when the token is within the validity period. It can also verify whether the information contained in the token is consistent with the corresponding information in the subscription request.

One of the authorization methods similar to proxy subscription. Optionally, SCP can also verify the token through NRF. Specifically, after receiving the subscription request, the SCP sends a verification request to the NRF, and the NRF receives the verification request from the SCP, and verifies the token included in the verification request. NRF returns the verification result to SCP. If the verification is successful, the SCP executes S508; otherwise, the SCP ends the process, or replies a subscription response to the first NF. The subscription response includes subscription failure, or token verification failure information, or other information indicating process failure.

The process of calibrating the token through NRF can replace S507.

S506. The SCP sends an authorization notification to the second NF, and the second NF receives the authorization notification from the SCP.

S507. The SCP sends a subscription request to the third NF, and the third NF receives the subscription request from the SCP.

The subscription request carries the information other than the token carried in the subscription request received from the first NF, and may also carry the verification result. The verification result is used to indicate whether the token verification is successful. Or it is used to indicate the authorization result, that is, whether the second NF has the authority to receive network function services provided by the third NF, and whether the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF.

There is no strict execution order between S506 and S507, and the order can be exchanged.

S508. The third NF returns a subscription response to the SCP, and the SCP receives the subscription response from the third NF.

S509. The SCP sends a subscription response to the first NF, and the first NF receives the subscription response from the SCP.

The subscription response may carry the authorization result, which is used to indicate whether the first NF has the authority to subscribe to the third NF for the network function service on behalf of the second NF and whether the second NF has the authority to receive the network function service provided by the third NF. When the SCP verifies the token successfully, the authorization result is yes, and when the SCP verifies the token unsuccessfully, the authorization result is no. The authorization result is that the first NF has the right to subscribe to the third NF for network function services on behalf of the second NF, and/or the second NF has the right to receive network function services provided by the third NF. If the authorization result is no, it includes that the first NF does not have the authority to subscribe network function services to the third NF on behalf of the second NF, and/or the second NF does not have the authority to receive network function services provided by the third NF.

Alternatively, the subscription response may carry the token. In the case that the token or authorization result is carried in the subscription response, the token or authorization result may be further sent to the second NF through the first NF, and S506 is omitted.

S510. The third NF provides network function services to the second NF according to the subscribed network function services.

Optionally, since the first NF performs service subscription on behalf of the third NF, the third NF may also send a notification to the first NF through the SCP, and the notification carries information such as service modification or unsubscription. Specifically, the third NF sends a notification to the SCP, and the SCP forwards the notification to the first NF.

The fourth authorization method for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. The interaction between NFs is forwarded through the SCP serving it. The token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The generation and authorization of the token is completed by the NRF in the PLMN where the third NF is located. In the way that the third NF can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the NF_B is located. The verification of the token is completed by the SCP serving the third NF. Other processing procedures are the same as those described in the fourth authorization method for proxy subscription.

Through the fourth authorization method of proxy subscription, in the SCP system architecture, the authority is judged by NRF, and the token is verified by SCP to improve the security of proxy subscription.

As shown in FIG. 6, the flow of the fifth method for authorizing proxy subscription provided by the embodiment of the present application is as follows. This method uses two tokens to indicate the authority of the first NF and the third NF respectively, so as to improve the security of the agent subscription process.

S601. The first NF sends a notification message to the SCP, and the SCP receives the notification message from the first NF.

S602. The SCP forwards the notification message to the second NF, and the second NF receives the notification message from the SCP.

The notification message is used to instruct the second NF to request a token. For example, instruct the second NF to send a token request to the NRF to obtain the token. The notification message can carry the following information:

The identity of the first NF, such as the instance ID and/or URI of the first NF. The notification also carries the type of service producer and/or the identifier and/or type of the service producer. In this embodiment, the service provider is the third NF. The notification also carries other parameters required for authorization and token generation.

S603. The second NF sends a token request to the NRF, and the NRF receives the token request from the second NF.

The token request is used to request execution authorization, and the execution authorization process includes: judging whether the second NF has the authority to receive the network function service provided by the third NF. The token request carries the identifier of the service consumer (service consumer), that is, the identifier of the second NF. For example, the identifier of the second NF is carried, such as the instance ID and/or URI of the second NF. The token request also carries the network function service for which subscription is requested, the type of service producer and/or the identifier and/or type of service producer. In this embodiment, the service provider is the third party. NF. The notification also carries other parameters required for authorization and token generation. Please refer to the relevant description of the parameters included in the second token request in S201, which will not be repeated here.

S604. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

The token request is used to request execution authorization. The process of performing authorization includes: determining whether the first NF has the authority to send a subscription request to the third NF, for example, whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. The token request carries the identity of the service consumer (service consumer), that is, the identity of the first NF, and also carries the identity of the second NF, which represents a proxy subscription scenario. For example, it carries the instance ID and/or uniform resource identifier (URI) of the first NF, and the instance ID and/or uniform resource identifier (URI) of the second NF. The token request also carries the network function service for which subscription is requested, the type of service producer and/or the identifier and/or type of service producer. In this embodiment, the service provider is the third party. NF. The notification also carries other parameters required for authorization and token generation. Please refer to the relevant description of the parameters included in the first token request in S201, which will not be repeated here.

There is no strict execution order between S603 and S604, and they can be exchanged.

Optionally, S600 is also included before S601.

S600, same as S200.

S605. Based on the received first token request, the NRF determines whether the first NF has the authority to subscribe to the third NF for the network function service on behalf of the second NF, and if so, generates the first token;

Specifically, the NRF may carry the identification of the first NF in the first token request, the identification or type of the service provider (that is, the third NF), and/or other information in the first token request in combination with locally configured Policy or authorization information to determine the authority, that is, to determine whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF. If it is determined that the first NF has the authority to subscribe to the network function service from the third NF on behalf of the second NF, the NRF generates the first token. For the information contained in the first token, please refer to the description of the information contained in the first token in S304.

The NRF can also determine the authority based on the identity of the second NF carried in the second token request, the type of the service provider (ie the third NF), and the locally configured policy or authorization information, that is, whether the second NF has The authority to receive the network function service provided by the third NF. If it is determined that the second NF has the authority to receive the network function service provided by the third NF, the NRF generates a second token. For the information contained in the second token, please refer to the description of the information contained in the second token in S304.

After the NRF generates the first token and the second token, S606 and S607 are executed.

S606. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

To distinguish, record as the first token response.

The first token response carries the first token and the second token. Because the NRF knows that the first NF acts as a proxy for the second NF to subscribe to the third NF to subscribe to the network function service, the NRF only needs to send a token response to the first NF without responding to the third NF. The first token response may also carry the identification of the first NF and the identification of the second NF.

Through S601-S606, NRF can determine the authority of agent subscription and improve the security of agent subscription.

After S606, the following steps may also be included.

The specific SCP stores the first token and the second token.

S607. The first NF sends a subscription request (subscribe request) to the SCP, and the SCP receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the above-mentioned first token and the second token. For other parameters included in the subscription request, please refer to the relevant description of S204.

S608. The SCP verifies the token contained in the subscription request. If the verification is successful, execute S610; otherwise, the third NF ends the process, or sends a subscription response to the first NF, and the subscription response contains subscription failure or token Verification failure information, or other information indicating that the process failed.

The content and method of token verification can be a parameter of the description of the embodiment shown in FIG. 5, which will not be repeated here.

Similarly, optionally, the SCP can also verify the token through NRF. Specifically, after receiving the subscription request, the SCP sends a verification request to the NRF, and the NRF receives the verification request from the SCP, and verifies the first token and the second token included in the verification request. NRF replies the verification result to SCP. If the verification is successful, the SCP executes S610. Otherwise, the third NF ends the process or replies a subscription response to the first NF. The subscription response includes subscription failure or token verification failure information, or other information indicating process failure.

The process of SCP verifying the token through NRF can replace S608.

S609 to S613 are the same as S506 to S510, and will not be repeated here.

The fifth method of authorization through proxy subscription is implemented in the SCP system architecture. The authority is judged by NRF, the first token and the second token are generated, and the first token and the second token are verified by the SCP. Improve the security of proxy subscriptions.

The fifth authorization method for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. The token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The verification of the token is completed by the SCP serving the third NF. In the way that the SCP can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the third NF is located. The other processing procedures are the same as those described in the fifth authorization method for proxy subscription.

As shown in FIG. 7, the process of the sixth method for authorization of proxy subscription provided by the embodiment of the present application is as follows. The design idea of this method is that when SCP receives a subscription request that represents agent subscription, it does not immediately forward it, first consults NRF for authorization, or judges whether to authorize itself, and decides whether to forward the subscription request according to the authorization result. This helps to improve the security of the agent subscription process.

S701. The first NF sends a subscription request to the SCP, and the SCP receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. Please refer to the relevant description of S204 for the parameters included in the subscription request.

Optionally, S700 is also included before S701.

S700. The second NF sends NF information to the first NF, and the first NF receives the NF information from the second NF.

This step is the same as S700. For detailed description, please refer to S200, which will not be repeated here.

S702. The SCP sends an authorization request to the NRF, and the NRF receives the authorization request from the SCP.

The authorization request is used to ask the NRF whether the second NF has the right to receive the network function service provided by the third NF, and whether the first NF has the right to subscribe to the third NF for the network function service on behalf of the second NF. For the information contained in the authorization request, refer to the relevant description of the parameters contained in the token request in S201.

S703. The NRF performs authorization based on the received authorization request.

When performing authorization, the NRF can determine whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and determine whether the second NF has the authority to receive network function services provided by the third NF. The method for judging the authority may be, for example, the NRF may combine the local identity according to the identity of the first NF, the identity of the second NF, the identity and/or type of the service provider, and/or other information in the authorization request carried in the authorization request. Configure the policy or authorization information to determine the authority.

S704. The NRF sends an authorization response to the SCP, and the SCP receives the authorization response from the NRF.

The authorization response is used to respond to the authorization request of S702. The authorization response carries the authorization result of the authorization judgment. For example, the authorization result is that the authorization is successful, which means that the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and the second NF has the authority to receive network function services provided by the third NF.

Optionally, only when the determined authorization result is that the authorization is successful, S704 is executed. Otherwise, the NRF process ends, or the NRF returns a response containing authorization failure to the SCP.

Optionally, S702 to S704 can be omitted, and the authorization is judged through the SCP. That is, after the SCP receives the subscription request, based on the subscription request, it determines whether the first NF has the authority to subscribe network function services to the third NF as an agent for the second NF and whether the second NF has the ability to receive network function services provided by the third NF. Permission to obtain authorization results.

S705. The SCP judges whether to forward the subscription request according to the authorization response, or sends a subscription rejection message.

When the result of the SCP in the authorization response is that the authorization is successful, S706 is executed. When the result in the authorization response is that the authorization is unsuccessful, the SCP sends a subscription rejection message to the first NF. The subscription rejection message indicates that the first NF acts as a proxy for the second NF to subscribe the network function service to the third NF.

S706. The SCP sends an authorization notification to the second NF, and the second NF receives the authorization notification from the SCP.

The authorization notification carries the authorization result. The authorization result includes: the second NF has the right to receive network function services provided by the third NF, and may also include that the first NF has the right to subscribe to the third NF for network function services on behalf of the second NF . The second NF can save the authorization result in the authorization notification.

S707. The SCP sends a subscription request to the third NF, and the third NF receives the subscription request from the SCP.

The subscription request carries the information carried in the subscription request received from the first NF, and may also carry the authorization result. The authorization result is used to indicate whether the second NF has the right to receive the network function service provided by the third NF, and/or whether the first NF has the right to subscribe to the third NF for the network function service on behalf of the second NF.

There is no strict execution order between S706 and S707, and the order can be exchanged.

S708. The third NF returns a subscription response to the SCP, and the SCP receives the subscription response from the third NF.

S709. The SCP sends a subscription response to the first NF, and the first NF receives the subscription response from the SCP.

The subscription response may carry the authorization result, which is used to indicate whether the first NF has the authority to subscribe to the third NF for the network function service by proxying the second NF.

S710. The third NF provides network function services to the second NF according to the subscribed network function services.

The sixth authorization method for proxy subscription can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. The interaction between NFs is forwarded through the SCP serving it. The subscription request sent by the first NF is forwarded by the SCP serving the first NF to the SCP serving the third NF. The subscription response sent by the SCP serving the third NF is sent to the first NF by the SCP serving the first NF. The authorization (that is, the judgment of authority) is completed by the NRF in the PLMN where the third NF is located. The authorization verification (S705) is completed by the SCP serving the third NF, and when the authorization mode is determined through the SCP, it is completed by the SCP in the PLMN where the third NF is located. Other processing procedures are the same as those described in the sixth authorization method for proxy subscription.

The embodiments described below involve interactions between multiple NFs, and the multiple NFs include a first NF, a third NF, and an NRF. Among them, the first NF corresponds to the aforementioned NF_A, and the third NF corresponds to the aforementioned NF_B. The first NF subscribes to the third NF, and then the third NF sends a service notification to the first NF. The network function service provided by the service provider or service producer in this application may also be referred to as service for short.

The seventh authorization method for proxy subscription below is based on the interaction between three network functions, including the first NF, NRF, and third NF.

As shown in FIG. 10, the process of the seventh method for authorization of proxy subscription provided by the embodiment of the present application is as follows.

S1001. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

This token request is used to request execution authorization. The process of performing authorization includes: determining whether the first NF has the authority to send a subscription request to the third NF.

The token request carries the identifier of the service consumer (service consumer), that is, the identifier of the first NF. For example, the instance ID and/or the uniform resource identifier (URI) of the first NF are carried. The token request may also carry the network function service for which the subscription is requested, the type of service producer and/or the service producer's identifier. In this embodiment, the service provider is the third NF. For example, the instance ID and/or uniform resource identifier (URI) of the third NF are carried, and/or the type of the third NF (NF type). The token request can also carry an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI). The token request may also carry other parameters required for authorization and token generation.

Optionally, the token request may also carry an indication information, which is used to indicate that the first NF is requesting a token in a subscription scenario, that is, indicating that the NRF needs to determine whether the first NF has the ability to send to the third NF. Permission to subscribe to the request.

S1002. The NRF generates a token based on the received token request.

The NRF first determines according to the token request that what the first NF requests is the token in the subscription scenario. Specifically, the NRF can be determined according to the service call name of the token request; or, the NRF can be determined according to the indication information carried in the token request; or, the NRF can be determined according to the parameters carried in the token request (such as URI, Event ID(s), etc.); or the NRF determines according to other methods that the current first NF request is the token in the subscription scenario.

When performing authorization, the NRF can combine the local configuration according to the identification of the first NF carried in the token request, the identification and/or type of the service provider (that is, the third NF), and/or other information in the token request. The policy or authorization information to determine the authority.

If the NRF determines that the first NF has the right to subscribe to the network function service from the third NF, it generates a token.

The generated token includes the first NF identifier, and the specific NF identifier may be the NF Instance ID, and/or the URI of the NF, and/or other forms of ID or address information that can uniquely identify the NF. The token may also include an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI), and/or other parameters required for authorization and token generation.

This application does not restrict how the token carries the identity of the first NF and other information in the token.

Optionally, the token may also carry an indication information, the indication information is used to indicate that the token is a token in a subscription scenario, for example, the indication information is used to indicate that the first NF subscribes to the third NF Network function service.

After the token is generated, S1003 is executed.

If it is determined that the first NF does not have the authority to subscribe to the network function service from the third NF, the procedure is ended, and a message may also be sent to the first NF to indicate the determination result.

S1003. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

The token response is used to respond to the token request in S1001. The token response carries the token generated by NRF. The token is used to indicate that the first NF has the right to subscribe to the network function service from the third NF.

Through S1001~S1003, NRF can determine the subscription authority and improve the security of subscription.

After S1003, the following steps may also be included.

S1004. The first NF sends a subscription request (subscribe request) to the third NF, and the third NF receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the aforementioned token, the instance ID of the first NF and/or the uniform resource identifier (URI). The subscription request may also carry the network function service for which the subscription is requested, the type of service producer, and/or the identifier of the service producer. In this embodiment, the service provider is the third NF. For example, the instance ID and/or uniform resource identifier (URI) of the third NF are carried, and/or the type of the third NF (NF type). The subscription request may also carry an event ID (Event ID(s)), and/or an event list (Event List), and/or a subscription change notification uniform resource identifier (Subscription Change Notification Uniform Resource Identifier), and/or subscription Change Notification Correlation ID (Subscription Change Notification Correlation ID), and/or Subscription Permanent Identifier (SUPI), and/or Group ID (Group ID), and/or General Public Subscription Identifier (Generic Public Subscription Identifier) , GPSI), and/or Permanent Equipment Identifier (PEI).

Specifically, according to the token response sent by the NRF, the first NF determines that the first NF has the right to subscribe to the network function service from the third NF, and then sends a subscription request to the third NF.

S1005. The third NF verifies the token included in the subscription request, and if the verification succeeds, then executes S1006; otherwise, if the token verification fails, the third NF ends the process or sends a subscription response to the first NF , The subscription response contains subscription failure, or token verification failure information, or other information indicating that the process failed.

Specifically, if the token verification is successful, the third NF determines that the first NF has the right to subscribe to the third NF for network function services.

Among them, the token verification includes one or more of the following: integrity verification of the token, verification of whether the token is used to indicate that the first NF has the right to subscribe to the network function service of the third NF, and the verification token Effectiveness. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF. It is also necessary to verify whether the identifier and/or type of the service producer (service producer) included in the Audience Claim in the token is the same as the identifier and/or type of the third NF. It can also verify whether the third NF can provide the network function service in the subscription request. For example, the network function services that the third NF can provide include service 1, service 2, and service 3. However, if the token indicates that the authorized service is service 4, the verification fails. The token has a validity period. When the token is within the validity period, it is valid. After the validity period, the token becomes invalid. The verification succeeds only when the token is within the validity period. It can also verify whether the information contained in the token is consistent with the corresponding information in the subscription request.

Optionally, the third NF may verify the token through NRF. Specifically, after receiving the subscription request, the third NF sends a verification request to the NRF. The NRF receives the verification request from the third NF, and verifies the token contained in the verification request. The NRF replies the verification result to the third NF. If the verification is successful, the third NF executes S1006. Otherwise, the third NF process ends, or a subscription response is replies to the first NF, and the subscription response includes subscription failure or token verification failure information, or other information indicating that the process fails. Among them, when NRF verifies the token, in addition to the above-mentioned token verification, it can also verify whether the token is consistent with the stored token, or whether the token is consistent with the first NF The token contained in the sent token response is consistent. If they are consistent, the verification is successful, otherwise the verification fails. Consistency means that the information indicated by the instruction board is the same.

The process of verifying the token through NRF can replace S1005.

S1006. The third NF sends a subscription response (subscribe response) to the first NF, and the first NF receives the subscription response from the third NF.

The subscription response may carry the authorization result, which is used to indicate that the first NF has the authority to subscribe to the network function service from the third NF on behalf of the second NF; or, the third NF carries a token of successful verification in the subscription response. The first NF determines that the authorization is successful according to the token carried in the subscription response or the authorization result.

S1007. The third NF provides network function services to the first NF according to the subscribed network function services.

Specifically, when the subscription condition is met, the third NF sends a notification (notify) to the first NF, and the notification includes the network function service provided by the third NF.

Optionally, the third NF may also send a notification to the first NF, and the notification carries information such as service modification or unsubscription.

The seventh subscription authorization method can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different public land mobile networks (PLMN). The interaction between NFs is forwarded through the SCP serving it. The token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The generation and authorization of the token is completed by the NRF in the PLMN where the third NF is located. In the manner in which the third NF can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the third NF is located. Other processing procedures are the same as those described in one of the authorization methods for proxy subscription.

Based on the same inventive concept, the embodiment of this application provides the eighth subscription authorization method. The eighth method of subscription authorization described below is based on the interaction between four network functions. The four network functions include the first NF, the third NF, NRF and SCP. The network function service provided by the service provider or service producer in this application may also be referred to as service for short.

As shown in FIG. 11, the process of the eighth method for authorization of subscription provided in the embodiment of the present application is as follows. This method uses tokens to ensure the security of the subscription.

S1101. The first NF sends a token request to the NRF, and the NRF receives the token request from the first NF.

This step is the same as S1001, and the detailed description can refer to S1001, which will not be repeated here.

S1102. The NRF generates a token based on the received token request.

This step is the same as S1002. For detailed description, please refer to S1002, which will not be repeated here.

S1103. The NRF sends a token response to the first NF, and the first NF receives the token response from the NRF.

This step is the same as S1003. For details, please refer to S1003, which will not be repeated here.

The description of S1101 to S1103 is the same as the description of S1001 to S1003. You can refer to the related description of the seventh authorization method for proxy subscription.

After S1103, the following steps may also be included.

S1104. The first NF sends a subscription request (subscribe request) to the SCP, and the SCP receives the subscription request from the first NF.

The subscription request is used by the first NF to request the proxy of the second NF to subscribe to the network function service from the third NF. The subscription request includes the above token. For other information included in the subscription request, refer to the related description in S1004.

S1105. The SCP verifies the token contained in the subscription request. If the verification succeeds, then executes S1106; otherwise, if the verification fails, the SCP ends the process or replies to the first NF with a subscription response, and the subscription response contains subscription failure. Or token verification failure information, or other information indicating process failure.

If the verification is successful, the SCP determines that the first NF has the right to subscribe to the network function service from the third NF.

Among them, the verification includes one or more of the following: integrity verification of the token, verification of whether the token is used to indicate that the first NF has the right to subscribe to the network function service from the third NF, and the validity of the verification token Sex. The verification fails when any one of the verifications is unsuccessful, and the verification succeeds when all verifications are successful. Specifically, it is necessary to check whether the subscription request contains the identity of the third NF. It is also necessary to verify whether the identity and/or type of the service producer (service producer) contained in the audience claim in the token is the same as the identity and/or type of the third NF queried by the SCP. Specifically, the SCP can be configured according to the local configuration. The identity of the third NF can be obtained by querying the information of the third NF, and the identity of the third NF can also be obtained by querying the information obtained from the NRF. It can also verify whether the third NF can provide the subscribed network function service. For example, the network function services that the third NF can provide include service 1, service 2, and service 3. However, if the token indicates that the authorized service is service 4, the verification fails. The token has a validity period. When the token is within the validity period, it is valid. After the validity period, the token becomes invalid. The verification succeeds only when the token is within the validity period. It can also verify whether the information contained in the token is consistent with the corresponding information in the subscription request.

The seventh authorization method similar to subscription, optionally, SCP can also verify the token through NRF. Specifically, after receiving the subscription request, the SCP sends a verification request to the NRF, and the NRF receives the verification request from the SCP, and verifies the token included in the verification request. NRF returns the verification result to SCP. If the verification is successful, the SCP executes S1106; otherwise, the SCP ends the process, or replies a subscription response to the first NF. The subscription response includes subscription failure, token verification failure information, or other information indicating process failure.

The process of calibrating the token through NRF can replace S1105.

S1106. The SCP sends a subscription request to the third NF, and the third NF receives the subscription request from the SCP.

The subscription request carries the information carried in the subscription request received from the first NF, and may also carry the verification result. The verification result is used to indicate whether the token verification is successful. Or it is used to indicate the authorization result, that is, whether the first NF has the right to subscribe to the network function service from the third NF.

S1107. The third NF returns a subscription response to the SCP, and the SCP receives the subscription response from the third NF.

S1108. The SCP sends a subscription response to the first NF, and the first NF receives the subscription response from the SCP.

The subscription response may carry the authorization result, which is used to indicate whether the first NF has the right to subscribe to the network function service from the third NF. When the SCP verification token is successful, the authorization result is yes; when the SCP verification token is unsuccessful, the authorization result is no. The authorization result is yes, including that the first NF has the right to subscribe to the network function service from the third NF. The authorization result is no, including that the first NF does not have the right to subscribe to the network function service from the third NF.

Alternatively, the subscription response may carry the token.

S1109-S1110, the third NF provides network function services to the first NF according to the subscribed network function services.

Specifically, when the subscription condition is met, the third NF sends a notification (notify) to the first NF through the SCP, and the notification includes the network function service provided by the third NF.

Optionally, since the first NF subscribes to the third NF, the third NF may also send a notification to the first NF through the SCP, and the notification carries information such as service modification or unsubscription. Specifically, the third NF sends a notification to the SCP, and the SCP forwards the notification to the first NF.

The eighth subscription authorization method can also be applied to roaming scenarios. In the roaming scenario, each NF is located in two different PLMNs. The interaction between NFs is forwarded through the SCP serving it. The token request sent by the first NF is forwarded by the NRF in the PLMN where the first NF is located to the NRF in the PLMN where the third NF is located. The token response sent by the NRF in the PLMN where the third NF is located is forwarded to the first NF by the NRF in the PLMN where the first NF is located. The generation and authorization of the token is completed by the NRF in the PLMN where the third NF is located. In the way that the third NF can verify the token through the NRF, the token verification is also completed by the NRF in the PLMN where the NF_B is located. The verification of the token is completed by the SCP serving the third NF. The other processing procedures are the same as those described in the eighth subscribing authorization method.

Through the eighth subscription authorization method, in the SCP system architecture, the authority is judged through NRF, and the SCP performs token verification, which improves the security of agent subscription.

Based on the same inventive concept of the foregoing method embodiment, as shown in FIG. 8, an embodiment of the present application also provides an authorization device 800 for proxy subscription. The device 800 includes a receiving unit 801 and a processing unit 802, and also includes a sending unit 803.

The device 800 can be applied to NRF or NRF, and the device 800 can perform the operations performed by the NRF in the authorization method of each proxy subscription. Taking one of the authorization methods for performing proxy subscription as an example, the receiving unit 801 is configured to receive a token request from the first network function NF, and the processing unit 802 is configured to generate a token based on the token request. Optionally, the receiving unit 801 is further configured to receive a verification request from the third NF. The processing unit 802 is also used to verify the second token. The sending unit 803 is used for the NRF to send messages to other functions.

The device 800 may also be applied to the first NF, and may also be the first NF, and the device 800 may perform the operations performed by the first NF in the authorization method for each proxy subscription. Taking one of the authorization methods for performing proxy subscription as an example, the sending unit 803 is configured to send a token request to the network function storage function NRF, and the token request is used to request the NRF to generate a token. The receiving unit 801 is configured to receive a token from the NRF.

The device 800 may also be applied to a third NF, or may be a third NF, and the device 800 may perform operations performed by the third NF in the authorization method of each proxy subscription. Taking one of the authorization methods for performing proxy subscription as an example, the receiving unit 801 is configured to receive a subscription request from the first NF, and the subscription request carries a token. The processing unit 802 is configured to verify the token included in the subscription request to obtain a verification result. Wherein, if the verification is passed, the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and the second NF has the network function to receive the network function provided by the third NF Service authority; if the verification fails, the first NF does not have the authority to subscribe network function services to the third NF on behalf of the second NF, and the second NF does not have the authority to receive the third The authority of network function services provided by NF. The sending unit 803 is configured to send a subscription response to the first NF, where the subscription response carries the verification result.

Based on the same inventive concept as the foregoing method embodiment, as shown in FIG. 9, an embodiment of the present application also provides an authorization device 900 for proxy subscription. The proxy subscription authorization device 900 is used to implement each proxy provided in the foregoing embodiment. The operations performed by the NRF, the first NF, the second NF, the third NF, or the SCP in the subscription authorization method are for brief description. The schematic diagrams of the above-mentioned possible physical devices for each function are illustrated by referring to FIG. 9. It can be understood that Fig. 9 is only a schematic diagram, which can be applied to the various functions described above. The authorization device 900 for proxy subscription includes a transceiver 901, a processor 902, and may also include a memory 903. The processor 902 is used to call a set of programs. When the programs are executed, the processor 902 executes the NRF, the first NF, the second NF, the third NF, or the SCP in the authorization method for each proxy subscription provided in the above embodiment. operating. The memory 903 is used to store programs executed by the processor 902. The sending unit and the receiving unit of the functional module in FIG. 8 may be implemented by the transceiver 901, and the processing unit may be implemented by the processor 902.

The processor 902 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.

The processor 902 may further include a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

The memory 903 may include a volatile memory (volatile memory), such as a random-access memory (random-access memory, RAM); the memory 903 may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory). memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 903 may also include a combination of the foregoing types of memories.

In the methods provided in the foregoing embodiments of the present application, part or all of the operations and functions performed by the described functional entities (or functions) may be completed by chips or integrated circuits.

In order to realize the functions of the device described in FIG. 8 or FIG. 9, an embodiment of the present application further provides a chip, including a processor, for supporting the device to implement the functions involved in the method provided in the foregoing embodiment. In a possible design, the chip is connected to a memory or the chip includes a memory, and the memory is used to store the necessary program instructions and data of the device.

The embodiment of the present application provides a computer storage medium storing a computer program, and the computer program includes instructions for executing the method provided in the foregoing embodiment.

The embodiments of the present application provide a computer program product containing instructions, which when run on a computer, cause the computer to execute the method provided in the foregoing embodiments.

Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

This application is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of this application. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. In this way, if these modifications and variations of the embodiments of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these modifications and variations.

Claims

An authorization method for proxy subscription, which is characterized in that it includes:

The network function storage function NRF receives a token request from the first network function NF, where the token request includes the identity of the first NF and the identity of the second NF;

The NRF generates a first token based on the token request, where the first token is used to indicate that the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and Used to indicate that the second NF has the authority to receive network function services provided by the third NF;

The NRF sends the first token to the first NF.
The method according to claim 1, wherein the token request includes first indication information, and the indication information is used to instruct the first NF to proxy the second NF to subscribe to the network from the third NF. Functional service.
The method according to any one of claims 1, wherein the first token includes an identification of the second NF.
The method according to any one of claims 1 or 2, wherein the first token includes the second indication information for instructing the first NF to proxy the second NF to the first NF Three NFs subscribe to network function services.
An authorization method for proxy subscription, which is characterized in that it includes:

The first network function NF sends a token request to the network function storage function NRF, where the token request includes the identity of the first NF and the identity of the second NF;

The first NF receives a token from the NRF, where the token is used to indicate that the first NF has the authority to subscribe network function services to the third NF on behalf of the second NF, and is used to indicate The second NF has the right to receive the network function service provided by the third NF.
The method according to claim 5, wherein the token request includes first indication information, and the first indication information is used to instruct the first NF to proxy the second NF to the third NF Subscribe to the network function service.
The method according to claim 5 or 6, wherein the token includes an identification of the second NF.
The method according to any one of claims 5 to 7, wherein the token includes second indication information, and the second indication information is used to instruct the first NF to proxy the second NF to the The third NF subscribes to the network function service.
The method according to any one of claims 5 to 8, characterized in that the method further comprises:

The first NF sends a subscription request to the third NF, and the subscription request carries the token.
The method of claim 9, wherein the method further comprises:

The first NF receives a subscription response from the third NF, the subscription response carries the token or authorization result, and the authorization result includes: the second NF has a network provided by the third NF Function service authority, and the first NF has the authority to subscribe network function services from the third NF on behalf of the second NF.
The method according to any one of claims 5 to 10, wherein the method further comprises:

The first NF receives a notification from the third NF, and the notification carries the token or authorization result, and the authorization result includes that the first NF has the agent of the second NF to send the third NF to the third NF. The right to subscribe to the network function service, and the second NF has the right to receive the network function service provided by the third NF.
An authorization method for proxy subscription, which is characterized in that it includes:

The third network function NF receives a subscription request from the first NF, and the subscription request carries a token;

The third NF verifies the token included in the subscription request to obtain a verification result, wherein, if the verification is successful, the first NF has a proxy for the second NF to send to the third NF The right to subscribe to the network function service, and the second NF has the right to receive the network function service provided by the third NF; if the verification is unsuccessful, the first NF does not have the authority to proxy the second NF to the The third NF has the right to subscribe to the network function service, and the second NF does not have the right to receive the network function service provided by the third NF;

The third NF sends a subscription response to the first NF, and the subscription response carries the verification result.
The method of claim 12, wherein the token carries the identity of the second NF.
The method according to claim 13, wherein the method further comprises:

When the verification succeeds, the third NF obtains the identifier of the second NF from the token.
The method according to any one of claims 12 to 14, wherein the token carries indication information, and the indication information is used to instruct the first NF to proxy the second NF to the third NF Subscribe to the network function service.
The method according to any one of claims 12 to 15, wherein the method further comprises:

The third NF sends an authorization notification to the second NF when the verification succeeds, the authorization notification includes an authorization result, and the authorization result includes that the second NF has the ability to receive the network function service provided by the third NF permission.
The method according to any one of claims 12 to 16, wherein the verification comprises one or more of the following: performing integrity verification on the token, and verifying whether the token is used Indicate that the second NF has the authority to receive the network function service provided by the third NF, verify the validity of the token, verify whether the identity of the service provider contained in the token is the same as the identity of the third NF, And verify whether the token is consistent with the token stored in the third NF.
The method according to any one of claims 12 to 17, wherein the subscription response also carries the token or authorization result, and the authorization result includes that the first NF has the agent of the second NF to send the The third NF has the right to subscribe to the network function service and the second NF has the right to receive the network function service provided by the third NF.
The method according to any one of claims 12 to 18, wherein the third NF sends a notification to the first NF, and the notification carries the token or authorization result, and the authorization result includes The first NF has the authority to subscribe network function services from the third NF on behalf of the second NF, and the second NF has the authority to receive network function services provided by the third NF.
A proxy subscription system is characterized by comprising:

The first network function NF is configured to send a token request to the network function storage function NRF, where the token request includes the identity of the first NF and the identity of the second NF;

The NRF is configured to receive the token request from the first NF, generate a token based on the token request, and send the token to the first NF; wherein the token is used to indicate Whether the first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and is used to indicate whether the second NF has the authority to receive network function services provided by the third NF.
The system according to claim 20, wherein the first NF is further configured to send a subscription request to the third NF, and the subscription request carries the token.
The system according to claim 20 or 21, wherein the system further comprises:

The third NF is configured to receive a subscription request from the first NF, verify the token carried in the subscription request, and obtain a verification result; wherein, if the verification is successful, the first NF Has the authority to subscribe network function services to the third NF on behalf of the second NF, and the second NF has the authority to receive network function services provided by the third NF; if the verification is unsuccessful, the The first NF does not have the authority to subscribe network function services from the third NF on behalf of the second NF, and the second NF does not have the authority to receive network function services provided by the third NF.
The system of claim 22, wherein the third NF is further configured to send a subscription response to the first NF, and the subscription response carries the token or authorization result; the authorization result includes The first NF has the authority to subscribe to the third NF for network function services on behalf of the second NF, and the second NF has the authority to receive network function services provided by the third NF;

The first NF is also used to receive the subscription response from the third NF.
The system according to claim 22 or 23, wherein the third NF is further configured to send an authorization notification to the second NF when the verification succeeds, the authorization notification includes an authorization result, and the authorization result Including that the second NF has the authority to receive network function services provided by the third NF

The second NF is also used to receive the authorization notification from the third NF.
The system according to any one of claims 22 to 24, wherein the verification includes one or more of the following: performing integrity verification on the token, and verifying whether the token is used for Indicate that the second NF has the authority to receive the network function service provided by the third NF, verify the validity of the token, verify whether the identity of the service provider contained in the token is the same as the identity of the third NF, And verify whether the token is consistent with the token stored in the third NF.
The system according to any one of claims 22 to 25, wherein the third NF is also used to send a notification to the first NF, and the notification carries the token or authorization result, and the The authorization result includes that the second NF has the right to receive that the first NF has the right to subscribe network function services to the third NF on behalf of the second NF and the network function service provided by the third NF;

The first NF is also used to receive the notification from the third NF.
The system according to any one of claims 20 to 26, wherein the token request includes an identification of the first NF and an identification of the second NF.
An authorization device for proxy subscription, which is characterized by comprising:

The processor is configured to be coupled with the memory, call the program in the memory, and execute the program to implement the method according to any one of claims 1-4.
An authorization device for proxy subscription, which is characterized by comprising:

The processor is configured to be coupled with the memory, call the program in the memory, and execute the program to implement the method according to any one of claims 5-11.
An authorization device for proxy subscription, which is characterized by comprising:

The processor is configured to be coupled with the memory, call the program in the memory, and execute the program to implement the method according to any one of claims 12-19.