WO2021189828A1 - 一种服务授权方法、装置及系统 - Google Patents

一种服务授权方法、装置及系统 Download PDF

Info

Publication number
WO2021189828A1
WO2021189828A1 PCT/CN2020/121594 CN2020121594W WO2021189828A1 WO 2021189828 A1 WO2021189828 A1 WO 2021189828A1 CN 2020121594 W CN2020121594 W CN 2020121594W WO 2021189828 A1 WO2021189828 A1 WO 2021189828A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
snpn
information
access token
nrf
Prior art date
Application number
PCT/CN2020/121594
Other languages
English (en)
French (fr)
Inventor
李飞
何承东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20927985.0A priority Critical patent/EP4117343A4/en
Publication of WO2021189828A1 publication Critical patent/WO2021189828A1/zh
Priority to US17/950,187 priority patent/US20230019000A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/73—Access point logical identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/18—Selecting a network or a communication service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/105—PBS [Private Base Station] network

Definitions

  • This application relates to the field of communication technology, and in particular to a service authorization method, device and system.
  • the 3rd Generation Partnership Project defines a service-based architecture (SBA) network, and the network function (Network Function, NF) service consumer (service consumer) in the network can report to the NF
  • the service producer makes a service request.
  • 3GPP introduced a Network Repository Function (NRF) network element to provide functions such as registration, maintenance, discovery, and access authorization for network functions.
  • NRF Network Repository Function
  • each network element will exchange messages (such as access token requests, service requests, etc.) by carrying NF services
  • the public land mobile network (Public Land Mobile Network, PLMN) identification (ID) of the consumer and the NF service provider is used to identify the visited network and the home network.
  • PLMN Public Land Mobile Network
  • SNPN non-public networks
  • the embodiments of the present application provide a service authorization method, device and system, which are used to solve the problem that the home network and/or the visited network cannot be uniquely identified in the SNPN network roaming scenario, and the service authorization or service request cannot be successfully completed, thereby improving the network Reliability and safety.
  • a service authorization method including: a first network storage function NRF receives a first request from a first network function NF, wherein the first NF and the first NRF are located in a first network, and the The first request is used to request an access token, the access token is used to access the service of the second NF in the second network, and the first request includes independent non-public network SNPN information of the first network and/ Or the SNPN information of the second network; the first NRF forwards the first request to the second NRF, where the second NRF is located in the second network; in response to the first request, the The second NRF generates an access token, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network; the second NRF sends the access to the first NRF Token; the first NRF receives an access token from the second NRF; and, the first NRF sends the access token to the first NF.
  • the first NF when the first network is an SNPN network, the first NF will add the SNPN information of the first network to the first request, and when the second network is an SNPN network, the first NF will be in The SNPN information of the second network is added to the first request, so that the network requesting the access token and the network requesting the access token can be uniquely identified during the service authorization process, ensuring that the process of the first NF requesting the access token can be Successfully completed, improving the reliability of service authorization.
  • the returned access token will also carry the corresponding SNPN information to clarify the service consumer and service provider authorized by the access token, which can further improve the reliability of service authorization.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second network
  • the SNPN information includes NID and PLMN ID.
  • the SNPN network can be uniquely identified in the form of a combination of NID and PLMN ID, which improves the reliability of network interaction.
  • the method further includes: the first NF sends the first NF to the first security border proxy gateway SEPP A service request message; the first SEPP is located in the first network; the first service request message carries the access token; the first SEPP generates a second service request according to the first service request message Message; the first SEPP sends the second service request message to the second SEPP; the second SEPP is located in the second network, and the second service request message carries the N32 interface context identifier and the access command
  • the second SEPP determines the N32 interface context corresponding to the N32 interface context identifier; the second SEPP verifies whether the remote SNPN information recorded in the N32 interface context is the same as the SNPN of the first network Information matching; if the remote SNPN information does not match the SNPN information of the first network, the second SEPP returns an error code to the first SEPP.
  • the second SEPP in the second network when the first network is SNPN information, the second SEPP in the second network will preset the SNPN information of the first SEPP in the context of the N32 interface.
  • the second SEPP in the first network When the second network is SNPN information, the second SEPP in the first network The first SEPP will preset the SNPN information of the second SEPP in the N32 interface context, and then the signaling between the first network and the second network can be checked for security through the N32 interface context, which can further improve the security of the network .
  • the method further includes: the first NF sends a service request message to the second NF
  • the service request message is used to request the service of the second NF, and the service request message carries the access token and independent non-public network SNPN information of the first network;
  • the access token is verified; if the access token is successfully verified, the second NF returns a service response message to the first NF.
  • the authorization token when the first network is an SNPN network, the authorization token will carry the SNPN information of the first network, and when the second network is an SNPN network, the authorization token will carry the second network
  • the SNPN information enables the service requester’s network and the requested party’s network to be uniquely identified during the service request process, thereby ensuring that the first NF requesting service can be successfully completed, which can improve the reliability of the service request. Beware of malicious attacks, which can improve network security.
  • the second NF verifying the access token includes: the second NF verifying the Whether the SNPN information of the second network in the access token matches the SNPN information of the second NF; and/or, the second NF verifies the SNPN of the first network in the access token Whether the information matches the SNPN information of the first network carried in the service request message.
  • the reliability of the service request can be improved, beware of malicious attacks, and the network security can be improved.
  • a service authorization method including: a first network storage function NRF receives a first request from a first network function NF, wherein the first NF and the first NRF are located in a first network, and the The first request is used to request an access token, the access token is used to access the service of the second NF in the second network, and the first request includes independent non-public network SNPN information of the first network and/ Or the SNPN information of the second network; the first NRF forwards the first request to the second NRF, where the second NRF is located in the second network; the first NRF receives from the first NRF Two access tokens of the NRF; and, the first NRF sends the access token to the first NF.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • a service authorization method including:
  • the second network storage function NRF receives the first request from the first NRF, where the first NRF is located in the first network, the second NRF is located in the second network, and the first request is used to request an access token, so The access token is used to access the service of the second network function NF in the second network, and the first request includes independent non-public network SNPN information of the first network and/or information of the second network SNPN information;
  • the second NRF In response to the first request, the second NRF generates an access token, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network;
  • the second NRF sends the access token to the first NRF.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • a service authorization method including: a first network function NF generates a first request, wherein the first NF is located in a first network, the first request is used to request an access token, and the access command
  • the card is used to access the service of the second NF in the second network, and the first request includes the independent non-public network SNPN information of the first network and/or the SNPN information of the second network;
  • the NF sends the first request to a first network storage function NRF, where the first NRF is located in the first network; the first NF receives an access token, and the access token contains the first SNPN information of the network and/or SNPN information of the second network.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second network
  • the SNPN information includes NID and PLMN ID.
  • the method further includes: the first NF sends the first NF to the first security border proxy gateway SEPP A service request message; the first SEPP is located in the first network; the first service request message carries the access token.
  • the method further includes: the first NF sends a service request message to the second NF
  • the service request message is used to request the service of the second NF, and the service request message carries the access token and independent non-public network SNPN information of the first network.
  • a service request method including: a second network function NF receives a service request message from a first NF, wherein the first NF is located in a first network, and the second NF is located in a second network, so The service request message is used to request the service of the second NF, the service request message carries an access token and independent non-public network SNPN information of the first network, and the access token contains the first The SNPN information of the network and/or the SNPN information of the second network; the second NF verifies the access token; if the access token is successfully verified, the second NF reports The first NF returns a service response message.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • the second NF verifying the access token includes: the second The NF verifies whether the SNPN information of the second network in the access token matches the SNPN information of the second NF; and/or, the second NF verifies the SNPN information in the access token Whether the SNPN information of the first network matches the SNPN information of the first network carried in the service request message.
  • a service request method including: a first security border proxy gateway SEPP receives a first service request message from a first network function NF, wherein the first SEPP is located in a first network, and the first service The request message carries an access token, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network; the first SEPP generates a second service according to the first service request message Request message; the first SEPP sends the second service request message to the second SEPP, where the second SEPP is located in the second network, and the second service request message carries the N32 interface context identifier and the Access token.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • a service request method including: a second security border proxy gateway SEPP receives a second service request message from a first SEPP, wherein the first SEPP is located in a first network, and the second SEPP is located in a first network.
  • the second service request message carries the N32 interface context identifier and the access token, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network;
  • the second SEPP determines the N32 interface context corresponding to the N32 interface context identifier; the second SEPP verifies whether the remote SNPN information recorded in the N32 interface context matches the SNPN information of the first network ; If the remote SNPN information does not match the SNPN information of the first network, the second SEPP returns an error code to the first SEPP.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • a service authorization system including: a first network function NF for sending a first request; a first network storage function NRF for receiving a first request from the first NF, wherein the The first NF and the first NRF are located in the first network, the first request is used to request an access token, and the access token is used to access the service of the second NF in the second network, and the first request Include the independent non-public network SNPN information of the first network and/or the SNPN information of the second network; forward the first request to a second NRF, where the second NRF is located in the second network
  • the second NRF is used to receive the first request, and in response to the first request, generate an access token, the access token contains the SNPN information of the first network and/or the SNPN information of the second network; send the access token to the first NRF; the first NRF is also used to receive the access token from the second NRF, and send the access token to the The first NF; the first NF is also used to receive the access
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second network
  • the SNPN information includes NID and PLMN ID.
  • the system further includes a first security border proxy gateway SEPP and a second SEPP; the first NF is also used to send a first service request message to the first SEPP, where the first SEPP is located in the first network, and the first service request message carries the access token; the first SEPP, configured to generate a second service request message according to the first service request message, and send the second service request message to a second SEPP, where the second SEPP is located in the second network, and the second service The request message carries the N32 interface context identifier and the access token; the second SEPP is used to receive the second service request message, and determine the N32 interface context corresponding to the N32 interface context identifier; check the office Whether the remote SNPN information recorded in the N32 interface context matches the SNPN information of the first network; if the remote SNPN information does not match the SNPN information of the first network, the second SEPP is still used Then return an
  • the first NF is further used to send a service request message to the second NF, so The service request message is used to request the service of the second NF, and the service request message carries the access token and independent non-public network SNPN information of the first network; the second NF is also used to The access token is verified; if the access token is successfully verified, a service response message is returned to the first NF.
  • the second NF when the second NF checks the access token, it is specifically used to: check the Whether the SNPN information of the second network in the access token matches the SNPN information of the second NF; and/or, the second NF verifies the SNPN of the first network in the access token Whether the information matches the SNPN information of the first network carried in the service request message.
  • a communication device including: a receiving unit, configured to receive a first request from a first network function NF, wherein the first NF and the device are located in a first network, and the first request is used for When requesting an access token, the access token is used to access the service of the second NF in the second network, and the first request includes independent non-public network SNPN information of the first network and/or the first network. SNPN information of the second network; a sending unit, used to forward the first request to a second NRF, where the second NRF is located in the second network; the receiving unit, further used to receive from the second NRF NRF access token; the sending unit is also used to send the access token to the first NF.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second network
  • the SNPN information includes NID and PLMN ID.
  • a communication device including: a receiving unit, configured to receive a first request from a first NRF, wherein the first NRF is located in a first network, the device is located in a second network, and the first NRF The request is used to request an access token, the access token is used to access the service of the second network function NF in the second network, and the first request includes the independent non-public network SNPN information of the first network And/or the SNPN information of the second network; a processing unit, configured to generate an access token in response to the first request, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network; a sending unit for sending the access token to the first NRF.
  • the SNPN information of the first network includes the network identifier NID and the public land mobile network identifier PLMN ID, and/or the SNPN information of the second network SNPN information includes NID and PLMN ID.
  • a communication device including: a processing unit configured to generate a first request, wherein the device is located in a first network, the first request is used to request an access token, and the access token is used For accessing the service of the second NF in the second network, the first request includes the independent non-public network SNPN information of the first network and/or the SNPN information of the second network; the sending unit is used to transfer The first request is sent to a first network storage function NRF, where the first NRF is located in the first network; the receiving unit is configured to receive an access token, and the access token contains the information of the first network SNPN information and/or SNPN information of the second network.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the first network
  • the SNPN information of the second network includes NID and PLMN ID.
  • the sending unit is further configured to send the first possible design to the first security border proxy gateway SEPP.
  • a service request message wherein the first SEPP is located in the first network, and the first service request message carries the access token.
  • the sending unit is further configured to send a service request message to the second NF
  • the service request message is used to request the service of the second NF, and the service request message carries the access token and the SNPN information of the first network.
  • a communication device including: a receiving unit, configured to receive a service request message from a first NF, wherein the first NF is located in a first network, the device is located in a second network, and the service A request message is used to request a service of the device, the service request message carries an access token and independent non-public network SNPN information of the first network, and the access token contains SNPN information of the first network And/or SNPN information of the second network; a processing unit for verifying the access token; a sending unit for returning to the first NF when the access token is successfully verified Service response message.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second The SNPN information of the network includes NID and PLMN ID.
  • the processing unit is specifically configured to: verify all of the access tokens. Whether the SNPN information of the second network matches the SNPN information of the device; and/or, the second NF checks whether the SNPN information of the first network in the access token matches the service request message The SNPN information of the first network carried in it matches.
  • a communication device including: a receiving unit, configured to receive a first service request message from a first network function NF, wherein the device is located in a first network, and the first service request message carries An access token, where the access token contains the SNPN information of the first network and/or the SNPN information of the second network; the processing unit is configured to generate a second service request message according to the first service request message; and send; The unit is configured to send the second service request message to the second SEPP, where the second SEPP is located in the second network, and the second service request message carries the N32 interface context identifier and the access token.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or the second The SNPN information of the network includes NID and PLMN ID.
  • a communication device including: a receiving unit, configured to receive a second service request message from a first SEPP, wherein the first SEPP is located in a first network, the device is located in a second network, and The second service request message carries the N32 interface context identifier and the access token, and the access token contains the SNPN information of the first network and/or the SNPN information of the second network; the processing unit uses After determining the N32 interface context corresponding to the N32 interface context identifier, it is checked whether the remote SNPN information recorded in the N32 interface context matches the SNPN information of the first network; the sending unit is in the remote When the SNPN information does not match the SNPN information of the first network, an error code is returned to the first SEPP.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID, and/or, the second The SNPN information of the network includes NID and PLMN ID.
  • a communication device including: at least one processor; and a memory and a communication interface that are communicatively connected with the at least one processor; wherein the memory stores the memory that can be executed by the at least one processor; The at least one processor executes the instructions stored in the memory to execute the method described in any one of the above-mentioned second aspect to the seventh aspect or any one of the possible designs of any one of the aspects .
  • a computer-readable storage medium including a program or instruction, when the program or instruction runs on a computer, it executes any one of the above-mentioned second to seventh aspects or Aspects of any one of the possible designs described in the method.
  • a chip is provided, the chip is coupled with a memory, and is used to read and execute program instructions stored in the memory to implement any one or any of the above-mentioned second to seventh aspects.
  • program instructions stored in the memory to implement any one or any of the above-mentioned second to seventh aspects.
  • any one of the possible designs is described in the method.
  • a computer program product including instructions, which when run on a computer, cause the computer to execute any one of the above-mentioned second to seventh aspects or any one of the possibilities of any of the above-mentioned aspects The method described in the design.
  • Figure 1 is a schematic diagram of a service authorization process in a non-roaming scenario in the prior art
  • Figure 2 is a schematic diagram of a service request process in a non-roaming scenario in the prior art
  • Figure 3 is a schematic diagram of a service authorization process in a roaming scenario in the prior art
  • Figure 4 is a schematic diagram of a service request process in a roaming scenario in the prior art
  • FIG. 5 is a schematic structural diagram of a communication system to which an embodiment of this application is applicable.
  • FIG. 6 is a flowchart of a service authorization method provided by an embodiment of the application.
  • FIG. 7 is a flowchart of a service request method provided by an embodiment of the application.
  • FIG. 8 is a flowchart of another service request method provided by an embodiment of the application.
  • FIG. 9 is a flowchart of a method for service discovery, service authorization, and service request provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of a communication device 1000 provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of a communication device 1100 according to an embodiment of this application.
  • FIG. 12 is a schematic structural diagram of a communication device 1200 according to an embodiment of this application.
  • FIG. 13 is a schematic structural diagram of a communication device 1300 according to an embodiment of this application.
  • FIG. 14 is a schematic structural diagram of a communication device 1400 according to an embodiment of the application.
  • FIG. 15 is a schematic structural diagram of a communication device 1500 according to an embodiment of this application.
  • FIG. 16 is a schematic structural diagram of a communication device 1600 provided in an embodiment of this application.
  • the access authorization mechanism defined between NF service consumer, NRF, and NF service provider is based on OAuth 2.0, where NRF corresponds to the authorization server in OAuth 2.0, and the NF service consumer corresponds to OAuth 2.0 The client of the NF service provider corresponds to the resource server in OAuth 2.0.
  • the main process of the NF service consumer requesting the service of the NF service provider includes the following two steps:
  • NF service consumer requests service from NF service provider.
  • step 1 the process of step 1 is shown in Figure 1:
  • the NF service consumer sends an access token request to the NRF.
  • the access token request carries the service name and type (expected service name and type) expected by the NF service consumer, the client ID (client ID), and the client function type (NF) consumer NF type) etc.;
  • the NRF After receiving the access token request, the NRF generates a corresponding access token after authenticating the NF service consumer, where the claim part of the access token carries the NF instance Id (issuer) of the NRF and the NF service consumption Party's NF instance Id (subject), producer's NF type (audience), expected service name (scope), expiration time (expiration), etc.;
  • the NRF sends the access token to the NF service consumer in a response message.
  • step 2 the process of step 2 is shown in Figure 2:
  • the NF service consumer sends a service request message to the NF service producer, and the service request message carries the access token obtained from the NRF;
  • the NF service producer verifies the integrity of the claim part in the access token, and if the verification is successful, the NF service consumer service request is accepted.
  • the NF service producer returns a service response message to the NF service consumer.
  • the processes shown in Figure 1 and Figure 2 above are service authorization and service request processes in a non-roaming scenario (that is, the client and server are in the same Public Land Mobile Network (PLMN)), while in a roaming scenario ( That is, the client and the server are in different PLMNs, the client is in the visited network (visited network), and the server is in the home network (hone network), the corresponding service authorization and service request processes are shown in Figure 3 And shown in Figure 4.
  • PLMN Public Land Mobile Network
  • the process of service authorization in a roaming scenario includes:
  • the client registers with the visited NRF (vNRF);
  • S302 The client sends an access token request message to vNRF;
  • the vNRF sends an access token request message to a home network storage function (home NRF, hNRF);
  • hNRF generates an access token, and the access token has a validity period
  • hNRF returns an access token response message to vNRF, carrying the access token and the validity period;
  • the vNRF returns an access token response message to the client, carrying the access token and the validity period.
  • step S300 is also performed: mutual verification of hNRF and vNRF. Only after the mutual authentication between hNRF and vNRF is passed, vNRF can forward the client's access token request message to hNRF.
  • SEPP Security Edge Protection Proxy
  • SEPP is responsible for the security protection of signaling between the visited network and the home network in roaming scenarios.
  • SEPP in the visited network is the service consumer SEPP (service consumer, cSEPP)
  • SEPP in the home network is called the service provider SEPP (producer SEPP, pSEPP).
  • the cSEPP in the visited network is used to securely process the message sent from the client to the server and then sent to the pSEPP of the home network.
  • the pSEPP in the home network is used to securely process the message sent from the server to the client and then send it to cSEPP, cSEPP is also used to receive the message sent by pSEPP and send the message to the client after security processing, pSEPP is also used to receive the message sent by cSEPP and send the message to the server after security processing.
  • the home network and the visited network are both PLMNs. Therefore, in the PLMN network roaming authorization and service request, the PLMN ID is used to identify the home network and the visited network. Therefore, both the access token request and the claim of the access token include the PLMN ID of the client. At the same time, the server will also verify the corresponding PLMN ID.
  • the client will carry the PLMN IDs of the visited network and the home network in the access token request, and the NRF of the home network will also write the PLMN IDs of both parties in the claim of the access token when generating the token.
  • the server verifies whether the PLMN ID in the service request is consistent with the client PLMN ID in the access token, and at the same time verifies whether its own home PLMN ID is consistent with the server PLMN ID in the access token.
  • SNPN has the same network elements as PLMN in terms of network architecture, but SNPN is different from PLMN in terms of service objects, networking scale, and user subscriptions.
  • the private network built by the enterprise park is a kind of SNPN.
  • the client uses a third-party credential to access the SNPN network
  • the SNPN is regarded as the visited network
  • the SNPN or PLMN where the third-party credential is located is regarded as the home network.
  • PLMN ID When the home network or the visited network is SNPN, if the PLMN ID is still carried in the access token request process and the service request process according to the existing method to identify the home network or the visited network, the following scenario exists: PLMN ID If the same two visited SNPNs (such as SNPN A and SNPN B) have a roaming access relationship with a third-party network (SNPN C or PLMN C), the third-party network cannot identify which visited network the request comes from; or, visit The local network and the two third-party networks with the same PLMN ID have a roaming access relationship, so the client cannot distinguish which third-party network should send the request to. That is, in the process of access authorization and service request, it is impossible to uniquely identify an SNPN network, which results in the failure of client access authorization or service request to complete, and the reliability and security of the network are low.
  • the service authorization method, device and system of the embodiments of the present application are provided.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, such as: the fourth generation (4th Generation, 4G) communication system, the fifth generation (5th Generation, 5G) communication system or other future evolution systems, or other various systems.
  • FIG. 5 is a communication system to which the embodiments of this application are applicable.
  • the communication system includes a user equipment (User Equipment, UE), a radio access network (Radio Access Network, RAN), and a core network (Core Network, CN).
  • the user equipment can access the wireless access network through the access network equipment such as the base station, and establish a communication connection with the external data network (DN) through the core network.
  • the core network is mainly used for user equipment registration, security authentication, mobility management, location management, session management, and forwarding data packets between user equipment and external data networks.
  • the above-mentioned wireless access network may be a Next Generation Access Network (NG-AN).
  • NG-AN Next Generation Access Network
  • the above-mentioned core network includes the following network functions: Session Management Function (SMF), Access and Mobility Management Function (AMF), User Plane Function (UPF), and unified data Management (Unified Data Management, UDM), Policy Control Function (PCF), Authentication Server Function (AUSF), Network Slice Selection Function (NSSF), Network Disclosure Function (Network Exposure Function (NEF), Network Repository Function (NRF), Application Function (AF), etc.
  • SMF Session Management Function
  • AMF Access and Mobility Management Function
  • UPF User Plane Function
  • UDM Unified Data Management
  • PCF Policy Control Function
  • AUSF Authentication Server Function
  • NSSF Network Slice Selection Function
  • NEF Network Disclosure Function
  • NEF Network Exposure Function
  • NRF Network Repository Function
  • AF Application Function
  • the aforementioned core network may include one or more core network devices.
  • the core network device may be a network element used to perform the foregoing single network function, or may be a network element used to perform the foregoing multiple network functions.
  • the core network device may include one or more functional modules for performing the above-mentioned multiple network functions.
  • the functional modules may be software modules or It is a software and hardware module, which is not limited in the embodiment of the present application.
  • network functions the above-mentioned network functions, the network elements, devices, and functional modules used to perform the above-mentioned network functions, and the chip systems provided in the above-mentioned network elements and devices are collectively referred to as network functions hereinafter.
  • the core network of the above-mentioned communication system adopts a service-oriented architecture.
  • the above-mentioned different network functions can communicate based on the client-server model.
  • the NF service consumer is also called the client
  • the NF service provider is also called the function server or server or server.
  • the aforementioned control plane network functions such as access and mobility management functions, session management functions, policy control functions, and unified data management functions may interact with service-oriented interfaces.
  • the servicing interface provided by the access and mobility management function can be Namf
  • the servicing interface provided by the session management function can be Nsmf
  • the servicing interface provided by the policy control function can be Npcf
  • unified data The service-oriented interface provided by the management function can be Nudm, etc.
  • the aforementioned access network device is a device that is located on the network side of the aforementioned communication system and has a wireless transceiver function or a chip that can be installed in the device.
  • the access network equipment includes but is not limited to: evolved Node B (eNB), Radio Network Controller (RNC), Node B (Node B, NB), Base Station Controller (Base Station Controller) , BSC), base transceiver station (Base Transceiver Station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (BaseBand Unit, BBU), wireless fidelity (Wireless Fidelity, WIFI)
  • the access point (Access Point, AP), wireless relay node, wireless backhaul node, transmission point (Transmission and Reception Point, TRP or Transmission Point, TP) in the system, etc., can also be 5G, such as the new air interface ( The gNB in the New Radio, NR) system, or the transmission point (TRP or
  • the above-mentioned user equipment is a terminal device that accesses the above-mentioned communication system and has a wireless transceiver function, or a chip that can be installed in the terminal device.
  • the user equipment may also be referred to as a user device, an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device.
  • the terminal device in the embodiments of the present application may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, and an augmented reality (Augmented Reality, AR) terminal Equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, transportation safety ( Wireless terminals in transportation safety, wireless terminals in smart cities, and wireless terminals in smart homes.
  • FIG. 5 is only a simplified schematic diagram of an example for ease of understanding, and the communication system may also include other network devices or other terminal devices, which are not shown in FIG. 5.
  • an embodiment of the present application provides a service authorization method, which can be applied to the communication system shown in FIG. 5.
  • Methods include:
  • the first NF sends a first request to the first NRF, and the first NRF receives the first request.
  • the first NF is a client or an NF service consumer.
  • the first NF may be SMF, AMF, etc. in the communication system shown in FIG. 5.
  • the first request is used to request an access token
  • the access token is used to access the service of the second NF in the second network.
  • the access token is the authorization for the client to access the service of the second NF in the second network. Credentials, the client must hold the access token to access the services of the second NF.
  • the second NF is used to provide a certain functional service.
  • the second NF may be AUSF, UDM, UPF, AF, etc. in the communication system shown in FIG. 5.
  • Both the first NF and the first NRF are located in the first network, and the second NF is located in the second network.
  • the first request includes the SNPN information of the first network and/or the SNPN information of the second network.
  • the SNPN information contained in the first request needs to be determined according to the specific types of the first network and the second network. For example, if the network type of the first network is SNPN and the network type of the second network is PLMN, the first request includes the SNPN information of the first network, and may further include the PLMN information of the second network; The network type of the second network is SNPN, and the network type of the first network is PLMN, then the first request includes the SNPN information of the second network, and may further include the PLMN information of the first network; if the network type of the first network is SNPN, the network type of the second network is also SNPN, then the first request contains both the SNPN information of the first network and the SNPN information of the second network.
  • an SNPN can be identified by a set of network identifiers (Network ID, NID) and public land mobile network identifiers (PLMN ID).
  • Network ID Network ID
  • PLMN ID public land mobile network identifiers
  • the NID and the PLMN ID can be carried in two different information elements respectively, or can be carried in one information element in a combined form, which is not limited here.
  • the combination of NID and PLMN ID is carried in the cell where the original PLMN ID is located, which can save resource overhead.
  • the first request further includes at least one of the following parameters: desired service name and type, client identification, client (ie, first NF) function type, and so on.
  • the first NF needs to register on the first NRF, and initiate a service discovery request process for the first NRF, and obtain the first request based on service discovery. After the instance information of the second NF, the above-mentioned first request is initiated.
  • the first NRF forwards the first request to the second NRF.
  • the second NRF is located in the second network.
  • the first NRF may directly forward the first request to the second NRF, and the first NRF may also reorganize and transform the first request and then forward it to the second NRF, which is not limited here.
  • the first NRF may verify the first NF, and after verifying that the identity of the first NF is legal, the first request is forwarded to the second NRF.
  • the first NRF and the second NRF need to be mutually authenticated.
  • the first NRF and the second NRF may use certificates for mutual authentication.
  • the second NRF authorizes the first NF to generate an access token, where the access token contains the SNPN information of the first network and/or the SNPN information of the second network.
  • the SNPN information in the access token is consistent with the SNPN information carried in the first request.
  • the access token carries the SNPN information of the first network, and can also further carry the PLMN information of the second network;
  • the network type of the second network is SNPN, and the network type of the first network is PLMN, then the access token carries the SNPN information of the second network, and can also further carry the PLMN information of the first network;
  • the network type of the first network is SNPN
  • the network type of the second network is also SNPN
  • the access token carries the SNPN information of the first network and the SNPN information of the second network.
  • the access token may also include other information, such as the first NF function type, the second NF function type, the validity period or expiration date (used to indicate when the access token expires), the name of the expected service, and the first NF function type. 2.
  • the second NRF may verify the first NF before generating the access token, and after verifying that the identity of the first NF is legal, authorize the first NF to generate an access token for it.
  • the second NRF after the second NRF generates the access token, it can also perform integrity protection on the access token, such as adding a digital signature, a message verification code, and so on.
  • the second NRF sends an access token to the first NRF, and the first NRF receives the access token from the second NRF.
  • the first NRF sends the access token to the first NF, and the first NF receives the access token from the first NRF.
  • the first NF when the first network is an SNPN network, the first NF will add the SNPN information of the first network to the first request.
  • the second network is an SNPN network
  • the first NF will add the SNPN information of the first network to the first request.
  • An NF will add the SNPN information of the second network to the first request, so that both the network requesting the access token and the network requesting the access token can be uniquely identified during the service authorization process, ensuring that the first NF requests the access order
  • the licensing process can be completed smoothly, improving the reliability of service authorization.
  • the access token will also carry the corresponding SNPN information to clarify the service consumer and service provider authorized by the access token, which can further improve the reliability of service authorization.
  • an embodiment of the present application also provides a service request method, which is suitable for the communication system shown in FIG. 5.
  • Methods include:
  • the first NF sends a service request message to the second NF.
  • the first NF is located in the first network
  • the second NF is located in the second network.
  • the network type of at least one of the first network and the second network is SNPN.
  • the service request message is used to request the service of the second NF, and the service request message carries the access token.
  • the first NF carries the access token in the service request message and the second NRF issued to the first NF (see the embodiment shown in FIG. 6 for the specific process), so the access token may carry the access token of the first network
  • the SNPN information and/or the SNPN information of the second network, and the specific SNPN information in the access token is determined by the types of the first network and the second network.
  • the SNPN information of the first network carried in the access token is referred to as the first SNPN
  • the SNPN information of the second network carried in the access token is referred to as the second SNPN.
  • the service request message may also carry the service range requested by the first NF.
  • the service request message may also carry network information of the first NF (that is, network information of the first network).
  • network information of the first network that is, network information of the first network.
  • the service request message in addition to the access token, the service request message also carries the SNPN information of the first NF (service requester); if the type of the first network is PLMN, the service request message In addition to the access token, it also carries the PLMN information of the first NF (service requester).
  • the second NF verifies the access token; if the access token verification succeeds, S703 is executed, and if the access token verification fails, S704 is executed.
  • the verification of the access token by the second NF includes the verification of the SNPN information in the access token. Specifically, it includes checking whether the access token has the first SNPN information and/or the second SNPN information; if there is the first SNPN information and/or the second SNPN information, then the first SNPN information and/or the second SNPN information is further checked. SNPN information is verified.
  • the second NF further determines whether the SNPN information of the first NF carried in the service request message matches the first SNPN information in the access token, and if it matches, it checks Success, otherwise the verification fails; if the access token has the second SNPN information, the second NF further determines whether the SNPN information of the second NF matches the second SNPN information in the access token, and if it matches, the verification is successful.
  • the verification fails; if the access token has the first SNPN and the second SNPN information, the second NF further determines whether the SNPN information of the first NF carried in the service request message matches the first SNPN information in the access token, And it is judged whether the SNPN information of the second NF matches the second SNPN information in the access token, if both match, the verification is successful, otherwise the verification fails.
  • verifying the access token by the second NF may further include verifying the service scope requested by the first NF, for example, determining whether the service scope requested by the first NF exceeds the service scope recorded in the access token .
  • the optional verification of the access token by the second NF may further include verifying the integrity of the access token or the service request message to determine whether the access token or the service request message is complete.
  • verifying the access token by the second NF may further include verifying the expiration date in the access token to determine whether the access token has expired.
  • multiple dimensions of verification must be passed before step S703 can be executed.
  • multiple dimensions can be understood as at least two dimensions, such as the dimension of SNPN information verification, the dimension of integrity verification, the dimension of service range verification, the dimension of expiration date verification, and so on.
  • the second NF responds to the service request of the first NF, and returns a service response message to the first NF to notify the first NF to access the service of the second NF.
  • the second NF returns a message denying the first NF access to the service of the second NF to the first NF, or does not return a service response message.
  • the authorization token when the first network is an SNPN network, the authorization token will carry the SNPN information of the first network, and when the second network is an SNPN network, the authorization token will carry Carry the SNPN information of the second network, so that the network of the service requester and the network of the requested party can be uniquely identified during the service request process, thereby ensuring that the process of requesting the service by the first NF can be completed smoothly, improving the reliability of the service, and You can also beware of malicious attacks and improve network security.
  • the first NF and the second NF are in different networks, so the first NF and the second NF need to exchange messages through SEPP to communicate with the first network and the second network.
  • the signalling between is protected safely.
  • the SEPP in the first network is referred to as the first SEPP
  • the SEPP in the home network is referred to as the second SEPP, as shown by the dashed box in FIG. 7.
  • an embodiment of the present application also provides a service request method, including:
  • the first NF sends a first service request message to the first SEPP, and the first SEPP receives the first service request message.
  • the first NF and the first SEPP are both located in the first network
  • the first service request message is used to request the service of the second NF
  • the first service request message carries the access token and the target access object (ie, the second NF).
  • Internet Information For the specific implementation of the access token here, please refer to the specific implementation of the access token above, which will not be repeated here.
  • the first SEPP generates a second service request message according to the first service request message, and the second service request message carries the N32 interface context identifier and the access token.
  • the first SEPP and the second SEPP exchange messages through the N32 interface. Therefore, before the first SEPP and the second SEPP exchange messages, the first SEPP and the second SEPP will first establish the N32 interface connection. When the first SEPP and the second SEPP are establishing the N32-c link, they will negotiate and establish the N32 -f context, the SEPP information of the opposite end will be recorded in the respective N32-f context.
  • the SEPP information recorded in the N32 interface context includes at least network information, and the network information may be specifically recorded in the N32-f peer information (N32-f peer information) in the N32-f context.
  • the N32-f context of the first SEPP contains the SNPN information (PLMN ID+NID) of the second network
  • the N32-f context of the second SEPP Contains the SNPN information (PLMN ID+NID) of the first network.
  • PLMN ID+NID the peer network
  • the N32-f context can record the PLMN information of the peer network.
  • the first SEPP and the second SEPP preset the network information of the opposite end, including but not limited to the following two ways:
  • Method 1 Reuse the existing interface to establish a message.
  • the first process of N32-c is established between SEPP, and the respective SNPN information is carried in the two messages of the process.
  • the SEPP (which can be the first SEPP or the second SEPP) that initiates the establishment of the N32-c connection sends a capability exchange message to the peer SEPP, and the capability exchange message carries its own SNPN information.
  • the peer SEPP returns a response message
  • the response message carries the SNPN information of the peer SEPP.
  • the network types of the first SEPP and the second SEPP are both SNPN, but the actual situation is not limited to this, and other types of networks can also be used.
  • the second SEPP network type is PLMN
  • the response message carries PLMN information of the second SEPP.
  • Manner 2 Generate a new message specially used for exchanging SEPP network information.
  • the first SEPP generates and sends a dedicated exchange request message to the second SEPP, the dedicated exchange request message carries the SNPN information of the first SEPP, and then the second SEPP responds to the exchange request message and returns its own SNPN information to the first SEPP .
  • the second SEPP initiates a dedicated exchange request message, and the first SEPP responds with a reply, and there is no restriction here.
  • the first SEPP When the first SEPP generates the second service request message according to the first service request message, the first SEPP indexes the first SEPP and the first SEPP according to the network information of the target access object (ie, the second NF) carried in the first service request message.
  • the N32 interface context between the two SEPPs and then use the N32 interface context to reorganize and transform the first service request message to generate a second service request message.
  • the second service request message carries the access token and the N32 interface context identifier.
  • the specific implementation of the reorganization conversion includes but is not limited to: integrity protection of the first service request message (for example, adding a digital signature, message verification code, etc.), adding metadata, and the like. It is understandable that the valid data before and after the reorganization and conversion remains unchanged, such as access tokens, service request scope, etc.
  • the first SEPP sends a second service request message to the second SEPP, and the second SEPP receives the second service request message.
  • the second SEPP determines the N32 interface context corresponding to the N32 interface context identifier; if the first network is an SNPN network, the second SEPP checks whether the remote SNPN information recorded in the N32 interface context is the same as that in the access token The first SNPN information matches.
  • the second SEPP checks whether the remote PLMN information recorded in the N32 interface context matches the first PLMN information in the access token.
  • the second SEPP If the remote SNPN information does not match the SNPN information of the first network, the second SEPP returns an error code to the first SEPP.
  • the second SEPP forwards the second service request message to the second NF. It should be understood that the forwarding here may be direct forwarding, or it may be forwarding after transformation and reorganization of the second service request message, and there is no restriction here.
  • the second SEPP in the second network when the first network is SNPN information, the second SEPP in the second network will preset the SNPN information of the first SEPP in the context of the N32 interface, and when the second network When it is SNPN information, the first SEPP in the first network will preset the SNPN information of the second SEPP in the context of the N32 interface, which can further realize the security protection of the signaling between the first network and the second network. Improve network security.
  • an embodiment of the present application also provides a service discovery, service authorization, and service request method, which is applicable to the communication system shown in FIG. 5.
  • the NPN proxy (proxy) server acts as a proxy for the first NF (client) to perform service discovery, service authorization, and service request processes.
  • the NPN proxy server is located in the second network (home network), that is, the network where the second NF (NF service provider) is located.
  • the first NF sends an NF service request message to the NPN proxy server.
  • the first NF is located in the first network, and the NF service request message here carries the SNPN information (such as the NID of the first network) of the requesting party (ie, the first NF).
  • the SNPN information such as the NID of the first network
  • the NPN proxy server replaces the first NF to initiate a service discovery process to the second NRF.
  • the NPN proxy server initiates an access token request to the second NRF instead of the first NF.
  • the access token request carries the SNPN information of the requesting party (that is, the first NF), and may also carry the desired service type, etc.
  • the second NRF returns the access token to the NPN proxy server.
  • the access token carries the SNPN information of the client, and may also carry the authorized service range.
  • the NPN proxy server initiates a service request to the second NF, and the request carries the SNPN information of the requesting party, the access token, etc.
  • S906 The second NF checks whether the SNPN information of the client in the access token matches the SNPN information of the requester in the NF service request S905. If it matches, continue the service request process, if it does not match, then reject the service request.
  • the technical solution of the embodiment of the present application uses the NPN proxy server in the second network to proxy the first NF in the first network to perform service discovery, service authorization, and service request processes on the second NF in the second network. Further simplify the interaction process, improve the interaction efficiency, and reduce the complexity of the client.
  • an embodiment of the present application provides a communication device 1000, which may have the function of realizing the first NRF in the foregoing method embodiment, and the device may be the first NRF or the first NRF.
  • the device may be the first NRF or the first NRF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving unit 1001 is configured to receive a first request from a first network function NF, where the first NF and the device are located in a first network, and the first request is used to request an access token, the access token For accessing a service of a second NF in a second network, the first request includes independent non-public network SNPN information of the first network and/or SNPN information of the second network;
  • the sending unit 1002 is configured to forward the first request to a second NRF, where the second NRF is located in the second network;
  • the receiving unit 1001 is further configured to receive an access token from the second NRF; the sending unit is further configured to send the access token to the first NF.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • an embodiment of the present application provides a communication device 1100, which may have the function of realizing the second NRF in the foregoing method embodiment, and the device may be a second NRF or a second NRF.
  • the device may be a second NRF or a second NRF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving unit 1101 is configured to receive a first request from a first NRF, where the first NRF is located in a first network, and the device is located in a second network, the first request is used to request an access token, and the access The token is used to access the service of the second network function NF in the second network, and the first request includes the independent non-public network SNPN information of the first network and/or the SNPN information of the second network ;
  • the processing unit 1102 is configured to generate an access token in response to the first request, where the access token contains SNPN information of the first network and/or SNPN information of the second network;
  • the sending unit 1103 is configured to send the access token to the first NRF.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • an embodiment of the present application provides a communication device 1200, which may have the function of realizing the first NF in the foregoing method embodiment, and the device may be the first NF or the first NF.
  • the device may be the first NF or the first NF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the processing unit 1201 is configured to generate a first request, where the device is located in a first network, the first request is used to request an access token, and the access token is used to access the service of the second NF in the second network ,
  • the first request includes independent non-public network SNPN information of the first network and/or SNPN information of the second network;
  • the sending unit 1202 is configured to send the first request to a first network storage function NRF, where the first NRF is located in the first network;
  • the receiving unit 1203 is configured to receive an access token, where the access token contains SNPN information of the first network and/or SNPN information of the second network.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • the sending unit 1202 is further configured to send a first service request message to the first security border proxy gateway SEPP, where the first SEPP is located in the first network, and the first service request message carries The access token.
  • the sending unit 1202 is further configured to send a service request message to the second NF, where the service request message is used to request a service of the second NF, and the service request message carries the access The token and the SNPN information of the first network.
  • an embodiment of the present application provides a communication device 1300, which may have the function of realizing the second NF in the foregoing method embodiment.
  • the device may be a second NF or a second NF.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving unit 1301 is configured to receive a service request message from a first NF, where the first NF is located in the first network, the device is located in the second network, and the service request message is used to request the service of the device, so
  • the service request message carries an access token and independent non-public network SNPN information of the first network, and the access token contains SNPN information of the first network and/or SNPN information of the second network;
  • the processing unit 1302 is configured to verify the access token
  • the sending unit 1303 is configured to return a service response message to the first NF when the access token is successfully verified.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • the processing unit 1302 is specifically configured to: verify whether the SNPN information of the second network in the access token matches the SNPN information of the device; and/or, the second NF calibration Verifying whether the SNPN information of the first network in the access token matches the SNPN information of the first network carried in the service request message.
  • an embodiment of the present application provides a communication device 1400, which may have the function of realizing the first SEPP in the foregoing method embodiment.
  • the device may be the first SEPP or the first SEPP.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving unit 1401 is configured to receive a first service request message from a first network function NF, where the device is located in a first network, the first service request message carries an access token, and the access token contains all SNPN information of the first network and/or SNPN information of the second network;
  • the processing unit 1402 is configured to generate a second service request message according to the first service request message
  • the sending unit 1403 is configured to send the second service request message to a second SEPP, where the second SEPP is located in the second network, and the second service request message carries the N32 interface context identifier and the access command Card.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • an embodiment of the present application provides a communication device 1500, which may have the function of realizing the second SEPP in the foregoing method embodiment.
  • the device may be a second SEPP or a second SEPP.
  • the above-mentioned functions can be realized by hardware, or can be realized by hardware executing corresponding software, and the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device includes:
  • the receiving unit 1501 is configured to receive a second service request message from a first SEPP, where the first SEPP is located in a first network, the device is located in a second network, and the second service request message carries an N32 interface context identifier And the access token, where the access token contains the SNPN information of the first network and/or the SNPN information of the second network;
  • the processing unit 1502 is configured to determine the N32 interface context corresponding to the N32 interface context identifier, and verify whether the remote SNPN information recorded in the N32 interface context matches the SNPN information of the first network;
  • the sending unit 1503 returns an error code to the first SEPP when the remote SNPN information does not match the SNPN information of the first network.
  • the SNPN information of the first network includes a network identifier NID and a public land mobile network identifier PLMN ID
  • the SNPN information of the second network includes a NID and a PLMN ID.
  • an embodiment of the present application further provides a communication device 1600, including:
  • At least one processor 1601 and,
  • the memory 1602 stores instructions that can be executed by the at least one processor 1601, and the at least one processor 1601 executes the instructions stored in the memory 1602 to perform the operations performed by any network element in the foregoing method embodiments. Method of execution.
  • processor 1601 and the memory 1602 may be coupled through an interface circuit, or may be integrated together, which is not limited here.
  • the specific connection medium between the processor 1601, the memory 1602, and the communication interface 1603 is not limited in the embodiment of the present application.
  • the processor 1601, the memory 1602, and the communication interface 1603 are connected by a bus 1604.
  • the bus is represented by a thick line in FIG. 16, and the connection modes between other components are merely illustrative. , Is not limited.
  • the bus can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 16, but it does not mean that there is only one bus or one type of bus.
  • the processor mentioned in the embodiments of the present application may be implemented by hardware or software.
  • the processor may be a logic circuit, an integrated circuit, or the like.
  • the processor can be a general-purpose processor, implemented by reading software codes stored in the memory.
  • the processor may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), and Application Specific Integrated Circuit (ASIC) , Ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), and electrically available Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Eate SDRAM, DDR SDRAM enhanced synchronous dynamic random access memory
  • Enhanced SDRAM, ESDRAM synchronous connection dynamic random access memory
  • Synchlink DRAM, SLDRAM synchronous connection dynamic random access memory
  • DR RAM Direct Rambus RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component
  • the memory storage module
  • the embodiments of the present application also provide a computer-readable storage medium, including a program or instruction.
  • the program or instruction runs on a computer, it executes what is executed by any network element in the foregoing method embodiments. method.
  • an embodiment of the present application also provides a chip, which is coupled with a memory, and is used to read and execute the program instructions stored in the memory to implement the execution of any network element in the above method embodiment.
  • the embodiments of the present application also provide a computer program product, including instructions, which when run on a computer, cause the computer to execute the method performed by any network element in the above method embodiments.
  • These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another readable storage medium. For example, the computer instructions may be passed from a website, a computer, a server, or a data center.
  • Wired such as coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a digital versatile disc (DVD)), or a semiconductor medium (for example, a solid state disk (SSD)). ))Wait.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例涉及一种服务授权方法、装置及系统，用于解决SNPN网络漫游场景下无法顺利完成服务授权或服务请求的问题。方法包括：第一NRF接收来自第一NF的第一请求，第一NF和第一NRF位于第一网络，第一请求用于请求访问令牌，访问令牌用于访问第二网络中的第二NF的服务，第一请求中包含第一网络的SNPN信息和/或第二网络的SNPN信息；第一NRF将第一请求转发给第二NRF，第二NRF位于第二网络；响应于第一请求，第二NRF生成访问令牌，访问令牌中包含第一网络的SNPN信息和/或第二网络的SNPN信息；第二NRF向第一NRF发送访问令牌；第一NRF接收访问令牌并将访问令牌发送给第一NF。

Description

一种服务授权方法、装置及系统
相关申请的交叉引用
本申请要求在2020年03月23日提交中国专利局、申请号为202010209382.4、申请名称为“一种服务授权方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种服务授权方法、装置及系统。
背景技术
第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)定义了服务化架构(service-based architecture，SBA)网络，网络中的网络功能(Network Function，NF)服务消费方(service consumer)可以向NF服务提供商(service producer)进行服务请求。为了支持该特性，3GPP引入一个网络存储功能(Network Repository Function，NRF)网元，用于提供网络功能的注册、维护、发现以及访问授权等功能。
在漫游场景下，即NF服务消费方处于拜访地网络，而NF服务提供商处于归属地网络时，各网元会在交互消息(如访问令牌请求、服务请求等消息)中通过携带NF服务消费方和NF服务提供商的公共陆地移动网(Public Land Mobile Network，PLMN)标识(identity，ID)来标识拜访地网络和归属地网络。
以上方案仅考虑了PLMN网络漫游的场景，但是事实上，目前除了PLMN网络，还存在独立非公共网络(Stand-alone Non-Public Network，SNPN)。当归属地网络和/或拜访地网络的类型为SNPN时，如果仍按照现有方法在交互过程中通过携带PLMN ID来标识归属地网络或拜访地网络，则可能无法顺利完成服务授权或服务请求。
发明内容
本申请实施例提供一种服务授权方法、装置及系统，用于解决SNPN网络漫游场景下，无法唯一标识归属地网络和/或拜访地网络导致无法顺利完成服务授权或服务请求的问题，提高网络的可靠性和安全性。
第一方面，提供一种服务授权方法，包括：第一网络存储功能NRF接收来自第一网络功能NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；所述第一NRF将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；响应于所述第一请求，所述第二NRF生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；所述第二NRF向所述第一NRF发送所述访问令牌；所述第一NRF接收来自所述第二NRF的访问令牌；以及，所述第一NRF将所述访问令牌发送给所述第一NF。
通过本申请实施例提供的技术方案，当第一网络是SNPN网络时，第一NF会在第一请求中添加第一网络的SNPN信息，当第二网络是SNPN网络时，第一NF会在第一请求中添加第二网络的SNPN信息，这样可使得服务授权过程中请求访问令牌的网络和被请求访问令牌的网络均能够被唯一标识，保证第一NF请求访问令牌的过程可以顺利完成，提高服务授权的可靠性。另外，返回的访问令牌中也会携带对应的SNPN信息，以明确访问令牌授权的服务消费方和服务提供方，可以进一步提高服务授权的可靠性。
结合第一方面，在第一方面的第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
通过本实施方式，SNPN网络可以通过NID和PLMN ID组合的形式被唯一标识，提高了网络交互的可靠性。
结合第一方面或者第一方面的第一种可能的设计，在第一方面的第二种可能的设计中，所述方法还包括：所述第一NF向第一安全边界代理网关SEPP发送第一服务请求消息；所述第一SEPP位于所述第一网络；所述第一服务请求消息中携带所述访问令牌；所述第一SEPP根据所述第一服务请求消息生成第二服务请求消息；所述第一SEPP向第二SEPP发送所述第二服务请求消息；所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌；所述第二SEPP确定出与所述N32接口上下文标识相对应N32接口上下文；所述第二SEPP校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP返回错误码给所述第一SEPP。
通过本实施方式，当第一网络是SNPN信息时，第二网络中的第二SEPP会在N32接口上下文中预置第一SEPP的SNPN信息，当第二网络是SNPN信息时，第一网络中的第一SEPP会在N32接口上下文中预置第二SEPP的SNPN信息，进而可以通过N32接口上下文对第一网络和第二网络之间的信令进行安全校验，可以进一步提高网络的安全性。
结合第一方面或者第一方面的第一种可能的设计，在第一方面的第三种可能的设计中，所述方法还包括：所述第一NF向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的独立非公共网络SNPN信息；所述第二NF对所述访问令牌进行校验；若所述访问令牌校验成功，则所述第二NF向所述第一NF返回服务响应消息。
通过本申请实施例提供的技术方案，当第一网络是SNPN网络时，授权令牌中会携带第一网络的SNPN信息，当第二网络是SNPN网络时，授权令牌中会携带第二网络的SNPN信息，使得服务请求过程中服务请求方的网络和被请求方的网络均能够被唯一标识，进而保证第一NF请求服务的过程可以顺利完成，可以提高服务请求的可靠性，另外还可以提防恶意攻击，可以提高网络安全性。
第一方面的第三种可能的设计，在第一方面的第四种可能的设计中，所述第二NF对所述访问令牌进行校验，包括：所述第二NF校验所述访问令牌中的所述第二网络的SNPN信息是否与所述第二NF的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
通过本实施方式，通过对访问令牌中的SNPN信息的校验，可以提高服务请求的可靠 性，提防恶意攻击，提高网络安全性。
第二方面，提供一种服务授权方法，包括：第一网络存储功能NRF接收来自第一网络功能NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；所述第一NRF将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；所述第一NRF接收来自所述第二NRF的访问令牌；以及，所述第一NRF将所述访问令牌发送给所述第一NF。
结合第二方面，在第二方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第三方面，提供一种服务授权方法，包括：
第二网络存储功能NRF接收来自第一NRF的第一请求，其中所述第一NRF位于第一网络，所述第二NRF位于第二网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问所述第二网络中的第二网络功能NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
响应于所述第一请求，所述第二NRF生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；
所述第二NRF向所述第一NRF发送所述访问令牌。
结合第三方面，在第三方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第四方面，提供一种服务授权方法，包括：第一网络功能NF生成第一请求，其中所述第一NF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；所述第一NF将所述第一请求发送给第一网络存储功能NRF，其中所述第一NRF位于所述第一网络；所述第一NF接收访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息。
结合第四方面，在第四方面的第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
结合第四方面或者第四方面的第一种可能的设计，在第四方面的第二种可能的设计中，所述方法还包括：所述第一NF向第一安全边界代理网关SEPP发送第一服务请求消息；所述第一SEPP位于所述第一网络；所述第一服务请求消息中携带所述访问令牌。
结合第四方面或者第四方面的第一种可能的设计，在第四方面的第三种可能的设计中，所述方法还包括：所述第一NF向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的独立非公共网络SNPN信息。
第五方面，提供一种服务请求方法，包括：第二网络功能NF接收来自第一NF的服务请求消息，其中所述第一NF位于第一网络，所述第二NF位于第二网络，所述服务请 求消息用于请求所述第二NF的服务，所述服务请求消息中携带访问令牌和所述第一网络的独立非公共网络SNPN信息，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；所述第二NF对所述访问令牌进行校验；若所述访问令牌校验成功，则所述第二NF向所述第一NF返回服务响应消息。
结合第五方面，在第五方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
结合第五方面或者第五方面的第一种可能的设计，在第五方面的第二种可能的设计中，所述第二NF对所述访问令牌进行校验，包括：所述第二NF校验所述访问令牌中的所述第二网络的SNPN信息是否与所述第二NF的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
第六方面，提供一种服务请求方法，包括：第一安全边界代理网关SEPP接收来自第一网络功能NF的第一服务请求消息，其中所述第一SEPP位于第一网络，所述第一服务请求消息中携带访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或第二网络的SNPN信息；所述第一SEPP根据所述第一服务请求消息生成第二服务请求消息；所述第一SEPP向第二SEPP发送所述第二服务请求消息，其中所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌。
结合第六方面，在第六方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第七方面，提供一种服务请求方法，包括：第二安全边界代理网关SEPP接收来自第一SEPP的第二服务请求消息，其中所述第一SEPP位于第一网络，所述第二SEPP位于第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；所述第二SEPP确定出与所述N32接口上下文标识相对应N32接口上下文；所述第二SEPP校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP返回错误码给所述第一SEPP。
结合第七方面，在第七方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第八方面，提供一种服务授权系统，包括：第一网络功能NF，用于发送第一请求；第一网络存储功能NRF，用于接收来自所述第一NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；所述第二NRF，用于接收所述第一请求，并响应于所述第一请求，生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；向所述第一NRF发送所述访问令牌；所述第一NRF还用于接收来自所述第二NRF 的访问令牌，将所述访问令牌发送给所述第一NF；所述第一NF还用于接收所述访问令牌。
结合第八方面，在第八方面的第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
结合第八方面或者第八方面的第一种可能的设计，在第八方面的第二种可能的设计中，所述系统还包括第一安全边界代理网关SEPP和第二SEPP；所述第一NF，还用于向所述第一SEPP发送第一服务请求消息，其中所述第一SEPP位于所述第一网络，所述第一服务请求消息中携带所述访问令牌；所述第一SEPP，用于根据所述第一服务请求消息生成第二服务请求消息，向第二SEPP发送所述第二服务请求消息，其中所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌；所述第二SEPP，用于接收所述第二服务请求消息，确定出与所述N32接口上下文标识相对应N32接口上下文；校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP还用于返回错误码给所述第一SEPP。
结合第八方面或者第八方面的第一种可能的设计，在第八方面的第三种可能的设计中，所述第一NF，还用于向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的独立非公共网络SNPN信息；所述第二NF，还用于对所述访问令牌进行校验；若所述访问令牌校验成功，则向所述第一NF返回服务响应消息。
结合第八方面的第三种可能的设计，在第八方面的第四种可能的设计中，所述第二NF在对所述访问令牌进行校验时，具体用于：校验所述访问令牌中的所述第二网络的SNPN信息是否与所述第二NF的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
第九方面，提供一种通信装置，包括：接收单元，用于接收来自第一网络功能NF的第一请求，其中所述第一NF和所述装置位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；发送单元，用于将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；所述接收单元，还用于接收来自所述第二NRF的访问令牌；所述发送单元还用于将所述访问令牌发送给所述第一NF。
结合第九方面，在第九方面的第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第十方面，提供一种通信装置，包括：接收单元，用于接收来自第一NRF的第一请求，其中所述第一NRF位于第一网络，所述装置位于第二网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问所述第二网络中的第二网络功能NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；处理单元，用于响应于所述第一请求，生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；发送单元，用于向所述第一NRF发送所述访问令 牌。
结合第十方面，在第十方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第十一方面，提供一种通信装置，包括：处理单元，用于生成第一请求，其中所述装置位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；发送单元，用于将所述第一请求发送给第一网络存储功能NRF，其中所述第一NRF位于所述第一网络；接收单元，用于接收访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息。
结合第十一方面，在第十一方面的第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
结合第十一方面或者第十一方面的第一种可能的设计，在第十一方面的第二种可能的设计中，所述发送单元，还用于向第一安全边界代理网关SEPP发送第一服务请求消息，其中所述第一SEPP位于所述第一网络，所述第一服务请求消息中携带所述访问令牌。
结合第十一方面或者第十一方面的第一种可能的设计，在第十一方面的第三种可能的设计中，所述发送单元，还用于向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的SNPN信息。
第十二方面，提供一种通信装置，包括：接收单元，用于接收来自第一NF的服务请求消息，其中所述第一NF位于第一网络，所述装置位于第二网络，所述服务请求消息用于请求所述装置的服务，所述服务请求消息中携带访问令牌和所述第一网络的独立非公共网络SNPN信息，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；处理单元，用于对所述访问令牌进行校验；发送单元，用于在所述访问令牌校验成功时，向所述第一NF返回服务响应消息。
结合第十二方面，在第十二方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
结合第十二方面或者第十二方面的第一种可能的设计，在第十二方面的第二种可能的设计中，所述处理单元具体用于：校验所述访问令牌中的所述第二网络的SNPN信息是否与所述装置的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
第十三方面，提供一种通信装置，包括：接收单元，用于接收来自第一网络功能NF的第一服务请求消息，其中所述装置位于第一网络，所述第一服务请求消息中携带访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或第二网络的SNPN信息；处理单元，用于根据所述第一服务请求消息生成第二服务请求消息；发送单元，用于向第二SEPP发送所述第二服务请求消息，其中所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌。
结合第十三方面，在第十三方面第一种可能的设计中，所述第一网络的SNPN信息包 括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第十四方面，提供一种通信装置，包括：接收单元，用于接收来自第一SEPP的第二服务请求消息，其中所述第一SEPP位于第一网络，所述装置位于第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；处理单元，用于确定出与所述N32接口上下文标识相对应N32接口上下文，校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；发送单元，在所述远端SNPN信息与所述第一网络的SNPN信息不匹配时，返回错误码给所述第一SEPP。
结合第十四方面，在第十四方面第一种可能的设计中，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
第十五方面，提供一种通信装置，包括：至少一个处理器；以及与所述至少一个处理器通信连接的存储器、通信接口；其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如上述第二方面至第七方面中任一方面或所述任一方面的任一种可能的设计中所述的方法。
第十六方面，提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，执行如上述第二方面至第七方面中任一方面或所述任一方面的任一种可能的设计中所述的方法。
第十七方面，提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现如上述第二方面至第七方面中任一方面或所述任一方面的任一种可能的设计中所述的方法。
第十八方面，提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行如上述第二方面至第七方面中任一方面或所述任一方面的任一种可能的设计中所述的方法。
附图说明
图1为现有技术中非漫游场景下的服务授权过程示意图；
图2为现有技术中非漫游场景下的服务请求过程示意图；
图3为现有技术中漫游场景下的服务授权过程示意图；
图4为现有技术中漫游场景下的服务请求过程示意图；
图5为本申请实施例适用的一种通信系统的结构示意图；
图6为本申请实施例提供的一种服务授权方法的流程图；
图7为本申请实施例提供的一种服务请求方法的流程图；
图8为本申请实施例提供的另一种服务请求方法的流程图；
图9为本申请实施例提供的一种服务发现、服务授权和服务请求方法的流程图；
图10为本申请实施例提供一种通信装置1000的结构示意图；
图11为本申请实施例提供一种通信装置1100的结构示意图；
图12为本申请实施例提供一种通信装置1200的结构示意图；
图13为本申请实施例提供一种通信装置1300的结构示意图；
图14为本申请实施例提供一种通信装置1400的结构示意图；
图15为本申请实施例提供一种通信装置1500的结构示意图；
图16为本申请实施例提供一种通信装置1600的结构示意图。
具体实施方式
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
目前，3GPP 33.501，NF service consumer、NRF以及NF service provider之间定义的访问授权机制是基于OAuth 2.0的方式，其中NRF对应OAuth 2.0中的授权服务器(Authorization server)，NF服务消费方对应OAuth 2.0中的客户端，NF服务提供商对应OAuth 2.0中的资源服务器(resource server)。为了便于描述，后文中的部分描述使用“授权服务器”来描述“NRF”(即“授权服务器”和“NRF”可以相互替换，本文不做区分)，使用“客户端”来描述“NF服务消费方”(即“NF服务消费方”和“客户端”可以相互替换，本文不做区分)，使用“服务端”或“服务器”来描述“NF服务提供商”(即“服务端”或“服务器”和“NF服务提供商”可以相互替换，本文不做区分)。
NF服务消费方请求NF服务提供商的服务的主要流程包括以下两步：
1、NF service consumer在NRF的注册以及访问令牌(access token)获取；
2、NF service consumer向NF service provider请求服务。
其中，第1步流程参考图1所示：
S101、NF service consumer首先到NRF上进行注册；
S102、NF service consumer向NRF发送访问令牌请求，访问令牌请求中携带NF service consumer期望的服务名称和类型(expected service name and type)、客户端标识(client ID)、客户端功能类型(NF consumer NF type)等；
S103、NRF收到访问令牌请求之后，对NF service consumer认证完后生成相应的访问令牌，其中访问令牌中的声明(claim)部分携带NRF的NF实例Id(颁发者)、NF服务消费方的NF实例Id(主题)、生产者的NF类型(受众)、预期的服务名称(范围)、过期时间(过期)等；
S104、NRF将访问令牌在响应消息中发送给NF service consumer。
其中，第2步流程参考图2所示：
S201、NF service consumer向NF service producer发送服务请求消息，服务请求消息中携带从NRF处获取的访问令牌；
S202、NF service producer校验访问令牌中的声明部分的完整性，若校验成功则接受NF service consumer服务请求。
S203、NF service producer返回服务响应消息给NF service consumer。
上述图1和图2所示的流程是非漫游场景下(即客户端和服务端处于同一公共陆地移动网(Public Land Mobile Network，PLMN))的服务授权和服务请求过程，而在漫游场景下(即客户端和服务端处于不同的PLMN，客户端处于拜访地网络(visited network)，而服务端处于归属地网络(hone network))，则相应的服务授权和服务请求的过程则分别如图3和图4所示。
参见图3，漫游场景下的服务授权的过程包括：
S301、客户端向拜访地网络存储功能(visited NRF，vNRF)进行注册；
S302、客户端向vNRF发送访问令牌请求消息；
S303、vNRF对客户端进行验证，验证通过之后执行S304；
S304、vNRF向归属地网络存储功能(home NRF，hNRF)发送访问令牌请求消息；
S305、hNRF授权客户端；
S306、hNRF生成访问令牌，访问令牌有一个有效期；
S307、hNRF向vNRF返回访问令牌响应消息，携带访问令牌和有效期；
S308、vNRF向客户端返回访问令牌响应消息，携带访问令牌和有效期。
其中，在执行步骤S304之前，还要执行S300：hNRF和vNRF相互验证。只有hNRF和vNRF相互验证通过之后，vNRF才能将客户端的访问令牌请求消息转发给hNRF。
参见图4，漫游场景下的服务请求的过程与非漫游场景下的服务请求的过程不同之处在于，客户端和服务端之间需要通过边界安全保护代理(Security Edge Protection Proxy，SEPP)交互消息，SEPP负责漫游场景中拜访网络和归属网络之间的信令安全保护。其中，拜访地网络中的SEPP为服务消费方SEPP(service consumer，cSEPP)，归属地网络中的SEPP称为服务提供方SEPP(producer SEPP，pSEPP)。拜访地网络中的cSEPP用于对客户端发往服务端的消息进行安全处理后发送给归属地网络的pSEPP，归属地网络中的pSEPP用于对服务端发往客户端的消息进行安全处理后发送给cSEPP，cSEPP还用于接收pSEPP发送的消息并对该消息进行安全处理后发送给客户端，pSEPP还用于接收cSEPP发送的消息并对该消息进行安全处理后发送给服务端。
在图3和图4所描述的漫游场景中，归属地网络和拜访地网络均为PLMN，因此PLMN网络漫游授权和服务请求中，通过PLMN ID来标识归属地网络以及拜访地网络。所以在访问令牌请求中、访问令牌的claim中均包含客户端的PLMN ID。同时服务端也会对相应的PLMN ID进行校验。
示例性的，客户端在访问令牌请求中会携带拜访网络和归属网络的PLMN ID，同时归属网络的NRF在生成token时，也会将双方的PLMN ID写在访问令牌的claim中。在后续服务请求时，服务端校验服务请求中的PLMN ID与访问令牌中的客户端的PLMN ID是否一致，同时校验自身的归属PLMN ID与访问令牌中的服务端的PLMN ID是否一致。
现有技术在考虑漫游场景下的访问令牌请求和服务请求时，只考虑了PLMN网络漫游的场景，但是实际上，除了上述PLMN，现有技术中还存在独立非公共网络(Stand-alone Non-Public Network，SNPN)。
SNPN在网络架构上与PLMN拥有相同的网元，但SNPN在服务对象、组网规模以及用户签约上均与PLMN不同。示例性的，企业园区搭建的私网即为一种SNPN。当客户端在使用第三方凭证接入SNPN网络的场景时，将SNPN视为拜访网络，将第三方凭证所在的SNPN或者PLMN视为归属地网络。
当归属地网络或拜访地网络为SNPN时，如果仍然按照现有方法在访问令牌请求过程和服务请求过程中通过携带PLMN ID来标识归属地网络或拜访地网络，则存在如下场景：PLMN ID相同的两个拜访地SNPN(如SNPN A和SNPN B)均与第三方网络(SNPN C或PLMN C)存在漫游访问关系，则第三方网络无法识别请求到底来自哪一个拜访地网络；或者，拜访地网络与PLMN ID相同的两个第三方网络存在漫游访问关系，则客户端无法区分到底应该向哪一个第三方网络发送请求。也即访问授权和服务请求过程中，即无法唯 一标识一个SNPN网络，导致客户端访问授权或服务请求无法完成，网络的可靠性和安全性较低。
为了解决上述一个或多个技术问题，提供本申请实施例的服务授权方法、装置及系统。本申请实施例的技术方案可以应用于各种通信系统，例如：第四代(4th Generation，4G)通信系统、第五代(5th Generation，5G)通信系统或未来的其他演进系统、或其他各种采用无线接入技术的无线通信系统等。
示例性的，图5为本申请实施例适用的一种通信系统，该通信系统包括用户设备(User Equipment，UE)、无线接入网(Radio Access Network，RAN)，以及核心网(Core Network，CN)。用户设备可以通过基站等接入网设备接入无线接入网，并通过核心网与外部的数据网络(Data Network，DN)建立通信连接。核心网主要用于用户设备注册、安全认证、移动性管理、位置管理、会话管理，以及转发用户设备和外部的数据网络之间的数据包等。
上述无线接入网可以为下一代接入网(Next Generation Access Network，NG-AN)。
上述核心网包括下述网络功能：会话管理功能(Session Management Function，SMF)、接入和移动性管理功能(Access and Mobility Management Function，AMF)、用户面功能(User Plane Function，UPF)、统一数据管理(Unified Data Management，UDM)、策略控制功能(Policy Control Function，PCF)、鉴权服务功能(Authentication Server Function，AUSF)、网络切片选择功能(Network Slice Selection Function，NSSF)、网络公开功能(Network Exposure Function，NEF)、网络存储功能(Network Repository Function，NRF)和应用功能(Application Function，AF)等。其中，NRF用于维护网元实例及其服务的配置文件(profile)，同时为NF service consumer提供服务发现(即接受NF服务消费方的服务发现请求，返回相应的NF服务提供商的实例信息给请求方)和授权(即颁发访问令牌)的服务。
需要说明的是，上述核心网可以包括一台或多台核心网设备。其中，核心网设备可以是用于执行上述单一网络功能的网元，也可以是用于执行上述多个网络功能的网元。在一台核心网设备用于执行上述多个网络功能的情况下，该核心网设备可以包括一个或多个用于执行上述多个网络功能的功能模块，该功能模块可以是软件模块，也可以是软硬件模块，本申请实施例不做限定。
为便于描述，上述网络功能，以及用于执行上述网络功能的网元、设备、功能模块，以及设置于上述网元、设备内部的芯片系统等，下文中统一称之为网络功能。
需要说明的是，上述通信系统的核心网采用服务化架构。也就是说，上述不同的网络功能之间可以基于客户端-服务器模式进行通信。其中，NF服务消费方又称为客户端，NF服务提供商又称为功能服务器或服务器或服务端。具体地，上述接入和移动性管理功能、会话管理功能、策略控制功能和统一数据管理功能等控制面网络功能可以采用服务化接口进行交互。例如，如图5所示，接入和移动性管理功能提供的服务化接口可以为Namf，会话管理功能提供的服务化接口可以为Nsmf，策略控制功能提供的服务化接口可以为Npcf，统一数据管理功能提供的服务化接口可以为Nudm等。
上述接入网设备为位于上述通信系统网络侧，且具有无线收发功能的设备或可设置于该设备的芯片。该接入网设备包括但不限于：演进型节点B(evolved Node B，eNB)、无线网络控制器(Radio Network Controller，RNC)、节点B(Node B，NB)、基站控制器(Base Station Controller，BSC)、基站收发台(Base Transceiver Station，BTS)、家庭基站(例如， home evolved NodeB，或home Node B，HNB)、基带单元(BaseBand Unit，BBU)，无线保真(Wireless Fidelity，WIFI)系统中的接入点(Access Point，AP)、无线中继节点、无线回传节点、传输点(Transmission and Reception Point，TRP或者Transmission Point，TP)等，还可以为5G，如，新空口(New Radio，NR)系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(Distributed Unit，DU)等。
上述用户设备为接入上述通信系统，且具有无线收发功能的终端设备或可设置于该终端设备的芯片。该用户设备也可以称为用户装置、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。本申请的实施例中的终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(Virtual Reality，VR)终端设备、增强现实(Augmented Reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
应理解，图5仅为便于理解而示例的简化示意图，该通信系统中还可以包括其他网络设备或者还可以包括其他终端设备，图5中未予以画出。
如图6所示，本申请实施例提供了一种服务授权方法，该方法可以应用于图5所示的通信系统。方法包括：
S601、第一NF向第一NRF发送第一请求，第一NRF接收第一请求。
其中，第一NF为客户端或NF服务消费方，举例来说，第一NF可以是图5所示通信系统中的SMF、AMF等。
第一请求用于请求访问令牌，访问令牌用于访问第二网络中的第二NF的服务，具体来说，访问令牌是客户端访问第二网络中的第二NF的服务的授权凭证，客户端必须持有该访问令牌才能访问第二NF的服务。第二NF用于提供某种功能服务，举例来说，第二NF可以是图5所示通信系统中的AUSF、UDM、UPF或AF等。
第一NF和第一NRF均位于第一网络，第二NF位于第二网络。第一请求中包含第一网络的SNPN信息和/或第二网络的SNPN信息。
需要指出的是，第一请求中包含的SNPN信息需要根据第一网络和第二网络的具体类型确定。举例来说，如果第一网络的网络类型是SNPN，第二网络的网络类型是PLMN，则第一请求中包含第一网络的SNPN信息，另外还可以进一步包括第二网络的PLMN信息；如果第二网络的网络类型是SNPN，第一网络的网络类型是PLMN，则第一请求中包含第二网络的SNPN信息，另外还可以进一步包括第一网络的PLMN信息；如果第一网络的网络类型是SNPN，第二网络的网络类型也是SNPN，则第一请求中同时包含第一网络的SNPN信息和第二网络的SNPN信息。
在本申请实施例中，一个SNPN可以通过一组网络标识符(Network ID，NID)和公共陆地移动网标识符(PLMN ID)来标识。相应的，如果第一网络的网络类型是SNPN，则第一网络的SNPN信息包括第一网络的NID和PLMN ID；如果第二网络的网络类型是 SNPN，则第二网络的SNPN信息包括第二网络的NID和PLMN ID。
可选的，NID和PLMN ID可以分别承载在两个不同信元中，也可以以组合的形式承载在一个信元中，这里不做限制。例如，将NID和PLMN ID组合承载在原来PLMN ID所在的信元中，这样可以节省资源开销。
可选的，第一请求中还包括以下参数中的至少一种：期望的服务名称和类型、客户端标识、客户端(即第一NF)功能类型等。
另外，可以理解的是，第一NF在向第一NRF发送第一请求之前，第一NF需要在第一NRF上进行注册，以及对第一NRF发起服务发现请求过程，在基于服务发现获得第二NF的实例信息后再发起上述第一请求。
S602、第一NRF将第一请求转发给第二NRF。
其中，第二NRF位于第二网络。第一NRF可以直接将第一请求转发给第二NRF，第一NRF也可以对第一请求进行重组转化后再转发给第二NRF，这里不做限制。
可选的，第一NRF可以对第一NF进行验证，在验证第一NF身份合法之后，再将第一请求转发给第二NRF。
另外，可以理解的是，第一NRF将第一请求转发给第二NRF之前，第一NRF和第二NRF需要相互验证，具体来说，第一NRF和第二NRF可以采用证书相互认证。
S603、响应于第一请求，第二NRF对第一NF授权，生成访问令牌，访问令牌中包含第一网络的SNPN信息和/或第二网络的SNPN信息。
可以理解的是，访问令牌中的SNPN信息与第一请求中携带的SNPN信息一致。举例来说，如果第一网络的网络类型是SNPN，第二网络的网络类型是PLMN，则访问令牌中携带第一网络的SNPN信息，另外还可以进一步携带第二网络的PLMN信息；如果第二网络的网络类型是SNPN，第一网络的网络类型是PLMN，则访问令牌中携带第二网络的SNPN信息，另外还可以进一步携带第一网络的PLMN信息；如果第一网络的网络类型是SNPN，第二网络的网络类型也是SNPN，则访问令牌中携带第一网络的SNPN信息和第二网络的SNPN信息。
可选的，访问令牌中还可以包括其他的信息，例如第一NF功能类型、第二NF功能类型、有效期或截止日期(用于指示访问令牌什么时候过期)、期待服务的名称、第二NRF实例标识、第二NF的实例标识等等。
可选的，第二NRF在生成访问令牌之前，可以对第一NF进行验证，在验证第一NF身份合法之后，再对第一NF授权，为其生成访问令牌。
可选的，第二NRF在生成访问令牌之后，还可以对访问令牌进行完整性保护，例如添加数字签名、消息验证码等。
S604、第二NRF向第一NRF发送访问令牌，第一NRF接收来自第二NRF的访问令牌。
S605、第一NRF将访问令牌发送给第一NF，第一NF接收来自第一NRF的访问令牌。
基于上述可知，通过本申请实施例提供的技术方案，当第一网络是SNPN网络时，第一NF会在第一请求中添加第一网络的SNPN信息，当第二网络是SNPN网络时，第一NF会在第一请求中添加第二网络的SNPN信息，这样可使得服务授权过程中请求访问令牌的网络和被请求访问令牌的网络均能够被唯一标识，保证第一NF请求访问令牌的过程可以 顺利完成，提高服务授权的可靠性。另外，访问令牌中也会携带对应的SNPN信息，以明确访问令牌授权的服务消费方和服务提供方，可以进一步提高服务授权的可靠性。
如图7所示，在图6的基础上，本申请实施例还提供了一种服务请求方法，该方法适用于图5所示的通信系统。方法包括：
S701、第一NF向第二NF发送服务请求消息。
其中，第一NF位于第一网络，第二NF位于第二网络。第一网络和第二网络中的至少一个的网络类型为SNPN。
服务请求消息用于请求第二NF的服务，服务请求消息中携带有访问令牌。
可理解的是，这里第一NF携带服务请求消息中的访问令牌第二NRF颁发给第一NF的(具体过程参见图6所示实施例)，因此访问令牌中可能携带第一网络的SNPN信息和/或第二网络的SNPN信息，访问令牌中具体的SNPN信息由第一网络和第二网络的类型确定。
为了便于描述，本申请实施例中将访问令牌中携带的第一网络的SNPN信息称为第一SNPN，将访问令牌中携带的第二网络的SNPN信息称为第二SNPN。
可选的，服务请求消息中还可以携带第一NF请求的服务范围。
进一步可选的，服务请求消息中还可以携带第一NF的网络信息(即第一网络的网络信息)。举例来说，如果第一网络的类型是SNPN，则服务请求消息中除了访问令牌，还携带第一NF(服务请求方)的SNPN信息；如果第一网络的类型是PLMN，则服务请求消息中除了访问令牌，还携带第一NF(服务请求方)的PLMN信息。
S702、第二NF对访问令牌进行校验；若访问令牌校验成功，则执行S703，访问令牌校验失败，则执行S704。
第二NF对访问令牌进行校验包括对访问令牌中的SNPN信息的校验。具体来说，包括校验访问令牌是否存在第一SNPN信息和/或第二SNPN信息；如果存在第一SNPN信息和/或第二SNPN信息，则进一步对第一SNPN信息和/或第二SNPN信息进行校验。
示例的，如果访问令牌存在第一SNPN信息，则第二NF进一步判断服务请求消息中携带的第一NF的SNPN信息是否与访问令牌中的第一SNPN信息匹配，如果匹配，则校验成功，否则校验失败；如果访问令牌存在第二SNPN信息，则第二NF进一步判断第二NF的SNPN信息是否与访问令牌中的第二SNPN信息匹配，如果匹配，则校验成功，否则校验失败；如果访问令牌存在第一SNPN和第二SNPN信息，则第二NF进一步判断服务请求消息中携带的第一NF的SNPN信息是否与访问令牌中的第一SNPN信息匹配，以及判断第二NF的SNPN信息是否与访问令牌中的第二SNPN信息匹配，如果均匹配，则校验成功，否则校验失败。
可选的，第二NF对访问令牌进行校验可以还包括对第一NF所请求的服务范围进行校验，比如判断第一NF所请求的服务范围是否超出访问令牌所记载的服务范围。
可选的第二NF对访问令牌进行校验可以还包括对访问令牌或者服务请求消息的完整性进行校验，以确定访问令牌或者服务请求消息是否完整。
可选的，第二NF对访问令牌进行校验可以还包括对访问令牌中的截止日期进行校验，以确定访问令牌是否过期。
需要说明的是，如果存在多个维度的校验，必须多个维度的校验都通过之后，才能执 行步骤S703。举例来说，多个维度可以理解为至少两个维度，例如SNPN信息校验的维度、完整性校验的维度、服务范围校验的维度、截止日期校验的维度等。
S703、第二NF响应第一NF的服务请求，向第一NF返回服务响应消息，通知第一NF访问第二NF的服务。
S704、第二NF向第一NF返回拒绝第一NF访问第二NF的服务的消息，或者不返回服务响应消息。
基于上述可知，通过本申请实施例提供的技术方案，当第一网络是SNPN网络时，授权令牌中会携带第一网络的SNPN信息，当第二网络是SNPN网络时，授权令牌中会携带第二网络的SNPN信息，使得服务请求过程中服务请求方的网络和被请求方的网络均能够被唯一标识，进而保证第一NF请求服务的过程可以顺利完成，提高服务的可靠性，另外还可以提防恶意攻击，可以提高网络的安全性。
可理解的是，本申请实施例中，第一NF和第二NF分别处于不同的网络中，所以第一NF和第二NF之间需要通过SEPP交互消息，以对第一网络和第二网络之间的信令进行安全保护。为了便于描述，这里将第一网络中的SEPP即称为第一SEPP，将归属地网络中的SEPP称为第二SEPP，如图7中的虚线框所示。
如图8所示，在图7的基础上，本申请实施例还提供了一种服务请求方法，包括：
S801、第一NF向第一SEPP发送第一服务请求消息，第一SEPP接收第一服务请求消息。
其中，第一NF和第一SEPP均位于第一网络，第一服务请求消息用于请求第二NF的服务，第一服务请求消息中携带访问令牌以及目标访问对象(即第二NF)的网络信息。这里访问令牌的具体实现可以参见上文中访问令牌的具体实现，这里不再赘述。
S802、第一SEPP根据第一服务请求消息生成第二服务请求消息，第二服务请求消息中携带N32接口上下文标识和访问令牌。
在本申请实施例中，第一SEPP和第二SEPP之间通过N32接口进行消息交互。因此在第一SEPP和第二SEPP进行交互消息之前，第一SEPP和第二SEPP会先建立N32接口连接，当第一SEPP和第二SEPP在进行N32-c链接建立时，会协商并建立N32-f的上下文，各自的N32-f上下文中会记录对端的SEPP信息。
其中，N32接口上下文中记录的SEPP信息至少包括网络信息，该网络信息具体可以记录在N32-f上下文中的N32-f对等信息(N32-f peer information)中。举例来说，假设第一网络和第二网络均为SNPN网络，则第一SEPP的N32-f上下文中包含第二网络的SNPN信息(PLMN ID+NID)，第二SEPP的N32-f上下文中包含第一网络的SNPN信息(PLMN ID+NID)。当然，此处仅为举例而非限定，如果对端网络是PLMN网络，则N32-f上下文可以中记录对端网络的PLMN信息。
第一SEPP和第二SEPP预置对端的网络信息包括但不限于以下两种方式：
方式1、复用现有的接口建立消息。在SEPP之间建立N32-c的第一个流程，将各自的SNPN信息携带在该流程的两条消息中。例如发起建立N32-c连接的SEPP(可以是第一SEPP也可以是第二SEPP)向对端SEPP发送能力交换消息，在能力交换消息中携带自身的SNPN信息，对端SEPP返回响应消息时，在响应消息中携带对端SEPP的SNPN信息。当然，这里是以第一SEPP和第二SEPP的网络类型均为SNPN为例，但实际不限于 此，也可以是其他类型的网络，例如如果第二SEPP网络类型是PLMN，则响应消息中携带第二SEPP的PLMN信息。
方式2、生成专门用于交换SEPP的网络信息的新消息。例如第一SEPP生成并发送专用的交换请求消息给第二SEPP，专用的交换请求消息中携带第一SEPP的SNPN信息，然后第二SEPP响应该交换请求消息，返回自身的SNPN信息给第一SEPP。当然，也可以是第二SEPP发起专用的交换请求消息，第一SEPP响应回复，这里不做限制。
当第一SEPP根据第一服务请求消息生成第二服务请求消息时，第一SEPP是根据第一服务请求消息中携带的目标访问对象(即第二NF)的网络信息索引出第一SEPP和第二SEPP之间的N32接口上下文，然后利用该N32接口上下文对第一服务请求消息进行重组转化，生成第二服务请求消息，第二服务请求消息中携带访问令牌和N32接口上下文标识。
可选的，重组转化的具体实现方式包括但不限于：对第一服务请求消息进行完整性保护(例如添加数字签名、消息验证码等)，添加元数据等。可理解的是，重组转换前后的有效数据保持不变，如访问令牌、服务请求范围等。
S803、第一SEPP向第二SEPP发送第二服务请求消息,第二SEPP接收第二服务请求消息。
S804、第二SEPP确定出与该N32接口上下文标识相对应N32接口上下文；如果第一网络是SNPN网络，则第二SEPP校验N32接口上下文中记录的远端SNPN信息是否与访问令牌中的第一SNPN信息匹配。
可替换的，如果第一网络是PLMN网络，则第二SEPP校验N32接口上下文中记录的远端PLMN信息是否与访问令牌中的第一PLMN信息匹配。
S805A、如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP返回错误码给所述第一SEPP。
S805B、如果N32接口上下文中记录的远端SNPN信息与访问令牌中的第一SNPN信息匹配，则在对访问令牌完成其他校验(例如完整性校验，服务范围校验、有效期校验等等)之后，第二SEPP讲第二服务请求消息转发给第二NF。应理解，这里的转发可以是直接转发，也可以是对第二服务请求消息进行转化重组后再转发，这里不做限制。
基于上述可知，通过本申请实施例提供的技术方案，当第一网络是SNPN信息时，第二网络中的第二SEPP会在N32接口上下文中预置第一SEPP的SNPN信息，当第二网络是SNPN信息时，第一网络中的第一SEPP会在N32接口上下文中预置第二SEPP的SNPN信息，进而可以实现对第一网络和第二网络之间的信令进行安全保护，可以进一步提高网络的安全性。
如图9所示，在图6～图8的基础上，本申请实施例还提供了一种服务发现、服务授权和服务请求方法，该方法适用于图5所示的通信系统。与图6～图8所示实施例不同的是，本实施例中由NPN代理(proxy)服务器代理第一NF(客户端)进行服务发现、服务授权和服务请求等过程。应理解的是，NPN proxy服务器位于第二网络(归属地网络)，也即第二NF(NF服务提供商)所在网络。
S901、第一NF向NPN代理服务器发送NF服务请求消息。
其中，第一NF位于第一网络，这里的NF服务请求消息携带请求方(即第一NF)的SNPN信息(如第一网络的NID)。
S902、NPN代理服务器代替第一NF向第二NRF发起服务发现过程。
S903、NPN代理服务器代替第一NF向第二NRF发起访问令牌请求。
访问令牌请求携带请求方(即第一NF)的SNPN信息，还可能携带期望的服务类型等。
S904、第二NRF返回访问令牌给NPN代理服务器。
访问令牌中携带客户端的SNPN信息，还可能携带授权的服务范围等。
S905、NPN代理服务器向第二NF发起服务请求，请求中携带请求方的SNPN信息，访问令牌等。
S906、第二NF校验访问令牌中的客户端的SNPN信息是否与NF服务请求中的请求方的SNPN信息匹配S905。如果匹配，则继续服务请求过程，如果不匹配，则拒绝该服务请求。
通过上述可知，本申请实施例技术方案通过第二网络中的NPN代理服务器代理第一网络中的第一NF对第二网络中的第二NF进行服务发现、服务授权以及服务请求等过程，可以进一步简化交互流程，提高交互效率，降低客户端的复杂度。
应理解的是，上述各实施例可以相互结合以实现不同的技术效果。
以上结合图6～图9详细说明了本申请实施例提供的方法。以下结合图10～图16详细说明本申请实施例提供的装置。
基于同一技术构思，参见图10，本申请实施例提供一种通信装置1000，该装置可具有实现上述方法实施例中第一NRF的功能，该装置可以为第一NRF，也可以为第一NRF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收单元1001，用于接收来自第一网络功能NF的第一请求，其中所述第一NF和所述装置位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
发送单元1002，用于将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；
所述接收单元1001，还用于接收来自所述第二NRF的访问令牌；所述发送单元还用于将所述访问令牌发送给所述第一NF。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
基于同一技术构思，参见图11，本申请实施例提供一种通信装置1100，该装置可具有实现上述方法实施例中第二NRF的功能，该装置可以为第二NRF，也可以为第二NRF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收单元1101，用于接收来自第一NRF的第一请求，其中所述第一NRF位于第一网络，所述装置位于第二网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问所述第二网络中的第二网络功能NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
处理单元1102，用于响应于所述第一请求，生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；
发送单元1103，用于向所述第一NRF发送所述访问令牌。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
基于同一技术构思，参见图12，本申请实施例提供一种通信装置1200，该装置可具有实现上述方法实施例中第一NF的功能，该装置可以为第一NF，也可以为第一NF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
处理单元1201，用于生成第一请求，其中所述装置位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
发送单元1202，用于将所述第一请求发送给第一网络存储功能NRF，其中所述第一NRF位于所述第一网络；
接收单元1203，用于接收访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
可选的，所述发送单元1202，还用于向第一安全边界代理网关SEPP发送第一服务请求消息，其中所述第一SEPP位于所述第一网络，所述第一服务请求消息中携带所述访问令牌。
可选的，所述发送单元1202，还用于向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的SNPN信息。
基于同一技术构思，参见图13，本申请实施例提供一种通信装置1300，该装置可具有实现上述方法实施例中第二NF的功能，该装置可以为第二NF，也可以为第二NF中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收单元1301，用于接收来自第一NF的服务请求消息，其中所述第一NF位于第一网络，所述装置位于第二网络，所述服务请求消息用于请求所述装置的服务，所述服务请求消息中携带访问令牌和所述第一网络的独立非公共网络SNPN信息，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；
处理单元1302，用于对所述访问令牌进行校验；
发送单元1303，用于在所述访问令牌校验成功时，向所述第一NF返回服务响应消息。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
可选的，所述处理单元1302具体用于：校验所述访问令牌中的所述第二网络的SNPN信息是否与所述装置的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
基于同一技术构思，参见图14，本申请实施例提供一种通信装置1400，该装置可具 有实现上述方法实施例中第一SEPP的功能，该装置可以为第一SEPP，也可以为第一SEPP中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收单元1401，用于接收来自第一网络功能NF的第一服务请求消息，其中所述装置位于第一网络，所述第一服务请求消息中携带访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或第二网络的SNPN信息；
处理单元1402，用于根据所述第一服务请求消息生成第二服务请求消息；
发送单元1403，用于向第二SEPP发送所述第二服务请求消息，其中所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
基于同一技术构思，参见图15，本申请实施例提供一种通信装置1500，该装置可具有实现上述方法实施例中第二SEPP的功能，该装置可以为第二SEPP，也可以为第二SEPP中的装置。上述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现，所述硬件或软件包括一个或多个与上述功能相对应的模块。该装置包括：
接收单元1501，用于接收来自第一SEPP的第二服务请求消息，其中所述第一SEPP位于第一网络，所述装置位于第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；
处理单元1502，用于确定出与所述N32接口上下文标识相对应N32接口上下文，校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；
发送单元1503，在所述远端SNPN信息与所述第一网络的SNPN信息不匹配时，返回错误码给所述第一SEPP。
可选的，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
基于同一技术构思，参见图16，本申请实施例还提供一种通信装置1600，包括：
至少一个处理器1601；以及，
与所述至少一个处理器1601通信连接的存储器1602、通信接口1603；
其中，所述存储器1602存储有可被所述至少一个处理器1601执行的指令，所述至少一个处理器1601通过执行所述存储器1602存储的指令，执行如上述方法实施例中任一网元所执行的方法。
其中，所述处理器1601和所述存储器1602可以通过接口电路耦合，也可以集成在一起，这里不做限制。
本申请实施例中不限定上述处理器1601、存储器1602以及通信接口1603之间的具体连接介质。本申请实施例在图16中以处理器1601、存储器1602以及通信接口1603之间通过总线1604连接，总线在图16中以粗线表示，其它部件之间的连接方式，仅是进行示意性说明，并不引以为限。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图16中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
应理解，本申请实施例中提及的处理器可以通过硬件实现也可以通过软件实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等。当通过软件实现时，该处理器可 以是一个通用处理器，通过读取存储器中存储的软件代码来实现。
示例性的，处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Eate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
基于同一技术构思，本申请实施例还提供一种计算机可读存储介质，包括程序或指令，当所述程序或指令在计算机上运行时，执行如上述方法实施例中任一网元所执行的方法。
基于同一技术构思，本申请实施例还提供一种芯片，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现如上述方法实施例中任一网元所执行的方法。
基于同一技术构思，本申请实施例还提供一种计算机程序产品，包括指令，当其在计算机上运行时，使得计算机执行如上述方法实施例中任一网元所执行的方法。
应理解，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算 机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disk，SSD))等。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (17)

  1. 一种服务授权方法，其特征在于，包括：
    第一网络存储功能NRF接收来自第一网络功能NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
    所述第一NRF将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；
    响应于所述第一请求，所述第二NRF生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；
    所述第二NRF向所述第一NRF发送所述访问令牌；
    所述第一NRF接收来自所述第二NRF的访问令牌；以及
    所述第一NRF将所述访问令牌发送给所述第一NF。
  2. 如权利要求1所述的方法，其特征在于，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
  3. 如权利要求要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一NF向第一安全边界代理网关SEPP发送第一服务请求消息；所述第一SEPP位于所述第一网络；所述第一服务请求消息中携带所述访问令牌；
    所述第一SEPP根据所述第一服务请求消息生成第二服务请求消息；
    所述第一SEPP向第二SEPP发送所述第二服务请求消息；所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌；
    所述第二SEPP确定出与所述N32接口上下文标识相对应N32接口上下文；
    所述第二SEPP校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；
    如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP返回错误码给所述第一SEPP。
  4. 如权利要求要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一NF向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的独立非公共网络SNPN信息；
    所述第二NF对所述访问令牌进行校验；
    若所述访问令牌校验成功，则所述第二NF向所述第一NF返回服务响应消息。
  5. 如权利要求要求4所述的方法，其特征在于，所述第二NF对所述访问令牌进行校验，包括：
    所述第二NF校验所述访问令牌中的所述第二网络的SNPN信息是否与所述第二NF的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
  6. 一种服务授权方法，其特征在于，包括：
    第一网络存储功能NRF接收来自第一网络功能NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
    所述第一NRF将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；
    所述第一NRF接收来自所述第二NRF的访问令牌；以及
    所述第一NRF将所述访问令牌发送给所述第一NF。
  7. 如权利要求6所述的方法，其特征在于，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
  8. 一种服务授权系统，其特征在于，包括：
    第一网络功能NF，用于发送第一请求；
    第一网络存储功能NRF，用于接收来自所述第一NF的第一请求，其中所述第一NF和所述第一NRF位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；
    所述第二NRF，用于接收所述第一请求，并响应于所述第一请求，生成访问令牌，所述访问令牌中包含所述第一网络的SNPN信息和/或所述第二网络的SNPN信息；向所述第一NRF发送所述访问令牌；
    所述第一NRF还用于接收来自所述第二NRF的访问令牌，将所述访问令牌发送给所述第一NF；
    所述第一NF还用于接收所述访问令牌。
  9. 如权利要求8所述的系统，其特征在于，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
  10. 如权利要求要求8或9所述的系统，其特征在于，所述系统还包括第一安全边界代理网关SEPP和第二SEPP；
    所述第一NF，还用于向所述第一SEPP发送第一服务请求消息，其中所述第一SEPP位于所述第一网络，所述第一服务请求消息中携带所述访问令牌；
    所述第一SEPP，用于根据所述第一服务请求消息生成第二服务请求消息，向第二SEPP发送所述第二服务请求消息，其中所述第二SEPP位于所述第二网络，所述第二服务请求消息中携带N32接口上下文标识和所述访问令牌；
    所述第二SEPP，用于接收所述第二服务请求消息，确定出与所述N32接口上下文标识相对应N32接口上下文；校验所述N32接口上下文中记录的远端SNPN信息是否与所述第一网络的SNPN信息匹配；
    如果所述远端SNPN信息与所述第一网络的SNPN信息不匹配，则所述第二SEPP还用于返回错误码给所述第一SEPP。
  11. 如权利要求要求8或9所述的系统，其特征在于，
    所述第一NF，还用于向所述第二NF发送服务请求消息，所述服务请求消息用于请求所述第二NF的服务，所述服务请求消息中携带所述访问令牌和所述第一网络的独立非公共网络SNPN信息；
    所述第二NF，还用于对所述访问令牌进行校验；若所述访问令牌校验成功，则向所述第一NF返回服务响应消息。
  12. 如权利要求要求11所述的系统，其特征在于，所述第二NF在对所述访问令牌进行校验时，具体用于：
    校验所述访问令牌中的所述第二网络的SNPN信息是否与所述第二NF的SNPN信息匹配；和/或，所述第二NF校验所述访问令牌中的所述第一网络的SNPN信息是否与所述服务请求消息中携带的所述第一网络的SNPN信息匹配。
  13. 一种通信装置，其特征在于，包括：
    接收单元，用于接收来自第一网络功能NF的第一请求，其中所述第一NF和所述装置位于第一网络，所述第一请求用于请求访问令牌，所述访问令牌用于访问第二网络中的第二NF的服务，所述第一请求中包含所述第一网络的独立非公共网络SNPN信息和/或所述第二网络的SNPN信息；
    发送单元，用于将所述第一请求转发给第二NRF，其中所述第二NRF位于所述第二网络；
    所述接收单元，还用于接收来自所述第二NRF的访问令牌；以及
    所述发送单元，还用于将所述访问令牌发送给所述第一NF。
  14. 如权利要求13所述的装置，其特征在于，所述第一网络的SNPN信息包括网络标识符NID和公共陆地移动网标识符PLMN ID，和/或，所述第二网络的SNPN信息包括NID和PLMN ID。
  15. 一种通信装置，其特征在于，包括：
    至少一个处理器；以及与所述至少一个处理器通信连接的存储器、通信接口；
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如权利要求8-12任一项所述系统中的任一网元所执行的方法。
  16. 一种计算机可读存储介质，其特征在于，包括程序或指令，当所述程序或指令在计算机上运行时，执行如权利要求8-12任一项所述系统中的任一网元所执行的方法。
  17. 一种芯片，其特征在于，所述芯片与存储器耦合，用于读取并执行所述存储器中存储的程序指令，实现如权利要求8-12任一项所述系统中的任一网元所执行的方法。
PCT/CN2020/121594 2020-03-23 2020-10-16 一种服务授权方法、装置及系统 WO2021189828A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20927985.0A EP4117343A4 (en) 2020-03-23 2020-10-16 SERVICE AUTHENTICATION METHOD, APPARATUS AND SYSTEM
US17/950,187 US20230019000A1 (en) 2020-03-23 2022-09-22 Service authorization method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010209382.4A CN113438196B (zh) 2020-03-23 2020-03-23 一种服务授权方法、装置及系统
CN202010209382.4 2020-03-23

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/950,187 Continuation US20230019000A1 (en) 2020-03-23 2022-09-22 Service authorization method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2021189828A1 true WO2021189828A1 (zh) 2021-09-30

Family

ID=77753329

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/121594 WO2021189828A1 (zh) 2020-03-23 2020-10-16 一种服务授权方法、装置及系统

Country Status (4)

Country Link
US (1) US20230019000A1 (zh)
EP (1) EP4117343A4 (zh)
CN (1) CN113438196B (zh)
WO (1) WO2021189828A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240031347A1 (en) * 2022-07-20 2024-01-25 Cisco Technology, Inc. Method for robust token generation in 5g mobile core network

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4047867A1 (en) * 2021-02-19 2022-08-24 Nokia Technologies Oy Enhanced authorization in cellular communication networks
US12028800B2 (en) * 2021-05-26 2024-07-02 Oracle International Corporation Methods, systems, and computer readable media for determining time related parameter values for a communications network
CN116782228A (zh) * 2022-03-11 2023-09-19 华为技术有限公司 授权验证的方法和装置
CN114945173B (zh) * 2022-03-29 2023-05-05 广州爱浦路网络技术有限公司 跨plmn信令转发方法、电子设备及存储介质
CN116980921A (zh) * 2022-04-21 2023-10-31 华为技术有限公司 一种通信方法及装置
CN117082507A (zh) * 2022-05-09 2023-11-17 华为技术有限公司 通信方法和网元设备
CN114978551B (zh) * 2022-06-14 2024-02-06 中国电信股份有限公司 访问令牌下发方法、获取方法、装置、系统、设备及介质
CN115297465A (zh) * 2022-08-01 2022-11-04 中国电信股份有限公司 接入网号传递方法、装置、电子设备及计算机存储介质
CN115134908B (zh) * 2022-08-30 2022-12-02 中国移动通信有限公司研究院 一种服务化架构下网络注册的方法
CN115515090A (zh) * 2022-09-22 2022-12-23 中国电信股份有限公司 信令互通方法、装置、系统和存储介质
CN118573385A (zh) * 2023-02-28 2024-08-30 华为技术有限公司 通信方法和通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110213808A (zh) * 2019-05-06 2019-09-06 腾讯科技（深圳）有限公司 网络接入控制方法、装置、计算机可读介质及电子设备
CN110536331A (zh) * 2019-01-29 2019-12-03 中兴通讯股份有限公司 一种非公众网络的配置方法、装置、cu、du和基站
CN110636587A (zh) * 2018-06-22 2019-12-31 维沃移动通信有限公司 处理方法、终端及网元
WO2020036364A1 (ko) * 2018-08-13 2020-02-20 삼성전자 주식회사 단말이 사설 셀룰러 네트워크를 발견하고 선택하기 위한 방법 및 장치

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8140669B2 (en) * 2009-08-31 2012-03-20 International Business Machines Corporation Resolving hostnames on a private network with a public internet server
CN107666723B (zh) * 2016-07-22 2021-04-09 华为技术有限公司 一种信息传输方法、融合网关及系统
CN109688586B (zh) * 2017-10-19 2021-12-07 中兴通讯股份有限公司 一种网络功能认证的方法、装置及计算机可读存储介质
CN110035433B (zh) * 2018-01-11 2024-03-19 华为技术有限公司 采用共享密钥、公钥和私钥的验证方法及装置
US10645583B2 (en) * 2018-02-15 2020-05-05 Nokia Technologies Oy Security management for roaming service authorization in communication systems with service-based architecture
US11924641B2 (en) * 2018-06-29 2024-03-05 Nokia Technologies Oy Security management for service access in a communication system
CN110753346B (zh) * 2019-10-30 2021-02-19 北京微智信业科技有限公司 移动通信专网密钥生成方法、装置及控制器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110636587A (zh) * 2018-06-22 2019-12-31 维沃移动通信有限公司 处理方法、终端及网元
WO2020036364A1 (ko) * 2018-08-13 2020-02-20 삼성전자 주식회사 단말이 사설 셀룰러 네트워크를 발견하고 선택하기 위한 방법 및 장치
CN110536331A (zh) * 2019-01-29 2019-12-03 中兴通讯股份有限公司 一种非公众网络的配置方法、装置、cu、du和基站
CN110213808A (zh) * 2019-05-06 2019-09-06 腾讯科技（深圳）有限公司 网络接入控制方法、装置、计算机可读介质及电子设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
3GPP 33.501
INTERDIGITAL INC: "Solution for Supporting Non-Standalone NPN", 3GPP DRAFT; S2-1810275_NON-STANDALONE NPN_V2, vol. SA WG2, 9 October 2018 (2018-10-09), Dongguan, China, pages 1 - 4, XP051539266 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20240031347A1 (en) * 2022-07-20 2024-01-25 Cisco Technology, Inc. Method for robust token generation in 5g mobile core network

Also Published As

Publication number Publication date
EP4117343A1 (en) 2023-01-11
US20230019000A1 (en) 2023-01-19
EP4117343A4 (en) 2023-09-20
CN113438196B (zh) 2022-10-25
CN113438196A (zh) 2021-09-24

Similar Documents

Publication Publication Date Title
WO2021189828A1 (zh) 一种服务授权方法、装置及系统
EP3570515B1 (en) Method, device, and system for invoking network function service
US10963553B2 (en) Security management for service authorization in communication systems with service-based architecture
US11844014B2 (en) Service authorization for indirect communication in a communication system
US11296877B2 (en) Discovery method and apparatus based on service-based architecture
JP6800994B2 (ja) 通信ネットワークを介してデータを中継するシステム及び方法
US20210250344A1 (en) Service authorization method and communications apparatus
CN111630882B (zh) 用户设备、认证服务器、介质、及确定密钥的方法和系统
JP2022541760A (ja) コアネットワークドメインにおける証明書ハンドリングのための技法
WO2022089290A1 (zh) 一种服务授权方法、通信装置及系统
CN112438041A (zh) 用于执行接入的方法与装置
US20210168139A1 (en) Network Slice Authentication Method and Communications Apparatus
WO2019056971A1 (zh) 一种鉴权方法及设备
JP2023519997A (ja) 端末パラメータ更新を保護するための方法および通信装置
TW202245442A (zh) 一種通訊方法及裝置
JP2024530949A (ja) セキュアチャネルの確立方法およびその装置、関連機器、並びに記憶媒体
CN114640992A (zh) 更新用户身份标识的方法和装置
WO2019141135A1 (zh) 支持无线网络切换的可信服务管理方法以及装置
WO2023227057A1 (zh) 业务授权方法、装置、网络功能及存储介质
TWI755951B (zh) 通訊系統及通訊方法
WO2022147838A1 (zh) 无线通信的方法和装置
WO2022066076A1 (en) Binding a subscriber's identity in a mobile network to transactions in a distributed ledger network
WO2024062374A1 (en) Digital identity management
CN116847350A (zh) 一种d2d通信方法、终端及介质
CN118235365A (zh) 无线网络认证方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20927985

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020927985

Country of ref document: EP

Effective date: 20221005

NENP Non-entry into the national phase

Ref country code: DE