WO2020253344A1 - 一种授权控制的方法、装置以及存储介质 - Google Patents

一种授权控制的方法、装置以及存储介质 Download PDF

Info

Publication number
WO2020253344A1
WO2020253344A1 PCT/CN2020/085008 CN2020085008W WO2020253344A1 WO 2020253344 A1 WO2020253344 A1 WO 2020253344A1 CN 2020085008 W CN2020085008 W CN 2020085008W WO 2020253344 A1 WO2020253344 A1 WO 2020253344A1
Authority
WO
WIPO (PCT)
Prior art keywords
management
management object
identity
network device
target
Prior art date
Application number
PCT/CN2020/085008
Other languages
English (en)
French (fr)
Inventor
李卓明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020253344A1 publication Critical patent/WO2020253344A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]

Definitions

  • This application relates to the field of communication technology, and in particular to an authorization control method, device and storage medium.
  • the fifth-generation mobile communication (the 5 th -generation, 5G) system has introduced network slices (NS). ) Concept to deal with the differences in network performance requirements of different communication services.
  • Network slicing refers to a complete logical network that is instantiated with specific network characteristics and is composed of a set of network functions (NF) on a physical or virtual network infrastructure.
  • NF network functions
  • NSS network slice subnet
  • a network sub-slice refers to a group of network functions and network resources that support the network functions.
  • Network slicing is provided to customers in a network slice as a service (NSaaS) manner, that is, an operator provides services to customers by creating a network slice instance (NSI).
  • a network slice instance may include zero, one, or multiple network slice subnet instances (network slice subnet instance, NSSI) or several network function instances.
  • MnS management services
  • a specific management service includes various types of managed object instances, such as network slices, network slice subnets, network functions, and other managed object classes (MOC) corresponding to managed object instances (MOI).
  • MOC managed object classes
  • each management object instance corresponds to different management operations, such as creation, modification, deletion, query, subscription, notification and other management actions.
  • the management service may also involve the management data corresponding to each management object instance, such as key Contents such as key performance indicator (KPI) or fault alarm information.
  • KPI key performance indicator
  • the management function (MnF) is divided into providers and consumers. The MnF of the management service provider can directly realize the creation, modification, and deletion of management object instances and the subscription and acquisition of management data (KPI or warning information).
  • MnF and vertical industry customers need to call the network service provided by MnF as a management service provider to realize the creation, modification and deletion of management object instances, as well as corresponding management.
  • MnF of the management service provider often needs to open a part of the management operation authority to customers (such as the MnF of the management service consumer or vertical industry customers) according to business needs. For example, allow customers to obtain certain KPI data of managed object instances, or allow customers to perform some management operations, such as creating a network slice instance, network slice subnet instance, or network function instance, and modify some networks in the network slice subnet instance Configuration of functional examples, etc.
  • 3GPP TS 28.533 defines the open control management function (exposure government management function, EGMF) as a management open control function, EGMF detects whether the management operation requested by the customer is within the allowed scope If the management operation in the request is allowed, it will call the management service as an agent and provide the result of the management operation to the customer.
  • MnF exposure government management function
  • MnF management service consumer and vertical industry customers need to call the network services provided by MnF as a management service provider to realize the creation, modification and deletion of management object instances, as well as management data (KPI or warning information) Operations such as subscription, acquisition, and query.
  • EGMF implements management and open authority control by setting a set of access control list (ACL) rules for each client. Specifically, EGMF sets a corresponding ACL rule for each customer.
  • the ACL rules of each customer include the specific management object instance corresponding to the customer, the attributes of the management object instance, and the management operations that are permitted or prohibited. combination.
  • EGMF After the customer sends a management operation request, EGMF first needs to determine the corresponding ACL rule according to the customer’s identity, and then query the network resource modeling (NRM) information database or the management information database (management information base, MIB).
  • NVM network resource modeling
  • Relevant information and corresponding attributes of the management object instance and then match the ACL rules according to the management operation, management object instance and attributes in the management operation request sent by the customer, and finally determine whether the management operation request should be allowed or rejected. Allowed means Authorization is passed, and rejection means that the card authorization is not passed. If authorized through EGMF, the agent will call the management service and return the call result. If it is rejected, the management operation failure will be returned to the client.
  • the embodiment of the present application provides an authorization control method, so that the first network device only needs to query one target database during each authorization control process, thereby reducing the complexity of implementing authorization control by the first network device.
  • the first aspect of the embodiments of the present application provides a data processing method, including: a first network device obtains a first management operation request and a first identity from a second network device, the first management operation request includes information about the first management object and
  • the first management object is a management object instance, which refers to an instance of a network resource that can be managed, and the first management object includes at least one of the following: network instance, network slice Instance, subnet instance, network slicing subnet instance or network function instance, the information of the first management object is used to indicate the first management object or one or more attributes of the first management The management object or some information associated with each attribute and other management information.
  • the first operation refers to one of multiple management operations such as creation, modification, deletion, query, subscription, or notification.
  • the first identity refers to one Tenant ID can refer to an ID set by the management service provider to distinguish management service consumers, such as third-party vertical industry customers or other operator customers, when they provide management services and realize management open control functions. Information, the specific form of the tenant identification can be presented in digital form or string form, or other forms of identification information.
  • the first network device obtains the first management operation request and the first identity from the second network device.
  • the first management operation request and the first identity can be obtained at the same time or separately.
  • the first management operation request can be obtained first, and then the first identity can be obtained, or the first identity can be obtained first, and then Acquire the first management operation request; the first network device determines the first identification set in the target database according to the first management operation request, the first identification set includes one or more identities, and each identity has a reference to the first management object
  • the authority to perform the first operation, the target database can store a corresponding identification set for all different management information and different management operation combinations, or it can only store a corresponding identification set for some different management information and different management operation combinations
  • the identification set of the identification set can be stored in the target database in the form of a customer list.
  • the information of the first management object and the identification set corresponding to the first operation are the first identification set; if the first identification belongs to the first identification set, then The first network device determines that the first management operation request is authorized. Since each of the one or more identities included in the first identity set has the authority to perform the first operation on the first management object, if the first A network device determines that the first identity belongs to the first identity set, and can determine that the first identity has the authority to perform the first operation on the first management object, and can determine that the first management operation request is authorized.
  • the identification set stores the identity identifier that has the authority to perform the first operation on the management object
  • the first network device can directly determine the corresponding identification set from the target database according to the information of the management object in the first management operation request and the first operation, and determine Whether the identity corresponding to the second network device exists or not, the identity set directly determines whether the first management operation request of the second network device is authorized to pass, so that the first network device only needs to query one target database during each authorization control process, which reduces The first network device realizes the complexity of authorization control.
  • the first network device determines the target database according to the first management operation request
  • the first identification set in includes: the first network device determines the target management object class corresponding to the first management object in the target database according to the information of the first management object, the target database is the information database of the network resource model, and the information of the network resource model
  • the library contains one or more management object classes.
  • the management object class is an abstract category summary of a type of management object instance.
  • a specific management object instance can be a network instance, network slice instance, subnet instance, network Slice subnet instance or network function instance, etc.
  • the corresponding management object class can include network object class, network slice management object class, subnet management object class, network slicing subnet management object class or network function management object class, etc.
  • Object class each management object class corresponds to an identification set, the identification set contains one or more identities, each of which has the authority to create a management object instance corresponding to the management object class, and the target management object class is one Or one of a plurality of management object classes, the first management object is a management object instance corresponding to the target management object class, the first identification set is an identification set corresponding to the target management object class; the first network device determines the first management object class according to the target management object class An identification set, for example, if the first management object is a network slice instance, the first network device will first determine the corresponding first management object in the information database of the network resource model according to the information of the first management object in the first management operation request
  • the target management object class of is a network slice management object class, and the identification set corresponding to the network slice management object class is the first identification
  • the identification sets store the corresponding management object classes.
  • the corresponding management object instance has the identity identifier of the creation operation authority, so that after receiving the first management operation request sent by the second network device, the first network device can directly according to the information and information of the first management object in the first management operation request.
  • the creation operation determines the target management object class of the first management object from the information database of the network resource model, and then determines the first identification set corresponding to the target management object class, and determines whether the first identity sent by the second network device exists.
  • the first identification set directly determines whether the first management operation request of the second network device is authorized to pass, so that the first network device only needs to query the information database of the network resource model during the authorization control process of each creation operation, thereby reducing the first network device The complexity of implementing authorization control.
  • the first network device determines that the first management operation request is authorized, it further includes: the first network device adds the first identity to a second identity set, the second identity set is the identity set corresponding to the first management object, and the second identity set includes One or more identities, each of which has the authority to perform a second operation on the first management object.
  • the second operation is one or more of a variety of non-creation operations.
  • the multiple non-creation operations include One or more of the following: modify operation, delete operation, query operation, subscription operation or notification operation.
  • the first identity can be directly added to the second identity set, so that the first identity with the creation operation authority for the first management object can be created in the first management After the object is created, it can directly have the authority to perform non-creation operations on the first management object, thereby improving the accuracy and diversity of the management authority maintenance of the management object in the target database, and can also reduce the target database to a certain extent.
  • the complexity of maintenance and control of management authority ensures the accuracy of data.
  • the first identifier set includes a target subset, and the target subset is A subset of the first identity set.
  • the method further includes: if the first identity belongs to the target subset, the first network device The network device adds the first identity to the third identity set, the third identity set contains one or more identities, and each of the one or more identities has a separate creation operation for the second management object Authority, the second management object is the subordinate management object of the first management object, the subordinate management object refers to the component management object, the component management object of a management object instance is the subordinate management object instance that composes the management object instance, that is, the second management object It is an instance of the subordinate management object that constitutes the first management object.
  • the first identity with the creation operation authority for the first management object can also be provided with the subordinate management for creating the first management object.
  • Object permissions thereby improving the accuracy and diversity of the maintenance of the management permissions of the management objects in the target database, and can also reduce the complexity of maintenance and control of the management permissions in the target database to a certain extent, and ensure the accuracy of the data.
  • the multiple non-creation operations include One or more of the following: modify operation, delete operation, query operation, subscription operation or notification operation.
  • the first network device determines the first set of identifiers in the target database according to the first management operation request, including: the first network
  • the device determines the first identification set in the target database according to the information of the first management object and the first operation.
  • the target database is the management information database.
  • the management information database is an instance of the network resource model.
  • the management information database contains one or more The created management object instance, the first management object is one of one or more management object instances, and the identity identifier in the first identification set has the authority to perform multiple non-creation operations on the first management object. For each management object instance in the information database, all non-creation operations as a whole can correspond to an identity set.
  • the identity set contains one or more identities. Each identity has the ability to perform all non-creation operations on the management object instance.
  • the identity set corresponding to the first management object is the first identity set, and each identity included in the first identity set has the authority to perform all non-creation operations on the first management object.
  • the identification sets store the management corresponding to the management object classes.
  • the object instance has the identity identifier of the non-creation type operation authority, so that after receiving the first management operation request sent by the second network device, the first network device can directly according to the first management object information and the first management operation request in the first management operation request.
  • An operation determines the corresponding first identification set from the management information database, and directly determines whether the first management operation request is authorized to pass by judging whether the first identification exists in the first identification set, so that the first network device will not create a class every time During the operation authorization control process, only the management resource database needs to be queried, which reduces the complexity of implementing authorization control by the first network device.
  • the multiple non-creation operations include One or more of the following: modify operation, delete operation, query operation, subscription operation or notification operation.
  • the first network device determines the first set of identifiers in the target database according to the first management operation request, including: the first network The device determines the target combination according to the first operation.
  • the target combination is one of multiple combinations. Multiple non-creation operations are divided into multiple combinations, and each combination includes one or more of multiple non-creation operations ,
  • the first management object corresponds to multiple identification sets, and each combination corresponds to an identification set corresponding to the first management object.
  • the identification set contains one or more identities, and each identity in the identification set has the first management
  • the object has the authority to perform non-creation operations contained in the corresponding combination.
  • the combination to which the first operation belongs is the target combination, and the target database is the management information database.
  • the management information database contains one or more management object instances, the first management object It is one of one or more management object instances; the first network device determines the first identification set in the management information database according to the target combination.
  • all non-creation operations are taken as a whole, corresponding to the existence of an identity set, all non-creation operations can also be divided into multiple combinations, each There is an identification set corresponding to the combination, and the first network device can directly determine the corresponding first identification set from the management information database according to the information of the first management object and the target combination to which the first operation belongs, so as to improve the diversity of solution implementation.
  • the first operation is a modification operation
  • the information of the first management object is used
  • the fourth identification set has an association relationship with the target attribute in one or more attributes of the first management object, and the fourth identification set contains one or more identities.
  • the second operation is one or more of a variety of non-creation operations.
  • the first management operation request is used to request modification of the fourth identity set to add the second identity to the fourth Identity collection.
  • the first management object has one or more attributes.
  • each attribute can be Associate an identity set
  • the first identity that has the right to modify an attribute of the first management object can be modified by adding the second identity to the identity set associated with the attribute, that is, to modify a certain attribute of the management object
  • a customer with operating authority can authorize management authority to other customers by adding the identity of other customers to the corresponding identifier set, which can reduce the complexity of maintaining the management authority in the target database to a certain extent, and ensure The accuracy of the data.
  • the first network device determines After a management operation request is authorized, it further includes: the first network device obtains the second management operation request and the first identity identifier, and the second management operation request includes the indication information of the first identity set and the second identity of the first identity set.
  • the second operation is one or more of a variety of non-creation operations, the second management operation request and the first identity may be sent by the second network device or other network devices.
  • the indication information of an identification set is used to indicate the first identification set, and the second management operation request is used to request to perform a second operation on the first identification set, such as a modification operation, a deletion operation, a subscription operation, or a query operation; the first network
  • the device determines the fifth identification set in the management information database according to the second management operation request.
  • the first identification set in the management information database is associated with the fifth identification set.
  • the fifth identification set contains one or more identities, and the identities have The authority to perform the second operation on the first identity set.
  • the first identity set may also be one of the one or more attributes of the first management object, and this attribute is associated with the fifth identity set; if the first identity belongs to the Five identification sets, the first network device determines that the second management operation request is authorized.
  • the first network device After determining the fifth identification set according to the second management operation request, the first network device will determine whether the first identification belongs to the fifth identification set. Each of the one or more identities included in the fifth identity set has the authority to perform the first operation on the first management object. Therefore, if the first network device determines that the first identity belongs to the fifth identity set , It can be determined that the first identity has the authority to perform the first operation on the first set of identities.
  • the eighth implementation manner of the first aspect of the embodiments of the present application if the first identity belongs to The first identification set, after the first network device determines that the first management operation request is authorized, it further includes: the first network device sends target information to the third network device, and the target information includes the first management operation request and address information, The target information is used by the third network device to perform the first operation on the first management object and send the result of the first operation performed by the third network device to the address information.
  • the target information includes the first management operation request and the address information, It can also contain other information.
  • the address information belongs to the first network device or the second network device.
  • the address information may be address information corresponding to the first network device, and the third network device will perform the first operation on the first management object according to the first management operation request.
  • the execution result is sent to the address information corresponding to the first network device, and the execution result is forwarded by the first network device to the second network device, so that the second network device can obtain the execution result of the first management operation request, the address
  • the information may also be the address information corresponding to the second network device.
  • the third network device After the third network device performs the first operation on the first management object according to the first management operation request, it will directly send the execution result to the corresponding address of the second network device. Address information, so that the execution result of the first management operation request can be directly obtained, so that the diversity of solution realization can be improved.
  • a second aspect of the embodiments of the present application provides an authorization control device, including: an obtaining module, configured to obtain a first management operation request and a first identity from a second network device, the first management operation request including the first management object Information and a first operation on the first management object, the first management object includes at least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance; the first determining module uses Determining a first set of identities in the target database according to the first management operation request obtained by the obtaining module, the first set of identities including one or more identities, the identities having the authority to perform the first operation on the first management object; The second determining module is configured to determine that the first management operation request is authorized when the first identity identifier belongs to the first identifier set determined by the first determining module.
  • the first determining module is configured to, when the first operation is a creation operation, according to the first
  • the information of the management object determines the target management object class corresponding to the first management object in the target database.
  • the target database is the information library of the network resource model.
  • the information library contains one or more management object classes.
  • Each management object class corresponds to an identification set ,
  • the identity set contains one or more identities, the identity has the authority to create management object instances corresponding to the management object class, the target management object class is one of one or more management object classes, and the first management object is the target management For the management object instance corresponding to the object class, the first identification set is the identification set corresponding to the target management object class; the first identification set is determined according to the target management object class.
  • the device further includes: a first adding module, configured to The second determination module determines that after the first management operation request is authorized, the first identity is added to the second identity set, and the second identity set contains one or more identities that have the second operation on the first management object
  • the second operation is one or more of a variety of non-creation operations, which include one or more of the following: modify operation, delete operation, query operation, subscription operation, or notification operation .
  • the first identifier set includes a target subset
  • the device further includes: The second adding module is used to add the first identity to the third identity set after the second determining module determines that the first management operation request is authorized, if the first identity belongs to the target subset, and the third identity set contains one Or multiple identities, each of which has the authority to create operations on the second management object, and the second management object is a subordinate management object of the first management object.
  • the multiple non-creation operations include One or more of the following: modify operation, delete operation, query operation, subscription operation or notification operation
  • the first determining module is used to determine the target database according to the information of the first management object acquired by the acquiring module and the first operation
  • the target database is the management information database
  • the management information database contains one or more management object instances
  • the first management object is one of the one or more management object instances
  • the identities in the first identification set have Permission to perform multiple non-creation operations on the first management object.
  • the multiple non-creation operations include One or more of the following: modify operation, delete operation, query operation, subscription operation or notification operation, the first determination module is used to determine the target combination according to the first operation acquired by the acquisition module, and the target combination is in multiple combinations
  • modify operation, delete operation, query operation, subscription operation or notification operation the first determination module is used to determine the target combination according to the first operation acquired by the acquisition module, and the target combination is in multiple combinations
  • multiple non-creation operations are divided into multiple combinations, each combination includes one or more of multiple non-creation operations, the first management object corresponds to multiple identification sets, and each combination corresponds to one Identification set
  • the target database is the management information database, the management information database contains one or more management object instances, the first management object is one of the one or more management object instances; the first identification in the management information database is determined according to the target combination set.
  • the first operation is a modification operation
  • the information of the first management object is used
  • the fourth identification set has an association relationship with the target attribute in one or more attributes of the first management object, and the fourth identification set contains one or more identities.
  • the second operation is one or more of a variety of non-creation operations.
  • the first management operation request is used to request modification of the fourth identity set to add the second identity to the fourth Identity collection.
  • the acquiring module is also used for the second determining module to determine that the first management operation request is authorized After that, the second management operation request and the first identity identifier are obtained.
  • the second management operation request includes the indication information of the first identifier set and the second operation on the first identifier set.
  • the second operation is in a variety of non-creation operations
  • the first determination module is further configured to determine a fifth identification set in the management information database according to the second management operation request obtained by the acquisition module, and the fifth identification set contains one or more identity information, the The identity information has the authority to perform the second operation on the first identification set; the second determination module is further configured to determine that the second management operation request is authorized when the first identification belongs to the fifth identification set determined by the first determination module.
  • the device further includes: sending Module for sending target information to a third network device after the second determining module determines that the first management operation request is authorized, the target information includes the first management operation request and address information, and the target information is used for the third network device Perform the first operation on the first management object, and send the result of the first operation performed by the third network device to the address information.
  • the address information belongs to the first network device or the second network device.
  • a third aspect of the present application provides a computer device that includes a processor and a computer-readable storage medium storing a computer program; the processor is coupled to the computer-readable storage medium, and the first aspect is realized when the computer program is executed by the processor And the authorization control method provided in any possible implementation of the first aspect.
  • a fourth aspect of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and when it runs on a computer, the computer can execute the first aspect or any possible implementation of the first aspect.
  • the method of authorization control is not limited to:
  • the fifth aspect of the present application provides a computer program product containing instructions, which when running on a computer, enables the computer to execute the authorization control method of the first aspect or any one of the possible implementation manners of the first aspect.
  • the embodiment of the present invention adopts an authorization control method, by setting a corresponding identification set for the combination of the management object and the management operation on the first network device side, and the identification set stores the identity identifier with the authority to perform the first operation on the management object , So that after receiving the first management operation request sent by the second network device, the first network device can directly determine the corresponding first management operation from the target database according to the information of the first management object in the first management operation request and the first operation.
  • the identification set by judging whether the first identification set exists, the first identification set directly determines whether the first management operation request sent by the second network device is authorized to pass, so that the first network device only needs to query one during each authorization control process
  • the target database reduces the complexity of implementing authorization control for the first network device.
  • Figure 1(a) is a schematic diagram of a network resource model provided by an embodiment of this application.
  • Figure 1(b) is a schematic diagram of a management information database provided by an embodiment of this application.
  • Figure 2 is a schematic diagram of an embodiment of an authorization control method provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of another embodiment of an authorization control method provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another embodiment of an authorization control method provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another embodiment of an authorization control method provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of the hardware structure of a network device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an authorization control device provided by an embodiment of the present application.
  • the embodiment of the present invention provides an authorization control method, by setting a corresponding identification set for a combination of a management object and a management operation on the first network device side, and the identification set stores an identity identifier that has the authority to perform the first operation on the management object , So that after receiving the first management operation request sent by the second network device, the first network device can directly determine the corresponding first management operation from the target database according to the information of the first management object in the first management operation request and the first operation.
  • the identification set by judging whether the first identification set exists, the first identification set directly determines whether the first management operation request sent by the second network device is authorized to pass, so that the first network device only needs to query one during each authorization control process
  • the target database reduces the complexity of implementing authorization control for the first network device.
  • the embodiment of the present invention also provides a corresponding authorization control device and storage medium. Detailed descriptions are given below.
  • the network configuration data is classified as an information object class (information object class, Standardized modeling is performed in the form of IOC, and the standardized configuration data becomes the network resource modeling (NRM) of the manageable aspect of the 5G network.
  • the network resource model is a high level of generalization and abstraction of network resources, including each management object class, management object class attributes, and the association relationship between management object classes.
  • the network resource model abstracts network resources in a unified way. Its purpose is It can provide a complete and accurate description of the communication network, support the rapid generation and expansion of network resources, and realize the dynamic maintenance and management of network resources.
  • the description form of the management object class in the network resource model is object class information IOC (Information Object Class), and a series of IOC combinations constitute the network resource model.
  • IOC Information Object Class
  • FIG. 1(a) An embodiment of the present application provides a schematic diagram of a network resource model, please refer to FIG. 1(a).
  • the network resource model shown in Figure 1(a) includes the object class information of the network slice management object class, the network slice subnet management object class, and the network function management object class, as well as the corresponding slice description attributes for each object class, and shows The association relationship between each object class is shown, that is, the network slice is composed of one or more network slice subnets, and each network slice subnet is composed of one or more network functions.
  • the management information database stores a series of specific management object instances, the attribute values of the management object instances, and the correlation between each management object instance. It should be noted that sometimes managed object instances can also be directly referred to as managed objects.
  • Figure 1(b) is a schematic diagram of a management information database created based on the network resource model in Figure 1(a). Referring to Figure 1(b), it can be seen that the management information database contains information based on Figure 1(a).
  • the management object instance corresponding to each management object class created in the network resource model in the network resource model and the association relationship between different management object instances such as the network slice instance NSI 1 contains the network slice subnet instance NSSI 1-1, and the network slice subnet instance Network instance NSSI 1-1 contains two parts of network function instance NF 1 and NF 2.
  • Figures 1(a) and 1(b) are only a simple example of the network resource model and the corresponding management information database in the embodiment of this application. In the application process, the network resource model and the management information database can be There are many different construction methods, and the above examples should not be understood as limiting the application.
  • the management service implements the management of network resources based on the network resource model and the management information database.
  • FIG. 2 is a schematic diagram of an embodiment of the authorization control method provided in the embodiment of the present application.
  • Fig. 2 is a schematic diagram of an embodiment of an authorization control method provided by an embodiment of the application.
  • an embodiment of the authorization control method provided in the embodiment of the present application may include:
  • a first network device obtains a first management operation request and a first identity from a second network device.
  • the first management operation request includes information about a first management object and a first operation on the first management object.
  • the first management object It includes at least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance.
  • the first network device obtains the first management operation request and the first identity from the second network device.
  • the first management object is a management object instance, which refers to an instance of a network resource that can be managed.
  • a specific management object instance can be a network instance, a network slice instance, a subnet instance, Network slicing subnet instance or network function instance, etc.
  • the first management object may also be another type of management object instance, which is not limited in the embodiment of the present application.
  • Each management object instance has one or more attributes. In the embodiments of the present application, some network configuration items that can be modified in the management object instance, the list of the next-level management object instances included, etc. may all be management object instances. The attributes possessed.
  • the information of the first management object is used to indicate the first management object or one or more attributes of the first management object, and can also be used to indicate some information associated with the first management object or each attribute
  • the information indicated by the information of the first management object is the information that the second network device requests to be managed.
  • the information of the first management object is the identifier of the first management object, and the identifier is used to indicate the first management object, and the first management operation request sent by the second network device is used to request management operations on the first management object ,
  • the information of the first management object is an indication information that is used for one or more attributes of the first management object, then the first management operation request sent by the second network device is used to request the one or more attributes Multiple attributes to perform management operations; or the indication information indicates certain information associated with the first management object, the first management operation request sent by the second network device is used to request the association with the first management object Some information of the management operation.
  • the first operation refers to one of multiple management operations such as creation, modification, deletion, query, subscription, or notification. It should be noted that, in addition to the above-exemplified types, the types of management operations in the embodiments of this application may also include other types of management operations, which are not limited in this application.
  • the first management operation request includes the information of the first management object and the first operation on the first management object, and the first management operation request is used to request that the first management object be processed according to the information of the first management object. Perform the first operation.
  • the first management object is the identification information of the network slice instance A
  • the identification information is used to indicate the network slice instance A
  • the first operation request is a creation operation
  • the first management operation request is used to request the creation of the network slice instance A
  • the information of the first management object is used to indicate a target attribute of the network slice instance A
  • the first operation is a modification or deletion operation
  • the first management operation request It is used to request to modify or delete the target attribute of the network slice instance A
  • the information of the first management object is used to indicate the network slice instance A, one or more attributes of the network slice instance A, or is associated with the network slice instance A
  • the first operation is a management operation such as query or subscription
  • the above introduction of the first management operation request by taking the network slicing instance A as an example is a schematic introduction and should not be understood as limiting the application.
  • the first management operation request may also include other information, which is not limited in this application.
  • the first identity identifier may refer to a tenant identifier, and specifically may refer to a management service provider that is set to distinguish management service consumers when providing management services and realizing management open control functions. (Such as third-party vertical industry customers or other operator customers) identification information.
  • the specific form of the tenant identification can be presented in digital form or string form, or other forms of identification information (such as an identity token processed by encryption technology, etc.), which is not limited in this application.
  • the first management operation request and the first identity can be obtained at the same time It may also be obtained separately, which is not limited in the embodiment of the present application.
  • the first network device obtains the first management operation request and the first identity information separately, the sequence of obtaining the first management operation request and the first identity is not done in this embodiment. Specific restrictions.
  • the first network device determines a first set of identities in the target database according to the first management operation request, the first set of identities includes one or more identities, and the identities in the first set of identities have the ability to perform the first management object The permission of the first operation.
  • a first identification set corresponding to the information of the first management object and the first operation is stored in the target database.
  • the first identification set contains one or more identification identifications, and each identification identification The authority of a management object to perform the first operation.
  • the target database can be a network resource model information database or a management information database.
  • the target information database can be stored in the first network device or in other devices, or it can be stored in a network management system by multiple devices.
  • Distributed database the present invention does not specifically limit the deployment and implementation of the target database.
  • the information of the first management object may be used to indicate management information such as the first management object, one or more attributes of the first management object, or some information associated with the first management object or each attribute
  • the first Operation refers to one of a variety of management operations such as creation, modification, deletion, query, subscription, or notification.
  • each combination can correspond to a set of identifiers.
  • the ID set contains one or more IDs, and each ID has the authority corresponding to the combination.
  • the target database can store a corresponding identification set for all combinations of different management information and different management operations, or only store a corresponding identification set for some combinations of different management information and different management operations.
  • the identification set may be stored in the target database in the form of a customer list, and each customer list stores the identification identification corresponding to a different customer.
  • the identification set may also be stored in other forms The embodiments of this application do not limit this.
  • the target database stores the information for the first management object and the first identification set corresponding to the first operation
  • the first identification set is the identification set corresponding to one of the above combinations.
  • the first network device determines that the first management operation request is authorized.
  • the first network device after determining the first identity set according to the first management operation request sent by the second network device, the first network device will determine whether the first identity sent by the second network device belongs to the first identity set.
  • Each of the one or more identities included in the first identity set has the authority to perform the first operation on the first management object. Therefore, if the first network device determines that the first identity belongs to the first identity set , It can be determined that the first identity has the authority to perform the first operation on the first management object, and the first network device can determine that the first management operation request sent by the second network device is authorized.
  • the embodiment of the application adopts an authorization control method, by setting a corresponding identification set for the combination of the management object and the management operation in the target database on the first network device side, and the identification set saves the first operation on the management object.
  • the identity of the authority allows the first network device to directly determine the corresponding from the target database according to the information of the management object in the first management operation request and the first operation after receiving the first management operation request sent by the second network device.
  • the identification set by judging whether the identity identification corresponding to the second network device exists, the identification set directly determines whether the first management operation request of the second network device is authorized to pass, so that the first network device only needs to query during each authorization control process
  • a target database reduces the complexity of implementing authorization control for the first network device.
  • Non-creation operations are management operations other than the above-mentioned creation operations. That is, non-creation operations include modification operations, deletion operations, and One or more non-creation management operations such as query operations, subscription operations, or notification operations. Therefore, based on the above-mentioned embodiments, this application will separately introduce the authorization control methods in the embodiments of this application from the first operation to the creation operation and the non-creation operation. Please refer to the following respectively.
  • the first operation is the creation operation
  • the target database is the information database of the network resource model.
  • the authorization control method provided by the embodiment of this application will be introduced from the first operation as the creation operation.
  • the target database in the above embodiment is the information database of the network resource model, as shown in Figure 3
  • the application embodiment provides a schematic diagram of another embodiment of the authorization control method.
  • the embodiment in FIG. 3 will introduce in detail the first operation as the creation operation and the target database as the information database of the network resource model.
  • another embodiment of the authorization control method provided by the embodiment of the present application may include:
  • a first network device obtains a first management operation request and a first identity from a second network device.
  • the first management operation request includes information of a first management object and a creation operation of the first management object.
  • the first management object includes At least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance.
  • the first operation is a creation operation, and other related content can be understood with reference to step 201 in FIG. 2, and will not be repeated here.
  • the first network device determines a target management object class corresponding to the first management object in the target database according to the information of the first management object, and the target database is an information database of the network resource model.
  • the target database is the information database of the network resource model.
  • the information database of the network resource model contains one or more management object classes.
  • a specific management object instance can be a network instance, network slice instance, subnet instance, network slice subnet instance, or network function Therefore, one or more management object classes contained in the information database of the network resource model can respectively correspond to the types corresponding to the above-mentioned various management object instances.
  • the management object class is a network slice management object class
  • the network slice management object class is an abstract category summary of different network slice instances.
  • Network slice instance A, network slice instance B, and network slice instance C all belong to The network slice management object class.
  • the information database of the network resource model in the embodiment of the present application may include multiple management object classes such as network object classes, network slice management object classes, subnet management object classes, network slice subnet management object classes, or network function management object classes. It should be noted that, in addition to the above-mentioned multiple types of management object classes, the information database of the network resource model in the embodiments of the present application may also include other types of management object classes, which are not limited in the embodiments of the present application.
  • the information database of the network resource model contains one or more management object classes, and each management object class corresponds to an identification set.
  • the identification set contains one or more identities.
  • the authority of the management object instance corresponding to the management object class For example, there is an identity set corresponding to the network slice management object class, which contains one or more identities, and each identity has the authority to create network slice instances; there is an identity set corresponding to the network slice subnet management object class.
  • the identity set contains one or more identities, and each identity has the authority to create a network slicing subnet instance.
  • the target management object class is one of one or more management object classes included in the information database of the network resource model
  • the first management object is a management object instance corresponding to the target management object class.
  • the first network device will first determine the target management object corresponding to the first management object in the information database of the network resource model according to the information of the first management object in the first management operation request
  • the class is a network slice management object class; if the first management object is a network function instance, the first network device will first determine the first management in the information database of the network resource model according to the information of the first management object in the first management operation request
  • the target management object class corresponding to the object is the network function management object class.
  • the first network device determines a first identification set according to the target management object class.
  • each management object class in the information database of the network resource model corresponds to an identification set
  • the first identification set is the identification set corresponding to the target management object class
  • the first network device is determining the corresponding identification of the first management object
  • a first identification set can be determined according to the target management object class.
  • the first identification set contains one or more identities, each of which has the authority to create a management object instance corresponding to the target management object class.
  • the first network device determines that the first management operation request is authorized.
  • the first network device sends target information to the third network device.
  • the target information includes the first management operation request and address information.
  • the target information is used by the third network device to perform a creation operation on the first management object, and The result of the creation operation performed by the third network device is sent to the address information.
  • the first network device after the first network device determines that the first management operation request is authorized, the first network device sends target information to the third network device, and the target information includes the first management information sent by the second network device. Operation request and address information. After receiving the target information, the third network device will execute the creation operation of the first management object according to the first management operation request, and send the execution result to the address information in the target information.
  • the target information in the embodiment of the present application may also include other information, which is not limited in the embodiment of the present application.
  • the address information in the embodiment of the present application may be address information corresponding to the first network device, and the third network device will send the execution result after executing the creation operation of the first management object according to the first management operation request Given the address information corresponding to the first network device, the execution result is then forwarded by the first network device to the second network device, so that the second network device can obtain the execution result of the first management operation request; in this embodiment of the application
  • the address information may also be the address information corresponding to the second network device.
  • the third network device executes the creation operation of the first management object according to the first management operation request, it will directly send the execution result to the second network device corresponding , So that it can directly obtain the execution result of the first management operation request.
  • the first network device adds the first identity to a second identity set, the second identity set includes one or more identities, and each identity has the authority to perform a second operation on the first management object, and the second identity
  • the operation is one or more of a variety of non-creation operations, and the multiple non-creation operations include one or more of the following: modify operations, delete operations, query operations, subscription operations, or notification operations.
  • a network device can add the first identity to the second set of identities.
  • the second identification set is the identification set corresponding to the first management object, which includes one or more identifications.
  • the various non-creation operations in the embodiments of this application include one or more of the following: modification operations, deletion operations, query operations, subscription operations, or notification operations. In addition, other types of non-creation operations can also be included. Class management operations.
  • the second operation in the embodiment of the present application refers to one or more of a variety of non-creation operations, and each identifier in the second identifier set has the authority to perform the second operation on the first management object.
  • the first network device adds the first identity to the second identity set after the first management object is created, the first identity not only has the right to create the first management object, but also has the The authority to perform the second operation on the first management object.
  • the second operation is a modification operation, a non-creation operation, each identifier in the second identifier set has the right to modify the first management object, and the first network device is After creation, the first identity is added to the second set of identity, then the first identity has the right to modify the first management object; if the second operation is one of the two operations of modification and deletion One or more operations, the first network device is adding the first identity to the second identity set, and the first identity has the authority to modify and delete the first management object.
  • the first network device adds the first identity to the third identity set.
  • the third identity set contains one or more identities, and each identity has a pair
  • the second management object has the authority to perform the creation operation, and the second management object is a subordinate management object of the first management object.
  • the first identification set may also include a target subset, and the target subset is a subset of the first identification set.
  • the second management object in the embodiment of the present application is a subordinate management object of the first management object.
  • the subordinate management object refers to the component management object, and the component management object of a management object instance is the subordinate management object instance that composes the management object instance. Therefore, in the embodiment of the present application, the second management object is a subordinate management object of the first management object, that is, the second management object is a subordinate management object instance constituting the first management object.
  • the first management object is a network slice instance
  • a network slice instance can be composed of multiple network slice subnet instances, then the network slice subnet instance that composes the network slice instance is the second management object
  • a network The slice subnet instance may be composed of multiple network function instances.
  • the third identification set is the identification set associated with the management object class corresponding to the second management object.
  • the third identification set contains one or more identification identifications, and each identification identification has the control of the second management The object's permission to create operations.
  • the first network device determines that the first identity belongs to the first identity set while determining that the first identity belongs to the target subset, then the first network device first determines that the first identity has the ability to create
  • the authority of the first management object that is, after it is determined that the first management operation request sent by the second network device is authorized, the first identity can also be added to the third identity set. At this time, the first identity has the right 2.
  • step 305, step 306, and step 307 in the embodiment of the present application are all optional steps.
  • the embodiment of the present application does not specify the order of step 305, step 306, and step 307. The limit.
  • the embodiment of the application adopts an authorization control method, by setting corresponding identification sets for different management object classes in the information database of the network resource model on the first network device side, and storing the identification sets There is an identity identifier that has the creation operation authority for the management object instance corresponding to the management object class, so that after receiving the first management operation request sent by the second network device, the first network device can directly follow the first management operation request in the first management operation request.
  • the information of the management object and the creation operation determine the target management object class of the first management object from the information database of the network resource model, and then determine the first identification set corresponding to the target management object class, and determine the first identification set sent by the second network device.
  • the first identification set Whether the first identification set exists or not, it directly determines whether the first management operation request of the second network device is authorized to pass, so that the first network device only needs to query the information database of the network resource model during the authorization control process of each creation operation. Reduce the complexity of implementing authorization control by the first network device.
  • the first operation is a non-creation operation
  • the target database is a management information database.
  • the authorization control method provided by the embodiment of this application will be introduced from the first operation being a non-creation type operation.
  • the target database in the above embodiment is a management information database, please refer to Figure 4- Figure 5.
  • FIG. 4 is a schematic diagram of another embodiment of an authorization control method provided by an embodiment of the application.
  • an embodiment of the authorization control method provided in the embodiment of the present application may include:
  • the first network device obtains a first management operation request and a first identity from a second network device, where the first management operation request includes the information of the first management object and the first operation on the first management object, the first management object It includes at least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance, and the first operation is one of multiple non-creation operations.
  • the first operation is one of a variety of non-creation operations, and other content can also be understood with reference to step 201 in FIG. 2 and will not be repeated here.
  • the first network device determines the first identification set in the target database according to the information of the first management object and the first operation, the target database is a management information database, and the management information database contains one or more management object instances, and the first management object For one of the one or more management object instances, the first identifier set includes one or more identities, and each identity identifier has the authority to perform multiple non-creation operations on the first management object.
  • the target database is the management information database.
  • the management information database is an instance of the network resource model.
  • the management information database contains one or more instances of management objects that have been created.
  • the first management object is a management object contained in the management information database. Instance.
  • all non-creation operations as a whole can correspond to an identity set.
  • the identity set contains one or more identities, and each identity is Has the authority to perform all non-creation operations on managed object instances.
  • the identification set corresponding to the first management object is the first identification set, and each identification included in the first identification set has the authority to perform all non-creation operations on the first management object.
  • the first network device determines that the first management operation request is authorized.
  • step 203 in FIG. 2 The embodiment of the present application can be understood by referring to step 203 in FIG. 2, and details are not described herein again.
  • the first network device sends target information to the third network device, the target information includes the first management operation request and address information, and the target information is used by the third network device to perform the first operation on the first management object, and Send the result of the first operation performed by the third network device to the address information.
  • the first network device after the first network device determines that the first management operation request is authorized, the first network device sends target information to the third network device, and the target information includes the first management information sent by the second network device. Operation request and address information. After receiving the target information, the third network device will execute the first operation on the first management object according to the first management operation request, and send the execution result to the address information in the target information.
  • the target information in the embodiment of the present application may also include other information, which is not limited in the embodiment of the present application.
  • the address information in the embodiment of the present application may be address information corresponding to the first network device.
  • the third network device After the third network device performs the first operation on the first management object according to the first management operation request, it will perform the result
  • the address information corresponding to the first network device is sent, and the execution result is forwarded by the first network device to the second network device, so that the second network device can obtain the execution result of the first management operation request; embodiments of the present application
  • the address information in may also be the address information corresponding to the second network device.
  • the third network device performs the first operation on the first management object according to the first management operation request, it will directly send the execution result to the second network device The corresponding address information so that it can directly obtain the execution result of the first management operation request.
  • the first network device obtains a second management operation request and a first identity identifier.
  • the second management operation request includes indication information of the first identity set and a second operation on the first identity set, and the second operation is of multiple types. One or more of non-creation operations.
  • the first network device may also receive the second management operation request and the first identity identifier.
  • the second management operation request and the first identity identifier may be sent by the second network device, or may be sent by other network devices, which is not limited in the embodiment of the present application.
  • the second management operation request includes the indication information of the first identification set and the second operation on the first identification set.
  • the indication information of the first identification set is used to indicate the first identification set, and the second identification set
  • the operation is one or more of a variety of non-creation operations, and the second management operation request is used to request to perform a second operation on the first identification set, such as a modification operation, a deletion operation, a subscription operation, or a query operation.
  • the first network device determines the fifth identification set in the management information database according to the second management operation request, the fifth identification set contains one or more identification identifications, and the identification identifications in the fifth identification set have a reference to the first identification set The right to perform the second operation.
  • the first identification set in the management information database is associated with the fifth identification set, and the fifth identification set contains one or more identifications, and each of the identifications has the ability to perform a check on the first identification set.
  • the authority of the second operation It should be noted that each management object instance in the embodiment of this application has one or more attributes, and the first identification set in the embodiment of this application may also be one of the one or more attributes of the first management object. , This attribute is associated with the fifth identification set.
  • the first network device determines that the second management operation request is authorized.
  • the first network device after determining the fifth identity set according to the second management operation request, the first network device will determine whether the first identity belongs to the fifth identity set, because the fifth identity set contains one or more identities Each of the identities in has the authority to perform the first operation on the first management object. Therefore, if the first network device determines that the first identity belongs to the fifth identity set, it can be determined that the first identity By identifying the authority of the set to perform the first operation, the first network device can determine that the second management operation request is authorized.
  • step 404 in the embodiment of this application is an optional step, and step 405 to step 407 as a whole are also optional steps, and the sequence of step 404 and step 405 to step 407 in this embodiment of the application The order is not limited.
  • step 402 in the embodiment of FIG. 4 all the non-creation operations are taken as a whole, and there is an identification set corresponding to them.
  • all the non-creation operations can also be divided into multiple combinations, each of which Correspondingly, there is an identifier set, which will be described in detail in the embodiment provided in FIG. 5.
  • FIG. 5 is a schematic diagram of another embodiment of an authorization control method provided by an embodiment of this application.
  • another embodiment of the authorization control method provided in the embodiment of the present application may include:
  • a first network device obtains a first management operation request and a first identity from a second network device.
  • the first management operation request includes information of a first management object and a first operation on the first management object.
  • the first management object It includes at least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance, and the first operation is one of multiple non-creation operations.
  • the first network device determines the target combination according to the first operation.
  • the target combination is one of multiple combinations. Multiple non-creation operations are divided into multiple combinations, and each combination includes multiple non-creation operations.
  • the first management object corresponds to multiple identification sets
  • each combination corresponds to one identification set
  • the target database is a management information database
  • the management information database contains one or more management object instances
  • the first management object is one or One of multiple managed object instances.
  • the relevant content of the management information database can be understood with reference to step 402 in FIG. 4, which will not be repeated here.
  • all non-creation operations are divided into multiple combinations, and each combination can contain one or more types of non-creation operations, and each combination corresponds to a corresponding first management object
  • An identification set the identification set contains one or more identifications, and each identification in the identification set has the authority to perform non-creation operations included in the corresponding combination on the first management object.
  • the combination to which the first operation belongs is the target combination. After obtaining the first management operation request and the first identity sent by the second network device, the first network device first determines the target combination according to the first operation.
  • all non-creation operations in the embodiments of the present application are five types of management operations: modify operations, delete operations, query operations, subscription operations, and notification operations.
  • the modification operations The sum delete operation is the first combination, the query operation is the second combination, and the subscription operation and the notification operation are the third combination. These three combinations respectively have an identity set. If the first operation is a modification operation, the first network device determines that the target combination is the first combination, and if the first operation is a query operation, the first network device determines that the target combination is the second combination. It should be noted that in addition to the above examples, there are also multiple ways to divide non-creation operations. For example, each non-creation operation corresponds to an identifier set, which is not limited in the embodiment of the present application.
  • the first network device determines a first identification set in the management information database according to the target combination.
  • the first network device determines the identity set corresponding to the first management object stored in the management information database according to the target combination, and the identity set is the first identity set.
  • the first network device determines that the first management operation request is authorized.
  • step 203 in FIG. 2 The embodiment of the present application can be understood by referring to step 203 in FIG. 2, and details are not described herein again.
  • the first management object has one or more attributes.
  • each of the attributes Both can be associated with an identity set
  • the identity set includes one or more identities
  • each identity has the authority to perform a second operation on the attribute corresponding to the identity set.
  • the second operation in the embodiment of the present application refers to one management operation among multiple non-creation operations, and can also be multiple operations among multiple non-creation operations, for example, two, three, etc.
  • the identification set associated with the target attribute is the fourth identification set.
  • the first operation is a modification operation
  • the first management The information of the object is used to indicate the fourth identity set
  • the first management operation request in the embodiment of the present application may be used to request to modify the fourth identity set.
  • the specific modification method is to add the second identity to In the fourth identifier set, the second identity identifier has the authority to perform the second operation on the target attribute.
  • the first network device sends target information to the third network device, where the target information includes the first management operation request and address information, and the target information is used by the third network device to perform the first operation on the first management object, and Send the result of the first operation performed by the third network device to the address information.
  • step 505 in the embodiment of the present application is an optional step.
  • the embodiment of the application adopts an authorization control method, by setting corresponding identification sets for different management object instances in the management information database on the first network device side, and the identification set stores the management information.
  • the management object instance corresponding to the object class has the identity identifier of the non-creation type operation authority, so that the first network device can directly follow the first management operation request in the first management operation request after receiving the first management operation request sent by the second network device.
  • the object information and the first operation determine the corresponding first identification set from the management information database, and directly determine whether the first management operation request is authorized to pass by judging whether the first identification exists or not, so that the first network device is In the authorization control process of each non-creation operation, only the management resource database needs to be queried, which reduces the complexity of implementing authorization control by the first network device.
  • the first network device in order to implement the above-mentioned functions, includes hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • the first network device in Figures 2 to 5 can refer to one or more physical devices, that is, one physical device implements the above-mentioned authorization control method embodiment, or multiple physical devices.
  • Joint implementation may also be one or more logical function modules in one physical device, which is not specifically limited in the embodiment of the present application.
  • the first network device may be implemented by the network device in FIG. 6.
  • FIG. 6 shows a schematic diagram of the hardware structure of a network device provided by an embodiment of the application.
  • the network device includes at least one processor 601, a communication line 602, a memory 603, and at least one communication interface 604.
  • the processor 601 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 602 may include a path to transmit information between the aforementioned components.
  • Communication interface 604 which uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 603 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (electrically programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, Optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures and can Any other medium accessed by the computer, but not limited to this.
  • the memory 603 may exist independently and is connected to the processor 601 through a communication line 602. The memory 603 may also be integrated with the processor.
  • the memory 603 is used to store computer-executed instructions for executing the solution of the present application, and the processor 601 controls the execution.
  • the processor 601 is configured to execute computer-executable instructions stored in the memory 603, so as to implement the authorization control method provided in the following embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program code, which is not specifically limited in the embodiments of the present application.
  • the processor 601 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 6.
  • the network device may include multiple processors, such as the processor 601 and the processor 607 in FIG. 6.
  • processors can be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the network device may further include an output device 605 and an input device 606.
  • the output device 605 communicates with the processor 601, and can display information in a variety of ways.
  • the output device 605 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 606 communicates with the processor 601 and can receive user input in a variety of ways.
  • the input device 606 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the aforementioned network device may be a general-purpose device or a special-purpose device.
  • the network device can be a desktop computer, a portable computer, a network server, a PDA (personal digital assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, or a device with a similar structure in Figure 6 .
  • PDA personal digital assistant
  • the embodiments of this application do not limit the type of network equipment.
  • the embodiment of the present application may divide the first network device into functional modules according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • FIG. 7 shows an authorization control device 70 provided in an embodiment of the present application.
  • the authorization control device 70 may include:
  • the obtaining module 701 is configured to obtain a first management operation request and a first identity from a second network device, where the first management operation request includes information of a first management object and a first operation on the first management object,
  • the first management object includes at least one of the following: a network instance, a network slice instance, a subnet instance, a network slice subnet instance, or a network function instance;
  • the first determining module 702 is configured to determine a first identification set in the target database according to the first management operation request acquired by the acquiring module 701.
  • the first identification set includes one or more identities.
  • the second determining module 703 is configured to determine that the first management operation request is authorized when the first identity identifier belongs to the first identifier set determined by the first determining module 702.
  • the identification set saves the identity identifier with the authority to perform the first operation on the management object, so that the authorization control device receives
  • the corresponding identification set can be determined from the target database directly according to the information of the management object in the first management operation request and the first operation, and the identity information corresponding to the second network device can be determined Whether there is the identification set directly judges whether the first management operation request of the second network device is authorized to pass, so that the authorization control device only needs to query one target database during each authorization control process, reducing the complexity of the authorization control device implementing authorization control .
  • the first determining module 702 is configured to determine the target management corresponding to the first management object in the target database according to the information of the first management object acquired by the acquiring module 701 when the first operation is a creation operation Object class
  • the target database is the information library of the network resource model.
  • the information library contains one or more management object classes.
  • Each management object class corresponds to an identification set.
  • the identification set contains one or more identity identifications.
  • the identity identifier has the authority to create a management object instance corresponding to the management object class, the target management object class is one of the one or more management object classes, and the first management object is the target management object A management object instance corresponding to a class, the first identification set is an identification set corresponding to the target management object class; the first identification set is determined according to the target management object class.
  • the authorization control device 70 further includes: a first adding module 704, configured to add the first identity after the second determining module 603 determines that the first management operation request is authorized To a second set of identifications, the second set of identifications includes one or more identifications, the identifications have the authority to perform a second operation on the first management object, and the second operation is a variety of non-creation types
  • the multiple non-creation operations include one or more of the following: modify operations, delete operations, query operations, subscription operations, or notification operations.
  • the authorization control apparatus 70 when the first identification set includes a target subset, the authorization control apparatus 70 further includes: a second adding module 705, configured to determine the first management operation in the second determining module 703 After the request is authorized, if the first identity belongs to the target subset, the first identity is added to a third identity set, and the third identity set contains one or more identities.
  • the identifiers respectively have the authority to perform the creation operation on the second management object, and the second management object is a subordinate management object of the first management object.
  • the multiple types of non-creation operations include one or more of the following: modify operations, delete operations, query operations,
  • the first determining module 702 is configured to determine the first set of identifiers in the target database according to the information of the first management object acquired by the acquiring module 701 and the first operation.
  • the target database is a management information database
  • the management information database contains one or more management object instances
  • the first management object is one of the one or more management object instances
  • all of the first identification sets are
  • the identity identifier has the authority to perform the multiple non-creation operations on the first management object.
  • the multiple types of non-creation operations include one or more of the following: modify operations, delete operations , Query operation, subscription operation or notification operation
  • the first determining module 702 is configured to determine a target combination according to the first operation acquired by the acquiring module 701, the target combination being one of multiple combinations, and the multiple non- The creation operations are divided into the multiple combinations, each of the combinations includes one or more of the multiple non-creation operations, the first management object corresponds to multiple identification sets, and each The combination corresponds to one of the identification sets
  • the target database is a management information database, the management information database contains one or more management object instances, and the first management object is one of the one or more management object instances One; determining the first set of identifiers in the management information database according to the target combination.
  • the first operation is the modification operation
  • the information of the first management object is used to indicate a fourth identification set
  • the fourth identification set is the same as that of the first management object.
  • the target attribute in one or more attributes has an association relationship
  • the fourth identifier set includes one or more identities
  • the identities have the authority to perform a second operation on the target attribute
  • the second operation For one or more of the multiple types of non-creation operations, the first management operation request is used to request modification of the fourth identifier set, so as to add a second identifier to the fourth identifier set.
  • the obtaining module 701 is further configured to obtain the second management operation request and the first identity identifier after the second determining module 703 determines that the first management operation request is authorized, and the second management operation request Includes the indication information of the first identification set and the second operation on the first identification set, and the second operation is one or more of the multiple types of non-creation operations;
  • the first determining module 702 also uses After determining the fifth identification set in the management information database according to the second management operation request acquired by the acquiring module 701, the fifth identification set contains one or more identity information, and the identity information has The first identity set has the authority to perform the second operation;
  • the second determining module 703 is further configured to determine the second identity when the first identity belongs to the fifth identity set determined by the first determining module 702 Management operation requests are authorized.
  • the authorization control apparatus 70 further includes: a sending module 706, configured to send the target information to the third network device after the second determining module 703 determines that the first management operation request is authorized, the target information It includes the first management operation request and address information, and the target information is used by the third network device to perform the first operation on the first management object, and send the result of the first operation performed by the third network device to the address information.
  • a sending module 706 configured to send the target information to the third network device after the second determining module 703 determines that the first management operation request is authorized, the target information It includes the first management operation request and address information, and the target information is used by the third network device to perform the first operation on the first management object, and send the result of the first operation performed by the third network device to the address information.
  • the address information belongs to the first network device or the second network device.
  • the acquiring module 701, the first determining module 702, the second determining module 703, the first adding module 704, and the second adding module 705 in the embodiment of the present application may be implemented by a processor or processor-related circuit components, and the sending module 706 can be implemented by a transceiver or transceiver-related circuit components.
  • the authorization control device 70 is presented in the form of dividing various functional modules in an integrated manner.
  • the "module” here can refer to application-specific integrated circuit (ASIC) circuits, processors and memories that execute one or more software or firmware programs, integrated logic circuits, and/or other functions that can provide the above functions Device.
  • ASIC application-specific integrated circuit
  • the processor 601 in FIG. 6 may invoke the computer execution instructions stored in the memory 603 to cause the first network device to execute the authorization control method in the foregoing method embodiment.
  • the function/implementation process of the acquiring module 701, the first determining module 702, the second determining module 703, the first adding module 704, and the second adding module 705 in FIG. 7 can be called by the processor 601 in FIG.
  • the computer stored in 603 executes instructions.
  • the function/implementation process of the sending module 706 in FIG. 7 can be implemented through the communication interface 604 in FIG. 6.
  • the authorization control device 70 provided in the embodiment of the present application can be used to execute the above-mentioned authorization control method, the technical effects that can be obtained can refer to the above-mentioned method embodiment, and will not be repeated here.
  • the first network device is presented in the form of dividing various functional modules in an integrated manner.
  • the embodiment of the present application may also divide the functional modules of the first network device corresponding to each function, which is not specifically limited in the embodiment of the present application.
  • an embodiment of the present application provides a chip system
  • the chip system includes a processor, and is configured to support a first network device to implement the foregoing authorization control method.
  • the chip system also includes memory.
  • the memory is used to store the necessary program instructions and data of the first network device.
  • the chip system may be composed of chips, or may include chips and other discrete devices, which are not specifically limited in the embodiment of the present application.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the program can be stored in a computer-readable storage medium, and the storage medium can include: ROM, RAM, magnetic disk or CD, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种授权控制的方法，包括：第一网络设备从第二网络设备获取第一管理操作请求和第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的第一操作；根据第一管理操作请求确定目标数据库中的第一标识集合，第一标识集合包括一个或多个具有对第一管理对象进行第一操作的权限的身份标识；若第一身份标识属于第一标识集合，则确定第一管理操作请求通过授权。本申请技术方案由于在第一网络设备侧为管理对象和管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。

Description

一种授权控制的方法、装置以及存储介质
本申请要求于2019年6月17日提交中国专利局、申请号为201910523086.9、发明名称为“一种授权控制的方法、装置以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，具体涉及一种授权控制的方法、装置以及存储介质。
背景技术
随着多种多样的通信业务的不断涌现，不同的通信业务对网络性能的需求存在显著的区别，第五代移动通信(the 5 th-generation，5G)系统引入了网络切片(network slice，NS)的概念，以应对不同通信业务对网络性能的需求的差异。网络切片是指在物理或者虚拟的网络基础设置上，由一组网络功能(network function，NF)组成的具有特定的网络特性的实例化的完整的逻辑网络。当一个网络切片比较复杂时，为了便于管理，网络切片还可以分解为网络子切片(network slice subnet，NSS)，网络子切片是指一组网络功能及支持所述网络功能的网络资源组成的具有特定的网络特性的一个逻辑网络。网络切片以网络切片即服务(network slice as a service,NSaaS)的方式提供给客户，即运营商通过创建一个网络切片实例(network slice instance，NSI)向客户提供服务。一个网络切片实例可以包括0个、1个或多个网络切片子网实例(network slice subnet instance，NSSI)或若干个网络功能实例。
现有技术中对于网络资源的管理通过管理服务(management service，MnS)实现。一个具体的管理服务中包括各种类型的管理对象实例，如网络切片、网络切片子网、网络功能等各种管理对象类(managed object class,MOC)对应的管理对象实例(managed object instance,MOI)，每个管理对象实例又对应于不同的管理操作，如创建、修改、删除、查询、订阅、通知等管理动作，管理服务中还可能涉及到每个管理对象实例对应的管理数据，如关键性能指标(key performance indicator，KPI)或故障告警信息等内容。管理功能(management function，MnF)分为提供者和消费者两种，管理服务提供者的MnF是可以直接实现管理对象实例的创建、修改、删除以及管理数据(KPI或警告信息)的订阅、获取和查询等操作的，而作为管理服务消费者的MnF以及垂直行业客户则需要通过调用作为管理服务提供者的MnF所提供的网络服务，实现管理对象实例的创建、修改和删除，以及相应的管理数据(KPI或警告信息)的订阅、获取和查询等操作。由于网络切片是相对隔离的逻辑网络，因此，管理服务提供者的MnF常常需要根据业务需求向客户(如管理服务消费者的MnF或者垂直行业客户等)开放一部分管理操作权限。例如，允许客户获得管理对象实例的某些KPI数据，或者允许客户进行一些管理操作，例如，创建一个网络切片实例、网络切片子网实例或网络功能实例，修改网络切片子网实例内某些网络功能实例的配置等。为了实现对客户的管理操作权限的开放，3GPP TS 28.533定义了开放控制管理功能(exposure governance management function，EGMF)作为管理开放的控制功能，EGMF 检测客户请求的管理操作是否在被允许的范围内，若请求中的管理操作被允许，则作为代理调用管理服务，提供管理操作结果给客户。作为管理服务消费者的MnF以及垂直行业客户均需要通过调用作为管理服务提供者的MnF所提供的网络服务，从而实现管理对象实例的创建、修改和删除，以及管理数据(KPI或警告信息)的订阅、获取和查询等操作。
现有技术中，EGMF通过为每个客户设置一套访问控制列表(access control list，ACL)规则来实现管理开放的权限控制。具体的，EGMF为每个客户设置一个对应的ACL规则，每个客户的ACL规则中包括了该客户对应的具体的管理对象实例、管理对象实例的属性、以及被允许或者被禁止等管理操作的组合。客户发送管理操作请求之后，EGMF首先需要根据客户的身份标识确定对应的ACL规则，然后再查询网络资源模型(network resource modeling，NRM)的信息库或管理信息数据库(management information base，MIB)中的管理对象实例的相关信息以及相应的属性，然后再根据客户发送的管理操作请求中的管理操作，管理对象实例以及属性来匹配ACL规则，最终确定管理操作请求是否应该被允许或者拒绝，允许则代表授权通过，拒绝则代表牌授权不通过。如果授权通过EGMF就代理调用管理服务并返回调用结果，如果拒绝就向客户返回管理操作失败。
上述EGMF在实现管理开放权限控制的授权过程中，EGMF在查询客户对应的ACL规则之后，还需要查询NRM或MIB中的管理对象实例及相应的属性的相关信息，即EGMF每一次控制授权的过程中都需要查询ACL规则和NRM或MIB至少两套数据库，最后再结合客户的管理操作请求判断是否授权，实现过程较为复杂。
发明内容
本申请实施例提供一种授权控制的方法，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。
本申请实施例第一方面提供一种数据处理方法，包括：第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的第一操作，第一管理对象是一个管理对象实例，管理对象实例是指可以被管理的网络资源的实例，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例，第一管理对象的信息用于指示第一管理对象或第一管理对象的某一个或多个属性，也可以用于指示与第一管理对象或各个属性相关联的一些信息等多种管理信息，第一操作是指创建、修改、删除、查询、订阅或通知等多种管理操作中的一种，第一身份标识是指一种租户标识，可以是指管理服务提供者在提供管理服务，实现管理开放的控制功能时，所设置的用于区分管理服务消费者，如第三方垂直行业客户或者其他的运营商客户的一种标识信息，租户标识的具体形式可以是以数字形式或者字符串形式呈现，也可以是其他形式的标识信息，第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识的过程中，第一管理操作请求和第一身份标识可以是同时获取的，也可以是分开获取的，可以先获取第一管理操作请求，再获取第一身份标识，也可以先获取第一身份标，再获取第一管理操作请求；第一网络设备根据第一管理操作请求，确定目标数据库中的第一标识集合，第一标识集合包括一个或多个身份标识， 每个身份标识具有对第一管理对象进行第一操作的权限，目标数据库中可以针对所有不同的管理信息和不同的管理操作的组合存储一个相应的标识集合，也可以只针对部分不同的管理信息和不同的管理操作的组合存储一个相应的标识集合，标识集合可以以客户列表的形式存储在目标数据库中，第一管理对象的信息和第一操作对应的标识集合为第一标识集合；若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权，由于第一标识集合包含的一个或多个身份标识中的每个身份标识都具有对第一管理对象进行第一操作的权限，因此，若第一网络设备判断第一身份标识属于第一标识集合，便可以确定第一身份标识具备对第一管理对象进行第一操作的权限，即可以确定第一管理操作请求通过授权。
由以上第一方面可知，通过在第一网络设备侧的目标数据库中为管理对象以及管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中管理对象的信息和第一操作从目标数据库中确定对应的标识集合，通过判断第二网络设备对应的身份标识是否存在该标识集合直接判断第二网络设备的第一管理操作请求是否授权通过，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。
结合本申请实施例的第一方面，在本申请实施例的第一方面的第一种实现方式中，当第一操作为创建操作时，第一网络设备根据第一管理操作请求，确定目标数据库中的第一标识集合，包括：第一网络设备根据第一管理对象的信息确定目标数据库中第一管理对象对应的目标管理对象类，目标数据库为网络资源模型的信息库，网络资源模型的信息库中包含一个或多个管理对象类，管理对象类是一种类型的管理对象实例的一个抽象的类别概括，一个具体的管理对象实例可以是一个网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例等，对应的管理对象类可以包括网络对象类、网络切片管理对象类、子网管理对象类、网络切片子网管理对象类或网络功能管理对象类等多种管理对象类，每个管理对象类对应一个标识集合，该标识集合中包含一个或多个身份标识，其中的每个身份标识具有创建管理对象类对应的管理对象实例的权限，目标管理对象类为一个或多个管理对象类中的一个，第一管理对象为目标管理对象类对应的管理对象实例，第一标识集合为目标管理对象类对应的标识集合；第一网络设备根据目标管理对象类确定第一标识集合，例如，若第一管理对象为一个网络切片实例，则第一网络设备会根据第一管理操作请求中第一管理对象的信息首先确定网络资源模型的信息库中第一管理对象对应的目标管理对象类为网络切片管理对象类，该网络切片管理对象类所对应的标识集合即为第一标识集合。
由以上第一方面的第一种实现方式可知，通过在第一网络设备侧的网络资源模型的信息库中为不同的管理对象类分别设置对应的标识集合，标识集合中保存有对管理对象类对应的管理对象实例具有创建操作权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和创建操作从网络资源模型的信息库中确定第一管理对象的目标管理对象类，然后确定该目 标管理对象类对应的第一标识集合，通过判断第二网络设备发送的第一身份标识是否存在该第一标识集合直接判断第二网络设备的第一管理操作请求是否授权通过，使得第一网络设备在每次创建操作的授权控制过程中只需要查询网络资源模型的信息库，降低第一网络设备实现授权控制的复杂度。
结合本申请实施例的第一方面或第一方面的第一种实现方式，本申请实施例的第一方面的第二种实现方式中，若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权之后，还包括：第一网络设备将第一身份标识添加至第二标识集合，第二标识集合是第一管理对象对应的标识集合，第二标识集合包含一个或多个身份标识，其中的每个身份标识具有对第一管理对象进行第二操作的权限，第二操作为多种非创建类操作中的一个或多个，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
由以上第一方面的第二种实现方式可知，可以直接通过将第一身份标识添加至第二标识集合的方式，使得对第一管理对象具备创建操作权限的第一身份标识，在第一管理对象被创建之后能够直接具备对第一管理对象进行非创建类操作的权限，从而提升目标数据库中对管理对象的管理权限的维护的准确性和多样性，也可以在一定程度上降低目标数据库中管理权限的维护和控制的复杂度，保证数据的准确性。
结合本申请实施例的第一方面的第一种或第二种实现方式，本申请实施例的第一方面的第三种实现方式中，第一标识集合包括目标子集合，该目标子集合是第一标识集合的子集，若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权之后，还包括：若第一身份标识属于目标子集合，则第一网络设备将第一身份标识添加至第三标识集合，第三标识集合包含一个或多个身份标识，该一个或多个身份标识中每个身份标识都分别具有对第二管理对象进行创建操作的权限，第二管理对象是第一管理对象的下级管理对象，下级管理对象是指成分管理对象，一个管理对象实例的成分管理对象是组成该管理对象实例的下级管理对象实例，即第二管理对象是组成第一管理对象的下级管理对象实例。
由以上第一方面的第三种实现方式可知，可以通过设置目标子集合的方式，使得对第一管理对象具备创建操作权限的第一身份标识，也可以具备创建该第一管理对象的下级管理对象的权限，从而提升目标数据库中对管理对象的管理权限的维护的准确性和多样性，也可以在一定程度上降低目标数据库中管理权限的维护和控制的复杂度，保证数据的准确性。
结合本申请实施例的第一方面，在本申请实施例的第一方面的第四种实现方式中，当第一操作为多种非创建类操作中的一种，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一网络设备根据第一管理操作请求，确定目标数据库中的第一标识集合，包括：第一网络设备根据第一管理对象的信息和第一操作确定目标数据库中的第一标识集合，目标数据库为管理信息数据库，管理信息数据库是网络资源模型的一个实例，管理信息数据库包含一个或多个已经被创建的管理对象实例，第一管理对象为一个或多个管理对象实例中的一个，第一标识集合中的所述身份标 识具有对第一管理对象进行多种非创建类操作的权限，对于管理信息数据库中的每个管理对象实例，所有的非创建操作作为一个整体均可以对应存在一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识具有对管理对象实例进行所有非创建类操作的权限，第一管理对象对应的标识集合为第一标识集合，该第一标识集合中包含的每个身份标识，都具有对第一管理对象进行所有非创建类操作的权限。
由上述第一方面的第四种实现方式可知，通过在第一网络设备侧的管理信息数据库中为不同的管理对象实例分别设置对应的标识集合，标识集合中保存有对管理对象类对应的管理对象实例具有非创建类操作权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和第一操作从管理信息数据库中确定对应的第一标识集合，通过判断第一身份标识是否存在该第一标识集合直接判断第一管理操作请求是否授权通过，使得第一网络设备在每次非创建类操作的授权控制过程中只需要查询管理资源数据库，降低第一网络设备实现授权控制的复杂度。
结合本申请实施例的第一方面，在本申请实施例的第一方面的第五种实现方式中，当第一操作为多种非创建类操作中的一种，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一网络设备根据第一管理操作请求，确定目标数据库中的第一标识集合，包括：第一网络设备根据第一操作确定目标组合，目标组合为多个组合中的一个，多种非创建类操作被划分为多个组合，每个组合中包括多种非创建类操作中的一种或多种，第一管理对象对应多个标识集合，每个组合对应一个与第一管理对象对应的标识集合，标识集合中包含一个或多个身份标识，标识集合中的每个身份标识具备对第一管理对象进行对应的组合中所包含的非创建类操作的权限，第一操作所属于的组合为目标组合，目标数据库为管理信息数据库，管理信息数据库包含一个或多个管理对象实例，第一管理对象为一个或多个管理对象实例中的一个；第一网络设备根据目标组合确定管理信息数据库中的第一标识集合。
由以上第一方面的第五种实现方式可知，所有的非创建类操作被作为一个整体，对应存在一个标识集合之外，所有的非创建类操作也可以是被划分为多个组合，每个组合对应存在一个标识集合，第一网络设备可以直接根据第一管理对象的信息和第一操作属于的目标组合从管理信息数据库中确定对应的第一标识集合，提升方案实现的多样性。
结合本申请实施例的第一方面的第四种或第五种实现方式，本申请实施例的第一方面的第六种实现方式中，第一操作为修改操作，第一管理对象的信息用于指示第四标识集合，第四标识集合与第一管理对象的一个或多个属性中的目标属性存在关联关系，第四标识集合中包含一个或多个身份标识，身份标识具有对目标属性进行第二操作的权限，第二操作为多种非创建类操作中的一种或多种，第一管理操作请求用于请求对第四标识集合进行修改，以将第二身份标识添加至第四标识集合。
由以上第一方面的第六种实现方式可知，第一管理对象具备一个或多个属性，对于第一管理对象所具备的一个或多个属性中的部分或者全部，其中的每个属性都可以关联一个标识集合，对于第一管理对象的某个属性具备修改操作权限的第一身份标识，可以通过将 第二身份标识添加至该属性关联的标识集合，即对于管理对象的某个属性具备修改操作权限的客户，可以通过将其他客户的身份标识添加至相应的标识集合的方式，将管理权限授权给该其他客户，可以在一定程度上降低目标数据库中管理权限的维护的复杂度，并保证数据的准确性。
结合本申请实施例的第一方面的第四种实现方式，本申请实施例的第一方面的第七种实现方式中，若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权之后，还包括：第一网络设备获取第二管理操作请求和第一身份标识，第二管理操作请求中包括第一标识集合的指示信息和对第一标识集合的第二操作，第二操作为多种非创建类操作中的一种或多种，第二管理操作请求和第一身份标识可以是第二网络设备发送的，也可以是其他的网络设备发送的，第一标识集合的指示信息用于指示该第一标识集合，第二管理操作请求用于请求对第一标识集合执行第二操作，例如修改操作、删除操作、订阅操作或查询操作等；第一网络设备根据第二管理操作请求确定管理信息数据库中的第五标识集合，管理信息数据库中的第一标识集合与第五标识集合关联，第五标识集合中包含一个或多个身份标识，身份标识具有对第一标识集合进行第二操作的权限，第一标识集合也可以是第一管理对象的一个或多个属性中的一个属性，该属性与第五标识集合关联；若第一身份标识属于第五标识集合，则第一网络设备确定第二管理操作请求通过授权，第一网络设备在根据第二管理操作请求确定第五标识集合之后，会判断第一身份标识是否属于第五标识集合，由于第五标识集合包含的一个或多个身份标识中的每个身份标识都具有对第一管理对象进行第一操作的权限，因此，若第一网络设备判断第一身份标识属于第五标识集合时，便可以确定第一身份标识具备对第一标识集合进行第一操作的权限。
结合本申请实施例的第一方面、第一方面的第一种至第七种中任意一种实现方式，本申请实施例的第一方面的第八种实现方式中，若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权之后，还包括：第一网络设备将目标信息发送给第三网络设备，目标信息中包括第一管理操作请求和地址信息，目标信息用于第三网络设备对第一管理对象执行第一操作，并将第三网络设备执行第一操作的结果发送至地址信息，目标信息除了包含第一管理操作请求和地址信息之外，还可以包含其他的信息。
结合本申请实施例的第一方面的第八种实现方式，本申请实施例的第一方面的第九种实现方式中，地址信息属于第一网络设备或第二网络设备。
由以上第一方面的第九种实现方式可知，地址信息可以是第一网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的第一操作之后，会将执行结果发送给第一网络设备所对应的地址信息，该执行结果再由第一网络设备转发给第二网络设备，以使第二网络设备可以获取到第一管理操作请求的执行结果，地址信息也可以是第二网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的第一操作之后，会将执行结果直接发送给第二网络设备所对应的地址信息，以使其直接获取到第一管理操作请求的执行结果，从而可以提升方案实现的多样性。
本申请实施例第二方面提供一种授权控制的装置，包括：获取模块，用于从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信 息和对第一管理对象的第一操作，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例；第一确定模块，用于根据获取模块获取的第一管理操作请求，确定目标数据库中的第一标识集合，第一标识集合包括一个或多个身份标识，该身份标识具有对第一管理对象进行第一操作的权限；第二确定模块，用于在第一身份标识属于第一确定模块确定的第一标识集合时，确定第一管理操作请求通过授权。
结合本申请实施例的第二方面，在本申请实施例的第二方面的第一种实现方式中，第一确定模块，用于在第一操作为创建操作时，根据获取模块获取的第一管理对象的信息确定目标数据库中第一管理对象对应的目标管理对象类，目标数据库为网络资源模型的信息库，该信息库包含一个或多个管理对象类，每个管理对象类对应一个标识集合，标识集合中包含一个或多个身份标识，身份标识具有创建管理对象类对应的管理对象实例的权限，目标管理对象类为一个或多个管理对象类中的一个，第一管理对象为目标管理对象类对应的管理对象实例，第一标识集合为目标管理对象类对应的标识集合；根据目标管理对象类确定所述第一标识集合。
结合本申请实施例的第二方面或第二方面的第一种实现方式，本申请实施例的第二方面的第二种实现方式中，该装置还包括：第一添加模块，用于在第二确定模块确定第一管理操作请求通过授权之后，将第一身份标识添加至第二标识集合，第二标识集合包含一个或多个身份标识，该身份标识具有对第一管理对象进行第二操作的权限，第二操作为多种非创建类操作中的一个或多个，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
结合本申请实施例的第二方面的第一种或第二种实现方式，本申请实施例的第二方面的第三种实现方式中，第一标识集合包括目标子集合，该装置还包括：第二添加模块，用于在第二确定模块确定第一管理操作请求通过授权之后，若第一身份标识属于目标子集合，将第一身份标识添加至第三标识集合，第三标识集合包含一个或多个身份标识，该身份标识都分别具有对第二管理对象进行创建操作的权限，第二管理对象是第一管理对象的下级管理对象。
结合本申请实施例的第二方面，在本申请实施例的第二方面的第四种实现方式中，当第一操作为多种非创建类操作中的一种，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一确定模块，用于根据获取模块获取的第一管理对象的信息和第一操作确定目标数据库中的第一标识集合，目标数据库为管理信息数据库，管理信息数据库包含一个或多个管理对象实例，第一管理对象为一个或多个管理对象实例中的一个，第一标识集合中的身份标识具有对第一管理对象进行多种非创建类操作的权限。
结合本申请实施例的第二方面，在本申请实施例的第二方面的第五种实现方式中，当第一操作为多种非创建类操作中的一种，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一确定模块，用于根据获取模块获取的第一操作确定目标组合，目标组合为多个组合中的一个，多种非创建类操作被划分 为多个组合，每个组合中包括多种非创建类操作中的一种或多种，第一管理对象对应多个标识集合，每个组合对应一个标识集合，目标数据库为管理信息数据库，管理信息数据库包含一个或多个管理对象实例，第一管理对象为一个或多个管理对象实例中的一个；根据目标组合确定管理信息数据库中的第一标识集合。
结合本申请实施例的第二方面的第四种或第五种实现方式，本申请实施例的第二方面的第六种实现方式中，第一操作为修改操作，第一管理对象的信息用于指示第四标识集合，第四标识集合与第一管理对象的一个或多个属性中的目标属性存在关联关系，第四标识集合中包含一个或多个身份标识，身份标识具有对目标属性进行第二操作的权限，第二操作为多种非创建类操作中的一种或多种，第一管理操作请求用于请求对第四标识集合进行修改，以将第二身份标识添加至第四标识集合。
结合本申请实施例的第一方面的第四种实现方式，本申请实施例的第一方面的第七种实现方式中，获取模块，还用于第二确定模块确定第一管理操作请求通过授权之后，获取第二管理操作请求和第一身份标识，第二管理操作请求中包括第一标识集合的指示信息和对第一标识集合的第二操作，第二操作为多种非创建类操作中的一种或多种；第一确定模块，还用于根据获取模块获取的第二管理操作请求确定管理信息数据库中的第五标识集合，第五标识集合中包含一个或多个身份信息，该身份信息具有对第一标识集合进行第二操作的权限；第二确定模块，还用于在第一身份标识属于第一确定模块确定的第五标识集合时，确定第二管理操作请求通过授权。
结合本申请实施例的第一方面、第一方面的第一种至第七种中任意一种实现方式，本申请实施例的第一方面的第八种实现方式中，该装置还包括：发送模块，用于在第二确定模块确定第一管理操作请求通过授权之后，将目标信息发送给第三网络设备，目标信息中包括第一管理操作请求和地址信息，目标信息用于第三网络设备对第一管理对象执行第一操作，并将第三网络设备执行第一操作的结果发送至地址信息。
结合本申请实施例的第二方面的第八种实现方式，本申请实施例的第二方面的第九种实现方式中，地址信息属于第一网络设备或第二网络设备。
本申请第三方面提供一种计算机设备，该计算机设备包括处理器和存储有计算机程序的计算机可读存储介质；处理器与计算机可读存储介质耦合，计算机程序被处理器执行时实现第一方面及第一方面的任一可能的实现方式中提供的授权控制的方法。
本申请第四方面提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述第一方面或第一方面任意一种可能实现方式的授权控制的方法。
本申请第五方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面或第一方面任意一种可能实现方式的授权控制的方法。
本发明实施例采用一种授权控制的方法，通过在第一网络设备侧为管理对象以及管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和第一操作从目标数据库中确定对应的第 一标识集合，通过判断第一身份标识是否存在该第一标识集合直接判断第二网络设备发送的第一管理操作请求是否授权通过，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。
附图说明
图1(a)为本申请实施例提供的一种网络资源模型的示意图；
图1(b)为本申请实施例提供的一种管理信息数据库的示意图；
图2是本申请实施例提供的授权控制的方法的一个实施例示意图；
图3是本申请实施例提供的授权控制的方法的另一个实施例示意图；
图4是本申请实施例提供的授权控制的方法的另一个实施例示意图；
图5是本申请实施例提供的授权控制的方法的另一个实施例示意图；
图6是本申请实施例提供的网络设备的硬件结构示意图；
图7是本申请实施例提供一种授权控制装置的结构示意图。
具体实施方式
下面结合附图，对本发明的实施例进行描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着网络架构的改变和新应用场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
本发明实施例提供一种授权控制的方法，通过在第一网络设备侧为管理对象以及管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和第一操作从目标数据库中确定对应的第一标识集合，通过判断第一身份标识是否存在该第一标识集合直接判断第二网络设备发送的第一管理操作请求是否授权通过，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。本发明实施例还提供相应的授权控制的装置以及存储介质。以下分别进行详细说明。
为了支持5G网络的管理和编排，更好的实现管理服务对网络资源的管理，现有技术中基于面向管理对象实例的分析与设计技术，将网络的配置数据以信息对象类(information object class，IOC)的形式进行标准化建模，标准化后的配置数据成为5G网络的可管理方面的网络资源模型(network resource modeling，NRM)。网络资源模型是对网络资源的高度概括和抽象，包括各个管理对象类、管理对象类属性以及管理对象类之间的关联关系，网络资源模型以统一的方式对网络资源进行抽象描述，其目的是能够提供对通信网络的完整，准确的描述，支撑对网络资源的快速生成和扩展，实现网络资源的动态维护管理。网络资源模型中管理对象类的描述形式为对象类信息IOC(Information Object Class)，一系列IOC组合构成了网络资源模型。为了方便理解，本申请实施例提供一种网络资源模型的示意图，请参阅图1(a)。图1(a)中示出的网络资源模型包括网络切片管理对象类、网络切片子网管理对象类以及网络功能管理对象类的对象类信息以及每个对象类分别对应的切片描述属性，且示出了每个对象类之间的关联关系，即网络切片是由一个或多个网络切片子网组成的，每个网络切片子网又由一个或多个网络功能组成。管理信息数据库 (management information base，MIB)作为网络资源模型的一个实例，其中存储了一系列的具体的管理对象实例、管理对象实例的属性值和各个管理对象实例之间相互关联关系。需要说明的是，管理对象实例有时也可以直接被称为管理对象。图1(b)为基于图1(a)中的网络资源模型创建得到的管理信息数据库的一个示意图，参阅图1(b)可以看出，该管理信息数据库中包含了基于图1(a)中的网络资源模型创建的各个管理对象类对应的管理对象实例以及不同的管理对象实例之间的关联关系，如网络切片实例NSI 1中包含网络切片子网实例NSSI 1-1，而网络切片子网实例NSSI 1-1则包含了网络功能实例NF 1和NF 2两个部分。需要说明的是，图1(a)和图1(b)仅为本申请实施例中网络资源模型以及对应的管理信息数据库的一个简单示例，在应用过程中，网络资源模型和管理信息数据库可以具备多种不同的构建方式，上述示例不应理解对本申请的限制。本申请实施例中，管理服务基于网络资源模型和管理信息数据库实现对网络资源的管理。
现有技术中，通过开放控制管理功能EGMF实现对客户的管理操作权限的开放的过程中，每一次的授权过程都需要查询客户对应的ACL规则以及网络资源模型的信息库或管理信息数据库两套数据库，实现过程较为复杂，因此本申请实施例提供一种授权控制的方法，能够解决上述问题，使得开放控制管理功能EGMF在每次授权控制的过程中只需要查询一个目标数据库，降低其实现授权控制的复杂度，请参阅图2，本申请实施例提供的授权控制的方法的一个实施例示意图。
图2为本申请实施例提供的授权控制的方法的一个实施例示意图。
参阅图2，本申请实施例提供的授权控制的方法的一个实施例，可以包括：
201、第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的第一操作，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例。
本申请实施例中，第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识。
本申请实施例中，第一管理对象是一个管理对象实例，管理对象实例是指可以被管理的网络资源的实例，一个具体的管理对象实例可以是一个网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例等，除此之外，第一管理对象也可以是其他类型的管理对象实例，本申请实施例对此不做限定。每个管理对象实例都具备一个或多个属性，本申请实施例中管理对象实例中可以修改的某些网络配置项、所包含的下一级的管理对象实例的列表等都可以是管理对象实例所具备的属性。
本申请实施例中，第一管理对象的信息用于指示第一管理对象或第一管理对象的某一个或多个属性，也可以用于指示与第一管理对象或各个属性相关联的一些信息，本申请实施例中，第一管理对象的信息所指示的信息，即为第二网络设备请求需要进行管理的信息。例如，第一管理对象的信息为第一管理对象的标识，该标识用于指示第一管理对象，则第二网络设备发送的第一管理操作请求便用于请求对第一管理对象进行管理操作，或者第一管理对象的信息为一个指示信息，该指示信息用于第一管理对象的某一个或多个属性，则 第二网络设备发送的第一管理操作请求便用于请求对该一个或多个属性进行管理操作；又或者该指示信息指示与第一管理对象相关联的某个信息，则第二网络设备发送的第一管理操作请求便用于请求对该与第一管理对象相关联的某个信息进行管理操作。
本申请实施例中，第一操作是指创建、修改、删除、查询、订阅或通知等多种管理操作中的一种。需要说明的是，本申请实施例中的管理操作的类型除了包含上述例举的几种类型，还可以包含其他类型的管理操作，本申请对此不做限定。
本申请实施例中，第一管理操作请求中包括第一管理对象的信息和对第一管理对象的第一操作，第一管理操作请求用于请求根据第一管理对象的信息对第一管理对象进行第一操作。以第一管理对象为网络切片实例A来举例：第一管理对象的信息为该网络切片实例A的标识信息，该标识信息用于指示该网络切片实例A，且第一操作请求为创建操作，则第一管理操作请求用于请求创建该网络切片实例A；第一管理对象的信息用于指示该网络切片实例A的一个目标属性，第一操作为修改或删除操作，则第一管理操作请求便用于请求修改或删除该网络切片实例A的目标属性；第一管理对象的信息用于指示网络切片实例A、网络切片实例A的某一个或多个属性，或者与网络切片实例A相关联的其他信息，第一操作为查询或订阅等管理操作，则第一管理操作请求用于请求查询或订阅网络切片实例A、网络切片实例A的某一个或多个属性，或者与网络切片实例A相关联的其他信息的管理数据，如KPI或警告信息等信息。需要说明的是，上述以网络切片实例A为例对第一管理操作请求的介绍是一种示意性的介绍，不应理解对本申请的限制。本申请实施例中，第一管理操作请求中除了包括第一管理对象的信息和对第一管理对象的第一操作，还可以包含其他的信息，本申请对此不做限定。
本申请实施例中，第一身份标识可以是指一种租户标识，具体的可以是指管理服务提供者在提供管理服务，实现管理开放的控制功能时，所设置的用于区分管理服务消费者(如第三方垂直行业客户或者其他的运营商客户)的一种标识信息。租户标识的具体形式可以是以数字形式或者字符串形式呈现，也可以是其他形式的标识信息(如加密技术处理的身份令牌等)，本申请对此不做限定。
需要说明的是，本申请实施例中，第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识的过程中，第一管理操作请求和第一身份标识可以是同时获取的，也可以是分开获取的，本申请实施例对此不做限定。除此之外，若第一网络设备是分开获取的第一管理操作请求和第一身份标识信息，则对于获取第一管理操作请求和第一身份标识的先后顺序，本申请实施例也不做具体的限定。
202、第一网络设备根据第一管理操作请求，确定目标数据库中的第一标识集合，第一标识集合包括一个或多个身份标识，第一标识集合中的身份标识具有对第一管理对象进行第一操作的权限。
本申请实施例中，在目标数据库中存储有与第一管理对象的信息和第一操作对应的第一标识集合，第一标识集合包含一个或多个身份标识，每个身份标识都具有对第一管理对象进行第一操作的权限。其中，目标数据库可以为网络资源模型的信息库或者管理信息数据库，目标信息库可以保存在第一网络设备中，也可以保存在其它设备中，还可以是网络 管理系统中多个设备共同保存的分布式数据库，本发明对目标数据库的部署和实现方式不做具体限定。具体的，第一管理对象的信息可以用于指示第一管理对象、第一管理对象的某一个或多个属性、或者与第一管理对象或各个属性相关联的一些信息等管理信息，第一操作指创建、修改、删除、查询、订阅或通知等多种管理操作中的一种，针对于不同的管理信息和不同的管理操作的组合，每个组合都可以分别对应存在一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识都具有该组合对应的权限。例如：第一管理对象和创建操作的组合对应的标识集合中包含的一个或多个身份标识，每个身份标识都具有对第一管理对象进行创建的管理权限；第一管理对象的目标属性和删除操作的组合对应的标识集合中包含的一个或多个身份标识，每个身份标识都具有对第一管理对象的目标属性进行删除的管理权限。目标数据库中可以针对所有不同的管理信息和不同的管理操作的组合存储一个相应的标识集合，也可以只针对部分不同的管理信息和不同的管理操作的组合存储一个相应的标识集合，对此本申请实施例不做限定。本申请实施例中，标识集合可以以客户列表的形式存储在目标数据库中，每个客户列表中保存有不同的客户对应的身份标识，除此之外，标识集合也可以以其他的形式进行存储，本申请实施例对此不做限定。
本申请实施例中，目标数据库中存储有针对第一管理对象的信息和第一操作对应的第一标识集合，第一标识集合即为上述组合中的一个组合对应的标识集合。第一网络设备在获取第一管理操作请求以及第一身份标识之后，会根据第一管理操作请求中的第一管理对象的信息和第一操作，从目标数据库中确定对应的第一标识集合。
203、若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权。
本申请实施例中，第一网络设备在根据第二网络设备发送的第一管理操作请求确定第一标识集合之后，会判断第二网络设备发送的第一身份标识是否属于第一标识集合，由于第一标识集合包含的一个或多个身份标识中的每个身份标识都具有对第一管理对象进行第一操作的权限，因此，若第一网络设备判断第一身份标识属于第一标识集合时，便可以确定第一身份标识具备对第一管理对象进行第一操作的权限，则第一网络设备便可以确定第二网络设备发送的该第一管理操作请求通过授权。
本申请实施例采用一种授权控制的方法，通过在第一网络设备侧的目标数据库中为管理对象以及管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中管理对象的信息和第一操作从目标数据库中确定对应的标识集合，通过判断第二网络设备对应的身份标识是否存在该标识集合直接判断第二网络设备的第一管理操作请求是否授权通过，使得第一网络设备在每次授权控制的过程中只需要查询一个目标数据库，降低第一网络设备实现授权控制的复杂度。
本申请实施例中的多种管理操作可以分为创建操作和非创建类操作，非创建类操作即为上述除创建操作之外的其他管理操作，即非创建类操作包含修改操作、删除操作、查询操作、订阅操作或通知操作等一种或多种非创建类的管理操作。因此，基于上述的实施例，本申请将分别从第一操作为创建操作和非创建类操作这两大类管理操作对本申请实施例中 授权控制的方法进行详细的介绍，请分别参阅下述的图2-图4实施例的介绍。
(一)第一操作为创建操作，目标数据库为网络资源模型的信息库。
首先将从第一操作为创建操作对本申请实施例提供的授权控制的方法进行介绍，当第一操作为创建操作时，上述实施例中的目标数据库为网络资源模型的信息库，图3为本申请实施例提供的授权控制的方法的另一个实施例示意图，图3实施例将对第一操作为创建操作，目标数据库为网络资源模型的信息库进行详细的介绍。
参阅图3，本申请实施例提供的授权控制的方法的另一个实施例，可以包括：
301、第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的创建操作，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例。
本申请实施例与图2实施例的区别在于第一操作为创建操作，其他相关内容可以参阅图2中的步骤201进行理解，此处不再赘述。
302、第一网络设备根据第一管理对象的信息确定目标数据库中第一管理对象对应的目标管理对象类，目标数据库为网络资源模型的信息库。
本申请实施例中，由于第一管理操作请求包括的是对第一管理对象的创建操作，第一管理对象是还未被创建的管理对象实例，因此，目标数据库为网络资源模型的信息库。
本申请实施例中，网络资源模型的信息库中包含一个或多个管理对象类，一个具体的管理对象实例可以是一个网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例等，因此网络资源模型的信息库中所包含的一个或多个管理对象类可以分别对应于上述各种管理对象实例所对应的类型。例如，管理对象类为网络切片管理对象类，则网络切片管理对象类即为各个不同的网络切片实例的一个抽象的类别概括，网络切片实例A、网络切片实例B、网络切片实例C等都属于该网络切片管理对象类。本申请实施例中网络资源模型的信息库中可以包含网络对象类、网络切片管理对象类、子网管理对象类、网络切片子网管理对象类或网络功能管理对象类等多种管理对象类。需要说明的是，本申请实施例中网络资源模型的信息库中除了可以包含上述多种类型的管理对象类，还可以包含其他类别的管理对象类，本申请实施例对此不做限定。
本申请实施例中，网络资源模型的信息库中包含一个或多个管理对象类，每个管理对象类对应一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识具有创建该管理对象类对应的管理对象实例的权限。例如：网络切片管理对象类对应存在一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识具有创建网络切片实例的权限；网络切片子网管理对象类对应存在一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识具有创建网络切片子网实例的权限。
本申请实施例中，目标管理对象类为网络资源模型的信息库中包含的一个或多个管理对象类中的一个，第一管理对象为目标管理对象类对应的管理对象实例。第一网络设备在接收到第二网络设备发送的第一管理操作请求以及第一身份标识之后，第一网络设备会根据第一管理操作请求中第一管理对象的信息首先确定网络资源模型的信息库中第一管理对 象对应的目标管理对象类。例如，若第一管理对象为一个网络切片实例，则第一网络设备会根据第一管理操作请求中第一管理对象的信息首先确定网络资源模型的信息库中第一管理对象对应的目标管理对象类为网络切片管理对象类；若第一管理对象为一个网络功能实例，则第一网络设备会根据第一管理操作请求中第一管理对象的信息首先确定网络资源模型的信息库中第一管理对象对应的目标管理对象类为网络功能管理对象类。
303、第一网络设备根据目标管理对象类确定第一标识集合。
本申请实施例中，网络资源模型的信息库中每个管理对象类都对应一个标识集合，第一标识集合为目标管理对象类对应的标识集合，第一网络设备在确定第一管理对象对应的目标管理对象类之后，可以根据该目标管理对象类确定第一标识集合，第一标识集合中包含一个或多个身份标识，每个身份标识具有创建目标管理对象类对应的管理对象实例的权限。
304、若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权。
本申请实施例的相关内容可以参阅图2中的步骤203进行理解，此处不再赘述。
305、第一网络设备将目标信息发送给第三网络设备，该目标信息中包括第一管理操作请求和地址信息，该目标信息用于第三网络设备对第一管理对象执行创建操作，并将第三网络设备执行创建操作的结果发送至该地址信息。
本申请实施例中，在第一网络设备确定第一管理操作请求通过授权之后，第一网络设备会将目标信息发送给第三网络设备，该目标信息中包含第二网络设备发送的第一管理操作请求以及地址信息，第三网络设备在接收到该目标信息后，会根据第一管理操作请求执行对第一管理对象的创建操作，并将执行结果发送到目标信息中的地址信息。本申请实施例中的目标信息除了包含第一管理操作请求和地址信息之外，还可以包含其他的信息，本申请实施例对此不做限定。
可选地，本申请实施例中的地址信息可以是第一网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的创建操作之后，会将执行结果发送给第一网络设备所对应的地址信息，该执行结果再由第一网络设备转发给第二网络设备，以使第二网络设备可以获取到第一管理操作请求的执行结果；本申请实施例中的地址信息也可以是第二网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的创建操作之后，会将执行结果直接发送给第二网络设备所对应的地址信息，以使其直接获取到第一管理操作请求的执行结果。
306、第一网络设备将第一身份标识添加至第二标识集合，第二标识集合包含一个或多个身份标识，每个身份标识具有对第一管理对象进行第二操作的权限，该第二操作为多种非创建类操作中的一个或多个，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
本申请实施例中，第一网络设备在判断第一身份标识具备创建第一管理对象的权限，确定第二网络设备发送的第一管理操作请求通过授权，并且第一管理对象被创建之后，第一网络设备可以将第一身份标识添加至第二标识集合。
本申请实施例中，第二标识集合是第一管理对象对应的标识集合，其中包含一个或多个身份标识。本申请实施例中多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，除此之外，还可以包含其他类型的属于非创建类的管理操作。本申请实施例中的第二操作是指多种非创建操作中的一个或者多个，第二标识集合中的每个标识都具有对第一管理对象进行第二操作的权限。本申请实施例中，若第一网络设备在第一管理对象被创建之后，将第一身份标识添加至第二标识集合，则第一身份标识不但具备创建第一管理对象的权限，还具备了对第一管理对象进行第二操作的权限。例如，若第二操作为修改操作这一种非创建类操作，则第二标识集合中的每个标识都具备对第一管理对象进行修改操作的权限，第一网络设备在第一管理对象被创建之后，将第一身份标识添加至第二标识集合，则第一身份标识则具备了对第一管理对象进行修改操作的权限；若第二操作为修改操作和删除操作这两种操作中的一种或多种操作，则第一网络设备在将第一身份标识添加至第二标识集合，则第一身份标识则具备了对第一管理对象进行修改操作以及删除操作的权限。
307、若第一身份标识属于目标子集合，则第一网络设备将第一身份标识添加至第三标识集合，第三标识集合包含一个或多个身份标识，每个身份标识都分别具有对第二管理对象进行创建操作的权限，第二管理对象是第一管理对象的下级管理对象。
本申请实施例中，第一标识集合还可以包括目标子集合，该目标子集合是第一标识集合的子集。本申请实施例中的第二管理对象是第一管理对象的下级管理对象。本申请实施例中，下级管理对象是指成分管理对象，一个管理对象实例的成分管理对象是组成该管理对象实例的下级管理对象实例。因此，本申请实施例中，第二管理对象是第一管理对象的下级管理对象，即第二管理对象是组成第一管理对象的下级管理对象实例。例如：第一管理对象为一个网络切片实例，一个网络切片实例可以是由多个网络切片子网实例组成的，则组成该网络切片实例的网络切片子网实例即为第二管理对象；一个网络切片子网实例可以是由多个网络功能实例组成的，若第一管理对象为一个网络切片子网实例，则组成该网络切片子网实例的网络功能实例则为第二管理对象。本申请实施例中，第三标识集合为第二管理对象对应的管理对象类所关联的标识集合，该第三标识集合中包含一个或多个身份标识，每个身份标识都具备对第二管理对象进行创建操作的权限。
本申请实施例中，第一网络设备在判断第一身份标识属于第一标识集合的同时，若判断第一身份标识属于目标子集合，则第一网络设备首先在确定第一身份标识在具备创建第一管理对象的权限，即确定第二网络设备发送的第一管理操作请求通过授权之后，还可以将第一身份标识添加至第三标识集合，此时，第一身份标识便具备了对第二管理对象进行创建操作的权限。
需要说明的是，本申请实施例中的步骤305、步骤306和步骤307都是可选的步骤，除此之外，本申请实施例对步骤305、步骤306和步骤307的先后顺序不做具体的限定。
本申请实施例中，本申请实施例采用一种授权控制的方法，通过在第一网络设备侧的网络资源模型的信息库中为不同的管理对象类分别设置对应的标识集合，标识集合中保存有对管理对象类对应的管理对象实例具有创建操作权限的身份标识，使得第一网络设备在 接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和创建操作从网络资源模型的信息库中确定第一管理对象的目标管理对象类，然后确定该目标管理对象类对应的第一标识集合，通过判断第二网络设备发送的第一身份标识是否存在该第一标识集合直接判断第二网络设备的第一管理操作请求是否授权通过，使得第一网络设备在每次创建操作的授权控制过程中只需要查询网络资源模型的信息库，降低第一网络设备实现授权控制的复杂度。
(二)第一操作为非创建类操作，目标数据库为管理信息数据库。
接下来将从第一操作为非创建类操作对本申请实施例提供的授权控制的方法进行介绍，当第一操作为非创建类操作时，上述实施例中的目标数据库为管理信息数据库，请参阅图4-图5。
图4为本申请实施例提供的授权控制的方法的另一个实施例示意图。
参阅图4，本申请实施例提供的授权控制的方法的一个实施例，可以包括：
401、第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的第一操作，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例，第一操作为多种非创建类操作中的一种。
本申请实施例中，第一操作为多种非创建操作中的一种，其他内容也可以参阅图2中的步骤201进行理解，此处不再赘述。
402、第一网络设备根据第一管理对象的信息和第一操作确定目标数据库中的第一标识集合，目标数据库为管理信息数据库，管理信息数据库包含一个或多个管理对象实例，第一管理对象为该一个或多个管理对象实例中的一个，第一标识集合中包含一个或多个身份标识，每个身份标识具有对第一管理对象进行多种非创建类操作的权限。
本申请实施例中，由于第一操作是多种非创建操作中的一种，第一管理对象是已经被创建的管理对象实例，第一管理操作请求用于请求对已经存在的第一管理对象进行非创建类操作，因此，目标数据库为管理信息数据库。本申请实施例中，管理信息数据库是网络资源模型的一个实例，管理信息数据库中包含一个或多个已经被创建的管理对象实例，第一管理对象即为该管理信息数据库中包含的一个管理对象实例。
本申请实施例中，对于管理信息数据库中的每个管理对象实例，所有的非创建操作作为一个整体均可以对应存在一个标识集合，该标识集合中包含一个或多个身份标识，每个身份标识具有对管理对象实例进行所有非创建类操作的权限。其中，第一管理对象对应的标识集合为第一标识集合，该第一标识集合中包含的每个身份标识，都具有对第一管理对象进行所有非创建类操作的权限。
403、若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权。
本申请实施例可以参阅图2中的步骤203进行理解，此处不再赘述。
404、第一网络设备将目标信息发送给第三网络设备，该目标信息中包括第一管理操作请求和地址信息，该目标信息用于第三网络设备对第一管理对象执行第一操作，并将第 三网络设备执行第一操作的结果发送至该地址信息。
本申请实施例中，在第一网络设备确定第一管理操作请求通过授权之后，第一网络设备会将目标信息发送给第三网络设备，该目标信息中包含第二网络设备发送的第一管理操作请求以及地址信息，第三网络设备在接收到该目标信息后，会根据第一管理操作请求执行对第一管理对象的第一操作，并将执行结果发送到目标信息中的地址信息。本申请实施例中的目标信息除了包含第一管理操作请求和地址信息之外，还可以包含其他的信息，本申请实施例对此不做限定。
可选地，本申请实施例中的地址信息可以是第一网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的第一操作之后，会将执行结果发送给第一网络设备所对应的地址信息，该执行结果再由第一网络设备转发给第二网络设备，以使第二网络设备可以获取到第一管理操作请求的执行结果；本申请实施例中的地址信息也可以是第二网络设备对应的地址信息，第三网络设备在根据第一管理操作请求执行对第一管理对象的第一操作之后，会将执行结果直接发送给第二网络设备所对应的地址信息，以使其直接获取到第一管理操作请求的执行结果。
405、第一网络设备获取第二管理操作请求和第一身份标识，第二管理操作请求中包括第一标识集合的指示信息和对第一标识集合的第二操作，该第二操作为多种非创建类操作中的一种或多种。
本申请实施例中，若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权之后，第一网络设备还可以接收第二管理操作请求和第一身份标识。本申请实施例中，第二管理操作请求和第一身份标识可以是第二网络设备发送的，也可以是其他的网络设备发送的，本申请实施例对此不做限定。
本申请实施例中，第二管理操作请求中包括第一标识集合的指示信息和对第一标识集合的第二操作，第一标识集合的指示信息用于指示该第一标识集合，该第二操作为多种非创建类操作中的一种或多种，第二管理操作请求用于请求对第一标识集合执行第二操作，例如修改操作、删除操作、订阅操作或查询操作等。
406、第一网络设备根据第二管理操作请求确定管理信息数据库中的第五标识集合，第五标识集合中包含一个或多个身份标识，第五标识集合中的身份标识具有对第一标识集合进行第二操作的权限。
本申请实施例中，管理信息数据库中的第一标识集合与第五标识集合关联，该第五标识集合中包含一个或多个身份标识，其中的每个身份标识都具有对第一标识集合进行第二操作的权限。需要说明的是，本申请实施例中每个管理对象实例都具备一个或多个属性，本申请实施例中的第一标识集合也可以是第一管理对象的一个或多个属性中的一个属性，该属性与第五标识集合关联。
407、若第一身份标识属于第五标识集合，则第一网络设备确定第二管理操作请求通过授权。
本申请实施例中，第一网络设备在根据第二管理操作请求确定第五标识集合之后，会判断第一身份标识是否属于第五标识集合，由于第五标识集合包含的一个或多个身份标识 中的每个身份标识都具有对第一管理对象进行第一操作的权限，因此，若第一网络设备判断第一身份标识属于第五标识集合时，便可以确定第一身份标识具备对第一标识集合进行第一操作的权限，则第一网络设备便可以确定第二管理操作请求通过授权。
需要说明的是，本申请实施例中的步骤404是一个可选的步骤，步骤405-步骤407作为一个整体也是可选的步骤，且本申请实施例对步骤404及步骤405-步骤407的先后顺序不做限定。
图4实施例中的步骤402中，所有的非创建类操作被作为一个整体，对应存在一个标识集合，可选地，所有的非创建类操作也可以是被划分为多个组合，每个组合对应存在一个标识集合，图5所提供的实施例将对此进行详细的介绍。
图5为本申请实施例提供的授权控制的方法的另一个实施例示意图。
参阅图5，本申请实施例提供的授权控制的方法的另一个实施例，可以包括：
501、第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，第一管理操作请求包括第一管理对象的信息和对第一管理对象的第一操作，第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例，第一操作为多种非创建类操作中的一种。
本申请实施例可以参阅图4中的步骤401进行理解，此处不再赘述。
502、第一网络设备根据第一操作确定目标组合，目标组合为多个组合中的一个，多种非创建类操作被划分为多个组合，每个组合中包括多种非创建类操作中的一种或多种，第一管理对象对应多个标识集合，每个组合对应一个标识集合，目标数据库为管理信息数据库，管理信息数据库包含一个或多个管理对象实例，第一管理对象为一个或多个管理对象实例中的一个。
本申请实施例中，管理信息数据库的相关内容可以参阅图4中的步骤402进行理解，此处不再赘述。
本申请实施例中，所有的非创建类操作被划分为多个组合，每个组合中可以包含一种或多种类型的非创建类操作，每个组合对应存在一个与第一管理对象对应的标识集合，标识集合中包含一个或多个身份标识，标识集合中的每个身份标识具备对第一管理对象进行对应的组合中所包含的非创建类操作的权限。本申请实施例中，第一操作所属于的组合为目标组合，第一网络设备在获取第二网络设备发送的第一管理操作请求以及第一身份标识之后，首先根据第一操作确定目标组合。例如，本申请实施例中的所有的非创建类操作为修改操作、删除操作、查询操作、订阅操作和通知操作这五类管理操作，将这五类管理操作划分为三个组合，其中修改操作和删除操作为第一组合，查询操作为第二组合，订阅操作以及通知操作为第三组合，这三个组合分别对应存在一个标识集合。若第一操作为修改操作，则第一网络设备确定目标组合为第一组合，若第一操作为查询操作，则第一网络设备确定目标组合为第二组合。需要说明的是，除了上述的示例，还存在多种对非创建类操作的划分方式，例如每一种非创建类操作都对应存在一个标识集合，本申请实施例对此不做限定。
503、第一网络设备根据目标组合确定管理信息数据库中的第一标识集合。
本申请实施例中，第一网络设备在根据第一操作确定目标组合之后，根据目标组合确定管理信息数据库中存储的第一管理对象对应的标识集合，该标识集合即为第一标识集合。
504、若第一身份标识属于第一标识集合，则第一网络设备确定第一管理操作请求通过授权。
本申请实施例可以参阅图2中的步骤203进行理解，此处不再赘述。
可选地，在图4或图5的实施例中，第一管理对象具备一个或多个属性，对于第一管理对象所具备的一个或多个属性中的部分或者全部，其中的每个属性都可以关联一个标识集合，该标识集合中包括一个或多个身份标识，每个身份标识都具有对该标识集合对应的属性进行第二操作的权限。本申请实施例中的第二操作是指多种非创建类操作中的一种管理操作，也可以是多种非创建类操作中的多种操作，例如，两种、三种等。
以第一管理对象所具备的一个或多个属性中的目标属性为例，该目标属性关联的标识集合为第四标识集合，本申请实施例中，若第一操作为修改操作，第一管理对象的信息用于指示该第四标识集合，则本申请实施例中的第一管理操作请求可以是用于请求对该第四标识集合进行修改，具体的修改方式是将第二身份标识添加至该第四标识集合中，则第二身份标识便具备了对该目标属性进行第二操作的权限。
505、第一网络设备将目标信息发送给第三网络设备，该目标信息中包括第一管理操作请求和地址信息，该目标信息用于第三网络设备对第一管理对象执行第一操作，并将第三网络设备执行第一操作的结果发送至该地址信息。
本申请实施例可以参阅图4中的步骤404进行理解，此处不再赘述。
需要说明的是，本申请实施例中的步骤505是可选的步骤。
本申请实施例中，本申请实施例采用一种授权控制的方法，通过在第一网络设备侧的管理信息数据库中为不同的管理对象实例分别设置对应的标识集合，标识集合中保存有对管理对象类对应的管理对象实例具有非创建类操作权限的身份标识，使得第一网络设备在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中第一管理对象的信息和第一操作从管理信息数据库中确定对应的第一标识集合，通过判断第一身份标识是否存在该第一标识集合直接判断第一管理操作请求是否授权通过，使得第一网络设备在每次非创建类操作的授权控制过程中只需要查询管理资源数据库，降低第一网络设备实现授权控制的复杂度。
上述对本申请实施例提供的授权控制的方法进行了介绍。可以理解的是，本申请实施例中，第一网络设备为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的模块及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
从硬件结构上来描述，图2至图5中的第一网络设备可以是指一个或多个实体设备，即由一个实体设备来实现上述授权控制的方法的实施例，也可以由多个实体设备共同实现， 还可以是一个实体设备内的一个或多个逻辑功能模块，本申请实施例对此不作具体限定。
例如，第一网络设备可以通过图6中的网络设备来实现。图6所示为本申请实施例提供的网络设备的硬件结构示意图。该网络设备包括至少一个处理器601，通信线路602，存储器603以及至少一个通信接口604。
处理器601可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路602可包括一通路，在上述组件之间传送信息。
通信接口604，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器603可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically er服务器able programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器603可以是独立存在，通过通信线路602与处理器601相连接。存储器603也可以和处理器集成在一起。
其中，存储器603用于存储执行本申请方案的计算机执行指令，并由处理器601来控制执行。处理器601用于执行存储器603中存储的计算机执行指令，从而实现本申请下述实施例提供的授权控制的方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器601可以包括一个或多个CPU，例如图6中的CPU0和CPU1。
在具体实现中，作为一种实施例，网络设备可以包括多个处理器，例如图6中的处理器601和处理器607。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，网络设备还可以包括输出设备605和输入设备606。输出设备605和处理器601通信，可以以多种方式来显示信息。例如，输出设备605可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备606和处理器601通信，可以以多种方式接收用户的输入。例如，输入设备606可以是鼠标、键盘、触摸屏设备或传感设备等。
上述的网络设备可以是一个通用设备或者是一个专用设备。在具体实现中，网络设备可以是台式机、便携式电脑、网络服务器、掌上电脑(personal digital assistant，PDA)、移动手机、平板电脑、无线终端设备、嵌入式设备或有图6中类似结构的设备。本申请实施例不限定网络设备的类型。
本申请实施例可以根据上述方法示例对第一网络设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
比如，以采用集成的方式划分各个功能模块的情况下，图7示出了本申请实施例提供的授权控制装置70。
参阅图7，本申请实施例提供一种授权控制装置的结构示意图，该授权控制装置70可以包括：
获取模块701，用于从第二网络设备获取第一管理操作请求以及第一身份标识，所述第一管理操作请求包括第一管理对象的信息和对所述第一管理对象的第一操作，所述第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例；
第一确定模块702，用于根据获取模块701获取的第一管理操作请求，确定目标数据库中的第一标识集合，第一标识集合包括一个或多个身份标识，身份标识具有对第一管理对象进行第一操作的权限；
第二确定模块703，用于在第一身份标识属于第一确定模块702确定的第一标识集合时，确定第一管理操作请求通过授权。
本申请实施例中，通过在目标数据库中为管理对象以及管理操作的组合设置对应的标识集合，标识集合中保存有对管理对象进行第一操作具有权限的身份标识，使得授权控制装置在接收到第二网络设备发送的第一管理操作请求后，可以直接根据第一管理操作请求中管理对象的信息和第一操作从目标数据库中确定对应的标识集合，通过判断第二网络设备对应的身份信息是否存在该标识集合直接判断第二网络设备的第一管理操作请求是否授权通过，使得授权控制装置在每次授权控制的过程中只需要查询一个目标数据库，降低授权控制装置实现授权控制的复杂度。
可选地，作为一个实施例，第一确定模块702，用于在第一操作为创建操作时，根据获取模块701获取的第一管理对象的信息确定目标数据库中第一管理对象对应的目标管理对象类，目标数据库为网络资源模型的信息库，信息库包含一个或多个管理对象类，每个所述管理对象类对应一个标识集合，所述标识集合中包含一个或多个身份标识，所述身份标识具有创建所述管理对象类对应的管理对象实例的权限，所述目标管理对象类为所述一个或多个管理对象类中的一个，所述第一管理对象为所述目标管理对象类对应的管理对象实例，所述第一标识集合为所述目标管理对象类对应的标识集合；根据所述目标管理对象类确定所述第一标识集合。
可选地，作为一个实施例，授权控制装置70还包括：第一添加模块704，用于在第二确定模块603确定所述第一管理操作请求通过授权之后，将所述第一身份标识添加至第二标识集合，所述第二标识集合包含一个或多个身份标识，所述身份标识具有对所述第一管理对象进行第二操作的权限，所述第二操作为多种非创建类操作中的一个或多个，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
可选地，作为一个实施例，当所述第一标识集合包括目标子集合时，授权控制装置70还包括：第二添加模块705，用于在第二确定模块703确定所述第一管理操作请求通过授权之后，若所述第一身份标识属于所述目标子集合，将所述第一身份标识添加至第三标识集合，所述第三标识集合包含一个或多个身份标识，所述身份标识都分别具有对所述第二管理对象进行所述创建操作的权限，所述第二管理对象是所述第一管理对象的下级管理对象。
可选地，作为一个实施例，当第一操作为多种非创建类操作中的一种，多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一确定模块702，用于根据获取模块701获取的所述第一管理对象的信息和所述第一操作确定所述目标数据库中的所述第一标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个，所述第一标识集合中的所述身份标识具有对所述第一管理对象进行所述多种非创建类操作的权限。
可选地，作为一个实施例，当所述第一操作为多种非创建类操作中的一种，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，第一确定模块702，用于根据获取模块701获取的所述第一操作确定目标组合，所述目标组合为多个组合中的一个，所述多种非创建类操作被划分为所述多个组合，每个所述组合中包括所述多种非创建类操作中的一种或多种，所述第一管理对象对应多个标识集合，每个所述组合对应一个所述标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个；根据所述目标组合确定所述管理信息数据库中的所述第一标识集合。
可选地，作为一个实施例，所述第一操作为所述修改操作，所述第一管理对象的信息用于指示第四标识集合，所述第四标识集合与所述第一管理对象的一个或多个属性中的目标属性存在关联关系，所述第四标识集合中包含一个或多个身份标识，所述身份标识具有对所述目标属性进行第二操作的权限，所述第二操作为所述多种非创建类操作中的一种或多种，所述第一管理操作请求用于请求对所述第四标识集合进行修改，以将第二身份标识添加至所述第四标识集合。
可选地，作为一个实施例，获取模块701，还用于第二确定模块703确定第一管理操作请求通过授权之后，获取第二管理操作请求和所述第一身份标识，第二管理操作请求中包括第一标识集合的指示信息和对第一标识集合的第二操作，所述第二操作为所述多种非创建类操作中的一种或多种；第一确定模块702，还用于根据所述获取模块701获取的所述第二管理操作请求确定所述管理信息数据库中的第五标识集合，所述第五标识集合中包含一 个或多个身份信息，所述身份信息具有对所述第一标识集合进行所述第二操作的权限；第二确定模块703，还用于在第一身份标识属于第一确定模块702确定的所述第五标识集合时，确定所述第二管理操作请求通过授权。
可选地，作为一个实施例，授权控制装置70还包括：发送模块706，用于在第二确定模块703确定第一管理操作请求通过授权之后，将目标信息发送给第三网络设备，目标信息中包括第一管理操作请求和地址信息，目标信息用于第三网络设备对第一管理对象执行所述第一操作，并将第三网络设备执行第一操作的结果发送至地址信息。
可选地，作为一个实施例，地址信息属于第一网络设备或第二网络设备。
应理解，本申请实施例中的获取模块701、第一确定模块702、第二确定模块703、第一添加模块704和第二添加模块705可以由处理器或处理器相关电路组件实现，发送模块706可以由收发器或收发器相关电路组件实现。
在本实施例中，授权控制装置70以采用集成的方式划分各个功能模块的形式来呈现。这里的“模块”可以指特定应用集成电路(application-specific integrated circuit，ASIC)电路，执行一个或多个软件或固件程序的处理器和存储器，集成逻辑电路，和/或其他可以提供上述功能的器件。在一个简单的实施例中，本领域的技术人员可以想到本申请实施例提供的授权控制装置均可以采用图6所示的形式。
比如，图6中的处理器601可以通过调用存储器603中存储的计算机执行指令，使得第一网络设备执行上述方法实施例中的授权控制的方法。
具体的，图7中的获取模块701、第一确定模块702、第二确定模块703、第一添加模块704和第二添加模块705的功能/实现过程可以通过图6中的处理器601调用存储器603中存储的计算机执行指令来实现。图7中的发送模块706的功能/实现过程可以通过图6中的通信接口604来实现。
由于本申请实施例提供的授权控制装置70可用于执行上述授权控制的方法，因此其所能获得的技术效果可参考上述方法实施例，在此不再赘述。
上述实施例中，第一网络设备以采用集成的方式划分各个功能模块的形式来呈现。当然，本申请实施例也可以对应各个功能划分第一网络设备的各个功能模块，本申请实施例对此不作具体限定。
可选的，本申请实施例提供了一种芯片系统，该芯片系统包括处理器，用于支持第一网络设备实现上述授权控制的方法。在一种可能的设计中，该芯片系统还包括存储器。该存储器，用于保存第一网络设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，本申请实施例对此不作具体限定。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传 输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：ROM、RAM、磁盘或光盘等。
以上对本申请实施例所提供的授权控制的方法及装置进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (22)

  1. 一种授权控制的方法，其特征在于，包括：
    第一网络设备从第二网络设备获取第一管理操作请求以及第一身份标识，所述第一管理操作请求包括第一管理对象的信息和对所述第一管理对象的第一操作，所述第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例；
    所述第一网络设备根据所述第一管理操作请求，确定目标数据库中的第一标识集合，所述第一标识集合包括一个或多个身份标识，所述身份标识具有对所述第一管理对象进行所述第一操作的权限；
    若所述第一身份标识属于所述第一标识集合，则所述第一网络设备确定所述第一管理操作请求通过授权。
  2. 根据权利要求1所述的方法，其特征在于，当所述第一操作为创建操作时，所述第一网络设备根据所述第一管理操作请求，确定目标数据库中的第一标识集合，包括：
    所述第一网络设备根据所述第一管理对象的信息确定所述目标数据库中所述第一管理对象对应的目标管理对象类，所述目标数据库为网络资源模型的信息库，所述信息库包含一个或多个管理对象类，每个所述管理对象类对应一个标识集合，所述标识集合中包含一个或多个身份标识，所述身份标识具有创建所述管理对象类对应的管理对象实例的权限，所述目标管理对象类为所述一个或多个管理对象类中的一个，所述第一管理对象为所述目标管理对象类对应的管理对象实例，所述第一标识集合为所述目标管理对象类对应的标识集合；
    所述第一网络设备根据所述目标管理对象类确定所述第一标识集合。
  3. 根据权利要求1或2所述的方法，其特征在于，所述若所述第一身份标识属于所述第一标识集合，则所述第一网络设备确定所述第一管理操作请求通过授权之后，还包括：
    所述第一网络设备将所述第一身份标识添加至第二标识集合，所述第二标识集合包含一个或多个身份标识，所述身份标识具有对所述第一管理对象进行第二操作的权限，所述第二操作为多种非创建类操作中的一个或多个，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
  4. 根据权利要求2或3所述的方法，其特征在于，所述第一标识集合包括目标子集合，若所述第一身份标识属于所述第一标识集合，则所述第一网络设备确定所述第一管理操作请求通过授权之后，还包括：
    若所述第一身份标识属于所述目标子集合，则所述第一网络设备将所述第一身份标识添加至第三标识集合，所述第三标识集合包含一个或多个身份标识，所述身份标识都分别具有对所述第二管理对象进行所述创建操作的权限，所述第二管理对象是所述第一管理对象的下级管理对象。
  5. 根据权利要求1所述的方法，其特征在于，当所述第一操作为多种非创建类操作中的一种，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，所述第一网络设备根据所述第一管理操作请求，确定目标数据 库中的第一标识集合，包括：
    所述第一网络设备根据所述第一管理对象的信息和所述第一操作确定所述目标数据库中的所述第一标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个，所述第一标识集合中的所述身份标识具有对所述第一管理对象进行所述多种非创建类操作的权限。
  6. 根据权利要求1所述的方法，其特征在于，当所述第一操作为多种非创建类操作中的一种，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，所述第一网络设备根据所述第一管理操作请求，确定目标数据库中的第一标识集合，包括：
    所述第一网络设备根据所述第一操作确定目标组合，所述目标组合为多个组合中的一个，所述多种非创建类操作被划分为所述多个组合，每个所述组合中包括所述多种非创建类操作中的一种或多种，所述第一管理对象对应多个标识集合，每个所述组合对应一个所述标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个；
    所述第一网络设备根据所述目标组合确定所述管理信息数据库中的所述第一标识集合。
  7. 根据权利要求5或6所述的方法，其特征在于，所述第一操作为所述修改操作，所述第一管理对象的信息用于指示第四标识集合，所述第四标识集合与所述第一管理对象的一个或多个属性中的目标属性存在关联关系，所述第四标识集合中包含一个或多个身份标识，所述身份标识具有对所述目标属性进行第二操作的权限，所述第二操作为所述多种非创建类操作中的一种或多种，所述第一管理操作请求用于请求对所述第四标识集合进行修改，以将第二身份标识添加至所述第四标识集合。
  8. 根据权利要求5所述的方法，其特征在于，若所述第一身份标识属于所述第一标识集合，则所述第一网络设备确定所述第一管理操作请求通过授权之后，还包括：
    所述第一网络设备获取第二管理操作请求和所述第一身份标识，所述第二管理操作请求中包括所述第一标识集合的指示信息和对所述第一标识集合的第二操作，所述第二操作为所述多种非创建类操作中的一种或多种；
    所述第一网络设备根据所述第二管理操作请求确定所述管理信息数据库中的第五标识集合，所述第五标识集合中包含一个或多个身份标识，所述身份标识具有对所述第一标识集合进行所述第二操作的权限；
    若所述第一身份标识属于所述第五标识集合，则所述第一网络设备确定所述第二管理操作请求通过授权。
  9. 根据权利要求1-8任一所述的方法，其特征在于，若所述第一身份标识属于所述第一标识集合，则所述第一网络设备确定所述第一管理操作请求通过授权之后，还包括：
    所述第一网络设备将目标信息发送给第三网络设备，所述目标信息中包括所述第一管理操作请求和地址信息，所述目标信息用于所述第三网络设备对所述第一管理对象执行所 述第一操作，并将所述第三网络设备执行所述第一操作的结果发送至所述地址信息。
  10. 根据权利要求9所述的方法，其特征在于，所述地址信息属于所述第一网络设备或所述第二网络设备。
  11. 一种授权控制的装置，其特征在于，包括：
    获取模块，用于从第二网络设备获取第一管理操作请求以及第一身份标识，所述第一管理操作请求包括第一管理对象的信息和对所述第一管理对象的第一操作，所述第一管理对象包括如下中的至少一个：网络实例、网络切片实例、子网实例、网络切片子网实例或网络功能实例；
    第一确定模块，用于根据所述获取模块获取的所述第一管理操作请求，确定目标数据库中的第一标识集合，所述第一标识集合包括一个或多个身份标识，所述身份标识具有对所述第一管理对象进行所述第一操作的权限；
    第二确定模块，用于在所述第一身份标识属于所述第一确定模块确定的所述第一标识集合时，确定所述第一管理操作请求通过授权。
  12. 根据权利要求11所述的装置，其特征在于，
    所述第一确定模块，用于在所述第一操作为创建操作时，根据所述获取模块获取的所述第一管理对象的信息确定所述目标数据库中所述第一管理对象对应的目标管理对象类，所述目标数据库为网络资源模型的信息库，所述信息库包含一个或多个管理对象类，每个所述管理对象类对应一个标识集合，所述标识集合中包含一个或多个身份标识，所述身份标识具有创建所述管理对象类对应的管理对象实例的权限，所述目标管理对象类为所述一个或多个管理对象类中的一个，所述第一管理对象为所述目标管理对象类对应的管理对象实例，所述第一标识集合为所述目标管理对象类对应的标识集合；根据所述目标管理对象类确定所述第一标识集合。
  13. 根据权利要求11或12所述的装置，其特征在于，所述装置还包括：
    第一添加模块，用于在所述第二确定模块确定所述第一管理操作请求通过授权之后，将所述第一身份标识添加至第二标识集合，所述第二标识集合包含一个或多个身份标识，所述身份标识具有对所述第一管理对象进行第二操作的权限，所述第二操作为多种非创建类操作中的一个或多个，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作。
  14. 根据权利要求12或13所述的装置，其特征在于，所述第一标识集合包括目标子集合，所述装置还包括：
    第二添加模块，用于在所述第二确定模块确定所述第一管理操作请求通过授权之后，若所述第一身份标识属于所述目标子集合，将所述第一身份标识添加至第三标识集合，所述第三标识集合包含一个或多个身份标识，所述身份标识都分别具有对所述第二管理对象进行所述创建操作的权限，所述第二管理对象是所述第一管理对象的下级管理对象。
  15. 根据权利要求11所述的装置，其特征在于，当所述第一操作为多种非创建类操作中的一种，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，
    所述第一确定模块，用于根据所述获取模块获取的所述第一管理对象的信息和所述第一操作确定所述目标数据库中的所述第一标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个，所述第一标识集合中的所述身份标识具有对所述第一管理对象进行所述多种非创建类操作的权限。
  16. 根据权利要求11所述的装置，其特征在于，当所述第一操作为多种非创建类操作中的一种，所述多种非创建类操作包括如下中的一种或多种：修改操作、删除操作、查询操作、订阅操作或通知操作，
    所述第一确定模块，用于根据所述获取模块获取的所述第一操作确定目标组合，所述目标组合为多个组合中的一个，所述多种非创建类操作被划分为所述多个组合，每个所述组合中包括所述多种非创建类操作中的一种或多种，所述第一管理对象对应多个标识集合，每个所述组合对应一个所述标识集合，所述目标数据库为管理信息数据库，所述管理信息数据库包含一个或多个管理对象实例，所述第一管理对象为所述一个或多个管理对象实例中的一个；根据所述目标组合确定所述管理信息数据库中的所述第一标识集合。
  17. 根据权利要求15或16所述的装置，其特征在于，所述第一操作为所述修改操作，所述第一管理对象的信息用于指示第四标识集合，所述第四标识集合与所述第一管理对象的一个或多个属性中的目标属性存在关联关系，所述第四标识集合中包含一个或多个身份标识，所述身份标识具有对所述目标属性进行第二操作的权限，所述第二操作为所述多种非创建类操作中的一种或多种，所述第一管理操作请求用于请求对所述第四标识集合进行修改，以将第二身份标识添加至所述第四标识集合。
  18. 根据权利要求15所述的装置，其特征在于，
    所述获取模块，还用于所述第二确定模块确定所述第一管理操作请求通过授权之后，获取第二管理操作请求和所述第一身份标识，所述第二管理操作请求中包括所述第一标识集合的指示信息和对所述第一标识集合的第二操作，所述第二操作为所述多种非创建类操作中的一种或多种；
    所述第一确定模块，还用于根据所述获取模块获取的所述第二管理操作请求确定所述管理信息数据库中的第五标识集合，所述第五标识集合中包含一个或多个身份信息，所述身份信息具有对所述第一标识集合进行所述第二操作的权限；
    所述第二确定模块，还用于在所述第一身份标识属于所述第一确定模块确定的所述第五标识集合时，确定所述第二管理操作请求通过授权。
  19. 根据权利要求11-18任一所述的装置，其特征在于，所述装置还包括：
    发送模块，用于在所述第二确定模块确定所述第一管理操作请求通过授权之后，将目标信息发送给第三网络设备，所述目标信息中包括所述第一管理操作请求和地址信息，所述目标信息用于所述第三网络设备对所述第一管理对象执行所述第一操作，并将所述第三网络设备执行所述第一操作的结果发送至所述地址信息。
  20. 根据权利要求19所述的装置，其特征在于，所述地址信息属于所述第一网络设备或所述第二网络设备。
  21. 一种计算机设备，其特征在于，所述计算机设备包括：输入/输出(I/O)接口、处理器和存储器，所述存储器中存储有程序指令；
    所述处理器用于执行存储器中存储的程序指令，执行如权利要求1-10任一所述的方法。
  22. 一种计算机可读存储介质，包括指令，其特征在于，当所述指令在计算机设备上运行时，使得所述计算机设备执行如权利要求1-10中任一项所述的方法。
PCT/CN2020/085008 2019-06-17 2020-04-16 一种授权控制的方法、装置以及存储介质 WO2020253344A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910523086.9 2019-06-17
CN201910523086.9A CN112105026B (zh) 2019-06-17 2019-06-17 一种授权控制的方法、装置以及存储介质

Publications (1)

Publication Number Publication Date
WO2020253344A1 true WO2020253344A1 (zh) 2020-12-24

Family

ID=73749211

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/085008 WO2020253344A1 (zh) 2019-06-17 2020-04-16 一种授权控制的方法、装置以及存储介质

Country Status (2)

Country Link
CN (1) CN112105026B (zh)
WO (1) WO2020253344A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115659405A (zh) * 2022-11-18 2023-01-31 中国信息通信研究院 数字对象的交互方法和装置、电子设备和存储介质
EP4322575A4 (en) * 2021-05-14 2024-04-17 Huawei Tech Co Ltd NETWORK MANAGEMENT METHOD AND ASSOCIATED DEVICE

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115150811A (zh) * 2021-03-30 2022-10-04 华为技术有限公司 多租户运维管理方法、装置及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474449A (zh) * 2017-09-08 2019-03-15 华为技术有限公司 一种处理网络切片实例的方法及装置
WO2019062634A1 (zh) * 2017-09-30 2019-04-04 华为技术有限公司 通信方法及装置
CN109787793A (zh) * 2017-11-10 2019-05-21 华为技术有限公司 网络切片管理的方法、装置、设备及系统
CN109787796A (zh) * 2017-11-13 2019-05-21 华为技术有限公司 网络功能服务授权的方法及装置
CN109874143A (zh) * 2017-12-04 2019-06-11 华为技术有限公司 一种网络切片的修改方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101282330B (zh) * 2007-04-04 2013-08-28 华为技术有限公司 网络存储访问权限管理方法及装置、网络存储访问控制方法
CN109379208B (zh) * 2017-08-11 2022-04-05 华为技术有限公司 网络对象管理方法及其装置
CN109525412B (zh) * 2017-09-19 2021-04-20 华为技术有限公司 管理网络切片的方法和装置
CN109756469B (zh) * 2017-11-08 2021-08-17 深圳竹云科技有限公司 一种公用账号管理方法、装置及计算机可读存储介质
CN109768875B (zh) * 2017-11-10 2021-10-15 华为技术有限公司 网络切片的策略管理方法、装置、设备及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109474449A (zh) * 2017-09-08 2019-03-15 华为技术有限公司 一种处理网络切片实例的方法及装置
WO2019062634A1 (zh) * 2017-09-30 2019-04-04 华为技术有限公司 通信方法及装置
CN109787793A (zh) * 2017-11-10 2019-05-21 华为技术有限公司 网络切片管理的方法、装置、设备及系统
CN109787796A (zh) * 2017-11-13 2019-05-21 华为技术有限公司 网络功能服务授权的方法及装置
CN109874143A (zh) * 2017-12-04 2019-06-11 华为技术有限公司 一种网络切片的修改方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
3GPP: "Management and orchestration of networks and network slicing; Provisioning; Stage 2 and stage 3(Release 15)", TS 28.532 V0.4.0, 31 July 2018 (2018-07-31), DOI: 20200706165840A *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4322575A4 (en) * 2021-05-14 2024-04-17 Huawei Tech Co Ltd NETWORK MANAGEMENT METHOD AND ASSOCIATED DEVICE
CN115659405A (zh) * 2022-11-18 2023-01-31 中国信息通信研究院 数字对象的交互方法和装置、电子设备和存储介质

Also Published As

Publication number Publication date
CN112105026B (zh) 2022-07-12
CN112105026A (zh) 2020-12-18

Similar Documents

Publication Publication Date Title
US11216444B2 (en) Scalable event sourcing datastore
US10680958B2 (en) Policy enforcement as a service for third party platforms
US10560349B2 (en) Data consistency of policy enforcement for distributed applications
WO2020253344A1 (zh) 一种授权控制的方法、装置以及存储介质
US8516249B2 (en) Cloud services layer
US11902279B2 (en) Method, apparatus, system and storage medium for access control policy configuration
US10601839B1 (en) Security management application providing proxy for administrative privileges
US20190238424A1 (en) Policy enforcement as a service for third party platforms with asynchronous user tracking mechanisms
US20150095973A1 (en) Cloud database lockdown
US20210097476A1 (en) Container Management Method, Apparatus, and Device
US20230110682A1 (en) Dynamic self-defined api via digital signatures
CN107306247B (zh) 资源访问控制方法及装置
US20230040635A1 (en) Graph-based impact analysis of misconfigured or compromised cloud resources
US11816511B1 (en) Virtual partitioning of a shared message bus
US11533596B2 (en) API publish method and apparatus
US20230086068A1 (en) Enabling an action based on a permission identifier for real-time identity resolution in a distributed system
CN112181599A (zh) 模型训练方法、装置及存储介质
CN108140053A (zh) 可插拔数据库锁定配置文件
WO2023279770A1 (zh) 数据存储方法、装置、系统、存储介质及程序产品
KR101570980B1 (ko) 멀티 테넌트 환경의 공통 코드 관리 방법, 이를 수행하는 공통 코드 관리 서버 및 이를 저장하는 기록매체
US20230153457A1 (en) Privacy data management in distributed computing systems
CN113128200B (zh) 用于处理信息的方法和装置
US11880491B2 (en) Tag-based application of masking policy
US11734451B1 (en) Secure continuous compliance enforcement on a data exchange system
WO2020223845A1 (zh) 资源添加方法、管理设备及计算机存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20825963

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20825963

Country of ref document: EP

Kind code of ref document: A1