WO2021089035A1 - 一种签约数据的管理方法、装置 - Google Patents

一种签约数据的管理方法、装置 Download PDF

Info

Publication number
WO2021089035A1
WO2021089035A1 PCT/CN2020/127442 CN2020127442W WO2021089035A1 WO 2021089035 A1 WO2021089035 A1 WO 2021089035A1 CN 2020127442 W CN2020127442 W CN 2020127442W WO 2021089035 A1 WO2021089035 A1 WO 2021089035A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
network
data
subscription data
blockchain
Prior art date
Application number
PCT/CN2020/127442
Other languages
English (en)
French (fr)
Inventor
薛开平
田航宇
洪佳楠
Original Assignee
华为技术有限公司
中国科学技术大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司, 中国科学技术大学 filed Critical 华为技术有限公司
Priority to EP20884910.9A priority Critical patent/EP4030802A4/en
Publication of WO2021089035A1 publication Critical patent/WO2021089035A1/zh
Priority to US17/738,899 priority patent/US20220272511A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/12—Mobility data transfer between location registers or mobility servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for managing subscription data.
  • a terminal device When a terminal device selects a service of a certain operator, it needs to sign a contract with the operator to obtain the right to enjoy a lower service charge in the resident service area (that is, the contracted service area). When the terminal device moves to another service, it needs to access the communication network in the service area through roaming. Among them, other service areas outside the contracted service area of the terminal device may be referred to as roaming service areas. When the terminal device communicates in the roaming service area, the service charge is relatively high.
  • the communication network provided by the operator in the contracted service area may be referred to as the contracted network for short, and the communication network provided by the operator in the roaming service area may be referred to as the visited network for short.
  • the network device in the communication network in the service area is required to provide a communication service for the terminal device according to the contract data of the terminal device.
  • the contract data is signed between the terminal device and the network device in the contracted network.
  • the communication network 1 is the contracted network of the terminal equipment
  • the communication network 2 is the visited network of the terminal equipment.
  • the terminal device A accesses the communication network 1
  • the communication network 1 provides communication services for the terminal device according to the contract data of the terminal device.
  • the communication network 2 obtains the contract data signed by the communication network 1 with the terminal device, and then provides the terminal device according to the contract data Provide communication services.
  • the contract data signed by the network of the contracted location and the terminal device is generally stored in the network device of the network of the contracted location. Therefore, the network device in the visited network needs to obtain the contract data of the terminal device from the network device in the contracted network.
  • the existing scheme for acquiring contract data by network equipment in the visited network includes the following steps:
  • the network device A in the visited network sends a request for acquiring the subscription data to the network device B in the contracted network;
  • network device B determines whether network device A conforms to the roaming contract formulated by said network device B, and queries the current location information of the terminal device to determine whether the terminal device is performing communication services in the visited network, where:
  • the roaming contract includes restriction conditions of network devices that can call the subscription data. After the network device B determines that the network device A satisfies the roaming contract, the network device B sends the subscription data to the network device A.
  • the network device A and the network device B need to interact multiple times, and the network device B will generate relatively large system overhead.
  • the network device B is in a fault state or a resting state, the network device A cannot obtain the contract data in time, and thus cannot provide communication services for the terminal device.
  • This application provides a method and device for managing contract data to solve the problem that when the network device in the visited network obtains the contract data, if the network device in the contracted network is in a fault state or a resting state, it cannot provide the terminal device Problems with communication services.
  • an embodiment of the present application provides a method for managing subscription data, including:
  • the first network element receives a request message from a second network element; wherein, the second network element is in the roaming area of the terminal device, and the request message is used to request subscription data of the terminal device;
  • a network element obtains a security token of the terminal device, where the security token is used to verify whether the second network element has the authority to obtain the subscription data;
  • the first network element provides the blockchain with The security token and query the contract data from the blockchain; if the verification is passed, the first network element obtains the address information of the contract data from the blockchain; the first network The element sends the address information of the subscription data to the second network element.
  • the visited network device such as the second network element, needs to obtain the contract data of the terminal device by verifying the authority to the blockchain. After the verification is passed, the contract data can be obtained, which reduces the number of contract data. The interaction of local network equipment, thereby saving the signaling overhead and power consumption of the contracted network equipment.
  • the visited network device needs to obtain contract data, it does not need to pass through the contracted network device, so that when the contracted network device is in a fault or resting state, the visited network device can still be Under the condition of obtaining the contract data, the contract data of the terminal device can be successfully obtained, so as to ensure that the terminal device can communicate smoothly in the visited network.
  • the authorization verification of the visited network equipment is realized through the blockchain, which can effectively and safely record the process information of each application for contract data, and has traceability, which improves the security of the roaming service.
  • the first network element obtains the security token locally; or the first network element receives the security token sent by the second network element.
  • the first network element obtains the security token from the received request message, where the request message carries the security token.
  • the first network element when the first network element queries the blockchain for the subscription data, the first network element provides the identification of the terminal device to the blockchain, where: The identifier of the terminal device is used to determine the subscription data corresponding to the terminal device.
  • the first network element decrypts the address information of the contract data to obtain the The storage address of the contract data in the database.
  • the first network element is a Block Chain Handling Function (BCHF) in the roaming network or BCHF in the blockchain.
  • BCHF Block Chain Handling Function
  • the second network device is an access and mobility management function (AMF) or a session management function (SMF) in the roaming network.
  • AMF access and mobility management function
  • SMF session management function
  • the first network device invokes the authority contract in the blockchain to query the subscription data.
  • an embodiment of the present application provides a method for managing subscription data, including:
  • the second network element sends a request message to the first network element; the second network element is in the roaming area of the terminal device, and the request message is used to request subscription data of the terminal device; the second network element Receiving the address information of the subscription data sent by the first network element; the second network element obtains the subscription data according to the address information of the subscription data.
  • the request message carries a security token; the security token is used to verify whether the second network element has the authority to obtain the subscription data.
  • the second network element after the second network element sends a request message for acquiring subscription data to the first network element, the second network element receives the acquisition data sent by the first network element. After the request for the security token, the security token is sent to the first network element.
  • the second network element obtains the subscription data from a database according to the address information of the subscription data.
  • the first network element is BCHF in the roaming network or BCHF in the blockchain.
  • the second network element is AMF or SMF in the roaming network.
  • an embodiment of the present application provides a method for managing subscription data, including:
  • the first network device stores the contract data obtained from the contract with the terminal device in the data server; the first network device receives the storage address of the contract data from the data server; the first network device stores the storage address Stored in the blockchain; wherein the first network device is in the network where the terminal device is contracted; the first network device sends the authorization certificate to the blockchain, and the authorization certificate is used to verify the acquisition of the contract data permission.
  • the storage address of the contracted data in the data server is stored in the blockchain, and the authority to verify that the visited network device obtains the contracted data is delegated to the blockchain. Therefore, the blockchain has the authority to verify and obtain the contract data.
  • the visited network device can verify the authority to the blockchain, and obtain the contract data after the verification is passed, reducing the interaction with the network device of the contract site. This saves the signaling overhead and power consumption of the contracted network equipment.
  • the visited network device when the visited network device needs to obtain contract data, it does not need to pass through the contracted network device, so that when the contracted network device is in a fault or resting state, the visited network device can still be Under the condition of obtaining the contract data, the contract data of the terminal device can be successfully obtained, so as to ensure that the terminal device can communicate smoothly in the visited network.
  • the authorization verification of the visited network equipment is realized through the blockchain, which can effectively and safely record the process information of each application for contract data, and has traceability, which improves the security of the roaming service.
  • the first network device determines the authority voucher in the following manner: the first network device generates a first random number, and the authority voucher is generated according to the first random number.
  • the first network device after the first network device generates the first random number, the first network device sends the first random number to the terminal device, wherein the first random number It is used to generate a security token, and the security token is used to verify the authority to obtain subscription data.
  • the first network device receives a second random number sent by the terminal device; the first network device generates the second random number according to the first random number and the second random number Authorization certificate; or the first network device receives the second random number sent by the terminal device; the first network device according to the first random number, the identity of the second network device, the second A random number is used to generate the authorization certificate.
  • the method It further includes: the first network device determines the identity of the second network device according to the roaming agreement with the second network device, and the second network device is in the roaming network of the terminal device.
  • an embodiment of the present application provides a method for managing contract data, including:
  • the terminal device receives the first random number sent by the first network device; the terminal device generates a security token according to the first random number, and sends the security token to the first network element; wherein, the security command
  • the card is used to verify the authority to obtain the subscription data, and the first network element is in the roaming area of the terminal device.
  • an embodiment of the present application provides a method for managing contract data, including:
  • the blockchain node receives a query request from a first network element, the query request includes a security token, and the security token is used to verify whether the second network element has the authority to obtain the subscription data;
  • the blockchain node verifies whether the security token is valid; if it is valid, the blockchain node calls a storage contract to obtain the address information of the contract data; the blockchain node returns the security token to the first network element Address information.
  • the authorization verification is performed on the blockchain, and the contract data is obtained after the verification is passed, which reduces the interaction with the network equipment of the contract site, thereby saving The signaling overhead and power consumption of the network equipment of the contracted site.
  • the visited network device needs to obtain contract data, it does not need to pass through the contracted network device, so that when the contracted network device is in a fault or resting state, the visited network device can still be Under the condition of obtaining the contract data, the contract data of the terminal device can be successfully obtained, so as to ensure that the terminal device can communicate smoothly in the visited network.
  • the authorization verification of the visited network equipment is realized through the blockchain, which can effectively and safely record the process information of each application for contract data, and has traceability, which improves the security of the roaming service.
  • verifying whether the security token is valid by the blockchain node includes: verifying whether the security token and the authorization certificate are consistent, and the authorization certificate is used to verify the second network element Whether it has the authority to obtain the contract data.
  • invoking the storage contract by the blockchain node includes: invoking the storage contract by the blockchain node according to the consensus algorithm of the blockchain.
  • the blockchain node obtains multiple encrypted address information.
  • the blockchain node performs a decryption process.
  • the blockchain node records an execution log of the contract data retrieval.
  • an embodiment of the present application provides a method for managing subscription data, including: a first network device signs a roaming agreement with a second network device; the first network device issues a smart contract to enable the second roaming device .
  • the first network device is located at the contract location of the terminal device
  • the second network device is located at the contract location of the terminal device.
  • an embodiment of the present application provides a communication device, which has the function of realizing the network element in the foregoing embodiment.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the communication device may be the first network element in the visited network, or a component that can be used for the network element, such as a chip or a chip system or a circuit, and the communication device may include: And processor.
  • the processor may be configured to support the communication device to perform the corresponding functions of the first network element shown above, and the transceiver is used to support the communication device and other network elements (for example, the second network element) and servers (for example, blockchain) Communication between etc.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores the necessary program instructions and data of the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may be a second network element in the visited network, or a component that can be used for the second network element, such as a chip or a chip system or a circuit.
  • the communication device may Including: transceiver and processor.
  • the processor may be configured to support the communication device to perform corresponding functions of the second network element shown above, and the transceiver is used to support communication between the communication device and other network elements (first network element), terminal equipment, and the like.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores the necessary program instructions and data of the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • an embodiment of the present application provides a communication device, which has the function of implementing the network device in the foregoing embodiment.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the communication device may be a network device in the network to which the terminal device is subscribed, or a component that can be used in the network device, such as a chip or a chip system or circuit.
  • the communication device may Including: transceiver and processor.
  • the processor may be configured to support the communication device to perform the corresponding functions of the first network device shown above, and the transceiver is used to support the communication between the communication device and the network device, terminal device, server (for example, blockchain), etc.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores the necessary program instructions and data of the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may be a network device in the network visited by the terminal device, or a component that can be used in the network device, such as a chip or a chip system or circuit
  • the communication device Can include: transceiver and processor.
  • the processor may be configured to support the communication device to perform the corresponding functions of the second network device shown above, and the transceiver is used to support the communication between the communication device and the network device, terminal device, server (for example, blockchain), etc.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores the necessary program instructions and data of the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • an embodiment of the present application provides a communication device, which has the function of realizing the server in the foregoing embodiment.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the communication device may be a blockchain, or a component that can be used in the blockchain, such as a chip or a chip system or circuit, and the communication device may include a transceiver and a processor.
  • the processor may be configured to support the communication device to perform the corresponding functions of the block chain shown above, and the transceiver is used to support communication between the communication device and network equipment, terminal equipment, and the like.
  • the communication device may further include a memory, and the storage may be coupled with the processor, which stores program instructions and data necessary for the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may be a data server, or a component that can be used in the data server, such as a chip or a chip system or a circuit
  • the communication device may include a transceiver and a processor.
  • the processor may be configured to support the communication device to perform the corresponding functions of the data server shown above, and the transceiver is used to support communication between the communication device and network equipment and other servers (such as blockchain).
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores the necessary program instructions and data of the communication device.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • an embodiment of the present application provides a communication device for implementing any one of the foregoing first to sixth aspects; or any one of the first to sixth aspects.
  • the communication device when the communication device is the first network element in the visited network, it may include: a processing unit and a communication unit:
  • the communication unit is configured to receive a request message from a second network element; wherein the second network element is in a roaming area of the terminal device, and the request message is used to request subscription data of the terminal device;
  • the processing unit is configured to obtain a security token of the terminal device, and the security token is used to verify whether the second network element has the authority to obtain the subscription data; and provide the blockchain with the Security token, and query the contract data from the blockchain; and if the verification is passed, obtain the address information of the contract data from the blockchain;
  • the communication unit is configured to send the address information of the subscription data to the second network element.
  • the communication device when it is a second network element in the visited network, it may include: a processing unit and a communication unit:
  • the processing unit is configured to send a request message to a first network element; the second network element is in a roaming area of the terminal device, and the request message is used to request subscription data of the terminal device;
  • the communication unit is configured to receive the address information of the subscription data sent by the first network element
  • the processing unit is configured to obtain the contract data according to the address information of the contract data.
  • the communication device when the communication device is a network device in the network to which the terminal device is contracted, it may include: a processing unit and a communication unit:
  • the processing unit is configured to store the contract data obtained from the contract with the terminal device in the data server;
  • the communication unit is configured to receive the storage address of the contract data from the data server;
  • the processing unit is further configured to store the storage address in a blockchain; wherein, the first network device is in the contracted network of the terminal device;
  • the communication unit is also used to send the authority certificate to the blockchain, and the authority certificate is used to verify the authority to obtain the contract data.
  • the communication device when it is a terminal device, it may include: a processing unit and a communication unit:
  • the communication unit is configured to receive a first random number sent by a first network device
  • the processing unit is configured to generate a security token according to the first random number
  • the communication unit is further configured to send the security token to a first network element; wherein the security token is used to verify the authority to obtain subscription data, and the first network element is in the roaming state of the terminal device. In the ground.
  • the communication device when it is a blockchain, it may include: a processing unit and a communication unit:
  • the communication unit is configured to receive a query request from a first network element, the query request includes a security token, and the security token is used to verify whether the second network element has the authority to obtain the subscription data;
  • the processing unit is used to verify whether the security token is valid
  • the processing unit is also used to call a storage contract to obtain the address information of the contract data;
  • the communication unit is further configured to return the address information to the first network element.
  • an embodiment of the present application provides a communication system, which includes a network device in a visited network, a network device in a contracted network, a terminal device, a blockchain, and a data server.
  • the network equipment in the visited network can be used to perform any one of the first and second aspects or any one of the methods in the first aspect
  • the network equipment in the contracted network can be used to perform the third and sixth aspects above Any one of the methods in the third or sixth aspect
  • the terminal device can be used to execute any one of the above-mentioned fourth aspect or the fourth aspect
  • the blockchain can be used to execute the above-mentioned fifth aspect or the first Any one of the five methods.
  • this application provides a chip system including a processor.
  • it may further include a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the communication device installed with the chip system executes any one of the first aspect to the sixth aspect; or Perform any one of the methods from the first aspect to the sixth aspect described above.
  • an embodiment of the present application provides a computer storage medium, in which instructions are stored, which when run on a communication device, cause the communication device to execute any one of the first aspect to the sixth aspect; Or execute any one of the methods from the first aspect to the sixth aspect described above.
  • an embodiment of the present application provides a computer program product containing instructions, which when run on a communication device, causes the communication device to execute any one of the first aspect to the sixth aspect; or execute the first aspect mentioned above. Any one of the aspect to the sixth aspect.
  • Figure 1 is an architecture diagram of a communication system provided by this application.
  • Figure 2 is a schematic diagram of signing a roaming agreement between the roaming operation equipment provided by the application and the home operation equipment;
  • Fig. 3 is a schematic diagram of the process of signing a contract between a terminal device and a home operating device provided by this application;
  • FIG. 4 is a schematic diagram of a flow chart of AMF network element performing subscription data access control during roaming provided by this application;
  • FIG. 5 is a schematic diagram of SMF network element performing subscription data access control during roaming provided by this application;
  • Figure 6 is a schematic diagram of network elements in the first visited network provided by this application.
  • FIG. 7 is a schematic diagram of the network element equipment in the second visited network provided by this application.
  • FIG. 8 is a schematic diagram of network equipment in the first type of contracted network provided by this application.
  • FIG. 9 is a schematic diagram of network equipment in the second type of contracted network provided by this application.
  • FIG. 10 is a schematic diagram of a terminal device provided by this application.
  • the embodiment of the present application provides a method for managing contract data.
  • the technical solutions of the embodiments of this application can be applied to various communication systems, such as long term evolution (LTE) systems, worldwide interoperability for microwave access (WiMAX) communication systems, and the fifth generation of the future (5th Generation, 5G) systems, such as new radio access technology (NR), and future communication systems, such as 6G systems.
  • LTE long term evolution
  • WiMAX worldwide interoperability for microwave access
  • 5G fifth generation
  • NR new radio access technology
  • 6G systems future communication systems
  • this application enables the blockchain to have the authority to verify and obtain contract data.
  • the authorization verification is performed on the blockchain, and the contract data is obtained after the verification is passed, which reduces the interaction with the network device of the contract, thereby saving The signaling overhead and power consumption of the network equipment of the contracted site.
  • the visited network device needs to obtain contract data, it does not need to pass through the contracted network device, so that when the contracted network device is in a fault or resting state, the visited network device can still be Under the condition of obtaining the contract data, the contract data of the terminal device can be successfully obtained, so as to ensure that the terminal device can communicate smoothly in the visited network.
  • the authorization verification of the visited network equipment is realized through the blockchain, which can effectively and safely record the process information of each application for contract data, and has traceability, which improves the security of the roaming service.
  • the communication system shown in FIG. 1 is taken as an example to describe in detail the communication system to which the embodiments of the present application are applicable.
  • the communication system includes a network device 100 in a visited network, a terminal device 101, a network device 102 in a contracted network, a blockchain 103, and a data server 104.
  • the network equipment in the network visited by the terminal device is referred to as a roaming operation device for short
  • the network equipment in the network where the terminal device is contracted is referred to as a home operating device for short.
  • the roaming operation device 100 is a network device located in the visited network, and is used to obtain the contract data between the terminal device 101 and the home operation device 102 when the conditions for obtaining the contract data are met, and then it is the access point.
  • the terminal device 101 provides a wireless communication function in the visited network.
  • the roaming operation device 100 may also determine the roaming fee incurred by the terminal device 101 communicating in the visited network, notify the home operation device 102 and charge the roaming fee.
  • the roaming operation device 100 may also be referred to as a base station (base station, BS).
  • base station base station
  • some examples of roaming operation equipment 100 are: next-generation base station (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (RNC), node B in 5G (node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand) unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • gnodeB, gNB next-generation base station
  • eNB evolved node B
  • RNC radio network controller
  • node B in 5G node B, NB
  • BSC base station controller
  • BTS base transceiver station
  • home base station for example, home evolved nodeB, or
  • the network elements in the roaming operation equipment 100 mainly include: Session Management Function (SMF), Access and Mobility Management Function (AMF), and Blockchain Processing Function (BlockChain). Handling Function, BCHF) and so on.
  • SMF Session Management Function
  • AMF Access and Mobility Management Function
  • BlockChain Blockchain Processing Function
  • BCHF Handling Function
  • the terminal device 101 is a device that provides voice and/or data connectivity to users. It can also be referred to as user equipment (UE), access terminal equipment, subscriber unit, user station, mobile station, mobile station, Remote station, remote terminal equipment, mobile equipment, user terminal equipment, terminal equipment, wireless communication equipment, user agent or user device.
  • the terminal device in the embodiment of the application may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, and an augmented reality (AR) terminal Equipment, wireless terminal equipment in industrial control, wireless terminal equipment in self-driving, wireless terminal equipment in remote medical, and wireless terminal equipment in smart grid , Wireless terminal equipment in transportation safety, wireless terminal equipment in smart city, wireless terminal equipment in smart home, etc.
  • the home operating device 102 is a network device located in the network of the contracted place, and is used to provide a wireless communication function for the terminal device 101 accessed in the network of the contracted place. Wherein, the home operation equipment 102 is also used to calculate the roaming expenses incurred by the terminal device 101 for roaming services sent by the roaming operation equipment 100, and to report the roaming operation equipment 100 to the roaming operation equipment 100 after determining that the roaming expenses are correct Paying the roaming fee; and formulating and collecting the roaming fee of the terminal device 101.
  • the home operation device 101 may also be referred to as a base station (base station, BS).
  • base station base station
  • some examples of home operation equipment 101 are: next-generation base station (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (RNC), node B in 5G (node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand) unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • gnodeB, gNB next-generation base station
  • eNB evolved node B
  • RNC radio network controller
  • node B in 5G node B, NB
  • BSC base station controller
  • BTS base transceiver station
  • home base station for example, home evolved nodeB, or home no
  • the network elements included in the home operation device 102 mainly include: SMF, BCHF, UDM (Unified Data Management), and so on.
  • Blockchain 103 a decentralized database with blocks as a data structure, with distributed storage and processing functions, used in the communication system to store relevant data information, and to update the stored data information according to the received information, or Return corresponding information according to the received information.
  • each block in the blockchain contains a block body and a block header, and the block body stores transaction records.
  • Transaction records can be transfer records, smart contract records, clearing records, data records, etc., according to specific application scenarios.
  • the block header stores the timestamp, the hash summary result of the transaction, and the necessary information to form a chain structure with the previous block, such as the hash value of the previous block. This chain structure guarantees that once a block is added to their respective block copies after being agreed by all nodes, the block cannot be changed, and valid credentials can be recorded for each visit.
  • the data server 104 has storage and processing functions, and is used in the communication system to store relevant data information, update the stored data information according to the received information, or return corresponding information according to the received information.
  • the data server 104 in the embodiment of the present application may be a database for storing the contract data in the embodiment of the present application; when the contract data is in an encrypted state, it may also be used to store the encrypted contract data.
  • the first network element in the embodiment of the present application may be the BCHF in the roaming operation equipment 100 or the BCHF in the blockchain 103.
  • the second network element in the embodiment of the present application may be the AMF or SMF in the roaming operation equipment 100.
  • the home operation device may be the first network device.
  • the first network device may be one or more network elements in the home (or called contract) network, or one of the home networks. Or multiple functional modules, the embodiment of the present application does not limit the specific form and structure of the first network device.
  • the roaming operation device may be the second network device.
  • the second network device may be one or more network elements in the roaming (or called visited) network, or one of the roaming networks. Or multiple functional modules, the embodiment of the present application does not limit the specific form and structure of the second network device.
  • FIG. 1 is only a simplified schematic diagram of an example for ease of understanding, and the communication system may also include other network devices or other terminal devices, which are not shown in FIG. 1.
  • the permission contract is essentially a program running in the blockchain, which is executed by events. It has the characteristics of certainty, real-time, autonomy, observability, verifiability, and decentralization, and has extensive research and applications in digital finance, big data, and the Internet of Things.
  • the permission contract based on blockchain includes data receiving, processing and status recording.
  • the contract account receives one or several input information that meets the triggering condition of the state transition, the contract action is selected according to the preset information to be automatically executed, and the current state is recorded. Therefore, as a kind of computer technology, the authority contract can ensure the mandatory performance of the contract without introducing a trusted third party, and ensure the credibility and security of the contract procedure.
  • the authority contract described in the embodiment of the present application includes authority credentials generated by the home operating device, which are used to verify the authority to obtain contract data.
  • Blockchain is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm, etc. It is essentially a decentralized database.
  • the blockchain technology does not rely on additional third-party management agencies or hardware facilities, and there is no central control.
  • each node realizes information self-verification, transmission and management .
  • decentralization is the most prominent and essential feature of the blockchain.
  • Distributed ledger which means that transaction accounting is completed by multiple nodes distributed in different places, and each node records a complete account, so they can participate in monitoring the legality of transactions, and they can also jointly perform Its testimony.
  • Consensus mechanism refers to how all nodes reach a consensus to determine the validity of a record. This is not only a means of identification, but also a means of preventing tampering.
  • the consensus mechanism has the characteristics of "the minority obeys the majority” and "everyone is equal”.
  • the minority obeys the majority does not completely refer to the number of nodes, but can also refer to the computing power, the number of equity, or other features that can be compared by computers. "Everyone is equal” means that when nodes meet the conditions, all nodes have the right to give priority to the consensus result, and it may become the final consensus result after being directly recognized by other nodes.
  • Symmetric encryption algorithm mainly refers to the encryption algorithm that uses the same key for encryption and decryption.
  • the sender and receiver are required to agree on a key before secure communication.
  • the encryption key can be calculated from the decryption key, and the decryption key can also be calculated from the encryption key.
  • the encryption key and the decryption key are the same, so this encryption algorithm is also called a secret key algorithm or a single key algorithm.
  • Asymmetric encryption algorithm means that two different keys are used for encryption and decryption, namely, public key (referred to as public key) and private key (referred to as private key), which has high security. Among them, the public key and the private key are a pair. If the public key is used to encrypt the data, only the corresponding private key can be used to decrypt it.
  • Party A For example, if Party A generates a pair of keys and publishes the public key, Party B who needs to send information to Party A uses Party A’s public key to encrypt confidential information before sending it to Party A; Party A then uses its own private key pair The encrypted information is decrypted.
  • Party A wants to reply to Party B, the opposite is true.
  • Party A uses Party B's public key to encrypt the data.
  • Party B uses its own private key to decrypt the data.
  • the term "at least one" in the embodiments of the present application refers to one or more, and “multiple” refers to two or more than two.
  • “And/or” describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A , B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an “or” relationship.
  • the following at least one item (item) or similar expressions refer to any combination of these items, including any combination of single item (item) or plural items (item).
  • at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • the roaming operation device before the roaming operation device obtains the contract data between the home operation device and the terminal device, the roaming operation device needs to sign a contract with the home operation device Roaming agreement.
  • the home operation device obtains the public key of the roaming operation device (for example, the public key PK_v) and the address information of the roaming operation device (for example, the address information is acc_v). Based on this, the home operating device issues a smart contract to activate the authority for the roaming operating device.
  • the contract complies with the transaction rules
  • the blockchain nodes reach a consensus and record the contract on the chain.
  • the smart contract may be referred to as a rights contract, and the address information of the roaming operation equipment (for example, acc_v is recorded) is recorded in the rights contract.
  • the private key corresponding to the public key (for example, PK_v) of the roaming operation device is stored in the security network element of the roaming operator.
  • the BCHF in the embodiment of the present application can be used as a network element that secretly stores and maintains the private key of the roaming operation device.
  • the method for managing contract data provided by the present application will be specifically described in terms of two aspects: terminal equipment signing a contract with a home operating equipment, and roaming operating equipment acquiring contract data of the terminal equipment.
  • Embodiment 1 The terminal equipment signs a contract with the home operating equipment.
  • the home operating device When the terminal device becomes a subscriber of the home operating device, the home operating device signs a contract with the terminal device according to the information provided by the terminal device, and saves the contract data.
  • the specific interaction flow can be shown in the figure As shown in 3, it specifically includes the following steps:
  • the terminal device sends subscription information for contracting to the home operating device.
  • the subscription information includes necessary information provided by the terminal device for performing a contract.
  • the contract information includes information such as the validity of the terminal device's identity and real-name system
  • the information such as the validity of the identity and the real-name system can be used as part of the contract data.
  • the terminal device sends a second random number to the home operating device, where the second random number is used to generate a permission certificate.
  • the terminal device may carry the second random number in the subscription information and send it to the home operation device together; or the terminal device may separately send the second random number to the home operation device Operational equipment.
  • S301 The home operating device determines contract data with the terminal device.
  • the home operation device encrypts the subscription data to obtain an encryption result, and determines a first decryption key used to decrypt the encryption result.
  • the home operation device may encrypt the subscription data in any manner.
  • the home operation device encrypts the contract data by using a symmetric encryption algorithm, then the first decryption key is both an encryption key used to encrypt the contract data and the The encryption result is decrypted to obtain the decryption key of the contract data.
  • the first decryption key is a private key used for decryption in the asymmetric algorithm.
  • the home operating device encrypts the contract data, it encrypts the contract data by using the public key corresponding to the private key.
  • step S302 is an unnecessary step and can be omitted. That is, in the embodiment of the present application, the home operating device may directly store the contract data in the data server, that is, the contract data stored in the data server is not encrypted.
  • the home operating device stores the encryption result in a data server.
  • the storage resources of the blockchain can be saved, and the storage burden of the blockchain can be effectively released.
  • the contract data corresponding to the terminal device may involve the contract data of multiple different services.
  • the contract data corresponding to the terminal device A is contract data A, contract data B, and contract data C.
  • the contract data A can be the contract data related to authentication and mobility management
  • the contract data B can be It is the subscription data related to session management
  • the subscription data C may be the subscription data related to policy control.
  • all the contract data corresponding to the terminal device A can be stored in the same address, or the contract data corresponding to the terminal device A can be stored in different addresses. in.
  • the contract data A, the contract data B, and the contract data C can be encrypted as a whole, and the encrypted result can be stored in the data server;
  • the contract data A, the contract data B, and the contract data C can all be stored in the same address of the data server.
  • the contract data A, the contract data B, and the contract data C can be respectively encrypted to obtain the encryption result A, the encryption result B, and the encryption result C, and
  • the three encryption results are stored in different addresses of the data server.
  • the data server returns a list of storage paths of the subscription data corresponding to the terminal device to the home operating device after the storage is completed.
  • the contract data A, the contract data B, and the contract data C can be directly stored in different addresses of the data server. And after the data server completes the storage, it returns a list of storage addresses of the subscription data corresponding to the terminal device to the home operating device.
  • the home operation device records the storage address and the first decryption key in the blockchain.
  • the storage address and the first decryption key may be stored together in the blockchain as a whole, or may be stored separately in the blockchain.
  • the storage address is used by the roaming operation device to obtain the subscription data (encryption result) from the data server, and the first decryption key is used to decrypt the obtained encryption result to obtain the State the contract data.
  • the home operation device generates a first random number, and sends the first random number to the terminal device.
  • the first random number is used to generate the authority certificate
  • the home operation device sends the first random number to the terminal device, which is mainly used by the terminal device according to the
  • the first random number generates a security token
  • the security token is used to verify the authority to obtain subscription data.
  • S307 The home operating device generates a permission voucher according to the first random number.
  • the home operation device generates the authority certificate according to the first random number. For example, if the first random number is non_H, the home operation device generates the authority according to the random number non_H. certificate.
  • the home operating device generates the authority certificate according to the first random number and the second random number. For example, assuming that the first random number is non_H and the second random number is non_UE, Then, the home operating equipment generates a permission voucher jointly according to the random number non_UE and the random number non_H.
  • the home operation device generates the authority voucher according to the identity information of the roaming operation device, the first random number, and the second random number.
  • the identity information of the roaming operation device may be the identity of the roaming operation device, or may be the address of the roaming device.
  • the identity information of the roaming operation equipment is an identity identifier VID
  • the first random number is non_H
  • the second random number is non_UE
  • the authority voucher is generated.
  • the identity of the roaming operation device is obtained by the home operation device according to a roaming agreement with the roaming operation device.
  • S308 The home operating device sends the authority certificate to the blockchain.
  • the home operating device invokes a rights contract stored in the blockchain, where the rights contract is a rights contract corresponding to the home operating device and the roaming operating device; the home operating device transfers the The authorization certificate is added to the authorization contract, and the authorization contract after the authorization certificate is added is sent to the blockchain.
  • the home operation device directly sends the authority certificate to the blockchain.
  • the block link receives the authority contract for increasing the authority voucher, it updates the authority contract corresponding to the home operation device and the roaming operation device in the block chain to all State the authority contract to increase the authority certificate; or,
  • the block link receives the authority certificate sent by the home operating device, it adds the authority certificate to the authority contract corresponding to the home operating device and the roaming operating device, and updates the Permission contract; or,
  • the block link receives the authority voucher sent by the home operating device, it stores the authority voucher locally, and then updates its own storage information.
  • the storage address and the first decryption key may be encrypted again, so as to better protect the security of the contract data Sex.
  • the home operating device in the embodiment of the present application performs double encryption on the storage address and the first decryption key.
  • the storage address is add_UE
  • the first decryption key is PK_UE. Therefore, when performing encryption, the storage address and the first decryption key may be asymmetrically encrypted first.
  • the first element in parentheses in the formula 1 represents the key used by the encryption algorithm (that is, the public key in asymmetric encryption), the second element is the encrypted content, and the M_1v represents the first re-encryption The encryption result.
  • the encryption result M_1v obtained by the first re-encryption is symmetrically encrypted, for example, the encrypted result M_1v after the encryption is re-encrypted by the following formula 2:
  • the first element in brackets in the formula 2 represents the key used by the symmetric encryption algorithm (the key is both an encryption key and a decryption key), and the second element is the encrypted content.
  • the K may be determined by the following formula 3:
  • the order of the symmetric encryption and the asymmetric encryption can be interchanged. For example, first perform symmetric encryption, and then perform asymmetric encryption on the result of the symmetric encryption.
  • each element in the list is encrypted to generate multiple M_vs to form an M_v list.
  • the second embodiment is the process of acquiring the subscription data during the roaming process.
  • One case is the acquisition process of the subscription data by the AMF network element in the roaming operation equipment; the other case is the acquisition process of the subscription data by the SMF network element in the roaming operation equipment. description.
  • the storage address appearing in the second embodiment represents the address of the contract data or the encryption result of the contract data in the data server;
  • the first decryption key represents The key used to decrypt the encryption result of the contract data;
  • M_1v represents the encryption result of the first re-encryption of the storage address and the first decryption key by the home operating device;
  • M_v represents the home operating device in the On the basis of M_1v, the result of encryption is performed again;
  • PK_v represents the public key of the home operating device for asymmetric encryption;
  • K represents the key of the home operating device for symmetric encryption;
  • non_H represents the first random number generated by the home operating device ;
  • Non_UE represents the second random number generated by the terminal device.
  • S400 The terminal device generates a security token, and then passes the security token to the AMF.
  • the terminal device may generate the security token in the following manner:
  • the terminal device generates the security token according to the generated second random number non_U and the first random number non_H sent by the home operating device.
  • the terminal device For example, assuming that the security token is a token, the terminal device generates the token according to the following formula 4.
  • the terminal device may generate a security token in the following manner:
  • the terminal device generates the security token according to the generated second random number non_U, the first random number non_H sent by the home operation device, and the identity information of the roaming operation device.
  • the token is generated according to the following formula 5.
  • the process of generating the security token by the terminal device can be completed in the security module of the terminal device, such as USIM (Universal Subscriber Identity Module), and then through NAS (Non-access stratum).
  • the access layer transfers the security token to the AMF.
  • the terminal device also needs to determine the K. Then, the terminal device passes the K to the AMF, so that the roaming operation device decrypts the M_v through the K and the private key corresponding to the public key PK_v.
  • the AMF sends a request for acquiring subscription data to the BCHF.
  • the security token is sent to the BCHF; wherein, if there is a double encryption, the AMF needs to send the security token to the BCHF
  • the K the K received from the terminal device is sent to the BCHF.
  • the AMF After receiving the information for acquiring the security token (which may also include K) sent by the BCHF, the AMF sends the security token (which may also include K) to the BCHF.
  • the security token may also include K) information sent to the BCHF, where the security token (may also include K) ) May be carried in the request for acquiring subscription data.
  • the BCHF After receiving the request for acquiring subscription data, the BCHF queries the blockchain for the subscription data, and sends the security token to the blockchain.
  • the BCHF in the roaming operation equipment in the embodiment of the present application deletes the received security token (may also include K) in the BCHF every threshold duration.
  • the AMF when the AMF sends a request for acquiring subscription data to the blockchain for the first time through the BCHF, the verification information is not in the BCHF. Therefore, the AMF also needs to send the security token to the BCHF, so that when the BCHF queries the blockchain for the subscription data, the security token is sent to the block Chain, so that the blockchain verifies whether the roaming operation device has the authority to obtain subscription data according to the security token.
  • the BCHF stores the Security token (may also contain K). Therefore, when the BCHF queries the blockchain for contract data, it can directly send the security token stored by itself to the blockchain, so that the blockchain can verify the security token according to the security token. Whether the roaming operation equipment has the authority to obtain subscription data.
  • the BCHF sends the request to the block
  • the chain queries subscription data, it also needs to send a request for obtaining the security token to the AMF, and obtain the security token sent by the AMF. Therefore, when the BCHF queries the blockchain for the subscription data, the security token is sent to the blockchain so that the blockchain can verify the roaming operation according to the security token Whether the device has the authority to obtain contract data.
  • S403 The blockchain determines whether the security token is the same as the permission certificate stored locally.
  • the blockchain processes the security token, and then compares the obtained processing result with the authority credential.
  • the blockchain processes the security token through the following formula 6 to obtain the processing result token_v, and then compares whether the token_v is the same with the authority certificate.
  • token_v Hash ⁇ Hash ⁇ non_UE
  • the blockchain in the embodiment of the present application determines that the processing result is not the same as the authority certificate, it is determined that the roaming operation device does not have the authority to obtain the subscription data, and the procedure is terminated; on the contrary If the blockchain determines that the processing result is the same as the authority voucher, it is determined that the roaming operation device has the authority to obtain the subscription data.
  • the blockchain if the storage address stored in the blockchain is a list, the blockchain returns part of the addresses allowed to be obtained by this query and the corresponding first decryption key .
  • the BCHF obtains the storage address and the first decryption key.
  • the BCHF also needs to decrypt the M_v to obtain the storage address and the first decryption key;
  • the process of solving the M_v in the embodiment of the present application corresponds to the previous encryption process.
  • the M_v is decrypted by formula 7 to obtain the storage address add_UE and the first decryption key PK_UE in the M_v:
  • SK_v in the formula 7 is the private key of the roaming operation device stored in the BCHF.
  • the BCHF sends the storage address and the first decryption key to the AMF.
  • the AMF obtains the encryption result from the data server according to the storage address.
  • S408 The AMF decrypts the received encryption result by using the first decryption key to obtain the subscription data.
  • Case 2 On the basis of Case 1, as shown in Figure 5, it is the access control process of the SMF network element in the roaming operation equipment or other network elements in the roaming operation equipment to the subscription data of the terminal device , The following selects the SMF network element as an example to introduce the specific process:
  • the SMF sends a request for acquiring the subscription data to the BCHF.
  • the BCHF in the roaming operation device in the embodiment of the present application deletes the security token that has been received in the BCHF every threshold duration. Therefore, if the SMF queries the blockchain for subscription data through the BCHF, if the security token is stored in the BCHF, when the BCHF queries the blockchain for the subscription data , Obtain the security token directly from the local, and send the security token to the blockchain, so that the blockchain can determine whether the roaming operation device has access to contract data according to the security token permission. That is, the execution of step S504 is continued.
  • step S502 if the security token is not stored in the BCHF, the BCHF still needs to perform step S502.
  • the BCHF sends a request for acquiring the security token to the AMF.
  • S503 The AMF sends the security token to the BCHF, and continues to perform step S501.
  • S504 The blockchain determines whether the security token and the authority certificate are the same.
  • the blockchain if the storage address stored in the blockchain is a list, the blockchain returns part of the addresses allowed to be obtained by this query and the corresponding first decryption key .
  • the BCHF decrypts the M_v, thereby obtaining the storage address and the first decryption key.
  • the BCHF sends the storage address and the first decryption key to the SMF.
  • the SMF obtains the encryption result from the data server according to the storage address.
  • S509 The SMF decrypts the received encryption result by using the decryption key to obtain the contract data.
  • the above-mentioned method for realizing the management of contract data through the configuration of the authority contract in the blockchain, enables the home operating device to participate in the management of contract data from time to time when it is not needed, effectively reducing the burden of the home operating device.
  • the embodiments of the present application ensure the security of the contracted data through cryptographic means, and unauthorized operators and other entities cannot obtain the content of the contracted data. Even if the online database is attacked, or the contract data encrypted in the database is obtained by other means, it is still a ciphertext format that cannot be decrypted if the predetermined access conditions are not met.
  • this application is further optimized for the second embodiment above on the premise of providing the same safety and functional performance.
  • An optional embodiment of the present application is mainly based on a threshold-based consensus mechanism, and is further optimized for the method of obtaining the subscription data.
  • the roaming operation device only when the roaming operation device receives subscription data response messages greater than or equal to a threshold number, can it obtain the subscription data stored in the data server.
  • the blockchain has a plurality of management nodes, and the subscription data response message is sent by the management node to the roaming operation equipment after determining that the authority voucher is consistent with the verification information.
  • the subscription data response message includes the storage address fragment message, and the storage address fragment represents part of the information of the storage address.
  • the subscription data response message does not include the complete storage address of the subscription data in the data server. Only after the roaming operation device receives a subscription data response message that is greater than or equal to the threshold, can it determine a complete storage address based on the partial fragment messages in the acquired subscription data response message. Then, according to the complete storage address, the contract data is obtained from the data server.
  • transactions or calls of contracts of the blockchain may be transactions or calls based on the consensus mechanism, or transactions or calls may not be based on the consensus mechanism.
  • multiple management nodes in the blockchain receive a request for acquiring the subscription data sent from the BCHF.
  • the management node sends its own node information f (index_bc) and the storage address fragments to the BCHF after determining that the roaming operation equipment meets the authority to obtain subscription data.
  • the BCHF may determine whether the subscription data can be acquired according to the subscription data response message in various situations:
  • Case 1 If the number of different node information f (index_bc) received by the BCHF within the preset time period is less than the threshold number t, it is determined that the roaming operation device does not have the authority to call the subscription data in the data server , Terminate the process.
  • Case 2 If the number of different node information f (index_bc) received by the BCHF within the preset time period is equal to or greater than t, the roaming operation device obtains storage address fragments from the received subscription data response message , And then determine a complete storage address according to the storage address fragments, and finally obtain the contract data from the data server according to the complete storage address.
  • the roaming operation device receives the subscription data response messages sent by 4 blockchain management nodes within a preset time period. For example, the subscription data response message 1 sent by the management node 1, the subscription data response message containing storage address fragment 1; the subscription data response message 2 sent by the management node 2, the subscription data response message containing storage address fragment 2; The subscription data response message 3 sent by the management node 3, the subscription data response message contains the storage address fragment 3; the subscription data response message 4 sent by the management node 4, the subscription data response message contains the storage address fragment 4.
  • the execution can continue.
  • the roaming operation equipment may determine the complete storage address fragments according to the storage address fragments in all the received subscription data response messages; or, the roaming operation equipment may select a threshold number of data from all the received subscription data response messages.
  • the subscription data response message, and then the complete storage address fragmentation is determined according to the storage address fragmentation in the selected subscription data response message.
  • the roaming operation device selects storage address fragment 1, storage address fragment 3, and storage address fragment 4. Then, the roaming operation device determines a complete storage address according to the selected three storage address fragments. Finally, the roaming operation device obtains the subscription data from the data server according to the complete storage address. Then, the successful execution log of this calling process is recorded in the blockchain.
  • a network element of the present application is located in the roaming network.
  • the network element includes a processor 600, a memory 601, and a communication interface 602.
  • the processor 600 is responsible for managing the bus architecture and general processing, and the memory 601 can store data used by the processor 600 when performing operations.
  • the transceiver communication interface 602 is used for receiving and sending data under the control of the processor 600 for data communication with the memory 601.
  • the processor 600 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 600 may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the memory 601 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other various media that can store program codes.
  • the processor 600, the memory 601, and the communication interface 602 are connected to each other.
  • the processor 600, the memory 601, and the communication interface 602 may be connected to each other through a bus 603; the bus 603 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 6, but it does not mean that there is only one bus or one type of bus.
  • the processor 600 is configured to read a program in the memory 601 and execute:
  • It is used to receive a request message from a second network element through a communication interface; wherein the second network element is in the roaming area of the terminal device, and the request message is used to request subscription data of the terminal device;
  • the security token of the terminal device the security token is used to verify whether the second network element has the authority to obtain the subscription data; the security token is provided to the blockchain, and the security token is provided to the zone
  • the block chain queries the contract data; if the verification is passed, obtain the address information of the contract data from the block chain; send the address information of the contract data to the second network element.
  • the processor 600 is specifically configured to:
  • the processor 600 is specifically configured to:
  • the identification of the terminal device is provided to the blockchain, where the identification of the terminal device is used to determine the subscription data corresponding to the terminal device.
  • the processor 600 is further configured to:
  • the first network element is the blockchain processing function BCHF in the roaming network or the BCHF in the blockchain.
  • the second network element is an access and mobility management function AMF or a session management function SMF in the roaming network.
  • the processor 600 is specifically configured to:
  • the present application provides a network element in the contracted network.
  • the network element includes: at least one processing unit 700, at least one storage unit 701, and at least one communication unit 702, wherein:
  • the communication unit 702 is configured to receive and send data under the control of the processing unit 700, and the storage unit 701 stores program code.
  • the processing unit 700 performs the following process:
  • It is used to receive a request message from a second network element through a communication unit; wherein the second network element is in the roaming area of the terminal device, and the request message is used to request subscription data of the terminal device;
  • the security token of the terminal device the security token is used to verify whether the second network element has the authority to obtain the subscription data; the security token is provided to the blockchain, and the security token is provided to the zone
  • the block chain queries the contract data; if the verification is passed, obtain the address information of the contract data from the block chain; send the address information of the contract data to the second network element.
  • the processing unit 700 is specifically configured to:
  • the processing unit 700 is specifically configured to:
  • the identification of the terminal device is provided to the blockchain, where the identification of the terminal device is used to determine the subscription data corresponding to the terminal device.
  • the processing unit 700 is further configured to:
  • the first network element is the blockchain processing function BCHF in the roaming network or the BCHF in the blockchain.
  • the second network element is an access and mobility management function AMF or a session management function SMF in the roaming network.
  • the processing unit 700 is specifically configured to:
  • an embodiment of the present application also provides a network device that is in a network to which the terminal device is subscribed.
  • the network device includes a processor 800, a memory 801, and a communication interface 802.
  • the processor 800 is responsible for managing the bus architecture and general processing, and the memory 801 can store data used by the processor 800 when performing operations.
  • the transceiver communication interface 802 is used to receive and send data under the control of the processor 800 for data communication with the memory 801.
  • the processor 800 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 800 may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the memory 801 may include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other various media that can store program codes.
  • the processor 800, the memory 801, and the communication interface 802 are connected to each other.
  • the processor 800, the memory 801, and the communication interface 802 may be connected to each other through a bus 803; the bus 803 may be a peripheral component interconnect (PCI) bus or an extended industry Standard structure (extended industry standard architecture, EISA) bus, etc.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or one type of bus.
  • the processor 800 is configured to read a program in the memory 801 and execute:
  • It is used to store the contract data obtained by contracting with the terminal device in the data server; receive the storage address of the contract data from the data server; store the storage address in the blockchain; wherein, the first network The device is in the contracted network of the terminal device; the authority certificate is sent to the blockchain, and the authority certificate is used to verify the authority to obtain the contract data.
  • the processor 800 determines the authority credential in the following manner:
  • the device generates a first random number, and generates the authority certificate according to the first random number.
  • the processor 800 is further configured to:
  • the first random number is sent to the terminal device, where the first random number is used to generate a security token, and the security token is used to verify a right to obtain subscription data.
  • the processor 800 is specifically configured to:
  • the device generates the authority credential according to the first random number, the identity of the second network device, and the second random number.
  • the processor 800 is further configured to:
  • the identity of the second network device is determined according to the roaming agreement with the second network device, and the second network device is in the roaming network of the terminal device.
  • the present application provides a network device that is in a contracted network where a terminal device is located.
  • the network device includes: at least one processing unit 900, at least one storage unit 901, and at least one communication unit 902, wherein The communication unit 902 is configured to receive and send data under the control of the processing unit 900, and the storage unit 901 stores program code.
  • the processing Unit 900 performs the following process:
  • the processing unit 900 determines the authority credential in the following manner:
  • the device generates a first random number, and generates the authority certificate according to the first random number.
  • the processing unit 900 is further configured to:
  • the first random number is sent to the terminal device, where the first random number is used to generate a security token, and the security token is used to verify a right to obtain subscription data.
  • the processing unit 900 is specifically configured to:
  • the device generates the authority credential according to the first random number, the identity of the second network device, and the second random number.
  • the processing unit 900 is further configured to:
  • the identity of the second network device is determined according to the roaming agreement with the second network device, and the second network device is in the roaming network of the terminal device.
  • an embodiment of the present application provides a terminal for managing subscription data.
  • the terminal 1000 includes: a radio frequency (RF) circuit 1010, a power supply 1020, a processor 1030, a memory 1040, an input unit 1050, Components such as a display unit 1060, a camera 1070, a communication interface 1080, and a wireless fidelity (Wireless Fidelity, WiFi) module 1090.
  • RF radio frequency
  • the terminal provided in the embodiment of the present application may include more or less components than those shown in the figure, or some components may be combined. Or different component arrangements.
  • the RF circuit 1010 can be used to receive and send data during a communication or call. In particular, after the RF circuit 1010 receives the downlink data of the base station, it sends it to the processor 1030 for processing; in addition, it sends the uplink data to be sent to the base station.
  • the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, and the like.
  • LNA low noise amplifier
  • the RF circuit 1010 can also communicate with the network and other terminals through wireless communication.
  • the wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code Division Multiple Access). Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), Email, Short Messaging Service (SMS), etc.
  • GSM Global System of Mobile Communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • Email Short Messaging Service
  • the WiFi technology belongs to a short-range wireless transmission technology.
  • the terminal 1000 can be connected to an access point (AP) through the WiFi module 1090, thereby achieving data network access.
  • the WiFi module 1090 can be used to receive and send data in the communication process.
  • the terminal 1000 may be physically connected with other terminals through the communication interface 1080.
  • the communication interface 1080 is connected to the communication interface of the other terminal through a cable to realize data transmission between the terminal 1000 and the other terminal.
  • the terminal 1000 can implement communication services and send information to other contacts. Therefore, the terminal 1000 needs to have a data transmission function, that is, the terminal 1000 needs to include a communication module inside.
  • FIG. 10 shows communication modules such as the RF circuit 1010, the WiFi module 1090, and the communication interface 1080, it is understandable that at least one of the above-mentioned components or other components are present in the terminal 1000 A communication module (such as a Bluetooth module) that realizes communication for data transmission.
  • the terminal 1000 when the terminal 1000 is a mobile phone, the terminal 1000 may include the RF circuit 1010, and may also include the WiFi module 1080; when the terminal 1000 is a computer, the terminal 1000 may include the communication
  • the interface 1080 may also include the WiFi module 1090; when the terminal 1000 is a tablet computer, the terminal 1000 may include the WiFi module.
  • the memory 1040 can be used to store software programs and modules.
  • the processor 1030 executes various functional applications and data processing of the terminal 1000 by running the software programs and modules stored in the memory 1040, and when the processor 1030 executes the program code in the memory 1040, it can be implemented Part or all of the processes in Fig. 3 and/or Fig. 4 in the embodiment of the present application.
  • the memory 1040 may mainly include a program storage area and a data storage area.
  • the storage program area can store operating systems, various application programs (such as communication applications), and face recognition modules, etc.
  • the storage data area can store data created based on the use of the terminal (such as various pictures, video files, etc.) Multimedia files, and face information templates), etc.
  • the memory 1040 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • a non-volatile memory such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • the input unit 1050 may be used to receive numeric or character information input by the user, and generate key signal input related to user settings and function control of the terminal 1000.
  • the input unit 1050 may include a touch panel 1051 and other input terminals 1052.
  • the touch panel 1051 also called a touch screen, can collect user touch operations on or near it (for example, the user uses any suitable objects or accessories such as fingers, stylus, etc.) on or on the touch panel 1051.
  • the touch panel 1051 may include two parts: a touch detection device and a touch controller.
  • the touch detection device detects the user's touch position, detects the signal brought by the touch operation, and transmits the signal to the touch controller;
  • the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it To the processor 1030, and can receive and execute the commands sent by the processor 1030.
  • the touch panel 1051 can be implemented in multiple types such as resistive, capacitive, infrared, and surface acoustic wave.
  • the other input terminal 1052 may include, but is not limited to, one or more of a physical keyboard, function keys (such as a volume control button, a switch button, etc.), a trackball, a mouse, and a joystick.
  • function keys such as a volume control button, a switch button, etc.
  • a trackball such as a mouse, and a joystick.
  • the display unit 1060 may be used to display information input by the user or information provided to the user and various menus of the terminal 1000.
  • the display unit 1060 is the display system of the terminal 1000, and is used for presenting an interface and realizing human-computer interaction.
  • the display unit 1060 may include a display panel 1061.
  • the display panel 1061 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), etc.
  • the touch panel 1051 can cover the display panel 1061, and when the touch panel 1051 detects a touch operation on or near it, it is transmitted to the processor 1030 to determine the type of touch event, Then the processor 1030 provides corresponding visual output on the display panel 1061 according to the type of the touch event.
  • the touch panel 1051 and the display panel 1061 are used as two independent components to implement the input and input functions of the terminal 1000, but in some embodiments, the touch panel may be
  • the control panel 1051 is integrated with the display panel 1061 to realize the input and output functions of the terminal 1000.
  • the processor 1030 is the control center of the terminal 1000, uses various interfaces and lines to connect various components, runs or executes software programs and/or modules stored in the memory 1040, and invokes the software programs and/or modules stored in the memory 1040.
  • the data in 1040 executes various functions of the terminal 1000 and processes data, thereby realizing multiple services based on the terminal.
  • the processor 1030 is configured to read a program in the memory 1040 and execute:
  • the processor 1030 may include one or more processing units.
  • the processor 1030 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 1030.
  • the camera 1070 is used for realizing the shooting function of the terminal 1000 and shooting pictures or videos.
  • the camera 1070 can also be used to realize the scanning function of the terminal 1000 to scan the scanned object (two-dimensional code/barcode).
  • the terminal 1000 further includes a power source 1020 (such as a battery) for supplying power to various components.
  • a power source 1020 such as a battery
  • the power supply 1020 may be logically connected to the processor 1030 through a power management system, so that functions such as charging, discharging, and power consumption can be managed through the power management system.
  • the terminal 1000 may also include at least one sensor, an audio circuit, etc., which will not be repeated here.
  • the memory 1040 may store the same program code as the storage unit 1001, and when the program code is executed by the processor 1030, the processor 1030 enables the processor 1030 to implement all the functions of the processing unit 1000.
  • various aspects of the contract data management method provided in the embodiments of the present application can also be implemented in the form of a program product, which includes program code, when the program code runs on a computer device At the time, the program code is used to make the computer device execute the steps in the contract data management method according to various exemplary embodiments of the present application described in this specification.
  • the program product can use any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the management program product for executing a contract data may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may run on a server device.
  • CD-ROM portable compact disk read-only memory
  • the program product of this application is not limited to this.
  • the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with information transmission, devices, or devices.
  • the readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing.
  • the readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with a periodic network action system, apparatus, or device.
  • the program code contained on the readable medium can be transmitted by any suitable medium, including, but not limited to, wireless, wired, optical cable, RF, etc., or any suitable combination of the above.
  • the program code used to perform the operations of the present application can be written in any combination of one or more programming languages.
  • the programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language.
  • the program code can be executed entirely on the user's computing device, partly on the user's device, executed as an independent software package, partly on the user's computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on.
  • the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device.
  • LAN local area network
  • WAN wide area network
  • the embodiment of the present application also provides a storage medium readable by a computing device for a method for managing contract data executed by a network device, that is, the content is not lost after a power failure.
  • the storage medium stores a software program, including program code.
  • the program code runs on a computing device, the software program can implement any of the above embodiments of the present application when it is read and executed by one or more processors. Contract data management plan.
  • the embodiment of the present application also provides a storage medium readable by a computing device for a method for managing contract data executed by a terminal device, that is, the content is not lost after a power failure.
  • the storage medium stores a software program, including program code.
  • the program code runs on a computing device, the software program can implement any of the above embodiments of the present application when it is read and executed by one or more processors. Contract data management plan.
  • this application can also be implemented by hardware and/or software (including firmware, resident software, microcode, etc.).
  • this application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium to be used or used by the instruction execution system. Used in conjunction with the instruction execution system.
  • a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, transmit, or transmit a program for use by an instruction execution system, apparatus, or device, or in combination with an instruction execution system, Device or equipment use.

Abstract

本申请涉及通信技术领域，公开一种签约数据的管理方法、装置及系统。方法包括：第一网元接收来自第二网元的用于获取签约数据的请求消息；所述第一网元获取所述终端设备的安全令牌，所述安全令牌用于验证获取签约数据的权限；所述第一网元向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；若验证通过，所述第一网元获取来自所述区块链的所述签约数据的地址信息，并向所述第二网元发送所述签约数据的地址信息。该方法通过区块链确定获取签约数据的权限，使签约地网络设备不参与时，满足条件的拜访地网络设备仍可获取签约数据，减轻了签约地网络设备的通信负担，解决了拜访地网络设备无法及时获取签约数据提供通信服务的问题。

Description

一种签约数据的管理方法、装置
相关申请的交叉引用
本申请要求在2019年11月08日提交中国专利局、申请号为201911089880.3、申请名称为“一种签约数据的管理方法、装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种签约数据的管理方法、装置。
背景技术
终端设备在选择某个运营商的服务时，需要向该运营商进行签约，以获得在常驻的服务区域(即签约服务区域)内享受较低服务资费的权利。当终端设备移动到其他服务内，则需要通过漫游接入到该服务区域内的通信网络。其中，终端设备签约服务区域以外的其他服务区域可以称为漫游服务区域。终端设备在漫游服务区域内进行通信时，服务资费较高。运营商在签约服务区域内提供的通信网络可以简称为签约地网络，运营商在漫游服务区域内提供的通信网络可以简称为拜访地网络。
终端设备在进入任一服务区域后，需要该服务区域内的通信网络中的网络设备根据所述终端设备的签约数据为所述终端设备提供通信服务。其中，所述签约数据是由所述终端设备与签约地网络中的网络设备之间签订的。
以国际通信为例：通信网络1为终端设备的签约地网络，通信网络2为终端设备的拜访地网络。当终端设备A接入通信网络1时，所述通信网络1根据所述终端设备的签约数据为所述终端设备提供通信服务。当所述终端设备离开签约服务区域后，漫游接入通信网络2时，所述通信网络2获取通信网络1与所述终端设备签约的签约数据，然后，根据所述签约数据为所述终端设备提供通信服务。
目前，签约地网络与终端设备签约的签约数据一般保存在签约地网络中的网络设备中。因此拜访地网络中的网络设备需要从签约地网络中的网络设备获取所述终端设备的签约数据。
现有的拜访地网络中的网络设备获取签约数据的方案中，包括以下步骤：
拜访地网络中的网络设备A向签约地网络中的网络设备B发送获取所述签约数据的请求；
然后，网络设备B判断网络设备A是否符合所述网络设备B制定的漫游合约，并查询所述终端设备的当前位置信息，判断所述终端设备是否正在所述拜访地网络进行通信业务，其中，所述漫游合约包含能够调用所述签约数据的网络设备限制条件。当所述网络设备B在确定所述网络设备A满足所述漫游合约后，所述网络设备B将所述签约数据发送给网络设备A。
上述获取签约数据的方案中，所述网络设备A和网络设备B之间需要多次交互，网络设备B会产生较大的系统开销。此外，若所述网络设备B处于故障状态或者休息状态时，网络设备A无法及时的获取所述签约数据，从而无法为所述终端设备提供通信服务。
发明内容
本申请提供一种签约数据的管理方法、装置，用以解决拜访地网络中的网络设备获取签约数据时，若签约地网络中的网络设备处于故障状态或者休息状态，无法为所述终端设备提供通信服务的问题。
第一方面，本申请实施例提供一种签约数据的管理方法，包括：
第一网元接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；所述第一网元获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；所述第一网元向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；若验证通过，所述第一网元获取来自所述区块链的所述签约数据的地址信息；所述第一网元向所述第二网元发送所述签约数据的地址信息。
基于该方案，拜访地网络设备，例如所述第二网元，在需要获取终端设备的签约数据时，通过向区块链进行权限验证，在验证通过后实现签约数据的获取，减少了与签约地网络设备的交互，由此节省了签约地网络设备的信令开销以及功耗。同时，该方法中所述拜访地网络设备在需要获取签约数据时，无需通过所述签约地网络设备，从而在签约地网络设备处于故障或者休息状态时，仍可使所述拜访地网络设备在满足获取签约数据的条件下，顺利获取到所述终端设备的签约数据，从而保障所述终端设备在拜访地网络中能够顺利进行通信。进一步的，通过区块链实现对所述拜访地网络设备的权限验证，能够有效安全的记录每次申请签约数据的流程信息，且具有可追溯性，提升了漫游业务的安全性。
在一种可能的实现方式中，所述第一网元从本地获取所述安全令牌；或所述第一网元接收所述第二网元发送的所述安全令牌。
在一种可能的实现方式中，所述第一网元从接收到的所述请求消息中获取所述安全令牌，其中，所述请求消息中携带所述安全令牌。
在一种可能的实现方式中，所述第一网元向所述区块链查询所述签约数据时，所述第一网元向所述区块链提供所述终端设备的标识，其中，所述终端设备的标识用于确定所述终端设备对应的签约数据。
在一种可能的实现方式中，所述第一网元获取来自所述区块链的所述签约数据的地址信息后，所述第一网元解密所述签约数据的地址信息，获取所述签约数据在数据库中的存储地址。
在一种可能的实现方式中，所述第一网元为所述漫游地网络中的区块链处理功能(Block Chain Handling Function，BCHF)或所述区块链中的BCHF。
在一种可能的实现方式中，所述第二网络设备为所述漫游地网络中的接入和移动管理功能(Access and Mobility Management Function，AMF)或会话管理功能(Session Management Function，SMF)。
在一种可能的实现方式中，所述第一网络设备调用所述区块链中的权限合约，以查询所述签约数据。
第二方面，本申请实施例提供一种签约数据的管理方法，包括：
第二网元向第一网元发送请求消息；所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；所述第二网元接收所述第一网元发送的所 述签约数据的地址信息；所述第二网元根据所述签约数据的地址信息获取所述签约数据。
在一种可能的实现方式中，所述请求消息中携带安全令牌；所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限。
在一种可能的实现方式中，所述第二网元向所述第一网元发送获取签约数据的请求消息之后，所述第二网元在接收到所述第一网元发送的获取所述安全令牌的请求后，将所述安全令牌发送给所述第一网元。
在一种可能的实现方式中，所述第二网元根据所述签约数据的地址信息，从数据库中获取所述签约数据。
在一种可能的实现方式中，所述第一网元为所述漫游地网络中的BCHF或所述区块链中的BCHF。
在一种可能的实现方式中，所述第二网元为所述漫游地网络中的AMF或SMF。
第三方面，本申请实施例提供一种签约数据的管理方法，包括：
第一网络设备将与终端设备签约得到的签约数据存储到数据服务器；所述第一网络设备接收来自所述数据服务器的所述签约数据的存储地址；所述第一网络设备将所述存储地址存储到区块链；其中，所述第一网络设备处于所述终端设备的签约地网络中；所述第一网络设备将权限凭证发送给区块链，所述权限凭证用于验证获取签约数据的权限。
基于该方案，签约地网络设备确定签约数据后，将所述签约数据在数据服务器中的存储地址存储到区块链中，并且将验证拜访地网络设备获取签约数据的权限下放到区块链。从而使区块链具有验证获取签约数据的权限，所述拜访地网络设备可通过向区块链进行权限验证，在验证通过后实现签约数据的获取，减少了与签约地网络设备的交互，由此节省了签约地网络设备的信令开销以及功耗。同时，该方法中所述拜访地网络设备在需要获取签约数据时，无需通过所述签约地网络设备，从而在签约地网络设备处于故障或者休息状态时，仍可使所述拜访地网络设备在满足获取签约数据的条件下，顺利获取到所述终端设备的签约数据，从而保障所述终端设备在拜访地网络中能够顺利进行通信。进一步的，通过区块链实现对所述拜访地网络设备的权限验证，能够有效安全的记录每次申请签约数据的流程信息，且具有可追溯性，提升了漫游业务的安全性。
在一种可能的实现方式中，所述第一网络设备通过下列方式确定所述权限凭证：所述第一网络设备生成第一随机数，根据所述第一随机数生成所述权限凭证。
在一种可能的实现方式中，所述第一网络设备生成第一随机数之后，所述第一网络设备将所述第一随机数发送给所述终端设备，其中，所述第一随机数用于生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
在一种可能的实现方式中，所述第一网络设备接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数与所述第二随机数生成所述权限凭证；或所述第一网络设备接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证。
在一种可能的实现方式中，若所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证，则所述方法还包括：所述第一网络设备根据与所述第二网络设备之间的漫游协议确定所述第二网络设备的身份标识，所述第二网络设备处于所述终端设备的漫游地网络中。
第四方面，本申请实施例提供一种签约数据的管理方法，包括：
终端设备接收第一网络设备发送的第一随机数；所述终端设备根据所述第一随机数生成安全令牌，并将所述安全令牌发送给第一网元；其中，所述安全令牌用于验证获取签约数据的权限，所述第一网元处于所述终端设备的漫游地中。
基于该方案，提出了一种通过生成安全令牌，并对所述安全令牌进行验证，确定是否具有获取签约数据的方式，方式更为新颖，简单。
第五方面，本申请实施例提供一种签约数据的管理方法，包括：
区块链节点接收来自第一网元的查询请求，所述查询请求包括安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；所述区块链节点验证所述安全令牌是否有效；若有效，所述区块链节点调用存储合约，获取所述签约数据的地址信息；所述区块链节点向所述第一网元返回所述地址信息。
基于该方案，拜访地网络设备需要获取终端设备的签约数据时，通过向区块链进行权限验证，在验证通过后实现签约数据的获取，减少了与签约地网络设备的交互，由此节省了签约地网络设备的信令开销以及功耗。同时，该方法中所述拜访地网络设备在需要获取签约数据时，无需通过所述签约地网络设备，从而在签约地网络设备处于故障或者休息状态时，仍可使所述拜访地网络设备在满足获取签约数据的条件下，顺利获取到所述终端设备的签约数据，从而保障所述终端设备在拜访地网络中能够顺利进行通信。进一步的，通过区块链实现对所述拜访地网络设备的权限验证，能够有效安全的记录每次申请签约数据的流程信息，且具有可追溯性，提升了漫游业务的安全性。
在一种可能的实现方式中，所述区块链节点验证所述安全令牌是否有效包括：验证所述安全令牌和权限凭证是否一致，所述权限凭证用于验证所述第二网元是否具有获取所述签约数据的权限。
在一种可能的实现方式中，所述区块链节点调用存储合约包括：所述区块链节点根据所述区块链的共识算法调用所述存储合约。
在一种可能的实现方式中，所述区块链节点获得多个加密后的地址信息。
在一种可能的实现方式中，所述区块链节点执行解密过程。
在一种可能的实现方式中，所述区块链节点记录所述签约数据取回的执行日志。
第六方面，本申请实施例提供一种签约数据的管理方法，包括：第一网络设备与第二网络设备签订漫游协议；所述第一网络设备发布智能合约为所述第二漫游设备开通权限。
在一种可能的实现方式中，第一网络设备处于终端设备的签约地，第二网络设备处于终端设备的签约地。
第七方面，本申请实施例提供一种通信装置，该通信装置具有实现上述实施例中的网元的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信装置可以是拜访地网络中的第一网元，或者是可用于所述网元的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示第一网元的相应功能，该收发器用 于支持该通信装置与其他网元(例如第二网元)和服务器(例如区块链)等之间的通信。可选地，该通信装置还可以包括存储器，该存储器可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
在另一种可能的实现方式中，该通信装置可以是拜访地网络中的第二网元，或者是可用于所述第二网元的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示第二网元的相应功能，该收发器用于支持该通信装置与其他网元(第一网元)和终端设备等之间的通信。可选地，该通信装置还可以包括存储器，该存储器可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
第八方面，本申请实施例提供一种通信装置，该通信装置具有实现上述实施例中的网络设备的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信装置可以是处于所述终端设备签约地网络中的网络设备，或者是可用于所述网络设备的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示第一网络设备的相应功能，该收发器用于支持该通信装置与网络设备、终端设备、服务器(例如区块链)等之间的通信。可选地，该通信装置还可以包括存储器，该存储器可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
在另一种可能的实现方式中，该通信装置可以是处于所述终端设备拜访地网络中的网络设备，或者是可用于所述网络设备的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示第二网络设备的相应功能，该收发器用于支持该通信装置与网络设备、终端设备、服务器(例如区块链)等之间的通信。可选地，该通信装置还可以包括存储器，该存储器可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
第九方面，本申请实施例提供一种通信装置，该通信装置具有实现上述实施例中的服务器的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信装置可以是区块链，或者是可用于所述区块链的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示区块链的相应功能，该收发器用于支持该通信装置与网络设备和终端设备等之间的通信。可选地，该通信装置还可以包括存储器，该存储可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
在另一种可能的实现方式中，该通信装置可以是数据服务器，或者是可用于所述数据 服务器的部件，例如芯片或芯片系统或者电路，该通信装置可以包括：收发器和处理器。该处理器可被配置为支持该通信装置执行以上所示数据服务器的相应功能，该收发器用于支持该通信装置与网络设备和其它服务器(例如区块链)等之间的通信。可选地，该通信装置还可以包括存储器，该存储器可以与处理器耦合，其保存该通信装置必要的程序指令和数据。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。
第十方面，本申请实施例提供一种通信装置，用于实现上述第一方面至第六方面中的任一方面；或第一方面至第六方面中的任意一种方法。
在一种可能的实施方式中，该通信装置为处于拜访地网络中的第一网元时，可以包括：处理单元和通信单元：
所述通信单元，用于接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；
所述处理单元，用于获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；以及若验证通过，获取来自所述区块链的所述签约数据的地址信息；
所述通信单元，用于向所述第二网元发送所述签约数据的地址信息。
在一种可能的实施方式中，该通信装置为处于拜访地网络中的第二网元时，可以包括：处理单元和通信单元：
所述处理单元，用于向第一网元发送请求消息；所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；
所述通信单元，用于接收所述第一网元发送的所述签约数据的地址信息；
所述处理单元，用于根据所述签约数据的地址信息获取所述签约数据。
在一种可能的实施方式中，该通信装置为处于所述终端设备签约地网络中的网络设备时，可以包括：处理单元和通信单元：
所述处理单元，用于将与终端设备签约得到的签约数据存储到数据服务器；
所述通信单元，用于接收来自所述数据服务器的所述签约数据的存储地址；
所述处理单元，还用于将所述存储地址存储到区块链；其中，所述第一网络设备处于所述终端设备的签约地网络中；
所述通信单元，还用于将权限凭证发送给区块链，所述权限凭证用于验证获取签约数据的权限。
在一种可能的实施方式中，该通信装置为终端设备时，可以包括：处理单元和通信单元：
所述通信单元，用于接收第一网络设备发送的第一随机数；
所述处理单元，用于根据所述第一随机数生成安全令牌；
所述通信单元，还用于将所述安全令牌发送给第一网元；其中，所述安全令牌用于验证获取签约数据的权限，所述第一网元处于所述终端设备的漫游地中。
在一种可能的实施方式中，该通信装置为区块链时，可以包括：处理单元和通信单元：
所述通信单元，用于接收来自第一网元的查询请求，所述查询请求包括安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；
所述处理单元，用于验证所述安全令牌是否有效；
以及若有效，所述处理单元还用于调用存储合约，获取所述签约数据的地址信息；
所述通信单元，还用于向所述第一网元返回所述地址信息。
第十一方面，本申请实施例提供一种通信系统，该通信系统包括拜访地网络中的网络设备、签约地网络中的网络设备、终端设备、区块链和数据服务器。其中，拜访地网络中的网络设备可以用于执行上述第一、二方面中任意一面或第一方面中的任意一种方法；签约地网络中的网络设备可以用于执行上述第三、六方面中任意一面或第三、六方面中的任意一种方法；终端设备可以用于执行上述第四方面或第四方面中的任意一种方法；区块链可以用于执行上述第五方面或第五方面中的任意一种方法。
第十二方面，本申请提供了一种芯片系统，包括处理器。可选地，还可包括存储器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行计算机程序，使得安装有芯片系统的通信装置执行上述第一方面至第六面中任意一面；或者执行上述第一方面至第六方面中的任意一种方法。
第十三方面，本申请实施例提供一种计算机存储介质，计算机存储介质中存储有指令，当其在通信装置上运行时，使得该通信装置执行上述第一方面至第六面中任意一面；或执行上述第一方面至第六方面中的任意一种方法。
第十四方面，本申请实施例提供一种包含指令的计算机程序产品，当其在通信装置上运行时，使得该通信装置执行上述第一方面至第六面中任意一面；或执行上述第一方面至第六方面中的任意一种方法。
附图说明
图1为本申请提供的一种通信系统架构图；
图2为本申请提供的漫游运营设备与归属运营设备签订漫游协议示意图；
图3为本申请提供的终端设备与归属运营设备进行签约的流程示意图；
图4为本申请提供的漫游过程中的AMF网元进行签约数据访问控制的流程示意图；
图5为本申请提供的漫游过程中的SMF网元进行签约数据访问控制的示意图；
图6为本申请提供的第一种拜访地网络中的网元示意图；
图7为本申请提供的第二种拜访地网络中的网元设备示意图；
图8为本申请提供的第一种签约地网络中的网络设备示意图；
图9为本申请提供的第二种签约地网络中的网络设备示意图；
图10为本申请提供的一种终端设备示意图。
具体实施方式
下面将结合附图对申请实施例的具体实施过程进行详尽的描述。
本申请实施例提供一种签约数据的管理方法。本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统，全球互联微波接入(worldwide  interoperability for microwave access，WiMAX)通信系统，未来的第五代(5th Generation，5G)系统，如新一代无线接入技术(new radio access technology，NR)，及未来的通信系统，如6G系统等。
以5G系统(也可以称为New Radio系统)为例，具体来说，为了保障终端设备在拜访地网络中能够顺利进行通信，本申请使区块链具有验证获取签约数据的权限。
通过该方法，拜访地网络设备需要获取终端设备的签约数据时，通过向区块链进行权限验证，在验证通过后实现签约数据的获取，减少了与签约地网络设备的交互，由此节省了签约地网络设备的信令开销以及功耗。同时，该方法中所述拜访地网络设备在需要获取签约数据时，无需通过所述签约地网络设备，从而在签约地网络设备处于故障或者休息状态时，仍可使所述拜访地网络设备在满足获取签约数据的条件下，顺利获取到所述终端设备的签约数据，从而保障所述终端设备在拜访地网络中能够顺利进行通信。
进一步的，通过区块链实现对所述拜访地网络设备的权限验证，能够有效安全的记录每次申请签约数据的流程信息，且具有可追溯性，提升了漫游业务的安全性。
为便于理解本申请实施例，首先以图1中示出的通信系统为例详细说明本申请实施例适用的通信系统。如图1所示，该通信系统包括拜访地网络中的网络设备100、终端设备101、签约地网络中的网络设备102、区块链103、数据服务器104。其中，为方便描述，本申请实施例中将处于所述终端设备拜访地网络中的网络设备简称为漫游运营设备，将处于所述终端设备签约地网络中的网络设备简称为归属运营设备。
漫游运营设备100，位于所述拜访地网络中的网络设备，用于在满足获取签约数据的条件时，获取所述终端设备101与归属运营设备102之间的签约数据，然后为接入的所述终端设备101在所述拜访地网络中提供无线通信功能。所述漫游运营设备100还可以确定所述终端设备101在所述拜访地网络中进行通信产生的漫游费用，向所述归属运营设备102通知并收取所述漫游费用。
其中，漫游运营设备100也可称为基站(base station，BS)。目前，一些漫游运营设备100的举例为：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
进一步的，所述漫游运营设备100中的网元主要包括：会话管理功能(Session Management Function，SMF)、接入和移动管理功能(Access and Mobility Management Function，AMF)、区块链处理功能(BlockChain Handling Function，BCHF)等等。
终端设备101，是一种向用户提供语音和/或数据连通性的设备，也可以称为用户设备(user equipment，UE)、接入终端设备、用户单元、用户站、移动站、移动台、远方站、远程终端设备、移动设备、用户终端设备、终端设备、无线通信设备、用户代理或用户装置。本申请的实施例中的终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端设备、无人驾驶(self driving)中的无线终端设备、远程医疗(remote medical)中的无线终端设备、智能电网(smart grid) 中的无线终端设备、运输安全(transportation safety)中的无线终端设备、智慧城市(smart city)中的无线终端设备、智慧家庭(smart home)中的无线终端设备等等。
归属运营设备102，位于所述签约地网络中的网络设备，用于在所述签约地网络中为接入的终端设备101提供无线通信功能。其中，所述归属运营设备102还用于核算所述漫游运营设备100发送的所述终端设备101进行漫游服务产生的漫游费用，并在确定所述漫游费用没有问题后向所述漫游运营设备100支付所述漫游费用；以及制定并收取所述终端设备101所述漫游费用。
其中，归属运营设备101也可称为基站(base station，BS)。目前，一些归属运营设备101的举例为：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
进一步的，所述归属运营设备102中包括的网元主要包括：SMF、BCHF、UDM(Unified Data Management，统一数据管理)等等。
区块链103，以区块作为数据结构的去中心化的数据库，具有分布式存储和处理功能，在通信系统中用于存储相关数据信息，以及根据接收到的信息更新存储的数据信息，或者根据接收到的信息返回对应信息。其中，区块链中的每个区块包含区块体和区块头，区块体存储交易记录。交易记录根据具体的应用场景需要，可以为转账记录、智能合约记录、清算记录、数据记录等。区块头存储时间戳、交易的哈希汇总结果，以及使之和前序区块形成链式结构的必要信息，如前序区块的哈希值。这种链式结构保证了，一旦一个区块被所有节点共识后加入到各自的区块副本上后，该区块将不可被更改，可以为每一次访问记录有效凭证。
数据服务器104，具有存储和处理功能，在通信系统中用于存储相关数据信息，根据接收到的信息更新存储的数据信息，或者根据接收到的信息返回对应信息。
其中，本申请实施例中的数据服务器104可以为数据库，用于存储本申请实施例中的签约数据；当所述签约数据处于加密状态时，还可用于存储所述加密后的签约数据。
本申请实施例中的第一网元可以是所述漫游运营设备100中的BCHF或所述区块链103中的BCHF。本申请实施例中的第二网元可以是所述漫游运营设备100中的AMF或SMF。
本申请实施例中归属运营设备可以是第一网络设备，换言之，第一网络设备可以是归属地(或称为签约地)网络中的一个或多个网元，也可以是归属地网络中一个或多个功能模块，本申请实施例对第一网络设备的具体形态和结构不作限定。
本申请实施例中漫游运营设备可以是第二网络设备，换言之，第二网络设备可以是漫游地(或称为拜访地)网络中的一个或多个网元，也可以是漫游地网络中一个或多个功能模块，本申请实施例对第二网络设备的具体形态和结构不作限定。
其中，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，例如，本申请实施例中可不包含数据服务器104，即本申请实施例中可以将所述数据服务器中存储的相关信息 存储到所述区块链103中。因此，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。应理解，图1仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备或者还可以包括其他终端设备，图1中未予以画出。
以下再对本申请实施例中涉及的部分用语进行解释说明，以便于理解。
1)权限合约，本质上是一段在区块链中运行的程序，由事件驱动执行。具有确定性、实时性、自治性、可观察、可验证、去中心化方面的特点，在数字金融、大数据、物联网等方面具有广泛的研究和应用。
其中，基于区块链的权限合约包含数据的接收、处理和状态记录。当合约账户接收到某个或某几个输入信息满足状态转移的触发条件，则根据预设信息选择合约动作自动执行，并记录当前状态。因此，权限合约作为一种计算机技术，能够保证在不引入可信第三方的条件下，强制履行合约，保证合约程序的可信安全。
进一步的，本申请实施例中所述权限合约中包含有归属运营设备生成的权限凭证，用于验证获取签约数据的权限。
2)区块链，是分布式数据存储、点对点传输、共识机制、加密算法等计算机技术的新型应用模式，它本质上是一个去中心化的数据库。
其中，区块链技术不依赖额外的第三方管理机构或硬件设施，没有中心管制，除了自成一体的区块链本身，通过分布式核算和存储，各个节点实现了信息自我验证、传递和管理。其中，去中心化是区块链最突出最本质的特征。
3)分布式账本，是指的交易记账由分布在不同地方的多个节点共同完成，而且每一个节点记录的是完整的账目，因此它们都可以参与监督交易合法性，同时也可以共同为其作证。
4)共识机制，是指所有节点之间怎么达成共识，去认定一个记录的有效性，这既是认定的手段，也是防止篡改的手段。所述共识机制具备“少数服从多数”以及“人人平等”的特点。
其中“少数服从多数”并不完全指节点个数，也可以是计算能力、股权数或者其他的计算机可以比较的特征量。“人人平等”是当节点满足条件时，所有节点都有权优先提出共识结果、直接被其他节点认同后并最后有可能成为最终共识结果。
5)对称加密算法，主要指加密和解密使用相同密钥的加密算法。在应用对称加密算法进行加密通信时，要求发送方和接收方在安全通信之前，商定一个密钥。
其中，加密密钥能够从解密密钥中推算出来，同时解密密钥也可以从加密密钥中推算出来。在大多数的对称算法中，加密密钥和解密密钥是相同的，所以也称这种加密算法为秘密密钥算法或单密钥算法。
6)非对称加密算法，是指加密和解密使用的是两个不同的密钥，即公开密钥(简称公钥)和私有密钥(简称私钥)，安全性较高。其中，公钥与私钥是一对，如果用公钥对数据进行加密，只有用对应的私钥才能解密。
例如，甲方生成一对密钥并将公钥公开，需要向甲方发送信息的乙方使用甲方的公钥，对机密信息进行加密后再发送给甲方；甲方再用自己私钥对加密后的信息进行解密。而当甲方想要回复乙方时正好相反，甲方使用乙方的公钥对数据进行加密，同理，乙方使用自 己的私钥来进行解密。
另外，本申请实施例中的术语“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中，A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。以下至少一项(个)下或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。
除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。
此外，本申请实施例和权利要求书及附图中的术语“包括”和“具有”不是排他的。例如，包括了一系列步骤或模块的过程、方法、系统、产品或设备，不限定于已列出的步骤或模块，还可以包括没有列出的步骤或模块。
其中，如图2所示，本申请实施例中，所述漫游运营设备获取所述归属运营设备与所述终端设备之间的签约数据之前，所述漫游运营设备需要与所述归属运营设备签订漫游协议。在该过程中，所述归属运营设备获得所述漫游运营设备的公钥(例如，所述公钥PK_v)以及所述漫游运营设备的地址信息(例如，所述地址信息为acc_v)。基于此，所述归属运营设备发布智能合约为所述漫游运营设备开通权限。此外，当所述合约符合交易规则时，则区块链节点达成共识将所述合约记录到链上。
本申请实施例中可将该智能合约称之为权限合约，所述权限合约中记录了所述漫游运营设备的地址信息(例如，记录了acc_v)。
进一步的，本申请实施例中，所述漫游运营设备的公钥(例如，PK_v)对应的私钥保存在漫游运营商的安全网元中。其中，本申请实施例中的BCHF可作为秘密存储和维护所述漫游运营设备的私钥的网元。
下面结合附图分别针对终端设备与归属运营设备进行签约、漫游运营设备获取终端设备的签约数据等两方面内容，对本申请提供的一种签约数据的管理方法进行具体说明。
实施例一、终端设备与归属运营设备进行签约。
当所述终端设备成为所述归属运营设备的签约用户时，所述归属运营设备根据所述终端设备提供的信息与所述终端设备进行签约，并保存签约数据，其中，具体交互流程可如图3所示，具体包括以下步骤：
S300，所述终端设备向所述归属运营设备发送用于进行签约的签约信息。
其中，所述签约信息中包含所述终端设备提供的用于进行签约的必要信息。除此之外，所述签约信息中，若包含所述终端设备身份有效性、实名制相关等信息时，可将所述身份有效性、实名制相关等信息作为签约数据的一部分。
可选的，本申请实施例中所述终端设备向所述归属运营设备发送第二随机数，其中，所述第二随机数用于生成权限凭证。
其中，所述终端设备可以将所述第二随机数携带在所述签约信息中，一起发送给所述归属运营设备；或者所述终端设备可以单独将所述第二随机数发送给所述归属运营设备。
S301，所述归属运营设备确定与所述终端设备的签约数据。
S302，所述归属运营设备将所述签约数据进行加密，得到加密结果，并确定用于解密所述加密结果的第一解密密钥。
本申请实施例中，所述归属运营设备可以通过任何方式对所述签约数据进行加密。
示例性的，例如所述归属运营设备通过对称加密算法对所述签约数据进行加密，则所述第一解密密钥既是用于对所述签约数据进行加密的加密密钥，又是对所述加密结果进行解密，从而得到所述签约数据的解密密钥。
再例如，若所述归属运营设备通过非对称算法对所述签约数据进行加密，则所述第一解密密钥为所述非对称算法中用于进行解密的私钥。其中，所述归属运营设备在对所述签约数据进行加密时，则通过所述私钥对应的公钥进行加密。
需要说明的是，所述步骤S302是非必要步骤，可省去。即本申请实施例中，所述归属运营设备可直接将所述签约数据存储到数据服务器中，即存储到所述数据服务器中的所述签约数据未进行加密处理。
S303，所述归属运营设备将所述加密结果存储到数据服务器。
本申请实施例中，通过将所述加密结果存储到所述数据服务器中，可节省区块链的存储资源，有效释放所述区块链的存储负担。
S304，所述数据服务器在存储所述加密结果后，向所述归属运营设备返回对应的存储地址。
需要说的是，本申请实施例中，所述数据服务器在存储所述终端设备的签约数据时，所述终端设备对应的签约数据可能涉及多种不同业务的签约数据。例如，如表1所示，假设所述终端设备A对应的签约数据为签约数据A、签约数据B、签约数据C，其中签约数据A可以是认证和移动管理相关的签约数据，签约数据B可以是会话管理相关的签约数据，签约数据C可以是策略控制相关的签约数据。
Figure PCTCN2020127442-appb-000001
表1 终端设备对应的签约数据
其中，针对所述终端设备A的不同业务的签约数据，可以将所述终端设备A对应的所有签约数据存储在同一地址中，也可以将所述终端设备A对应的签约数据存储在不同的地址中。
示例性的，在需要对签约数据进行加密存储的情况下，可以将所述签约数据A、签约数据B和签约数据C，整体进行加密，并将加密后的结果存储到所述数据服务器；在不需要对签约数据进行加密存储的情况下，则可以将所述签约数据A、签约数据B和签约数据C，都存储在所述数据服务器的同一地址中。
示例性的，在需要对签约数据进行加密存储的情况下，可以将所述签约数据A、签约数据B和签约数据C分别进行加密，得到加密结果A、加密结果B和加密结果C，并将所述三个加密结果存储到所述数据服务器的不同的地址中。
例如，将所述加密结果A存储到地址1中，将所述加密结果B和加密结果C存储到地址2中；或者将所述加密结果A存储到地址1中，将所述加密结果B存储到地址2中，将所述加密结果C存储到地址3中。其中，所述数据服务器在完成存储后，向所述归属运营设备返回所述终端设备对应的所述签约数据的存储路径的列表。
同理，在不需要对签约数据进行加密存储的情况下，则可以直接将所述签约数据A、签约数据B和签约数据C存储到所述数据服务器的不同的地址中。并在所述数据服务器在完成存储后，向所述归属运营设备返回所述终端设备对应的所述签约数据的存储地址的列表。
S305，所述归属运营设备将所述存储地址和所述第一解密密钥记录在所述区块链中。
本申请实施例一种可选的方式，所述存储地址与所述第一解密密钥可以作为整体，共同存储到所述区块链中，也可以分别存储到所述区块链中。
其中，所述存储地址用于所述漫游运营设备从所述数据服务器中获取所述签约数据(加密结果)，而所述第一解密密钥则用于对获得的加密结果进行解密，得到所述签约数据。
S306，所述归属运营设备生成第一随机数，并将所述第一随机数发送给所述终端设备。
本申请实施例中，所述第一随机数用于生成所述权限凭证，而所述归属运营设备将所述第一随机数发送给所述终端设备，主要用于所述终端设备根据所述第一随机数生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
S307，所述归属运营设备根据所述第一随机数生成权限凭证。
其中，本申请实施例所述归属运营设备生成的权限凭证的方式有多种，具体并不限于下述几种。
生成方式1：所述归属运营设备根据所述第一随机数生成所述权限凭证，例如，假设所述第一随机数为non_H，则所述归属运营设备根据所述随机数non_H生成所述权限凭证。
示例性的，所述归属运营设备生成的权限凭证为h_UE＝Hash2{non_H}。
生成方式2：所述归属运营设备根据所述第一随机数和所述第二随机数生成所述权限凭证，例如，假设所述第一随机数为non_H，所述第二随机数为non_UE，则所述归属运营设备根据所述随机数non_UE与所述随机数non_H共同生成权限凭证。
示例性的，所述归属运营设备生成的权限凭证为h_UE＝Hash2{non_UE||non_H}。
生成方式3：所述归属运营设备根据漫游运营设备的身份信息、所述第一随机数和所述第二随机数生成所述权限凭证。
其中，所述漫游运营设备的身份信息可以为所述漫游运营设备的身份标识，也可以为所述漫游设备的地址。例如，所述漫游运营设备的身份信息为身份标识VID，所述第一随机数为non_H，所述第二随机数为non_UE，生成所述权限凭证。
其中，所述漫游运营设备的身份标识是所述归属运营设备根据与所述漫游运营设备间的漫游协议获取的。
示例性的，所述归属运营设备生成的权限凭证为h_UE＝Hash2{non_UE||non_H||vID}。
S308，所述归属运营设备将所述权限凭证发送给所述区块链。
可选的，所述归属运营设备调用所述区块链中存储的权限合约，所述权限合约为所述归属运营设备与所述漫游运营设备对应的权限合约；所述归属运营设备将所述权限凭证增加到所述权限合约中，并将增加所述权限凭证后的权限合约发送给所述区块链。
可选的，所述归属运营设备直接将所述权限凭证发送给所述区块链。
S309，所述区块链更新存储信息。
可选的，若所述区块链接收到所述增加权限凭证的权限合约后，将所述区块链中的所述归属运营设备与所述漫游运营设备对应的权限合约，都更新为所述增加权限凭证的权限合约；或者，
若所述区块链接收到所述归属运营设备发送的所述权限凭证后，则将所述权限凭证添加到所述归属运营设备与所述漫游运营设备对应的权限合约中，并更新所述权限合约；或者，
若所述区块链接收到所述归属运营设备发送的所述权限凭证后，将所述权限凭证存储到本地，然后更新自身存储信息。
需要说明的是，本申请实施例中图2所示的交互流程中，并不限制某些步骤的先后顺序，例如S306可以先于S301执行。
进一步的，本申请实施例中为更好的保障所述签约数据的安全性，可将所述存储地址和所述第一解密密钥再次进行加密，从而更好的保障所述签约数据的安全性。
示例性的，本申请实施例中所述归属运营设备针对所述存储地址以及所述第一解密密钥进行双重加密。
假设所述存储地址为add_UE，所述第一解密密钥为PK_UE。因此，在进行加密时，可先对所述存储地址和所述第一解密密钥进行非对称加密。
例如，通过下述公式1对所述存储地址add_UE和所述第一解密密钥PK_UE进行第一重加密：
M_1v＝E_asy{PK_v,add_UE||PK_UE}    公式1
其中，所述公式1中括号里的第一个元素表示加密算法所用的密钥(即非对称加密中的公钥)，第二个元素为被加密的内容，所述M_1v表示第一重加密的加密结果。
然后，再对第一重加密得到的加密结果M_1v进行对称加密，例如，再通过下述公式2对上述加密后的所述加密结果M_1v再次进行加密：
M_v＝E_sym{K,M_1v}    公式2
其中，所述公式2中括号里的第一个元素表示对称加密算法所用的密钥(该密钥既是加密密钥又是解密密钥)，第二个元素为被加密的内容。
可选的，所述K可以通过下述公式3确定：
K＝Hash{non_UE||non_H}    公式3
需要说明的是，本申请实施例中对所述存储地址add_UE和所述第一解密密钥PK_UE进行双重加密的过程中，所述对称加密和非对称加密的顺序可以互换。例如，先进行对称加密，然后再将所述对称加密的结果进行非对称加密。
若存储路径add_UE是路径列表，则对于列表中的每一个元素，分别做加密生成多个M_v，形成M_v列表。
实施例二、漫游过程中的获取所述签约数据的过程。
本申请实施例中，在上述实施例一的基础上，所述漫游运营设备获取所述签约数据时，可分为两种情况。
一种情况为所述漫游运营设备中的AMF网元对所述签约数据的获取过程；另一种情况 为所述漫游运营设备中的SMF网元对所述签约数据的获取过程，下面分别进行描述。
其中，为避免重复描述造成的冗余，实施例二中对于相关示例的描述中，不再进行重复的限定。
例如，根据实施例一的内容可知，实施例二中出现的存储地址表示所述签约数据或者所述签约数据的加密结果，在所述数据服务器中的地址；所述第一解密密钥表示用于解密所述签约数据的加密结果的密钥；M_1v表示归属运营设备对所述存储地址和所述第一解密密钥进行第一重加密的加密结果；M_v表示所述归属运营设备在所述M_1v的基础上，再次进行加密的加密结果；PK_v表示归属运营设备进行非对称加密的公钥；K表示归属运营设备进行对称加密的密钥；non_H表示所述归属运营设备生成的第一随机数；non_UE表示所述终端设备生成的第二随机数。
情况1：如图4所示，为所述漫游运营设备中的AMF网元对所述终端设备的签约数据的访问控制过程，具体流程如下：
S400，所述终端设备生成安全令牌，然后将所述安全令牌传递给所述AMF。
示例性的，所述终端设备可通过下列方式生成所述安全令牌：
所述终端设备根据生成的第二随机数non_U，以及所述归属运营设备发送的第一随机数non_H，生成所述安全令牌。
例如，假设所述安全令牌为token，所述终端设备根据下述公式4生成所述token。
token＝Hash{non_UE||non_H}    公式4
示例性的，所述终端设备可通过下列方式生成安全令牌：
所述终端设备根据生成的第二随机数non_U、所述归属运营设备发送的第一随机数non_H、所述漫游运营设备的身份信息生成所述安全令牌token。
其中，假设所述漫游运营设备的身份信息为身份标识VID，则根据下述公式5生成所述token。
token＝Hash{non_UE||non_H||VID}    公式5
其中，所述终端设备生成所述安全令牌的过程可在所述终端设备的安全模块，如USIM(Universal Subscriber Identity Module，全球用户识别模块)中完成，然后通过NAS(Non-access stratum，非接入层)通道将所述安全令牌传递给所述AMF。
可选的，若所述归属运营设备对所述存储地址和所述第一解密密钥进行了双重加密，得到M_v，则所述终端设备还需确定所述K。然后，所述终端设备将所述K传递给所述AMF，从而使所述漫游运营设备通过所述K以及公钥PK_v对应的私钥，对所述M_v进行解密。
S401，所述AMF向所述BCHF发送获取签约数据的请求。
可选的，所述AMF在需要向所述BCHF提供安全令牌时，向所述BCHF发送所述安全令牌；其中，若存在双重加密的情况，则所述AMF在需要向所述BCHF发送所述K时，将从终端设备接收到的K发送给所述BCHF。
其中，所述AMF需要向所述BCHF提供安全令牌的情况有多种，具体包括且并不限于下述几种：
提供安全令牌(还可能包括K)情况1：
所述AMF在接收到所述BCHF发送的获取所述安全令牌(还可能包括K)的信息后， 将所安全令牌(还可能包括K)发送给所述BCHF。
提供安全令牌(还可能包括K)情况2：
所述AMF第一次向所述BCHF发送获取签约数据的请求时，向所述BCHF发送的所述安全令牌(还可能包括K)的信息，其中，所述安全令牌(还可能包括K)可携带在所述获取签约数据的请求中。
S402，所述BCHF接收到所述获取签约数据的请求后，向所述区块链查询所述签约数据，并将所述安全令牌发送给所述区块链。
本申请实施例一种可选的方式，本申请实施例中所述漫游运营设备中的BCHF每隔阈值时长会删除所述BCHF中已接收的安全令牌(还可能包含K)。
因此，所述AMF第一次通过所述BCHF向所述区块链发送获取签约数据的请求时，所述BCHF中并没有所述验证信息。因此，所述AMF还需要将所述安全令牌发送给所述BCHF，以使所述BCHF在向所述区块链查询所述签约数据时，将所述安全令牌发送给所述区块链，以使所述区块链根据所述安全令牌验证所述漫游运营设备是否具有获取签约数据的权限。
若所述AMF不是第一次向所述BCHF发送获取签约数据的请求时，且所述BCHF没有到删除所述安全令牌(还可能包含K)的时间，则所述BCHF中存有所述安全令牌(还可能包含K)。因此，所述BCHF向所述区块链查询签约数据时，可直接将自己存储的所述安全令牌发送给所述区块链，以使所述区块链根据所述安全令牌验证所述漫游运营设备是否具有获取签约数据的权限。
若所述AMF不是第一次向所述BCHF发送获取签约数据的请求时，且所述BCHF已删除所述BCHF中的安全令牌(还可能包含K)，则所述BCHF向所述区块链查询签约数据时，还需向所述AMF发送获取所述安全令牌的请求，并获取所述AMF发送的所述安全令牌。从而在所述BCHF向所述区块链查询所述签约数据时，将所述安全令牌发送给所述区块链，以使所述区块链根据所述安全令牌验证所述漫游运营设备是否具有获取签约数据的权限。
S403，所述区块链确定所述安全令牌与本地存储的所述权限凭证是否相同。
可选的，所述区块链将所述安全令牌进行处理，然后将得到的处理结果与所述权限凭证进行比较。例如，所述区块链通过下述公式6对所述安全令牌进行处理，得到处理结果token_v，然后比较所述token_v与所述权限凭证是否相同。
token_v＝Hash{Hash{non_UE||non_H||VID}}    公式6
示例性的，本申请实施例中所述区块链若确定所述处理结果与所述权限凭证不相同，则确定所述漫游运营设备不具有获取所述签约数据的权限，程序终止；相反的，若所述区块链确定所述处理结果与所述权限凭证相同，则确定所述漫游运营设备具有获取所述签约数据的权限。
S404，所述区块链确定所述安全令牌与所述权限凭证一致后，将所述区块链中所述存储地址和所述第一解密密钥返回给所述BCHF。
其中，本申请实施例中若所述区块链中存储的所述存储地址是列表的情形，则所述区块链返回的是本次查询允许获取的部分地址以及对应的第一解密密钥。
S405，所述BCHF获取所述存储地址和所述第一解密密钥。
其中，若本申请实施例中所述BCHF从所述区块链获取到的为进行双重加密后的信息， 即所述M_v。因此，所述BCHF还需要对所述M_v进行解密，从而获得所述存储地址和所述第一解密密钥；
示例性的，本申请实施例中对所述M_v进行解的过程与之前加密的过程对应。例如，通过公式7对所述M_v进行解密，获取所述M_v中的所述存储地址add_UE和所述第一解密密钥PK_UE：
add_UE||K_UE＝D_sym{K,D_asy{SK_v，M_v}}    公式7
其中，所述公式7中的SK_v为存储在所述BCHF中的漫游运营设备的私钥。
S406，所述BCHF将所述存储地址和所述第一解密密钥发送给所述AMF。
S407，所述AMF根据所述存储地址从所述数据服务器中获取所述加密结果。
S408，所述AMF通过所述第一解密密钥对接收到的加密结果进行解密，获得所述签约数据。
情况2：在情况1的基础上，如图5所示，为所述漫游运营设备中的SMF网元或所述漫游运营设备中的其他网元对所述终端设备的签约数据的访问控制过程，下面选取所述SMF网元为例进行具体流程介绍：
S500，所述SMF向所述BCHF发送获取所述签约数据的请求。
S501，所述BCHF接收到所述获取签约数据的请求后，向所述区块链查询所述签约数据，并将所述安全令牌发送给所述区块链。
需要说明的是，本申请实施例中所述漫游运营设备中的BCHF每隔阈值时长删除所述BCHF中已接收的所述安全令牌。因此，若所述SMF通过所述BCHF向所述区块链查询签约数据时，若所述BCHF中保存了所述安全令牌，则所述BCHF向所述区块链查询所述签约数据时，直接从本地获取所述安全令牌，并将所述安全令牌发送给所述区块链，以使所述区块链根据所述安全令牌判断所述漫游运营设备是否具有获取签约数据的权限。也就是，继续执行步骤S504。
但是，若所述BCHF中没有保存所述安全令牌，则所述BCHF还需执行步骤S502。
S502，所述BCHF向所述AMF发送获取所述安全令牌的请求。
S503，所述AMF将所述安全令牌发送给所述BCHF，继续执行步骤S501。
S504，所述区块链确定所述安全令牌与所述权限凭证是否相同。
S505，所述区块链确定所述安全令牌与所述权限凭证一致后，将所述区块链中的所述存储地址和所述第一解密密钥返回给所述BCHF。
其中，本申请实施例中若所述区块链中存储的所述存储地址是列表的情形，则所述区块链返回的是本次查询允许获取的部分地址以及对应的第一解密密钥。
S506，所述BCHF获取所述存储地址和所述第一解密密钥。
其中，若本申请实施例中所述BCHF从所述区块链获取到的为进行双重加密后的信息，即所述M_v。因此，所述BCHF对所述M_v进行解密，从而获得所述存储地址和所述第一解密密钥。
S507，所述BCHF将所述存储地址和所述第一解密密钥发送给所述SMF。
S508，所述SMF根据所述存储地址从所述数据服务器中获取所述加密结果。
S509，所述SMF通过所述解密密钥对接收到的所述加密结果进行解密，获得所述签约数据。
上述实现签约数据的管理的方法，通过对区块链中权限合约的配置，使所述归属运营设备在管理签约数据时不需要时时参与，有效减轻了所述归属运营设备的负担。而基于所述区块链技术，又能在所述归属运营商设备不在线的情况下，为每次数据访问事件作有效记录。与此同时，本申请实施例在安全上通过密码学手段保证了签约数据的安全性，非授权运营商和其他实体都无法获得签约数据内容。即使在线数据库被攻击，或其他手段获取所述数据库中加密的签约数据，在没有达到既定访问条件的情况下，也仍然是无法解密的密文格式。
进一步的，本申请在提供相同安全和功能表现的前提下，针对上述实施例二进行了进一步优化。
本申请一种可选的实施例，主要基于门限的共识机制，针对获取所述签约数据的方法进一步的进行优化。
即本申请实施例中只有当所述漫游运营设备接收到大于或等于阈值数量的签约数据响应消息，才能获取所述数据服务器中存储的签约数据。
其中，所述区块链具有多个管理节点，所述签约数据响应消息是所述管理节点在确定所述权限凭证和所述验证信息一致后发送给所述漫游运营设备的。所述签约数据响应消息中包含所述存储地址碎片消息，所述存储地址碎片表示所述存储地址的部分信息。
也就是说，所述签约数据响应消息中并不包含所述签约数据在所述数据服务器中的完整存储地址。而只有当所述漫游运营设备接收到大于或等于阈值的签约数据响应消息后，才能根据获取到的签约数据响应消息中的部分碎片消息确定出完整的存储地址。然后，根据所述完整的存储地址，从所述数据服务器中获取所述签约数据。
需要说明的是，本申请实施例中所述区块链的其他交易或合约的调用可以基于所述共识机制进行交易或调用，也可以不基于所述共识机制进行交易或调用。
示例性的，所述区块链中多个管理节点接收到来自所述BCHF的发送的获取所述签约数据的请求。所述管理节点在确定漫游运营设备符合获取签约数据权限后，将自身节点信息f(index_bc)以及所述存储地址碎片发送给所述BCHF。
其中，所述BCHF在接收到的所述签约数据响应消息后，根据所述签约数据响应消息确定是否能够获取签约数据的情况有多种：
情况1：若所述BCHF在预设时长内若接收到的不同的节点信息f(index_bc)的数目少于阈值数量t，则确定所述漫游运营设备没有权限调用所述数据服务器中的签约数据，终止过程。
其中，所述区块链中记录本次调用过程的成功的执行日志。
情况2：若所述BCHF在预设时长内接收到的不同的节点信息f(index_bc)的数目等于或大于t，则所述漫游运营设备从接收到的签约数据响应消息中的获取存储地址碎片，然后根据所述存储地址碎片确定完整的存储地址，最后根据所述完整的存储地址，从所述数据服务器中获取所述签约数据。
例如，假设阈值数量为3，所述漫游运营设备在预设时长内接收到4个区块链管理节点发送的签约数据响应消息。例如，管理节点1发送的签约数据响应消息1，所述签约数据响应消息中包含存储地址碎片1；管理节点2发送的签约数据响应消息2，所述签约数据响应消息中包含存储地址碎片2；管理节点3发送的签约数据响应消息3，所述签约数 据响应消息中包含存储地址碎片3；管理节点4发送的签约数据响应消息4，所述签约数据响应消息中包含存储地址碎片4。
因为，所述漫游运营设备接收到的管理节点发送的签约数据响应消息大于3，因此，可继续执行。
所述漫游运营设备可根据接收到的所有签约数据响应消息中的存储地址碎片，确定完整的存储地址碎片；或者，所述漫游运营设备可从接收到的所有签约数据响应消息中选取阈值数量的签约数据响应消息，然后，根据选取的签约数据响应消息中的存储地址碎片确定完整的存储地址碎片。
例如，所述漫游运营设备选取存储地址碎片1、存储地址碎片3、存储地址碎片4，然后，所述漫游运营设备根据选取的这三个存储地址碎片确定完整的存储地址。最后，所述漫游运营设备根据所述完整的存储地址，从所述数据服务器中获取所述签约数据。则其中，所述区块链中记录本次调用过程的成功的执行日志。
基于以上实施例，如图6所示，本申请一种网元，该网元处于所述漫游地网络中，该网元包括处理器600、存储器601和通信接口602。
处理器600负责管理总线架构和通常的处理，存储器601可以存储处理器600在执行操作时所使用的数据。收发机通信接口602用于在处理器600的控制下接收和发送数据与存储器601进行数据通信。
所述处理器600可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。所述处理器600还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。存储器601可以包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
所述处理器600、所述存储器601以及所述通信接口602之间相互连接。可选的，所述处理器600、所述存储器601以及所述通信接口602可以通过总线603相互连接；所述总线603可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
具体地，所述处理器600，用于读取存储器601中的程序并执行：
用于通过通信接口接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；若验证通过，获取来自所述区块链的所述签约数据的地址信息；向所述第二网元发送所述签约数据的地址信息。
在一种可能的实现方法中，所述处理器600具体用于：
从本地获取所述安全令牌；或接收所述第二网元发送的所述安全令牌。
在一种可能的实现方法中，所述处理器600具体用于：
向所述区块链提供所述终端设备的标识，其中，所述终端设备的标识用于确定所述终端设备对应的签约数据。
在一种可能的实现方法中，所述处理器600还用于：
解密所述签约数据的地址信息，获取所述签约数据在数据库中的存储地址。
在一种可能的实现方法中，所述第一网元为所述漫游地网络中的区块链处理功能BCHF或所述区块链中的BCHF。
在一种可能的实现方法中，所述第二网元为所述漫游地网络中的接入和移动管理功能AMF或会话管理功能SMF。
在一种可能的实现方法中，所述处理器600具体用于：
调用所述区块链中存储的权限合约，以查询所述签约数据。
如图7所示，本申请提供一种网元，该网元处于所述签约地网络中，该网元包括：至少一个处理单元700、至少一个存储单元701以及至少一个通信单元702，其中，所述通信单元702用于在所述处理单元700的控制下接收和发送数据，所述存储单元701存储有程序代码，当所述程序代码被所述处理单元700执行时，使得所述处理单元700执行下列过程：
用于通过通信单元接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；若验证通过，获取来自所述区块链的所述签约数据的地址信息；向所述第二网元发送所述签约数据的地址信息。
在一种可能的实现方法中，所述处理单元700具体用于：
从本地获取所述安全令牌；或接收所述第二网元发送的所述安全令牌。
在一种可能的实现方法中，所述处理单元700具体用于：
向所述区块链提供所述终端设备的标识，其中，所述终端设备的标识用于确定所述终端设备对应的签约数据。
在一种可能的实现方法中，所述处理单元700还用于：
解密所述签约数据的地址信息，获取所述签约数据在数据库中的存储地址。
在一种可能的实现方法中，所述第一网元为所述漫游地网络中的区块链处理功能BCHF或所述区块链中的BCHF。
在一种可能的实现方法中，所述第二网元为所述漫游地网络中的接入和移动管理功能AMF或会话管理功能SMF。
在一种可能的实现方法中，所述处理单元700具体用于：
调用所述区块链中存储的权限合约，以查询所述签约数据。
如图8所示，本申请实施例还提供了一种网络设备，该网络设备处于所述终端设备签约地网络中，该网络设备包括处理器800、存储器801和通信接口802。
处理器800负责管理总线架构和通常的处理，存储器801可以存储处理器800在执行操作时所使用的数据。收发机通信接口802用于在处理器800的控制下接收和发送数据与存储器801进行数据通信。
所述处理器800可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。所述处理器800还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。存储器801可以包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
所述处理器800、所述存储器801以及所述通信接口802之间相互连接。可选的，所述处理器800、所述存储器801以及所述通信接口802可以通过总线803相互连接；所述总线803可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
具体地，处理器800，用于读取存储器801中的程序并执行：
用于通过将与终端设备签约得到的签约数据存储到数据服务器；接收来自所述数据服务器的所述签约数据的存储地址；将所述存储地址存储到区块链；其中，所述第一网络设备处于所述终端设备的签约地网络中；将权限凭证发送给区块链，所述权限凭证用于验证获取签约数据的权限。
在一种可能的实现方法中，所述处理器800通过下列方式确定所述权限凭证：
设备生成第一随机数，根据所述第一随机数生成所述权限凭证。
在一种可能的实现方法中，所述处理器800还用于：
将所述第一随机数发送给所述终端设备，其中，所述第一随机数用于生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
在一种可能的实现方法中，所述处理器800具体用于：
接收所述终端设备发送的第二随机数；根据所述第一随机数与所述第二随机数生成所述权限凭证；或接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证。
在一种可能的实现方法中，所述处理器800还用于：
根据与所述第二网络设备之间的漫游协议确定所述第二网络设备的身份标识，所述第二网络设备处于所述终端设备的漫游地网络中。
如图9所示，本申请提供一种网络设备，该网络设备处于终端设备所在的签约地网络，该网络设备包括：至少一个处理单元900、至少一个存储单元901以及至少一个通信单元902，其中，所述通信单元902用于在所述处理单元900的控制下接收和发送数据，所述存储单元901存储有程序代码，当所述程序代码被所述处理单元900执行时，使得所述处理单元900执行下列过程：
用于通过通信单元将与终端设备签约得到的签约数据存储到数据服务器；接收来自所述数据服务器的所述签约数据的存储地址；将所述存储地址存储到区块链；其中，所述第一网络设备处于所述终端设备的签约地网络中；将权限凭证发送给区块链，所述权限凭证 用于验证获取签约数据的权限。
在一种可能的实现方法中，所述处理单元900通过下列方式确定所述权限凭证：
设备生成第一随机数，根据所述第一随机数生成所述权限凭证。
在一种可能的实现方法中，所述处理单元900还用于：
将所述第一随机数发送给所述终端设备，其中，所述第一随机数用于生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
在一种可能的实现方法中，所述处理单元900具体用于：
接收所述终端设备发送的第二随机数；根据所述第一随机数与所述第二随机数生成所述权限凭证；或接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证。
在一种可能的实现方法中，所述处理单元900还用于：
根据与所述第二网络设备之间的漫游协议确定所述第二网络设备的身份标识，所述第二网络设备处于所述终端设备的漫游地网络中。
如图10所示，本申请实施例给出一种签约数据的管理的终端，该终端1000包括：射频(Radio Frequency，RF)电路1010、电源1020、处理器1030、存储器1040、输入单元1050、显示单元1060、摄像头1070、通信接口1080、以及无线保真(Wireless Fidelity，WiFi)模块1090等部件。本领域技术人员可以理解，图10中示出的终端的结构并不构成对终端的限定，本申请实施例提供的终端可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图10对所述终端1000的各个构成部件进行具体的介绍：
所述RF电路1010可用于通信或通话过程中，数据的接收和发送。特别地，所述RF电路1010在接收到基站的下行数据后，发送给所述处理器1030处理；另外，将待发送的上行数据发送给基站。通常，所述RF电路1010包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(Low Noise Amplifier，LNA)、双工器等。
此外，RF电路1010还可以通过无线通信与网络和其他终端通信。所述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(Global System of Mobile communication，GSM)、通用分组无线服务(General Packet Radio Service，GPRS)、码分多址(Code Division Multiple Access，CDMA)、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)、长期演进(Long Term Evolution，LTE)、电子邮件、短消息服务(Short Messaging Service，SMS)等。
WiFi技术属于短距离无线传输技术，所述终端1000通过WiFi模块1090可以连接的接入点(Access Point，AP)，从而实现数据网络的访问。所述WiFi模块1090可用于通信过程中，数据的接收和发送。
所述终端1000可以通过所述通信接口1080与其他终端实现物理连接。可选的，所述通信接口1080与所述其他终端的通信接口通过电缆连接，实现所述终端1000和其他终端之间的数据传输。
所述终端1000能够实现通信业务，向其他联系人发送信息，因此所述终端1000需要具有数据传输功能，即所述终端1000内部需要包含通信模块。虽然图10示出了所述RF电路1010、所述WiFi模块1090、和所述通信接口1080等通信模块，但是可以理解的是， 所述终端1000中存在上述部件中的至少一个或者其他用于实现通信的通信模块(如蓝牙模块)，以进行数据传输。
例如，当所述终端1000为手机时，所述终端1000可以包含所述RF电路1010，还可以包含所述WiFi模块1080；当所述终端1000为计算机时，所述终端1000可以包含所述通信接口1080，还可以包含所述WiFi模块1090；当所述终端1000为平板电脑时，所述终端1000可以包含所述WiFi模块。
所述存储器1040可用于存储软件程序以及模块。所述处理器1030通过运行存储在所述存储器1040的软件程序以及模块，从而执行所述终端1000的各种功能应用以及数据处理，并且当处理器1030执行存储器1040中的程序代码后，可以实现本申请实施例图3和/或图4中的部分或全部过程。
可选的，所述存储器1040可以主要包括存储程序区和存储数据区。其中，存储程序区可存储操作系统、各种应用程序(比如通信应用)以及人脸识别模块等；存储数据区可存储根据所述终端的使用所创建的数据(比如各种图片、视频文件等多媒体文件，以及人脸信息模板)等。
此外，所述存储器1040可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
所述输入单元1050可用于接收用户输入的数字或字符信息，以及产生与所述终端1000的用户设置以及功能控制有关的键信号输入。
可选的，输入单元1050可包括触控面板1051以及其他输入终端1052。
其中，所述触控面板1051，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在所述触控面板1051上或在所述触控面板1051附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，所述触控面板1051可以包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给所述处理器1030，并能接收所述处理器1030发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现所述触控面板1051。
可选的，所述其他输入终端1052可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
所述显示单元1060可用于显示由用户输入的信息或提供给用户的信息以及所述终端1000的各种菜单。所述显示单元1060即为所述终端1000的显示系统，用于呈现界面，实现人机交互。
所述显示单元1060可以包括显示面板1061。可选的，所述显示面板1061可以采用液晶显示屏(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode，OLED)等形式来配置。
进一步的，所述触控面板1051可覆盖所述显示面板1061，当所述触控面板1051检测到在其上或附近的触摸操作后，传送给所述处理器1030以确定触摸事件的类型，随后所述处理器1030根据触摸事件的类型在所述显示面板1061上提供相应的视觉输出。
虽然在图10中，所述触控面板1051与所述显示面板1061是作为两个独立的部件来实现所述终端1000的输入和输入功能，但是在某些实施例中，可以将所述触控面板1051 与所述显示面板1061集成而实现所述终端1000的输入和输出功能。
所述处理器1030是所述终端1000的控制中心，利用各种接口和线路连接各个部件，通过运行或执行存储在所述存储器1040内的软件程序和/或模块，以及调用存储在所述存储器1040内的数据，执行所述终端1000的各种功能和处理数据，从而实现基于所述终端的多种业务。
本申请实施例中，所述处理器1030用于读取存储器1040中的程序并执行：
接收第一网络设备发送的第一随机数；根据所述第一随机数生成安全令牌，并将所述安全令牌发送给第一网元；其中，所述安全令牌用于验证获取签约数据的权限，所述第一网元处于所述终端设备的漫游地中。
可选的，所述处理器1030可包括一个或多个处理单元。可选的，所述处理器1030可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到所述处理器1030中。
所述摄像头1070，用于实现所述终端1000的拍摄功能，拍摄图片或视频。所述摄像头1070还可以用于实现终端1000的扫描功能，对扫描对象(二维码/条形码)进行扫描。
所述终端1000还包括用于给各个部件供电的电源1020(比如电池)。可选的，所述电源1020可以通过电源管理系统与所述处理器1030逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗等功能。
尽管未示出，所述终端1000还可以包括至少一种传感器、音频电路等，在此不再赘述。
其中，存储器1040可以存储与存储单元1001相同的有程序代码，当所述程序代码被处理器1030执行时，使得处理器1030实现处理单元1000的所有功能。
在一些可能的实施方式中，本申请实施例提供的一种签约数据的管理方法的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序代码在计算机设备上运行时，所述程序代码用于使所述计算机设备执行本说明书中描述的根据本申请各种示例性实施方式的签约数据的管理方法中的步骤。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
根据本申请的实施方式的用于执行一种签约数据的管理程序产品，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在服务器设备上运行。然而，本申请的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被信息传输、装置或者器件使用或者与其结合使用。
可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括——但不限于——电磁信号、 光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由周期网络动作系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括——但不限于——无线、有线、光缆、RF等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络——包括局域网(LAN)或广域网(WAN)—连接到用户计算设备，或者，可以连接到外部计算设备。
本申请实施例针对网络设备执行签约数据的管理方法还提供一种计算设备可读存储介质，即断电后内容不丢失。该存储介质中存储软件程序，包括程序代码，当所述程序代码在计算设备上运行时，该软件程序在被一个或多个处理器读取并执行时可实现本申请实施例上面任何一种签约数据的管理方案。
本申请实施例针对终端设备执行签约数据的管理方法还提供一种计算设备可读存储介质，即断电后内容不丢失。该存储介质中存储软件程序，包括程序代码，当所述程序代码在计算设备上运行时，该软件程序在被一个或多个处理器读取并执行时可实现本申请实施例上面任何一种签约数据的管理方案。
以上参照示出根据本申请实施例的方法、装置(系统)和/或计算机程序产品的框图和/或流程图描述本申请。应理解，可以通过计算机程序指令来实现框图和/或流程图示图的一个块以及框图和/或流程图示图的块的组合。可以将这些计算机程序指令提供给通用计算机、专用计算机的处理器和/或其它可编程数据处理装置，以产生机器，使得经由计算机处理器和/或其它可编程数据处理装置执行的指令创建用于实现框图和/或流程图块中所指定的功能/动作的方法。
相应地，还可以用硬件和/或软件(包括固件、驻留软件、微码等)来实施本申请。更进一步地，本申请可以采取计算机可使用或计算机可读存储介质上的计算机程序产品的形式，其具有在介质中实现的计算机可使用或计算机可读程序代码，以由指令执行系统来使用或结合指令执行系统而使用。在本申请上下文中，计算机可使用或计算机可读介质可以是任意介质，其可以包含、存储、通信、传输、或传送程序，以由指令执行系统、装置或设备使用，或结合指令执行系统、装置或设备使用。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (58)

  1. 一种签约数据的管理方法，其特征在于，包括：
    第一网元接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；
    所述第一网元获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；
    所述第一网元向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；
    若验证通过，所述第一网元获取来自所述区块链的所述签约数据的地址信息；
    所述第一网元向所述第二网元发送所述签约数据的地址信息。
  2. 如权利要求1所述的方法，其特征在于，所述第一网元获取所述终端设备的安全令牌，包括：
    所述第一网元从本地获取所述安全令牌；或
    所述第一网元接收所述第二网元发送的所述安全令牌。
  3. 如权利要求1所述的方法，其特征在于，所述第一网元向所述区块链查询所述签约数据，包括：
    所述第一网元向所述区块链提供所述终端设备的标识，其中，所述终端设备的标识用于确定所述终端设备对应的签约数据。
  4. 如权利要求1～3任一项所述的方法，其特征在于，所述第一网元获取来自所述区块链的所述签约数据的地址信息后，所述方法还包括：
    所述第一网元解密所述签约数据的地址信息，获取所述签约数据在数据库中的存储地址。
  5. 如权利要求1～4任一项所述的方法，其特征在于，所述第一网元为所述漫游地网络中的区块链处理功能BCHF或所述区块链中的BCHF。
  6. 如权利要求1～5任一项所述的方法，其特征在于，所述第二网元为所述漫游地网络中的接入和移动管理功能AMF或会话管理功能SMF。
  7. 如权利要求1～6任一项所述的方法，其特征在于，所述第一网元向区块链查询所述签约数据，包括：
    所述第一网元调用所述区块链中的权限合约，以查询所述签约数据。
  8. 一种签约数据的管理方法，其特征在于，包括：
    第一网络设备将与终端设备签约得到的签约数据存储到数据服务器；
    所述第一网络设备接收来自所述数据服务器的所述签约数据的存储地址；
    所述第一网络设备将所述存储地址存储到区块链；其中，所述第一网络设备处于所述终端设备的签约地网络中；
    所述第一网络设备将权限凭证发送给区块链，所述权限凭证用于验证获取签约数据的权限。
  9. 如权利要求8所述的方法，其特征在于，所述第一网络设备通过下列方式确定所述权限凭证：
    所述第一网络设备生成第一随机数，根据所述第一随机数生成所述权限凭证。
  10. 如权利要求8所述的方法，其特征在于，所述第一网络设备生成第一随机数之后， 还包括：
    所述第一网络设备将所述第一随机数发送给所述终端设备，其中，所述第一随机数用于生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
  11. 如权利要求9所述的方法，其特征在于，所述第一网络设备根据所述第一随机数生成权限凭证，包括：
    所述第一网络设备接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数与所述第二随机数生成所述权限凭证；或
    所述第一网络设备接收所述终端设备发送的第二随机数；所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证。
  12. 如权利要求11所述的方法，其特征在于，若所述第一网络设备根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证，则所述方法还包括：
    所述第一网络设备根据与所述第二网络设备之间的漫游协议确定所述第二网络设备的身份标识，所述第二网络设备处于所述终端设备的漫游地网络中。
  13. 一种签约数据的管理方法，其特征在于，包括：
    第二网元向第一网元发送请求消息；
    所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；
    所述第二网元接收所述第一网元发送的所述签约数据的地址信息；
    所述第二网元根据所述签约数据的地址信息获取所述签约数据。
  14. 如权利要求13所述的方法，其特征在于，所述请求消息中携带安全令牌；所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限。
  15. 如权利要求13或14所述的方法，其特征在于，所述第二网元向所述第一网元发送请求消息之后，还包括：
    所述第二网元在接收到所述第一网元发送的获取所述安全令牌的请求后，将所述安全令牌发送给所述第一网元。
  16. 如权利要求13～15任一项所述的方法，其特征在于，所述第一网元为所述漫游地网络中的BCHF或所述区块链中的BCHF。
  17. 如权利要求13～16任一项所述的方法，其特征在于，所述第二网元为所述漫游地网络中的AMF或SMF。
  18. 一种签约数据的管理方法，其特征在于，包括：
    终端设备接收第一网络设备发送的第一随机数；
    所述终端设备根据所述第一随机数生成安全令牌，并将所述安全令牌发送给第一网元；
    其中，所述安全令牌用于验证获取签约数据的权限，所述第一网元处于所述终端设备的漫游地中。
  19. 一种签约数据的管理方法，其特征在于，包括：
    区块链节点接收来自第一网元的查询请求，所述查询请求包括安全令牌，所述安全令牌用于验证第二网元是否具有获取所述签约数据的权限；
    所述区块链节点验证所述安全令牌是否有效；
    若有效，所述区块链节点调用存储合约，获取所述签约数据的地址信息；
    所述区块链节点向所述第一网元返回所述地址信息。
  20. 如权利要求19所述的方法，其特征在于，所述区块链节点验证所述安全令牌是否有效，包括：
    验证所述安全令牌和权限凭证是否一致，所述权限凭证用于验证所述第二网元是否具有获取所述签约数据的权限。
  21. 如权利要求19或20所述的方法，其特征在于，所述区块链节点调用存储合约，包括：
    所述区块链节点根据所述区块链的共识算法调用所述存储合约。
  22. 如权利要求19～21任一项所述的方法，其特征在于，所述方法还包括：
    所述区块链节点记录所述签约数据取回的执行日志。
  23. 一种签约数据的管理装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收来自第二网元的请求消息；其中，所述第二网元处于所述终端设备的漫游地中，所述请求消息用于请求所述终端设备的签约数据；
    所述处理单元，用于获取所述终端设备的安全令牌，所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限；
    向所述区块链提供所述安全令牌，并向所述区块链查询所述签约数据；
    以及若验证通过，获取来自所述区块链的所述签约数据的地址信息；
    所述通信单元，用于向所述第二网元发送所述签约数据的地址信息。
  24. 如权利要求23所述的签约数据的管理装置，其特征在于，所述处理单元具体用于：
    从本地获取所述安全令牌；或通过所述通信单元接收所述第二网元发送的所述安全令牌。
  25. 如权利要求23所述的签约数据的管理装置，其特征在于，所述处理单元具体用于：
    向所述区块链提供所述终端设备的标识，其中，所述终端设备的标识用于确定所述终端设备对应的签约数据。
  26. 如权利要求23～25任一项所述的签约数据的管理装置，其特征在于，所述处理单元还用于：
    解密所述签约数据的地址信息，获取所述签约数据在数据库中的存储地址。
  27. 如权利要求23～26任一项所述的签约数据的管理装置，其特征在于，所述第一网元为所述漫游地网络中的区块链处理功能BCHF或所述区块链中的BCHF。
  28. 如权利要求23～27任一项所述的签约数据的管理装置，其特征在于，所述第二网元为所述漫游地网络中的接入和移动管理功能AMF或会话管理功能SMF。
  29. 如权利要求23～28任一项所述的签约数据的管理装置，其特征在于，所述处理单元具体用于：
    调用所述区块链中的权限合约，以查询所述签约数据。
  30. 一种签约数据的管理装置，其特征在于，包括：处理单元和通信单元；
    所述处理单元，用于将与终端设备签约得到的签约数据存储到数据服务器；
    所述通信单元，用于接收来自所述数据服务器的所述签约数据的存储地址；
    所述处理单元，还用于将所述存储地址存储到区块链；其中，所述第一网络设备处于 所述终端设备的签约地网络中；
    所述通信单元，还用于将权限凭证发送给区块链，所述权限凭证用于验证获取签约数据的权限。
  31. 如权利要求30所述的签约数据的管理装置，其特征在于，所述处理单元通过下列方式确定所述权限凭证：
    设备生成第一随机数，根据所述第一随机数生成所述权限凭证。
  32. 如权利要求30所述的签约数据的管理装置，其特征在于，所述通信单元还用于：
    将所述第一随机数发送给所述终端设备，其中，所述第一随机数用于生成安全令牌，所述安全令牌用于验证获取签约数据的权限。
  33. 如权利要求31所述的签约数据的管理装置，其特征在于，
    所述通信单元还用于接收所述终端设备发送的第二随机数；所述处理单元具体用于根据所述第一随机数与所述第二随机数生成所述权限凭证；或
    所述通信单元还用于接收所述终端设备发送的第二随机数；所述处理单元具体用于根据所述第一随机数、所述第二网络设备的身份标识、所述第二随机数生成所述权限凭证。
  34. 如权利要求33所述的签约数据的管理装置，其特征在于，所述处理单元还用于：
    根据与所述第二网络设备之间的漫游协议确定所述第二网络设备的身份标识，所述第二网络设备处于所述终端设备的漫游地网络中。
  35. 一种签约数据的管理装置，其特征在于，所述签约数据的管理装置处于终端设备的漫游地中，包括：处理单元和通信单元；
    所述通信单元，用于向第一网元发送请求消息；其中，所述请求消息用于请求所述终端设备的签约数据；
    所述通信单元，还用于接收所述第一网元发送的所述签约数据的地址信息；
    所述处理单元，用于根据所述签约数据的地址信息获取所述签约数据。
  36. 如权利要求35所述的签约数据的管理装置，其特征在于，所述请求消息中携带安全令牌；所述安全令牌用于验证所述第二网元是否具有获取所述签约数据的权限。
  37. 如权利要求35或36所述的签约数据的管理装置，其特征在于，所述处理单元还用于：
    在接收到所述第一网元发送的获取所述安全令牌的请求后，将所述安全令牌发送给所述第一网元。
  38. 如权利要求35～37任一项所述的签约数据的管理装置，其特征在于，所述第一网元为所述漫游地网络中的BCHF或所述区块链中的BCHF。
  39. 如权利要求35～38任一项所述的签约数据的管理装置，其特征在于，所述第二网元为所述漫游地网络中的AMF或SMF。
  40. 一种签约数据的管理装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收第一网络设备发送的第一随机数；
    所述处理单元，用于根据所述第一随机数生成安全令牌；
    所述通信单元，还用于将所述安全令牌发送给第一网元；
    其中，所述安全令牌用于验证获取签约数据的权限，所述第一网元处于所述终端设备的漫游地中。
  41. 一种签约数据的管理装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收来自第一网元的查询请求，所述查询请求包括安全令牌，所述安全令牌用于验证第二网元是否具有获取所述签约数据的权限；
    所述处理单元，用于验证所述安全令牌是否有效；若有效，调用存储合约，获取所述签约数据的地址信息；
    所述通信单元，还用于向所述第一网元返回所述地址信息。
  42. 如权利要求41所述的签约数据的管理装置，其特征在于，所述处理单元具体用于：
    验证所述安全令牌和权限凭证是否一致，所述权限凭证用于验证所述第二网元是否具有获取所述签约数据的权限。
  43. 如权利要求41或42所述的签约数据的管理装置，其特征在于，所述处理单元具体用于：
    根据所述区块链的共识算法调用所述存储合约。
  44. 如权利要求41～43任一项所述的签约数据的管理装置，其特征在于，所述处理单元还用于：
    记录所述签约数据取回的执行日志。
  45. 一种签约数据的管理装置，其特征在于，包括：一个或多个处理器；存储器；一个或多个程序；其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令；当所述签约数据的管理装置为第一网元时，所述指令被所述处理器执行时，使得所述第一网元执行如权利要求1～7中任一所述的方法步骤。
  46. 一种签约数据的管理装置，其特征在于，包括：一个或多个处理器；存储器；一个或多个程序；其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令；当所述签约数据的管理装置为网络设备时，所述指令被所述处理器执行时，使得所述网络设备执行如权利要求8～12中任一所述的方法步骤。
  47. 一种签约数据的管理装置，其特征在于，包括：一个或多个处理器；存储器；一个或多个程序；其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令；当所述签约数据的管理装置为第二网元时，所述指令被所述处理器执行时，使得所述第二网元执行如权利要求13～17中任一所述的方法步骤。
  48. 一种签约数据的管理装置，其特征在于，包括：一个或多个处理器；存储器；一个或多个程序；其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令；当所述签约数据的管理装置为终端设备时，所述指令被所述处理器执行时，使得所述终端设备执行如权利要求18所述的方法步骤。
  49. 一种签约数据的管理装置，其特征在于，包括：一个或多个处理器；存储器；一个或多个程序；其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令；当所述签约数据的管理装置为区块链节点时，所述指令被所述处理器执行时，使得所述区块链节点执行如权利要求19～22中任一所述的方法步骤。
  50. 一种芯片系统，其特征在于，包括：所述芯片系统包括至少一个处理器，和接口电路，所述接口电路和所述至少一个处理器通过线路互联，所述处理器通过运行指令，以执行权利要求18所述的方法。
  51. 一种签约数据的管理装置，其特征在于，用于执行1～7项任一项所述方法。
  52. 一种签约数据的管理装置，其特征在于，用于执行8～12项任一项所述方法。
  53. 一种签约数据的管理装置，其特征在于，用于执行13～17项任一项所述方法。
  54. 一种签约数据的管理装置，其特征在于，用于执行18项所述方法。
  55. 一种签约数据的管理装置，其特征在于，用于执行19～22项任一项所述方法。
  56. 一种签约数据的管理系统，其特征在于，包括如权利要求23或35所述的装置，和，如权利要求30、40或41中部分或全部所述的装置。
  57. 一种计算机可读存储介质，其特征在于，包括计算机指令，当所述计算机指令在计算机上运行时，使得计算机执行如权利要求1～7中任一所述的方法步骤；或使得计算机执行如权利要求8～12中任一所述的方法步骤；或使得计算机执行如权利要求13～17中任一所述的方法步骤；或使得计算机执行如权利要求18所述的方法步骤；或使得计算机执行如权利要求19～22中任一所述的方法步骤。
  58. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机指令，当所述计算机指令在计算机上执行时，使得计算机执行如权利要求1～7中任一所述的方法步骤；或使得计算机执行如权利要求8～12中任一所述的方法步骤；或使得计算机执行如权利要求13～17中任一所述的方法步骤；或使得计算机执行如权利要求18所述的方法步骤；或使得计算机执行如权利要求19～22中任一所述的方法步骤。
PCT/CN2020/127442 2019-11-08 2020-11-09 一种签约数据的管理方法、装置 WO2021089035A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20884910.9A EP4030802A4 (en) 2019-11-08 2020-11-09 METHOD AND DEVICE FOR MANAGEMENT OF SUBSCRIPTION DATA
US17/738,899 US20220272511A1 (en) 2019-11-08 2022-05-06 Subscription data management method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911089880.3A CN112866981B (zh) 2019-11-08 2019-11-08 一种签约数据的管理方法、装置
CN201911089880.3 2019-11-08

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/738,899 Continuation US20220272511A1 (en) 2019-11-08 2022-05-06 Subscription data management method and apparatus

Publications (1)

Publication Number Publication Date
WO2021089035A1 true WO2021089035A1 (zh) 2021-05-14

Family

ID=75848284

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/127442 WO2021089035A1 (zh) 2019-11-08 2020-11-09 一种签约数据的管理方法、装置

Country Status (4)

Country Link
US (1) US20220272511A1 (zh)
EP (1) EP4030802A4 (zh)
CN (1) CN112866981B (zh)
WO (1) WO2021089035A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022258593A1 (en) * 2021-06-09 2022-12-15 International Business Machines Corporation Mobile device roaming optimization and operation

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116782224A (zh) * 2022-03-07 2023-09-19 华为技术有限公司 通信方法和装置
CN114928617B (zh) * 2022-06-15 2023-07-21 中国电信股份有限公司 专网签约数据管理方法、装置、设备及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106856602A (zh) * 2015-12-09 2017-06-16 普天信息技术有限公司 一种用户设备信息的获取方法及系统
CN109168156A (zh) * 2018-11-01 2019-01-08 中国联合网络通信集团有限公司 一种虚拟sim卡的实现方法及服务器
US10299128B1 (en) * 2018-06-08 2019-05-21 Cisco Technology, Inc. Securing communications for roaming user equipment (UE) using a native blockchain platform

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5819178A (en) * 1996-01-05 1998-10-06 Northern Telecom Limited Methods and apparatus for accessing subscriber information in interconnected wireless telecommunications networks
US10051463B2 (en) * 2013-12-02 2018-08-14 Telefonaktiebolaget Lm Ericsson (Publ) Methods and subscriber data storage nodes for handling signaling requests in a communication system
WO2017036546A1 (en) * 2015-09-04 2017-03-09 Nec Europe Ltd. Method for storing an object on a plurality of storage nodes
KR102142907B1 (ko) * 2016-12-15 2020-08-10 주식회사 케이티 이동통신 로밍 요금 정산 방법 및 장치
CN111543073B (zh) * 2017-11-03 2023-10-13 联想（新加坡）私人有限公司 用于用户认证的装置和方法
CN109451451B (zh) * 2019-01-04 2020-12-15 中国联合网络通信集团有限公司 终端漫游方法、设备及存储介质

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106856602A (zh) * 2015-12-09 2017-06-16 普天信息技术有限公司 一种用户设备信息的获取方法及系统
US10299128B1 (en) * 2018-06-08 2019-05-21 Cisco Technology, Inc. Securing communications for roaming user equipment (UE) using a native blockchain platform
CN109168156A (zh) * 2018-11-01 2019-01-08 中国联合网络通信集团有限公司 一种虚拟sim卡的实现方法及服务器

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
NGMN ALLIANCE: "P1-Requirements and Architecture", 5G END-TO-END ARCHITECTURE FRAMEWORK, vol. V3.0.8, 16 April 2019 (2019-04-16), pages 1 - 70, XP009529914 *
See also references of EP4030802A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022258593A1 (en) * 2021-06-09 2022-12-15 International Business Machines Corporation Mobile device roaming optimization and operation
US11647377B2 (en) 2021-06-09 2023-05-09 International Business Machines Corporation Mobile device roaming optimization and operation

Also Published As

Publication number Publication date
EP4030802A4 (en) 2022-11-02
EP4030802A1 (en) 2022-07-20
CN112866981B (zh) 2022-04-22
US20220272511A1 (en) 2022-08-25
CN112866981A (zh) 2021-05-28

Similar Documents

Publication Publication Date Title
US9807610B2 (en) Method and apparatus for seamless out-of-band authentication
WO2021089035A1 (zh) 一种签约数据的管理方法、装置
WO2018157858A1 (zh) 信息存储方法、装置及计算机可读存储介质
US11917054B2 (en) Network key processing method and system and related device
WO2018014723A1 (zh) 密钥管理方法、装置、设备及系统
EP3308519B1 (en) System, apparatus and method for transferring ownership of a device from manufacturer to user using an embedded resource
US11974132B2 (en) Routing method, apparatus, and system
US11568083B2 (en) User-controlled access to data in a communication network
US20220182825A1 (en) Identity Authentication Method and Apparatus
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
WO2018076740A1 (zh) 数据传输方法及相关设备
CN109104273B (zh) 报文处理方法以及接收端服务器
CN112512045B (zh) 一种通信系统、方法及装置
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
WO2019019853A1 (zh) 处理数据的方法、终端设备和网络设备
WO2017067369A1 (zh) 一种加密图片、解密图片的方法、装置和设备
WO2020087286A1 (zh) 一种密钥生成方法、设备及系统
WO2022252845A1 (zh) 一种用户数据管理方法以及相关设备
KR20240002666A (ko) 메신저 서비스를 제공하기 위한 방법, 시스템 및 비일시성의 컴퓨터 판독 가능한 기록 매체
US11258871B2 (en) Message push method and terminal
WO2021083012A1 (zh) 一种保护认证流程中参数的方法及装置
WO2021082558A1 (zh) 网络切片的访问控制方法、装置及存储介质
CN113039766A (zh) 无线网络中的优化的等值同时认证（sae）认证
Chen et al. Applications of multi-channel safety authentication protocols in wireless networks
Yadav et al. Lightweight capability-token for consent-based authentication protocol for smart sensor nodes

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20884910

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020884910

Country of ref document: EP

Effective date: 20220413

NENP Non-entry into the national phase

Ref country code: DE