WO2022027492A1 - 一种通信方法、设备及系统 - Google Patents

一种通信方法、设备及系统 Download PDF

Info

Publication number
WO2022027492A1
WO2022027492A1 PCT/CN2020/107538 CN2020107538W WO2022027492A1 WO 2022027492 A1 WO2022027492 A1 WO 2022027492A1 CN 2020107538 W CN2020107538 W CN 2020107538W WO 2022027492 A1 WO2022027492 A1 WO 2022027492A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
user
data
request
network
Prior art date
Application number
PCT/CN2020/107538
Other languages
English (en)
French (fr)
Inventor
崇卫微
辛阳
吴晓波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20948462.5A priority Critical patent/EP4187856A4/en
Priority to PCT/CN2020/107538 priority patent/WO2022027492A1/zh
Priority to JP2023507744A priority patent/JP2023536969A/ja
Priority to CN202080104314.XA priority patent/CN116210253A/zh
Priority to AU2020462414A priority patent/AU2020462414A1/en
Publication of WO2022027492A1 publication Critical patent/WO2022027492A1/zh
Priority to US18/164,416 priority patent/US20230185933A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a communication method, device and system.
  • the user-granular data generated by the user in the communication operator network belongs to the user itself, and the operator network is prohibited from arbitrarily obtaining and using the user-granularity data.
  • the communication operator network needs to acquire and use user granularity data to perform data analysis based on the acquired user granularity data.
  • the communication operator network does not provide a solution on how to accurately obtain authorization information of user-related data.
  • the embodiments of the present application provide a communication method, device, and system, which can accurately obtain authorization information of user-related data.
  • an embodiment of the present application provides a communication method, including: a first network element sending a first request to a second network element, where the first request is used to request authorization information for user-related data, the first The request includes user information and a first scope of use of the user-related data, and the first scope of use includes at least one of the following information: a first use object, a first use purpose, and a first use time; the first use scope
  • the network element receives the first response sent by the second network element, where the first response includes authorization information, and the authorization information is used to indicate whether the user corresponding to the user information allows the relevant data to be used for the first response. a scope of use.
  • the user information is used to indicate a certain user or some users, and the user information may be the identifier of the area where the user is located, the identifier of the user, the identifier of the user group where the user belongs, the user's corresponding identifier The identifier of the network slice, the name DNN of the data network where the user is located, and the identifier of the network element to which the user belongs.
  • the first network element When the first network element wants to obtain the user-related data of the user corresponding to the user information, it can first send a first request to the second network element to obtain the authorization information of the user through the second network element, so that when the authorization information indicates the user information When the corresponding user allows the user-related data to be used in the first usage range, the first network element obtains the user-related data, so that the first network element can perform related operations based on the user-granularity data. In this implementation manner, the first network element can accurately acquire the authorization information corresponding to the user-related data by sending the first request to the second network element, thereby achieving accurate acquisition.
  • the user-related data includes user-related first data and/or second data, wherein the first data includes the user correspondence generated by at least one of a terminal device, an application server, or a network device.
  • the second data includes data analysis results obtained by performing data analysis based on the first data.
  • the first data can be divided into raw data and processed data, the raw data can include raw data corresponding to the user generated by at least one of a terminal device, an application server or a network device, and the processed data can include processed data based on the raw data. data. Specifically, operations such as aggregation processing and anonymization processing can be performed on the original data.
  • data for user granularity is divided into multiple types of data, so that different authorization information can be set for each type of data, thereby realizing more comprehensive protection of user-related data.
  • the first request further includes a first type identifier, where the first type identifier is used to identify the type of user-related data. That is, the first type identifier is used to identify that what is to be acquired is the first data and/or the second data in the user-related data.
  • the first network element requests authorization information from the second network element, it will request authorization information of user-related data corresponding to the first type identifier.
  • the first type identifier is an event identifier, it indicates that the authorization information of the first data is requested; when the first type identifier is a data analysis identifier, it indicates that the authorization information of the second data is requested.
  • the first type identifier is an event identifier
  • the first data is event-related data corresponding to the event identifier
  • the first type identifier is the data analysis identifier
  • the second data is the data analysis result corresponding to the data analysis identifier
  • the second network element is the unified data management UDM network element or the user database UDR network element or the authentication service function AUSF network element or terminal equipment.
  • the first purpose of use may include performing data analysis, that is, the first purpose of use represents performing data analysis on the first data to obtain a data analysis result.
  • the purpose of obtaining the first data can be indicated by the first purpose of use, so as to obtain the authorization information of the user for the purpose of use.
  • the first scope of use may further include a data analysis identifier, where the data analysis identifier is used to instruct to perform data analysis on the first data to obtain the data
  • the analysis flag corresponds to the data analysis result.
  • the specific analysis type performed on the first data may be specifically indicated by the data analysis identifier.
  • the first purpose of use may be to obtain the data analysis result or to be open to a third-party AF for use, and may further limit the specific obtained data to be What kind of data analysis results, such as obtaining the user's movement trajectory analysis results.
  • the first request further includes a second usage scope corresponding to the data analysis result
  • the second usage scope includes at least one of the following information: a second usage object, a second usage purpose, a second usage time.
  • the usage range of the data analysis result may be further set.
  • the second usage object is used to indicate that the data analysis result will be The object to be used
  • the second purpose of use is used to indicate the purpose for which the data analysis result will be used
  • the second usage time is used to indicate the time when the data analysis result will be used.
  • the first network element is a network capability exposure function NEF network element
  • the second network element is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF network element or terminal equipment .
  • the first network element may send a first request to any one of the UDM network element, the UDR network element, the AUSF network element or the terminal device to request to acquire the user authorization information.
  • the first usage object is the application server AF.
  • the use object of the user-related data requested by the first network element may be AF.
  • the first network element is the access and mobility management function network element AMF
  • the second network element is the unified data management UDM or user database UDR network element or the authentication service function AUSF network element or terminal equipment.
  • condition for the first network element to send the first request to the second network element may be triggered by its own demand, or may be for the first network element to receive the second request sent by the third network element , the second request is used to request to obtain user-related data; the first network element sends the first request to the second network element according to the second request.
  • the first network element when receiving the second request sent by the third network element, sends the first request to the second network element to request authorization information of the user.
  • the second request may include user information and a third scope of use, where the user information is used to identify the user, and the user information may be an identifier of the area where the user is located, the user's identifier, the The identifier of the user group where the user belongs, the identifier of the network slice corresponding to the user, the data network name DNN where the user is located, and the identifier of the network element to which the user belongs;
  • the third scope of use includes at least one of the following information: 3. The object of use, the third purpose of use, and the third time of use.
  • the third usage object is used to indicate the usage object of the user-related data requested by the second request
  • the third usage purpose is used to indicate the usage purpose of the user-related data requested by the second request
  • the third usage time It is used to indicate the usage time of the user-related data requested by the second request.
  • the second request may further include a second type identifier, where the second type identifier is used to identify the type of user-related data requested by the third network element.
  • the second type of identification may be an event identification or a data analysis identification.
  • the first network element may determine the first type identifier according to the second type identifier.
  • the first network element may determine the first type identifier in the first request according to the second type identifier, so as to reflect it in the first request.
  • the first network element determining the first type identifier according to the second type identifier may include: the first network element determining the second data type identifier as the first type identifier.
  • the first network element determining the first type identifier according to the second type identifier may include: the first network element determining the first type identifier according to the configuration information and the second data type identifier, wherein the configuration information It is used to indicate the correspondence between the first type identifier and the second data type identifier.
  • the first network element maps the second type identifier to the first type identifier according to the configuration information, so as to include the first type identifier in the first request.
  • the method further includes: the first network element sends a second response to the third network element , the second response includes the user-related data requested by the third network element.
  • the third network element is an application server AF or a network function NF network element or a network management system network element or a terminal device.
  • the second network element may be a network capability exposure function NEF network element.
  • the method further includes: when the authorization information indicates that the user corresponding to the user information allows the user-related data to be used in the first usage range, the first network element acquires the user-related data.
  • the first network element obtains the user-related data, thereby avoiding abuse of the user-related data and improving the security of the user-related data.
  • the method further includes: when the authorization information indicates that the user corresponding to the user information does not allow the user-related data to be used in the first scope of use, the first network element deletes the user-related data or stops acquiring the user related data.
  • the first network element deletes the user-related data or stops acquiring the user related data.
  • the first response when the authorization information is used for the user corresponding to the user information and the user does not allow the user-related data to be used in the first use scope, the first response further includes reason information for indicating that the use is not allowed.
  • the first response when the user does not allow the use of the user-related data, the first response may further include information about the reason for not allowing the use, so as to inform the specific reason why the user is not allowed to be used.
  • an embodiment of the present application provides a communication method, including: a second network element receiving a first request sent by a first network element, where the first request is used to request authorization information for user-related data, and the first request includes The first scope of use of user information and user-related data, the first scope of use includes at least one of the following information: a first use object, a first use purpose, and a first use time; A request to determine authorization information; the second network element sends a first response to the first network element, where the first response includes authorization information, and the authorization information is used to indicate whether the user corresponding to the user information allows user-related data to be used for the first network element. range of use.
  • the second network element determining the authorization information according to the first request includes: the first network element determining the authorization information corresponding to the user information according to whether the first request matches the stored authorization information of the network user .
  • the second network element may pre-store the authorization information of the user in the network, and when receiving the first request sent by the first network element, the user information in the first request and the authorization information of the user are matched according to whether to determine the authorization information corresponding to the user information.
  • the second network element determining the authorization information according to the first request includes: the second network element sends a third request to the terminal device corresponding to the user information according to the first request, where the third request is used to send The terminal device requests authorization information corresponding to the user information; the second network element receives a third response sent by the terminal device, where the third response includes authorization information corresponding to the user information.
  • the second network element acquires the authorization information corresponding to the user information by sending a third request to the terminal device.
  • the second network element determining the authorization information according to the first request includes: the second network element initiates a fourth request to the fourth network element according to the first request, where the fourth request is used to send a fourth request to the fourth network element.
  • the network element requests authorization information corresponding to the user information; the second network element receives a fourth response sent by the fourth network element, where the fourth response includes authorization information corresponding to the user information.
  • the second network element acquires the authorization information corresponding to the user information by sending a fourth request to the fourth network element.
  • the user-related data includes first data and/or second data related to the user, and the first data includes data generated by at least one of a terminal device, an application server, or a network device.
  • the data corresponding to the user, and the second data includes a data analysis result obtained by performing data analysis based on the first data.
  • the first request further includes a first type identifier, where the first type identifier is used to indicate the type of the user-related data, and the first request is used to request user-related data
  • the authorization information includes: authorization information for the first requesting user to request the user-related data corresponding to the first type identifier.
  • the first network element is a network data analysis function NWDAF network element
  • the second network element is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF network element. element or terminal device.
  • the first usage object is the network element of the network data analysis function NWDAF.
  • the first purpose of use includes performing data analysis.
  • the first usage scope when the user-related data is the first data, the first usage scope further includes a data analysis identifier, where the data analysis identifier is used to indicate that the first data is to be performed on the first data. Data analysis is performed to obtain data analysis results corresponding to the data analysis identifiers.
  • the first request further includes a second usage scope corresponding to the data analysis result, and the second usage scope includes at least one of the following information: a second usage object, a second usage Purpose, second usage time.
  • the first type identifier is a data analysis identifier.
  • the first network element is a network capability exposure function NEF network element
  • the second network element is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF or Terminal Equipment.
  • the first usage object is an application server AF.
  • the first network element is an access and mobility management function network element AMF
  • the second network element is a unified data management UDM network element or a user database UDR network element or an authentication service Function AUSF network element or terminal equipment.
  • the first response when the authorization information indicates that the user corresponding to the user information does not allow the user-related data to be used in the first use scope, the first response further includes reason information for indicating that the use is not allowed.
  • the present application provides a communication method, including: a third network element sending a second request to a first network element, where the second request is used to request to obtain user-related data, and the second request includes user information and A third usage scope, where the third usage scope includes at least one of the following information: a third usage object, a third usage purpose, and a third usage time; the third network element receives the second response sent by the first network element, the The second response includes user-related data or indication information, where the indication information is used to indicate that acquiring the user-related data fails.
  • the user-related data includes first data and/or second data related to the user, and the first data includes data generated by at least one of a terminal device, an application server, or a network device.
  • the data corresponding to the user, and the second data includes a data analysis result obtained by performing data analysis based on the first data.
  • the second response when the second response includes indication information, the second response further includes failure cause information, so as to inform the third network element of the specific failure cause through the failure cause information.
  • the second request further includes a second type identifier, where the second type identifier is used to identify the type of user-related data requested by the third network element.
  • the second type identifier is used to identify the first data or the second data in the user-related data, and when the user-related data requested by the third network element is the first data, the second type identifier is an event identifier; when the user-related data requested by the third network element is the second data, the second type identifier is the data analysis identifier.
  • the third network element may be an application server AF or a network function NF network element.
  • an embodiment of the present application provides a communication method, including: a terminal device receiving a third request sent by a second network element, where the third request is used to request authorization information for user-related data, and the third request Including the first usage scope of the user-related data, where the first usage scope includes at least one of the following information: a first usage object, a first usage purpose, and a first usage time; the terminal device determines according to the third request authorization information, and send a third response to the second network element, where the third response includes the authorization information.
  • the user-related data includes first data and/or second data related to the user, and the first data includes data generated by at least one of a terminal device, an application server, or a network device.
  • the data corresponding to the user, and the second data includes a data analysis result obtained by performing data analysis based on the first data.
  • a fifth aspect a communication device, comprising:
  • a sending unit configured to send a first request to a second network element, where the first request is used to request authorization information for user-related data, and the first request includes user information and a first scope of use of the user-related data , the first scope of use includes at least one of the following information: a first use object, a first use purpose, and a first use time;
  • a receiving unit configured to receive a first response sent by the second network element, where the first response includes the authorization information, and the authorization information is used to indicate whether the user corresponding to the user information allows the user to be related to the user Data is used for the first usage range.
  • the user-related data includes first data and/or second data related to the user, and the first data includes data generated by at least one of a terminal device, an application server, or a network device.
  • the data corresponding to the user, and the second data includes a data analysis result obtained by performing data analysis based on the first data.
  • the first request further includes a first type identifier, where the first type identifier is used to identify the type of the user-related data,
  • the first request is used to request authorization information for user-related data, including:
  • the first request is used to request authorization information of the user-related data corresponding to the first type identifier.
  • the first type identifier is an event identifier
  • the first data is data of a related event corresponding to the event identifier
  • the first network element is a network data analysis function NWDAF network element
  • the second network element is a unified data management UDM network element or a unified user database UDR network element or an authentication service function AUSF network element or terminal equipment.
  • the first usage object is the network element of the network data analysis function NWDAF.
  • the first purpose of use includes performing data analysis.
  • the first usage scope when the user-related data is the first data, the first usage scope further includes a data analysis identifier, where the data analysis identifier is used to indicate that the first data is to be performed on the first data. Data analysis is performed to obtain data analysis results corresponding to the data analysis identifiers.
  • the first request further includes a second usage scope corresponding to the data analysis result, and the second usage scope includes at least one of the following information: a second usage object, a second usage Purpose, second usage time.
  • the first type identifier is a data analysis identifier
  • the second data is a data analysis result corresponding to the data analysis identifier
  • the communication device is a network capability exposure function NEF network element
  • the second network element is a unified data management UDM network element or a unified user database UDR network element or an authentication service function AUSF network element or terminal equipment.
  • the first usage object is an application server AF.
  • the second network element is a unified data management UDM network element or a unified user database UDR network element or an authentication network element Service function AUSF network element or terminal equipment.
  • the receiving unit is further configured to receive a second request sent by a third network element, where the second request is used to request to obtain user-related data,
  • the sending unit is specifically configured to send the first request to the second network element according to the second request.
  • the second request includes user information and a third usage scope
  • the third usage scope includes at least one of the following information: a third usage object, a third usage purpose, and a third usage time
  • the device also includes:
  • a processing unit configured to acquire the first usage range according to the third usage range.
  • the second request includes a second type identifier, and the second type identifier is used to identify the type of user-related data requested by the third network element,
  • the processing unit is further configured to determine the first type identifier according to the second type identifier.
  • the processing unit is specifically configured to determine the second data type identifier as the first type identifier.
  • the processing unit is specifically configured to determine a first type identifier according to configuration information and a second data type identifier, where the configuration information is used to indicate that the first type identifier and the second data type identifier Correspondence between data type identifiers.
  • the third network element is an application server AF or a network function NF network element.
  • a communication device the device includes:
  • a receiving unit configured to receive a first request sent by a first network element, where the first request is used to request authorization information for user-related data, and the first request includes user information and a first scope of use of the user-related data , the first use scope includes at least one of the following information: a first use object, a first use purpose, and a first use time;
  • a processing unit configured to determine the authorization information according to the first request
  • a sending unit further configured to send a first response to the first network element, where the first response includes the authorization information, and the authorization information is used to indicate whether the user corresponding to the user information allows the user-related data is used for the first range of use.
  • the processing unit is specifically configured to determine the authorization information corresponding to the user information according to whether the first request matches the stored authorization information of the network user.
  • the processing unit is specifically configured to initiate a third request to the terminal device corresponding to the user information through the transceiver according to the first request, where the third request is used to send
  • the terminal device requests the authorization information corresponding to the user information; and receives, through the transceiver, a third response sent by the terminal device, where the third response includes the authorization information corresponding to the user information.
  • the processing unit is specifically configured to initiate a fourth request to a fourth network element through the transceiver according to the first request, where the fourth request is used to send the fourth request to the fourth network element.
  • the network element requests the authorization information corresponding to the user information; and receives, through the transceiver, a fourth response sent by the fourth network element, where the fourth response includes the authorization information corresponding to the user information .
  • the user-related data includes first data and/or second data related to the user, and the first data includes data generated by at least one of a terminal device, an application server, or a network device.
  • the data corresponding to the user, and the second data includes a data analysis result obtained by performing data analysis based on the first data.
  • the first request further includes a first type identifier, where the first type identifier is used to indicate the type of the user-related data,
  • the first request is used to request authorization information for user-related data, including:
  • the first requesting user requests authorization information of the user-related data corresponding to the first type identifier.
  • the first network element is a network data analysis function NWDAF network element
  • the communication device is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF network element or Terminal Equipment.
  • the first usage object is the network element of the network data analysis function NWDAF.
  • the first purpose of use includes performing data analysis.
  • the first usage scope when the user-related data is the first data, the first usage scope further includes a data analysis identifier, where the data analysis identifier is used to indicate that the first data is to be performed on the first data. Data analysis is performed to obtain data analysis results corresponding to the data analysis identifiers.
  • the first request further includes a second usage scope corresponding to the data analysis result, and the second usage scope includes at least one of the following information: a second usage object, a second usage Purpose, second usage time.
  • the first type identifier is a data analysis identifier.
  • the first network element is a network capability exposure function NEF network element
  • the communication device is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF or a terminal device .
  • the first usage object is an application server AF.
  • the first network element is an access and mobility management function network element AMF
  • the communication device is a unified data management UDM network element or a user database UDR network element or an authentication service function AUSF network element or terminal equipment.
  • a communication device including a processor.
  • the processor coupled to the memory, is operable to perform the method of any one of the first to fourth aspects, and any one of possible implementations of the first to fourth aspects.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication device is a terminal device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a network device.
  • the communication interface may be a transceiver, Or, input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication device is a chip or a system of chips.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip or a chip system.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • a system in an eighth aspect, where the system includes the above-mentioned terminal device and network device.
  • the network device in this embodiment of the present application refers to a network element on the network side.
  • the first network element, the second network element, the third network element, and the fourth network element may be referred to as network devices.
  • the network device in this embodiment of the present application may refer to any one or more of a first network element, a second network element, a third network element, and a fourth network element.
  • a computer program product includes: a computer program (also referred to as code, or instruction), when the computer program is executed, the computer executes any one of the above-mentioned first aspects.
  • the method in the manner, or causing the computer to execute the method in any one of the implementation manners of the first aspect to the fourth aspect.
  • a computer-readable storage medium stores a computer program (also referred to as code, or instruction) that, when it is run on a computer, causes the computer to execute any one of the above-mentioned first aspects
  • the method in one possible implementation manner, or causing the computer to execute the method in any one of the implementation manners of the first aspect to the fourth aspect.
  • FIG. 1 is an architecture diagram of a communication system provided by an embodiment of the present application
  • FIG. 3 is a flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of another communication device according to an embodiment of the present application.
  • words such as “first” and “second” are used to distinguish the same or similar items with basically the same function and effect.
  • words “first”, “second” and the like do not limit the quantity and execution order, and the words “first”, “second” and the like are not necessarily different.
  • the technical solutions in the embodiments of the present application can be applied to the fourth generation (4th Generation, 4G) system, various systems based on the evolution of the 4G system, the fifth generation (5th Generation, 5G) system, and various systems based on the evolution of the 5G system. in the system.
  • the 4G system may also be called an evolved packet system (EPS).
  • the core network (CN) of the 4G system may be called an evolved packet core (EPC), and the access network may be called long term evolution (LTE).
  • LTE long term evolution
  • the core network of the 5G system can be called 5GC (5G core), and the access network can be called new radio (NR).
  • the present application is exemplified below by taking the application of the present application to a 5G system as an example.
  • the network elements involved in the present application may be replaced with network elements having the same or similar functions in the corresponding communication system.
  • FIG. 1 exemplarily shows a schematic diagram of a network architecture of a 5G system based on a service-oriented interface.
  • the 5G system may include: an authentication server function (AUSF) network element, an access and mobility management function (AMF) network element, a data network (DN) ), unified data management (UDM) network element, user data repository (UDR), policy control function (PCF) network element, (radio) access network , (R)AN) network element, user plane function (UPF) network element, terminal (terminal), application function (application function, AF) network element, session management function (session management function, SMF) network element , Binding support function (BSF) network element, network data analysis function (NWDAF) network element, network exposure function (network exposure function, NEF) network element, network storage function (network repository function) , NRF) network element.
  • AUSF authentication server function
  • AMF access and mobility management function
  • DN data network
  • UDM user data repository
  • PCF policy control function
  • (R)AN network element, AMF network element, SMF network element, UDM network element, UDR network element, AUSF network element, UPF network element, PCF network element, BSF network element, NWDAF network element, NRF network elements, NEF network elements, etc. are respectively referred to by RAN, AMF, SMF, UDM, UDR, AUSF, UPF, PCF, BSF, NWDAF, NRF, NEF, etc.
  • the 5G system is divided into two parts: the access network and the core network.
  • the access network is used to implement functions related to wireless access, mainly including the RAN.
  • the core network is used for network service control, data transmission, etc.
  • the core network consists of multiple network elements, mainly including: AMF, SMF, UPF, PCF, UDM, etc.
  • PCF is responsible for providing policies to AMF and SMF, such as quality of service (QoS) policies, slice selection policies, etc.
  • QoS quality of service
  • UDM for handling 3rd generation partnership project (3GPP) authentication and key agreement (AKA), authentication credentials, user identification processing, access authorization, registration/mobility management, Order management, SMS management, etc.
  • 3GPP 3rd generation partnership project
  • AKA authentication and key agreement
  • UDM may provide a network element (serving NF (serving NF), for example, serving AMF (serving AMF), serving SMF (serving SMF), serving NWDAF (serving NWDAF), etc.)
  • serving NF serving NF
  • serving AMF serving AMF
  • serving SMF serving SMF
  • NWDAF serving NWDAF
  • UDR as a logical repository for storing user data, realizes the sharing and distribution of user-related data.
  • AUSF provides user authentication and authentication services for the network.
  • AF which may be an application server, may belong to an operator or a third party. It mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • NEF is used to provide customized functions for opening network capabilities, and also supports authentication and authentication functions for third-party AFs.
  • AMF is mainly responsible for the signaling processing part, such as terminal registration management, terminal connection management, terminal reachability management, terminal access authorization and access authentication, terminal security function, terminal mobility management (such as terminal location update, terminal registration network, terminal switching, etc.), network slice selection, SMF selection, terminal registration or de-registration and other functions.
  • SMF is mainly responsible for all control plane functions of terminal session management, including UPF selection, control and redirection, Internet Protocol (IP) address allocation and management, session QoS management, and obtaining policies and charging from PCF Control (policy and charging control, PCC) policy, bearer or session establishment, modification and release, etc.
  • IP Internet Protocol
  • PCC Policy and charging control
  • UPF as the anchor point of the protocol data unit (protocol data unit, PDU) session connection, is responsible for data packet filtering, data transmission/forwarding, rate control, generation of billing information, user plane QoS processing, uplink transmission authentication, Transmission level verification, downlink data packet buffering, and downlink data notification triggering, etc.
  • the UPF can also act as a branch point for a multi-homed PDU session.
  • the transmission resources and scheduling functions that serve the terminal in the UPF are managed and controlled by the SMF.
  • NRF is a network element that stores information such as network element attributes, network element status, and network topology relationships. It has network element discovery functions and network element management functions.
  • BSF with the ability to bind or store the corresponding terminal address, terminal identifier, data network name (DNN), single network slice selection assistance information (S-NSSAI), PCF instance for PDU sessions , PCF set identification function.
  • DNN data network name
  • S-NSSAI single network slice selection assistance information
  • PCF instance for PDU sessions PCF set identification function.
  • the PCF corresponding to the terminal can be queried from the BSF.
  • NWDAF with at least one of the following functions: data collection function, data analysis function, .
  • the data collection function refers to the collection of relevant data from network elements, third-party service servers, terminals or network management systems
  • the data analysis function refers to the analysis and training based on relevant input data, and to the network elements, third-party
  • the service server providing terminal or network management system provides data analysis results, which can assist the network to select service quality parameters for services, or assist the network to perform traffic routing, or assist the network to select background traffic transmission strategies, etc.
  • NWDAF can only perform related training and analysis functions based on the collected data, the premise is that it can collect and obtain relevant data.
  • the NWDAF network element can be co-located with other NFs, or the NWDAF can be deployed independently. And multiple NWDAFs can be deployed in the network.
  • RAN a network composed of one or more access network devices (also referred to as RAN nodes or network devices), implements radio physical layer functions, resource scheduling and radio resource management, radio access control and mobility management functions, services Features such as quality management, data compression and encryption.
  • the access network equipment is connected to the UPF through the user plane interface N3, and is used to transmit data of the terminal.
  • the access network equipment establishes a control plane signaling connection with the AMF through the control plane interface N2 to implement functions such as radio access bearer control.
  • the access network equipment may be a base station, a wireless fidelity (WiFi) access point (AP), a worldwide interoperability for microwave access (WiMAX) site, and the like.
  • the base station may include various forms of base stations, such as: a macro base station, a micro base station (also called a small station), a relay station, an access point, and the like.
  • an AP in a wireless local area network WLAN
  • a base station in the global system for mobile communications (GSM) or code division multiple access (CDMA) base transceiver station, BTS
  • a base station NodeB, NB
  • WCDMA wideband code division multiple access
  • evolved node B, eNB or eNodeB in LTE
  • relay stations or access points or in-vehicle devices, wearable devices, and the next generation node B (gNB) in the future 5G system or the public land mobile network (PLMN) evolved in the future ) base stations in the network, etc.
  • gNB next generation node B
  • PLMN public land mobile network
  • the terminal may be a wireless terminal, or may also be a wired terminal.
  • a wireless terminal may be a device that provides voice and/or data connectivity to a user, a handheld device with wireless connectivity, or other processing device connected to a wireless modem.
  • a certain air interface technology (such as NR technology or LTE technology) is used between the terminal and the access network device to communicate with each other.
  • a certain air interface technology (such as NR technology or LTE technology) can also be used between terminals to communicate with each other.
  • a wireless terminal may communicate with one or more core network devices via access network devices, such as with AMF, SMF, and the like.
  • the wireless terminal may be a mobile terminal, such as a mobile phone (or "cellular" phone), smart phone, satellite wireless device, wireless modem card, and computer with a mobile terminal, for example, may be laptop, portable, pocket, Handheld, computer built-in or vehicle mounted mobile devices that exchange voice and/or data with access network equipment.
  • the wireless terminal may be a personal communication service (PCS) phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital Assistant (personal digital assistant, PDA), virtual reality (virtual reality, VR) glasses, augmented reality (augmented reality, AR) glasses, machine type communication terminals, IoT terminals and other equipment.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital Assistant
  • VR virtual reality
  • AR augmented reality
  • machine type communication terminals IoT terminals and other equipment.
  • the communication equipment loaded on the vehicle is a kind of terminal, and the roadside unit (RSU) can also be used as a kind of terminal.
  • the communication equipment loaded on the UAV can also be regarded as a kind of terminal.
  • a wireless terminal may also be referred to as user equipment (UE), terminal equipment, subscriber unit, subscriber station, mobile station, mobile station, remote station ), access point, access terminal, user terminal, user agent, etc.
  • DN refers to an operator network that provides data transmission services for users, such as IP multi-media service (IMS), Internet and so on.
  • the terminal accesses the DN by establishing a PDU session (PDU session) from the terminal to the access network device to the UPF to the DN.
  • PDU session PDU session
  • the network architecture of the 5G network may also include other functional network elements.
  • a network element may also be referred to as an entity or a device or the like.
  • RAN, AMF, SMF, AUSF, UDM, UPF, PCF, BSF, NWDAF, NRF, NEF, etc. in FIG. 1 are only a name, and the name does not limit the network element itself.
  • the entities or devices corresponding to these network elements may also have other names, which are not specifically limited in this embodiment of the present application.
  • UDM may also be replaced by a user home server (home subscriber server, HSS) or a user subscription database (user subscription database, USD) or a database network element, etc., which are described here uniformly, and will not be repeated below.
  • the NWDAF network element was introduced in 3GPP Release 15 (Release 15, R15) to obtain terminals, networks (for example, RAN, CN, transmission network (TN), etc.) , AF, operation, administration and maintenance (OAM) and other related data in various domains, and use machine learning methods to do training and analysis based on a large amount of data obtained to generate analysis results, which can be used to assist the network.
  • strategy formulation and implementation For example, the NWDAF generates service experience analysis results based on data obtained from the network and data obtained from the AF, and the service experience analysis results can help the PCF to formulate PCC and QoS policies related to terminal services.
  • NWDAFs can be deployed in a communication network at the same time. From one dimension, different NWDAFs are responsible for analysis work for different purposes. For example, some NWDAFs are responsible for the analysis of terminal movement trajectories, some NWDAFs are responsible for service experience analysis, and some NWDAFs are responsible for Analysis of abnormal terminal behavior; from another dimension, different NWDAFs are responsible for different service areas. For example, some NWDAFs are responsible for data analysis in area 1, and another NWDAF is responsible for data analysis in area 2.
  • the above network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • the above network elements or functions may be divided into one or more services, and further, services that exist independently of network functions may also appear.
  • an instance of the above-mentioned function, or an instance of a service included in the above-mentioned function, or an instance of a service that exists independently of a network function may be referred to as a service instance.
  • the embodiments of the present application are not limited to the above-mentioned system architecture, and may also be applied to other communication systems in the future, such as the 6th generation (the 6th generation, 6G) system architecture, and the like.
  • the names of the network elements used in the above-mentioned embodiments of the present application may keep the same functions in future communication systems, but the names will be changed.
  • the user in this embodiment of the present application may be a person or thing that uses a certain terminal device to perform communication services in the network.
  • the user may also be the terminal device itself, such as a terminal device of the Internet of Things.
  • the user information in the embodiment of the present application is used to identify the user, and its expression form is not limited, as long as it can play the role of identifying and distinguishing the user.
  • User information can be International Mobile Subscriber Identification Number (IMSI), user permanent identifier (SUPI), generic public subscription identifier (GPSI), user Internet Protocol (Internet Protocol) , IP) filter/quintuple (UE IP filter/5-tuple), mobile station international ISDN number (mobile station international ISDN number, MSISDN), International Mobile Equipment Identification Number (International Mobile Equipment Identification Number, IMEI) and so on.
  • User information may also be the identifier of the area where the user is located, the identifier of the user, the identifier of the user group where the user is located, the identifier of the network slice corresponding to the user, the data network name DNN where the user is located, and the identity of the user to which the user belongs. ID of the network element.
  • User-related data is user-level data protected by the GDPR.
  • the user-related data in this embodiment of the present application may include one or more of the following first data and second data: the first data includes raw data and/or processed data, where the raw data includes a terminal device, an application server, or a network Data generated by the device against the user. These data may be data already reported to the operator's network.
  • the data generated by the terminal device for the user may include one or more of the following data: data generated by the user on the terminal device, data of the terminal device itself, and data generated by the terminal device for the user.
  • the data generated by the user on the terminal device may be, for example, global positioning system (Global Positioning System, GPS) information of the terminal device, user input habits on the terminal device, and so on.
  • the data of the terminal device itself used by the user may be, for example, the type approval code (type approval code, TAC), memory capacity, CPU model, etc. of the terminal device.
  • the data generated by the terminal device for the user may be, for example, a port number allocated to the user by the terminal device, a storage space allocated to the user, and the like.
  • the data generated by the application server for the user can be described as application layer data corresponding to the user.
  • the application layer data of the user in the embodiment of the present application includes one or more of the following data: data generated by the user in the application server; data of the application server corresponding to the user; data generated by the application server for the user.
  • the data generated by the user in the application server may be, for example, the service type used by the user, the IP quintuple information corresponding to the user service, etc.; the data of the application server corresponding to the user may be the service type that the application server can provide, each The IP address and port number corresponding to each service type, the basic functions of each service, etc., the storage space of the application server itself, etc.; the data generated by the application server for the user can be, for example, the application layer identification information allocated by the service server for the user, The service requirements of the service allocation, the user's service quality information, etc.
  • the data generated by the network device to the user may include one or more of the following data: data generated by the user in the access network and/or core network; data of the access network and/or core network corresponding to the user ; data generated by the access network and/or the core network for the user.
  • the data generated by the user in the access network and/or the core network may be, for example, the user's location information (such as the cell identifier or TA identifier) or the network slice information that the user requests to access; /or the data of the core network itself may be, for example, the cell capacity of the access network or the load information of the AMF or the bandwidth information of the UPF, etc.; the data generated by the access network and/or the core network for the user may be, for example, the access network is The bandwidth allocated by the user's service or the slice information selected by the core network AMF for the user, or the QoS policy information customized by the PCF for the user's service, etc.
  • the network data of the user in the embodiment of the present application includes the access network data corresponding to the user.
  • the network data of the user in the embodiment of the present application includes core network data corresponding to the user.
  • the network data of the user in the embodiment of the present application includes the access network and core network data corresponding to the user.
  • the access network can also be described as the access network of the communication operator, and the core network can also be described as the core network of the communication operator.
  • Processed data refers to the data generated after corresponding processing of the original data, for example, after aggregation processing (data weighting of multiple UEs, data averaging of a single UE over a period of time), or anonymization processing (removing UE identification information) Wait.
  • a data type or an event identifier may be used to distinguish different data in the first data.
  • RSRP reference signal receiving power
  • the second data refers to data analysis results obtained by performing data analysis based on the first data, such as UE mobility information analysis results, UE abnormal behavior analysis results, and UE service behavior analysis results generated by NWDAF.
  • the data analysis identifier analytics ID can be used for identification.
  • the first network element in this embodiment may only request to obtain authorization information; the first network element may also serve as a data requester, and requests to obtain user-related data when requesting authorization information.
  • the first network element may be an NWDAF network element, or may be another network element that needs to acquire user-related data, such as an NEF network element, an AMF network element, and an AF network element.
  • the sent request may include a scope of use, where the scope of use may include information such as a use object, a use purpose, and a use time.
  • the use object is used to indicate the object that the acquired user-related data will be used, and the object has various manifestations, such as public land mobile network (PLMN) identification, network domain (core network domain, RAN domain, OAM domain), NF network element type (AMF type, SMF type), NF network element instance identifier, AF type, AF instance identifier or application identifier.
  • PLMN public land mobile network
  • core network domain core network domain
  • RAN domain RAN domain
  • OAM domain NF network element type
  • SMF type SMF type
  • NF network element instance identifier identifier
  • AF type AF instance identifier
  • application identifier application identifier
  • the purpose of use is used to indicate the purpose for which the user-related data will be used, that is, how the user-related data will be used.
  • the purpose of use may be defined differently according to the specific data in the acquired user-related data. For example, when the requested data is the first data, the purpose of use can be to obtain the data analysis result or to open it to a third-party AF for use, and it can also further limit the specific data analysis result obtained, such as obtaining the user's movement trajectory analysis result. When the requested data is the second data, the purpose of use can be open to the third-party AF, or it can further limit the specific use of the third-party AF, such as epidemic monitoring, business application layer parameter adjustment, paging area optimization, etc. .
  • the usage time is used to indicate the time when the usage object uses the user-related data, and may include a time period and/or a duration. For example, after obtaining user-related data, the user will use it from January 1 to December 31, 2020, or after obtaining user-related data, the user will use it for 6 months from the time of acquisition.
  • the second network element is used to acquire, save, and process authorization information of user-related data.
  • the second network element may be a data management UDM network element or a data repository (UDR network element, authentication service function AUSF network element, network capability opening function NEF network element, terminal equipment, etc.
  • the second network element may still be a UDM network element, a UDR network element, or may have other names, which are not limited in this application.
  • the second network element may obtain authorization information for user-related data in the following manner:
  • the second network element obtains the authorization information of the user-related data in a dynamic way, which specifically includes: the terminal device triggers the reporting of the user's authorization information to the network element on the network side during the initial network registration or mobility registration process. (eg AMF), the network element then saves the user's authorization information in the second network element (eg UDM). or.
  • the terminal device initiates PDU session establishment or process modification, it triggers to report the user's authorization information to the network element (such as SMF) on the network side, and then the network element saves the authorization information to the second network element (such as UDM).
  • the second network element asks the user's terminal device for authorization information of the user due to a trigger condition (other network elements query the second network element), and the terminal device sends the authorization information to the second network element, so that the second network element The metastore user's authorization information.
  • the other is that the second network element is obtained through static configuration, specifically, the user saves the authorization information as subscription information in the second network element through the terminal device during the account opening phase before network access.
  • the authorization information of the user changes, the subscription information in the second network element is updated, thereby realizing the updating of the authorization information.
  • the authorization information may include user information (identifying the user), data type (such as first data, second data), use scope (use object, use purpose, use time), authorization status information (yes, no, unknown, etc.) .
  • data type such as first data, second data
  • use scope use object, use purpose, use time
  • authorization status information yes, no, unknown, etc.
  • the second network element may store the authorization information of the user as the subscription information of the user, and also save the corresponding relationship between the subscription information and the user ID; and may also use the authorization information of the user as the subscription information of the user.
  • the context information is saved, and the corresponding relationship between the context information and the user ID is also saved.
  • the authorization information of the user-related data in this embodiment is used to indicate whether the user corresponding to the user information allows the user-related data to be used in the requested scope of use.
  • the authorization information may be any one of "Yes”, “No” and "Unknown”. If the authorization information is "Yes”, it indicates that the user-related data is allowed to be used. When the authorization information is "No”, it indicates that the use of user-related data is not allowed. If the authorization information is "unknown”, it indicates that the user's attitude on whether to allow the use of user-related data is not clear, that is, it is currently uncertain whether the user is allowed to use user-related data. User related data.
  • the authorization information in this embodiment of the present application may be used to indicate: whether to allow the use of the first data, whether to allow the use of the second data, whether to allow the use of certain data or certain data in the first data. any one or more of some data, whether to allow the use of a certain data or some data in the second data, and so on.
  • the authorization information indicates that the use of the first data is permitted.
  • the authorization information indicates that the use of the first data is allowed, but the use of the second data is not allowed.
  • the authorization information is used to indicate that the data a1 in the first data is allowed to be used, but the data a2 in the first data is not allowed to be used.
  • the authorization information is used to indicate that the use of the first data is not allowed, the use of the data b1 in the second data is allowed, and the use of the data b2 in the second data is not allowed.
  • Table 1 exemplarily shows a representation form of authorization information of user-related data
  • the first row and the third row in Table 1 are used as examples for description.
  • the user-related data requested by the data requester is the data corresponding to event ID1 in the first data
  • the user's identifier is ID1.
  • analytics ID1 analysis, the use time is during the UE registration on the network, and the authorization information is "yes", then the first line means: ID1 user allows the data corresponding to event ID1 to be used for the network element of the NWDAF type, and the purpose of use is to carry out
  • the data analysis and usage time corresponding to Analytics ID1 are the corresponding usage range of the UE during network registration.
  • the user-related data is the data corresponding to Analytics ID1 in the second data
  • the user's ID is ID1
  • the object of use is the AF instance ID
  • the purpose of use is epidemic monitoring
  • the use time is 2020.1.1-12.30
  • the authorization If the information is "No", the third line indicates that the user of ID1 does not allow the data corresponding to Analytics ID1 to be used in the scope of use corresponding to the AF instance ID, the purpose of use, and the use time of 2020.1.1-12.30 .
  • the authorization information can also be used to indicate: whether to allow the use of the terminal device data corresponding to the user, whether to allow the use of the user's network data, and whether to allow the use of any one or more of the application server data corresponding to the user. item.
  • the authorization information indicates that the terminal device data corresponding to the user is allowed to be used.
  • the authorization information indicates that the terminal device data corresponding to the user is allowed to be used, but the user's network data is not allowed to be used.
  • the authorization information indicates that the terminal device data corresponding to the user is allowed to be used, the user's network data is allowed to be used, but the application server data corresponding to the user is not allowed to be used.
  • the authorization information may further include other limited information, and the other limited information is used to limit user-related data.
  • Other qualified information includes any one or more of the following: time information, location information, service type, data network name (DNN) information, service identifier, and network slice information.
  • the network slice information may be network slice identification information, such as network slice selection assistance information (Network Slice Selection Assistance Information, NSSAI), single-network slice selection assistance information (single-Network Slice Selection Assistance Information, S-NSSAI), network slice selection assistance information (S-NSSAI).
  • NSSAI Network Slice Selection Assistance Information
  • S-NSSAI single-network slice selection assistance information
  • S-NSSAI network slice selection assistance information
  • Slice instance network slice instance, NSI
  • NSSI Network Slice Subnet Instance
  • the limited information is a preset time period and a preset location range
  • the authorization information is used to indicate whether the user-related data generated within the preset time period and the preset location range are allowed to be used.
  • the time information identifier, location information, service type, DNN information, etc. in this embodiment all indicate the corresponding time, area, service, DNN and other information when the user-related data is generated.
  • the authorization information of user-related data is divided according to limited information such as location information, time information, service type, service identifier, DNN, network slice information, etc., according to the above implementation method, the user can report his Authorization information corresponding to all regions, all times, all service types, all service identifiers, all DNNs, and all slices. Authorization information corresponding to different regions, different times, different service types, different DNNs, and different slices can also be reported in stages.
  • FIG. 2 is a flowchart of a communication method provided by an embodiment of the present application. As shown in FIG. 2 , the method may include:
  • the first network element sends a first request to the second network element.
  • the second network element may send a first request to the second network element, where the first request is used to request authorization information of user-related data.
  • the first request may include user information and a first usage range of data corresponding to the user information.
  • the first usage scope may include one or more of a first usage object, a first usage purpose, and a first usage time.
  • the first use object refers to the object using the user-related data
  • the first use purpose refers to the specific purpose of using the user-related data
  • the first use time refers to the time when the user-related data is used.
  • the first use time may include a use time period and/or a specific use time period.
  • the second network element may be a UDM, UDR, AUSF, NEF and other network elements and a terminal device.
  • the second network element is a UDM as an example for description.
  • the authorization information of the user-related data can be stored in the user subscription information stored in the UDM.
  • the user's authorization information can be set, and the authorization information is used as a part of the subscription information and stored in the UDM.
  • the first network element invokes the Nudm SDM Get service provided by the UDM through the service interface to obtain the subscription information of the user.
  • the first network element may only obtain the authorization information of one user from the UDM at a time.
  • the first network element only provides the UDM with the identity of one user. Accordingly, the UDM only feeds back one user's identity to the first network element at a time.
  • User's authorization information may also obtain authorization information of multiple users from the UDM at one time.
  • the first network element provides the UDM with information that can indicate the identities of the multiple users.
  • the identifier of the user may be a user group identifier, or an identifier of a region where multiple users are located, a network element identifier, a network slice identifier, a DNN, and the like.
  • the UDM feeds back the authorization information of multiple users to the first network element at one time.
  • the first request may further include a first type identifier, where the first type identifier is used to identify the type of the user-related data, and the first request is used to request authorization information of the user-related data corresponding to the first type identifier.
  • the first type identifier is used to identify the first data and the second data in the user-related data.
  • the first type identifier may be an event identifier, and the first data is event-related data corresponding to the event identifier.
  • the first type identifier may be a data analysis identifier
  • the second data is a data analysis result corresponding to the data analysis identifier.
  • the first request may further include a filter condition, and the first request is used to request to obtain authorization information of a user who satisfies the filter condition, where the filter condition may include any one or more of the following contents : Time information, location information, service type, data network name DNN information, network slice information.
  • the time information is used to indicate the time when the user-related data is generated
  • the location information is used to indicate the location where the user-related data is generated
  • the service type is used to indicate the service that generates the user-related data
  • the data network name DNN information is used to indicate the generation of the user-related data.
  • the DNN information and network slice information of the user-related data are used to indicate the slice information for generating the user-related data.
  • the triggering condition for the first network element to send the first request to the second network element to request the authorization information of the user may be the requirement of the first network element itself, and the triggering condition for actively sending the first request to the second network element may also be the first network element
  • the first network element sends the first request to the second network element according to the second request.
  • the second request is used for requesting to obtain user-related data. That is, the trigger condition for the first network element to send the first request to the second network element is to receive the second request sent by the third network element. In this case, the first network element generates the first request according to the second request. , and send the first request to the second network element.
  • the second request may include user information and a second type identifier, where the second type identifier is used to identify the type of user-related data requested by the third network element, and the second type identifier may identify the first type of user-related data. a data and/or a second data.
  • the second request may further include a third usage scope, and the third usage scope may include one or more of the following information: a third usage object, a third usage purpose, a third usage time, and the like.
  • the obtaining of the first usage range by the first network element according to the third usage range may include that the first network element directly determines the third usage range as the first usage range, or the first network element obtains the first usage range according to the third usage range and configuration information Get the first range of use.
  • the configuration information is used to indicate the mapping relationship between the third usage range and the first usage range.
  • the first network element determines the first type identifier according to the second type identifier, which may include that the first network element directly determines the second type identifier as the first type identifier, or the first network element determines the first type identifier according to the second type identifier and configuration information.
  • the first type identifier is obtained, wherein the configuration information is used to identify the mapping relationship between the first type identifier and the second type identifier. For example, when the user-related data requested by the third network element is data corresponding to an event identifier in the first data, the second type identifier is the event ID. If the first network element wants to request the second network element for the data corresponding to the event ID authorization information, the first network element can determine the event ID as the first type identifier. For another example, the user-related data requested by the third network element is a data analysis result in the second data, and the second type identifier is the data analysis identifier analytical ID.
  • the second network element determines the analytic ID as the first type identifier. For another example, if the user-related data requested by the third network element is a data analysis result in the second data, the second type identifier is the data analysis identifier analytical ID, and the first network element needs to analyze the identifier and configuration information according to the data. If the event identifier of the first data corresponding to the data analysis identifier is determined, the first type identifier is the event identifier. Among them, the event identifier can be represented by event ID or data type.
  • S203 The second network element sends a first response to the first network element.
  • the second network element when it receives the first request sent by the first network element, it can obtain the authorization information of the corresponding user-related data according to the first request, so as to send the authorization information to the user through the first response.
  • the first network element so that the first network element obtains the authorization information of the user.
  • the authorization information is used to indicate whether the user corresponding to the user information allows the user-related data to be used in the first scope of use.
  • the authorization information is used to indicate whether the user corresponding to the user information allows the user-related data to be used by the first object of use, whether the user-related data is allowed to be used for the first purpose of use, and whether the user-related data is allowed to be used at the first use time Wait.
  • the second network element may directly send the first response to the first network element, or may send the first response to the first network element through other intermediate network elements.
  • the second network element may also perform step S202.
  • the second network element determines the authorization information of the user according to the first request.
  • the determination of the authorization information of the user by the second network element according to the first request may be implemented in the following multiple ways:
  • the second network element determines the authorization information corresponding to the user information according to whether the first request matches the stored authorization information of the network user.
  • the second network element may pre-store the authorization information of the user in the network, and when receiving the first request sent by the first network element, it may store the authorization information of the user in the network according to the user information in the first request and the pre-stored user information in the network.
  • the authorization information is matched, and if the authorization information of the user corresponding to the user information exists in the pre-stored authorization information of the user in the network, the authorization information of the user is determined.
  • the second network element performs one-to-one matching according to each item included in the first usage scope in the first request, and determines the authorization information according to the matching result of each item. For example, when the first usage scope only includes the first usage object, the first usage object is matched with the usage object in the authorization information of the network user, and if the two match, the authorization information is determined as allowing the user-related data to be It is used for the first usage scope; if the two do not match, it is determined that the authorization information does not allow user-related data to be used for the first usage scope.
  • the first usage scope when the first usage scope includes the first usage object and the first usage time, the first usage object is matched with the usage object in the authorization information of the network user to obtain the first result; The time is matched with the usage time in the authorization information of the network user to obtain the second result.
  • both the first result and the second result match, it is determined that the authorization information allows the user-related data to be used in the first scope of use; when the first result or the second result does not match, it is determined that the authorization information is not allowed User-related data are used for the first usage area.
  • the second network element determines the terminal device corresponding to the user information through the user information in the first request.
  • the second network element sends a third request to the terminal device according to the first request, where the third request is used to request the terminal device for authorization information corresponding to the user information.
  • the terminal device After receiving the third request, the terminal device sends a third response to the second network element, where the third response includes authorization information corresponding to the user information.
  • the second network element sends a fourth request to the fourth network element according to the first request, where the fourth request is used to request authorization information corresponding to the user information. .
  • the fourth network element determines authorization information corresponding to the user information according to the fourth request, and sends a fourth response to the second network element, where the fourth response includes authorization information corresponding to the user information.
  • the fourth network element may store the authorization information of the user in advance. The relevant content of this part is similar to the foregoing content, and will not be repeated here.
  • the fourth network element may be an AF, a UE, or the like.
  • the second network element may directly send the fourth request to the fourth network element, or may send the fourth request to the fourth network element through other network elements. For example, when the fourth network element is the AF network element, the second network element sends the fourth request to the fourth network element through the NEF network element.
  • the method may further include the following steps:
  • the first network element may Get user-related data.
  • the first network element may send a second response to the third network element, where the second response includes user-related data, so that the third network element obtains the user-related data.
  • the first network element may send the user-related data to the third network element when acquiring the user-related data.
  • the user-related data requested by the third network element is the second data
  • the first network element may also first obtain the first data corresponding to the second data, and perform an analysis on the first data. The data analysis obtains the corresponding second data, and then sends the second data to the third network element.
  • the third network element may be an application server AF, a network function NF network element, a network management system network element, a terminal device, or the like.
  • the first response may further include reason information indicating that the use is not allowed.
  • the reason information is used to indicate the reason why certain data or some data are not allowed to be used, for example, the data type is not within the scope of UE authorization, the object of use is not within the scope of UE authorization, the purpose of use is illegal, and the time of use is not within the scope of UE authorization Wait.
  • the first network element obtains the authorization information of the user in advance before obtaining the user-related data.
  • the first network element obtains the user-related data, thereby preventing the user-related data from being used. Free access to realize the protection of user-related data.
  • the acquisition of the user-related data by the first network element can be divided into the following implementation manners.
  • the first request may include an event identifier (such as an event ID) to The specific data category to be acquired is identified by the data identification.
  • the first network element sends a fifth request to the fifth network element, where the fifth request includes an event identifier; the first network element receives a fifth response sent by the fifth network element, where the fifth response includes first data corresponding to the event identifier . That is, the first network element acquires the user-related data by sending the fifth request to the fifth network element.
  • the fifth network element is the network element where the user-related data that the first network element wants to acquire is located.
  • the fifth network element may be NF, AF, UE, OAM and so on.
  • the first request may include a data analysis identifier (such as an analytics ID), and the data analysis identifier is used to identify the specific data analysis result that the first network element wants to obtain. category.
  • the first network element may first obtain the first data corresponding to the second data before obtaining the second data.
  • the first network element determines the event identifier (eg, event ID) corresponding to the first data according to the data analysis identifier corresponding to the second data; the first network element obtains the first data according to the event identifier; the first network element determines the first data according to the first data Generate user related data.
  • the first network element may acquire the first data in the following manners, for example, it may be pre-stored on the first network element, or may be obtained from other network elements, wherein the other network elements may be NF, AF, UE, OAM, etc.
  • the first purpose of use in the first use scope may be data analysis, that is, to clarify The first data will be used for data analysis.
  • the first scope of use may further include an event identifier, and the first data is event-related data corresponding to the event identifier.
  • the first request may further include a second usage scope, where the second usage scope includes at least one of the following information: a second usage object, a second usage purpose, a second usage time, and the like.
  • the second usage object is used to indicate the object to which the data analysis result will be used
  • the second usage purpose is used to indicate the purpose of the data analysis result to be used
  • the second usage time is used to indicate the time when the data analysis result will be used.
  • the second usage object is used to indicate the object to which the user's mobility analysis result will be used, such as AF and AMF network elements
  • the second usage purpose is used to indicate the user's mobility
  • the purpose of using the mobility analysis results, such as epidemic monitoring, paging area optimization, etc., the second usage time is used to indicate the time when the user's mobility analysis results will be used, such as 2020.1.1-12.30.
  • the second network element may be a unified data management UDM network element, a unified user database UDR, an authentication service function AUSF network element, and a terminal device.
  • the second network element is a unified data management UDM network element, a unified database UDR network element, an authentication service function AUSF network element, or an interruption device .
  • the second network element is the unified management UDM network element, the unified user database UDR network element, the authentication service function AUSF network element or Terminal Equipment.
  • the second network element is a network capability exposure function NEF network element.
  • the authorization information of the user-related data can be obtained according to the embodiment shown in FIG. 2 .
  • FIG. 3 is a flowchart of another communication method provided by an embodiment of the present application.
  • the method may include:
  • a third network element sends a second request to the first network element, where the second request is used for requesting to acquire user-related data.
  • the third network element when it wants to obtain the second data, it may send a second request to the first network element, where the second type identifier in the second request may be a specific data analysis identifier (analytics ID), The specific data analysis result requested by the third network element is identified by the data analysis identifier. The data analysis result needs to be obtained by the first network element performing data analysis based on the corresponding first data.
  • the second request may include the identifier of the third network element or the service identifier (application ID), so as to specify the object using the second data through the identifier.
  • the second request may further include user information, where the user information is used to indicate which user's second data is requested by the third network element.
  • the user information For the specific expression form of the user information, reference may be made to the foregoing embodiment, and details are not described herein again in this embodiment.
  • the second request may further include a third usage scope, where the third usage scope includes one of the following information: a third usage object, a third usage purpose, a third usage time, and the like.
  • the third usage object identifies the object using the data analysis result
  • the third usage purpose identifies the specific purpose of using the data analysis result
  • the third usage time identifies the specific time for using the data analysis result.
  • the first network element sends a first request to the second network element based on the second request, where the first request is used to request authorization information for user-related data.
  • the first network element may generate the first request based on the received second request, and send the first request to the second network element to obtain the user Authorization information for the relevant data. That is, the first network element uses the second request sent by the third network element as a triggering condition for querying the second network element for user authorization information.
  • the first network element may generate the first request according to the second request, and reference may be made to the description of the foregoing embodiment for specific implementation, which will not be repeated in this embodiment.
  • the first network element may convert the user's network external identifier into the user's internal network identifier according to the configuration information, so as to include the user's network identifier in the first request. Internal identification.
  • the second network element determines the authorization information of the user according to the first request.
  • the second network element may acquire the authorization information of the user corresponding to the user information according to the authorization information of the user stored by itself and the first request.
  • the second network element determines, according to the first scope of use in the first request and the user information, whether the analytics ID is included in the data type of the user's authorization information, and whether the third network element ID or application ID is included in the user's permission for the analytics Among the objects used by the ID data analysis result, whether the purpose of requesting the use of the analytics ID data analysis result matches the purpose permitted by the user, and whether the usage time of the request to use the analytics ID data analysis result matches the user's permitted usage time. If all of the above conditions are met, the second network element determines that the user-related data is allowed to be used in the first use range; otherwise, the second network element determines that the user-related data is not allowed to be used for the first use range or the corresponding authorization is unknown.
  • the second network element may also determine the authorization information of the user by sending a request to other network elements.
  • the specific implementation is similar to the above-mentioned content, and details are not described herein again in this embodiment.
  • S304 The second network element sends a first response to the first network element, where the first response includes authorization information.
  • the authorization information is used to indicate whether the user corresponding to the user information allows the user-related data to be used in the first scope of use.
  • the authorization information may be that the user corresponding to the user information allows the user-related data to be used in the first scope of use, or does not allow the user-related data to be used for the first scope of use, or it is unknown whether the user-related data is allowed.
  • the first response may further include the data type that is not allowed to be used (when the third network element requests multiple data analysis results at the same time) ), information on the reason for not allowing the use, etc.
  • the first network element obtains first data, and performs data analysis on the first data to obtain a data analysis result.
  • the first network element When the first network element receives the authorization information sent by the second network element, it can obtain the first data based on the authorization information, so as to perform data analysis on the first data to obtain the data analysis result to be obtained by the third network element.
  • the first network element determines the first data to be used for generating the data analysis result according to the data analysis identifier in the second request, and then the first network element obtains the first data.
  • the first network element obtains the first data.
  • the first network element sends a request to other network elements to request to obtain the first data.
  • a data Regarding the specific implementation of the acquisition of the first data by the first network element, it will be described in subsequent embodiments.
  • the first network element obtains the first data
  • data analysis is performed based on the obtained first data to obtain a data analysis result corresponding to the analytics ID.
  • the first network element when the authorization information indicates that the user corresponding to the user information allows the relevant data to be used by the third network element, the first network element sends the data analysis result obtained in S305 to the third network element.
  • the third network element receives the data analysis result, and uses the data analysis result to perform operations such as epidemic monitoring and paging area optimization.
  • the first network element sends a feedback message to the third network element, where the feedback message may include a reason value for not allowing the use .
  • the first network element sends feedback information to the third network element, where the feedback information is used to indicate the data analysis requested by the third network element The result is rejected, along with the reason for the rejection.
  • the execution conditions of S305 may include the following two situations: one is that when the first network element determines that the user corresponding to the user information allows the user-related data to be used in the first usage range, the first The network element obtains the first data, performs data analysis on the first data to obtain a corresponding data analysis result, and executes S306. That is, if the authorization information indicates that the user corresponding to the user information does not allow the user-related data to be used in the first usage range, the first network element does not acquire the first data and does not perform a data analysis operation.
  • the first network element obtains the first data, performs a data analysis operation based on the first data, and obtains a data analysis result.
  • the authorization information indicates that the user corresponding to the user information allows the user-related data to be used in the first usage range
  • the first network element sends the data analysis result to the third network element.
  • the authorization information indicates that the user corresponding to the user information does not allow the user-related data to be used in the first usage range
  • the first network element does not perform the operation of S306.
  • the first network element can obtain the first data first, and perform data analysis to obtain the data analysis result. Then, the first network element decides whether to send the data analysis result to the third network element according to the specific instruction of the authorization information.
  • the first network element can acquire the first data in various ways. In addition to the first network element storing the relevant data of the user in advance, the first network element can also obtain it by requesting other network elements. When acquiring the first data, the first network element may also request the second network element to acquire the authorization information of the user. When the authorization information indicates that the user corresponding to the user information allows the user-related data to be used, the first network element acquires the first data. .
  • the first network element is the NWDAF and the second network element is the UDM as an example for description.
  • the method can include:
  • a first network element sends a first request to a second network element, where the first request is used to request authorization information of user-related data.
  • the first network element in order to obtain the first data, the first network element first sends a first request to the second network element, where the first request includes user information and a first usage range, and the first usage range may include one of the following information Type: the first object of use (such as NWDAF ID), the first purpose of use (such as a certain data analysis analytics ID), and the first time of use (such as 2020.1.1-6.1).
  • the first type identifier in the first request is an event identifier (such as event ID), so as to indicate a specific data type in the first data through the event identifier.
  • the first scope of use may further include a data analysis identifier (such as an analytics ID), where the data analysis identifier is used to instruct to perform data analysis on the first data to obtain data analysis corresponding to the data analysis identifier result.
  • the first request may further include a second usage scope, and the second usage scope may include one or more of the second usage object, the second usage purpose, and the second usage time.
  • the second usage object indicates the usage object of the data analysis result corresponding to the data analysis
  • the second usage purpose indicates the usage purpose of the data analysis result.
  • the second usage time indicates the usage time of the data analysis result. That is, the second scope of use is a further limitation of the fourth purpose of use (obtaining a certain data analysis result).
  • the second network element determines the authorization information of the user according to the first request.
  • the second network element determines the authorization information of the user according to the first request.
  • the second network element will determine whether the data analysis result corresponding to the analytics ID is included in the user's authorization according to the user information and the second usage scope.
  • the data type of the information whether the second use object is included in the object that the user allows the data analysis result corresponding to the analytics ID to be used, whether the second purpose of use matches the purpose allowed by the user, and whether the second use time is the same as that allowed by the user. The usage time is matched, so as to obtain authorization information for the second usage scope.
  • the second network element sends a first response to the first network element, where the first response includes authorization information.
  • the authorization information sent by the second network element includes both the authorization information for the first usage scope and the authorization information for the second usage scope. Scope of authorization information.
  • the authorization information may instruct the user corresponding to the user information to allow the first data to use the first scope, and at the same time, instruct the user corresponding to the user information to allow the data analysis result corresponding to the first data to use the second scope.
  • the first network element can acquire the user-related data under the condition that the user-related data is allowed to be acquired.
  • obtaining relevant data generated by users in the communication operator network can protect user-level data on the one hand, and on the other hand, it can also meet the requirements of capturing data for training and analysis to assist network policy formulation and development. purpose of execution.
  • FIG. 5 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may be a terminal device or a network device, or a chip or a circuit, such as a A chip or circuit, for example, a chip or circuit that can be provided in a network device.
  • the network device in this embodiment of the present application may refer to any one or more of a first network element, a second network element, a third network element, a fourth network element, or a terminal device.
  • the communication device 501 may further include a bus system, wherein the processor 502, the memory 504, and the transceiver 503 may be connected through the bus system.
  • the above-mentioned processor 502 may be a chip.
  • the processor 502 can be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a system on chip (SoC). It can be a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (microcontroller). unit, MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • SoC system on chip
  • SoC system on chip
  • MCU microcontroller
  • MCU programmable logic device
  • PLD programmable logic device
  • each step of the above-mentioned method may be completed by a hardware integrated logic circuit in the processor 502 or an instruction in the form of software.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor 502 .
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory 504, and the processor 502 reads the information in the memory 504, and completes the steps of the above method in combination with its hardware.
  • processor 502 in this embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above method embodiment may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the aforementioned processors may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable gate arrays
  • the methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the transceiver may be a transceiving unit, eg comprising a receiving unit and a transmitting unit.
  • the transceiver may also be a transceiver circuit or an interface circuit.
  • the transceiver is used for the processor to communicate with external network elements or elements.
  • the memory 504 in this embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the communication device 501 may include a processor 502 , a transceiver 503 and a memory 504 .
  • the memory 504 is used for storing instructions
  • the processor 502 is used for executing the instructions stored in the memory 504, so as to realize the first network element in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. related programs.
  • the transceiver 503 is configured to send a first request to the second network element, where the first request is used to request authorization information of user-related data, and the first request includes user information and a first scope of use of the user-related data , the first use scope includes at least one of the following information: a first use object, a first use purpose, and a first use time; receiving a first response sent by a second network element, where the first response includes authorization information, the authorization The information is used to indicate whether the user corresponding to the user information allows the user-related data to be used in the first usage range.
  • the transceiver 503 is specifically configured to: receive a second request sent by a third network element, where the second request is used to request user-related data; The second request sends the first request to the second network element.
  • the processor 502 is configured to: acquire the first usage range from the third usage range according to the second request.
  • the processor 502 is further configured to: determine the first type identifier according to the second type identifier.
  • the processor 502 is specifically configured to: determine the first type identifier according to the configuration information and the second data type identifier, where the configuration information is used to indicate that the first type identifier is the same as the first type identifier. The correspondence between the second type identifiers.
  • the processor 502 is specifically configured to: determine the second data type identifier as the first type identifier.
  • the transceiver 503 is further configured to: send a second response to the third network element, where the second response includes the user-related data requested by the third network element .
  • the processor 502 when the authorization information indicates that the user corresponding to the user information allows the user-related data to be used in the first usage range, the processor 502 is specifically configured to: : Obtain the user-related data.
  • the processor 502 specifically uses the To: delete the user-related data or stop acquiring the user-related data.
  • the communication device 501 may include a processor 502 , a transceiver 503 and a memory 504 .
  • the memory 504 is used for storing instructions
  • the processor 502 is used for executing the instructions stored in the memory 504, so as to implement the second network element in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. related programs.
  • the transceiver 503 is configured to receive a first request sent by a first network element, where the first request is used to request authorization information of user-related data, and the first request includes user information and a first use of the user-related data
  • the first usage scope includes at least one of the following information: a first usage object, a first usage purpose, and a first usage time; the processor 502 is configured to determine the authorization information according to the first request ; send a first response to the first network element, where the first response includes authorization information for the user-related data.
  • the processing 502 is specifically configured to: according to whether the first request matches the stored authorization information of the network user, determine the corresponding user information. the authorization information.
  • the process 502 is specifically configured to: the second network element initiates a third network element to the terminal device corresponding to the user information according to the first request. request, the third request is used to request the terminal device for the authorization information corresponding to the user information; the second network element receives a third response sent by the terminal device, where the third response includes the The authorization information corresponding to the user information.
  • the processing 502 is specifically configured to: the transceiver 503 initiates a fourth request to the fourth network element according to the first request, and the first request The fourth request is used to request the authorization information corresponding to the user information from the fourth network element; and receive a fourth response sent by the fourth network element, where the fourth response includes all the user information corresponding to the user information. the authorization information.
  • the communication device may include a processor 502 , a transceiver 503 and a memory 504 .
  • the memory 504 is used for storing instructions
  • the processor 502 is used for executing the instructions stored in the memory 504, so as to implement the third network element in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. related programs.
  • the transceiver 503 sends a second request to the first network element, where the second request is used to request to obtain user-related data, the second request includes user information and a third usage scope, and the third usage scope includes the following information At least one of: the third object of use, the third purpose of use, and the third time of use.
  • a second response sent by the first network element is received, where the second response includes the user-related data or indication information, where the indication information is used to indicate a failure to acquire the user-related data. .
  • the communication device may include a processor 502 , a transceiver 503 and a memory 504 .
  • the memory 504 is used for storing instructions
  • the processor 502 is used for executing the instructions stored in the memory 904, so as to realize the data providing network element in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. related programs.
  • the transceiver 503 receives a third request sent by a second network element, where the third request is used to request authorization information of user-related data, the third request includes a first scope of use of the user-related data, and the third request is used to request authorization information for user-related data.
  • a use scope includes at least one of the following information: a first use object, a first use purpose, and a first use time; the processor 502 determines the authorization information according to the third request, and sends the information to all users through the transceiver 503. The second network element sends a third response, where the third response includes the authorization information.
  • the transceiver 503 is specifically configured to: send a fifth request to the data management network element, where the fifth request is used to request to obtain the user's data Authorization information; receiving a fifth response from the data management network element, where the fifth response carries the authorization information of the user.
  • FIG. 6 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • a communication device 601 may include a communication interface 604 , a processor 602 , and a transceiver 603 .
  • the communication interface 604 is used for inputting and/or outputting information;
  • the processor 602 is used for executing a computer program or instruction, so that the communication device 601 implements the method on the terminal device side in the above-mentioned related solutions of FIG. 2 to FIG. 4 , Or make the communication device 601 implement the method on the network device side in the above-mentioned related solutions of FIG. 2 to FIG. 4 .
  • the network device side is, for example, any one or more of the above-mentioned first network element, second network element, third network element, fourth network element, and fifth network element.
  • the transceiver 603 can implement the solution implemented by the transceiver 503 in FIG. 5
  • the processor 602 can implement the solution implemented by the processor 502 in FIG. 5 , which is not repeated here.
  • the embodiment of the present application further provides a communication system, which includes the foregoing network device and one or more than one terminal device.
  • the network device is, for example, any one or more of the above-mentioned first network element, second network element, third network element, fourth network element, and fifth network element.
  • FIG. 7 is a schematic diagram of a communication device provided by an embodiment of the application.
  • the communication device 701 may be a terminal device or a network device, or a chip or a circuit, for example, it can be set Chips or circuits used in terminal equipment or network equipment.
  • the communication device 701 may include a processing unit 702 , a transceiver unit 703 and a storage unit 704 .
  • the storage unit 704 is configured to store instructions
  • the processing unit 702 is configured to execute the instructions stored in the storage unit 704, so as to implement the first network in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. Yuan related programs.
  • a transceiver unit 703 configured to send a first request to a second network element, where the first request is used to request authorization information for user-related data, and the first request includes user information and a first use of the user-related data
  • the first usage scope includes at least one of the following information: a first usage object, a first usage purpose, and a first usage time; receiving a first response sent by the second network element, where the first response includes Authorization information, where the authorization information is used to indicate whether the user corresponding to the user information allows the related data to be used for the first usage scope.
  • the communication device 701 may include a processing unit 702 , a transceiver unit 703 and a storage unit 704 .
  • the storage unit 704 is configured to store instructions
  • the processing unit 702 is configured to execute the instructions stored in the storage unit 704 to implement the second network in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. Yuan related programs.
  • Transceiving unit 703, receiving a first request sent by a first network element, where the first request is used to request authorization information of user-related data, the first request includes user information and a first scope of use of user-related data, the first scope of use It includes at least one of the following information: a first use object, a first use purpose, and a first use time; the processing unit 702 determines authorization information according to the first request; the transceiver unit 703 sends a first response to the first network element, The first response includes authorization information, where the authorization information is used to indicate whether the user corresponding to the user information allows the user-related data to be used for the first use scope.
  • the communication device 701 may include a processing unit 702 , a transceiver unit 703 and a storage unit 704 .
  • the storage unit 704 is used for storing instructions
  • the processing unit 702 is used for executing the instructions stored in the storage unit 704, so as to implement the third network in the method corresponding to any one or any of the items shown in FIG. 2 to FIG. 4 above. Yuan related programs.
  • Transceiving unit 703 sending a second request to the first network element, where the second request is used to request to obtain user-related data, the second request includes user information and a third usage range, where the third usage range includes at least the following information One: a third use object, a third purpose of use, and a third use time; receive a second response sent by the first network element, where the second response includes user-related data or indication information, and the indication information is used to instruct the acquisition of user-related data Data failed.
  • the communication device 701 may include a processing unit 702 , a transceiver unit 703 and a storage unit 704 .
  • the storage unit 704 is used for storing instructions
  • the processing unit 702 is used for executing the instructions stored in the storage unit 704, so as to realize the corresponding method of any one or any of the items shown in FIG. 2 to FIG. 4 above. related programs.
  • the transceiver unit 703 receives a third request sent by a second network element, where the third request is used to request authorization information of user-related data, the third request includes a first scope of use of the user-related data, and the third request is used to request authorization information for user-related data.
  • a usage scope includes at least one of the following information: a first usage object, a first usage purpose, and a first usage time; the terminal device determines authorization information according to the third request, and sends a third response to the second network element , the third response includes the authorization information.
  • each unit in the above-mentioned communication device 701 may refer to the implementation of the corresponding method embodiments, which will not be repeated here.
  • the transceiver unit 702 may be implemented by the transceiver 503 shown in FIG. 5 above, and the processing unit 702 may be implemented by the processor 502 shown in FIG. 5 above.
  • the present application also provides a computer program product, the computer program product includes: computer program code, when the computer program code is run on a computer, the computer is made to execute the programs shown in FIGS. 2 to 84 .
  • the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores program codes, and when the program codes are executed on a computer, causes the computer to execute FIG. 2 to FIG. 4 The method of any one of the illustrated embodiments.
  • the present application further provides a system, which includes the aforementioned one or more terminal devices and one or more network devices.
  • At least one (item) refers to one or more, and "a plurality” refers to two or more.
  • “And/or” is used to describe the association relationship of related objects, indicating that there can be three kinds of relationships, for example, “A and/or B” can mean: only A exists, only B exists, and both A and B exist at the same time. , where A and B can be singular or plural.
  • the character “/” generally indicates that the related objects are an “or” relationship.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • At least one (a) of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c" ", where a, b, c can be single or multiple.
  • a software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.
  • RAM random access memory
  • ROM read only memory
  • electrically programmable ROM electrically erasable programmable ROM
  • registers hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种通信方法、设备及系统，第一网元向第二网元发送第一请求，该第一请求用于请求用户相关数据的授权信息，第一请求中包括用户信息和用户相关数据的第一使用范围，该第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；第一网元接收所述第二网元发送的第一响应，该第一响应包括授权信息，该授权信息用于指示用户信息对应的用户是否允许相关数据被用于第一使用范围。当第一网元想要获取用户信息对应用户的用户相关数据时，可以先向第二网元发送第一请求，以通过第二网元获取授权信息，以便当授权信息指示用户允许用户相关数据被用于第一使用范围时，可以基于用户粒度的数据进行相关操作。

Description

一种通信方法、设备及系统 技术领域
本申请涉及通信技术领域，具体涉及一种通信方法、设备及系统。
背景技术
现在技术中，用户在通信运营商网络中产生的用户粒度的数据属于用户自身，禁止运营商网络随意获取和使用该用户粒度的数据。
在实际应用中，存在某些场景需求，通信运营商网络需要获取并使用用户粒度的数据，以基于所获取的用户粒度的数据进行数据分析等。然而，现有技术中，通信运营商网络并未提供如何精确获取用户相关数据的授权信息的方案。
发明内容
有鉴于此，本申请实施例提供一种通信方法、设备及系统，可以准确地获取用户相关数据的授权信息。
为解决上述问题，本申请实施例提供的技术方案如下：
第一方面，本申请实施例提供了一种通信方法，包括：第一网元向第二网元发送第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求中包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；所述第一网元接收所述第二网元发送的第一响应，所述第一响应包括授权信息，所述授权信息用于指示所述用户信息对应的用户是否允许所述相关数据被用于所述第一使用范围。在该实现方式中，用户信息用于指示某一用户或某些用户，该用户信息可以为用户所在区域的标识、所述用户的标识、所述用户所在用户群组的标识、所述用户对应的网络切片的标识、所述用户所在数据网络名称DNN和所述用户所属的网元的标识。当第一网元想要获取用户信息对应用户的用户相关数据时，可以先向第二网元发送第一请求，以通过第二网元获取该用户的授权信息，以便当授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围时，第一网元获取用户相关数据，从而使得第一网元可以基于用户粒度的数据进行相关操作。在该实现方式中，第一网元可以通过向第二网元发送第一请求的方式来准确获取用户相关数据对应的授权信息，从而实现精准获取。
在一种可能的实现方式中，用户相关数据包括用户相关的第一数据和/或第二数据，其中，第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，第二数据包括基于第一数据进行数据分析而获取的数据分析结果。其中，第一数据可以分为原始数据和处理数据，原始数据可以包括终端设备、应用服务器或网络设备中的至少一个产生的用户对应的原数据，处理数据包括基于所述原始数据进行处理后的数据。具体地，可以针对原始数据进行聚合处理、匿名化处理等操作。在该实现方式中，针对用户粒度的数据划分为获取多种数据，以便针对每种数据设置不同的授权信息，从而实现对用户相关数据的更全面的保护。
在一种可能的实现方式中，第一请求中还包括第一类型标识，该第一类型标识用于标识用户相关数据的类型。也就是，第一类型标识用于标识所要获取的是用户相关数据中的第一数据和/或第二数据。在该实现方式中，第一网元在向第二网元请求授权信息时，将请求第一类型标识对应的用户相关数据的授权信息。具体地，当第一类型标识为事件标识时，表明请求第一数据的授权信息；当第一类型标识为数据分析标识时，表明请求第二数据的授权信息。
在一种可能的实现方式中，当用户相关数据为第一数据时，第一类型标识为事件标识，第一数据为事件标识对应的事件相关的数据。
在一种可能的实现方式中，当用户相关数据为第二数据时，第一类型标识为数据分析标识，第二数据为数据分析标识对应的数据分析结果。
在一种可能的实现方式中，当第一网元为网络数据分析功能NWDAF，第二网元为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，当用户相关数据为第一数据时，第一使用目的可以包括进行数据分析，即第一使用目的表示对第一数据进行数据分析以获得数据分析结果。在该实现方式中，可以通过第一使用目的来表明获取第一数据的目的，从而获取用户对于该使用目的的授权信息。
在一种可能的实现方式中，当所述用户相关数据为第一数据时，第一使用范围还可以包括数据分析标识，该数据分析标识用于指示对第一数据进行数据分析以获取该数据分析标识对应的数据分析结果。在该实现方式中，可以通过数据分析标识来具体地表明对第一数据所进行的具体分析类型。
在一种可能的实现方式中，当所述用户相关数据为第一数据时，所述第一使用目的可以为获取数据分析结果或者为开放给第三方AF使用，也可以进一步限定具体获取的是哪种数据分析结果，如获取用户的移动轨迹分析结果。
在一种可能的实现方式中，第一请求还包括数据分析结果对应的第二使用范围，该第二使用范围包括以下信息的至少一种：第二使用对象、第二使用目的、第二使用时间。在该实现方式中，当获取针对第一数据进行数据分析获取数据分析结果时，还可以进一步对该数据分析结果的使用范围进行设定，例如，第二使用对象用于指示对数据分析结果将被使用的对象、第二使用目的用于指示数据分析结果将被使用的目的、第二使用时间用于指示数据分析结果将被使用的时间。通过进一步设置第二使用范围，以获取包括第二使用范围在内的用户的授权信息。
在一种可能的实现方式中，第一网元为网络能力开放功能NEF网元，第二网元为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。在该实现方式中，当第一网元为NEF网元时，第一网元可以向UDM网元、UDR网元、AUSF网元或终端设备中的任一个发送第一请求，以请求获取用户的授权信息。
在一种可能的实现方式中，第一使用对象为应用服务器AF。在该实现方式中，当第一网元为NEF网元时，第一网元所请求的用户相关数据的使用对象可以为AF。
在一种可能的实现方式中，第一网元为接入和移动性管理功能网元AMF，第二网元为 统一数据管理UDM或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，第一网元向第二网元发送第一请求的条件可以为自身的需求所触发，也可以为第一网元接收第三网元所发送的第二请求，该第二请求用于请求获取用户相关数据；第一网元根据第二请求向第二网元发送第一请求。在该实现方式中，第一网元在接收到第三网元所发送的第二请求的情况下，向第二网元发送第一请求以请求用户的授权信息。
在一种可能的实现方式中，第二请求可以包括用户信息和第三使用范围，其中，用户信息用于标识用户，该用户信息可以为用户所在区域的标识、所述用户的标识、所述用户所在用户群组的标识、所述用户对应的网络切片的标识、所述用户所在数据网络名称DNN和所述用户所属的网元的标识；第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间。其中，第三使用对象用于指示所述第二请求所请求的用户相关数据的使用对象、第三使用目的用于指示所述第二请求所请求的用户相关数据的使用目的、第三使用时间用于指示所述第二请求所请求的用户相关数据的使用时间。
在一种可能的实现方式中，第二请求还可以包括第二类型标识，该第二类型标识用于标识第三网元所请求的用户相关数据的类型。该第二类型标识可以为事件标识或数据分析标识。则第一网元可以根据第二类型标识确定第一类型标识。在该实现方式中，当第二请求包括第二类型标识时，第一网元可以根据该第二类型标识来确定第一请求中的第一类型标识，从而在第一请求中进行体现。
在一种可能的实现方式中，第一网元根据第二类型标识确定第一类型标识，可以包括：第一网元将所述第二数据类型标识确定为第一类型标识。
在一种可能的实现方式中，第一网元根据第二类型标识确定第一类型标识，可以包括：第一网元根据配置信息以及第二数据类型标识确定第一类型标识，其中，配置信息用于指示第一类型标识与第二数据类型标识之间的对应关系。在该实现方式中，第一网元根据配置信息将第二类型标识映射成第一类型标识，以在第一请求中包括第一类型标识。
在一种可能的实现方式中，当授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围时，所述方法还包括：第一网元向第三网元发送第二响应，该第二响应包括第三网元所请求的用户相关数据。
在一种可能的实现方式中，第三网元为应用服务器AF或网络功能NF网元或网管系统网元或终端设备。
在一种可能的实现方式中，当第一网元为应用功能AF网元时，所述第二网元可以为网络能力开放功能NEF网元。
在一种可能的实现方式中，所述方法还包括：当授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围，则第一网元获取用户相关数据。当用户允许使用用户相关数据时，则第一网元才获取用户相关数据，从而避免对用户相关数据的滥用，提高用户相关数据的安全性。
在一种可能的实现方式中，所述方法还包括：当授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，第一网元删除用户相关数据或停止获取用户相 关数据。在该实现方式中，当用户不允许使用用户相关数据时，如果第一网元已经获取的用户相关数据，则删除该用户相关数据；如果第一网元尚未获取用户相关数据，则停止获取，从而保证用户相关数据的安全性。
在一种可能的实现方式中，当授权信息用于用户信息对应的用户不允许用户相关数据被用于第一使用范围时，第一响应还包括用于指示不允许使用的原因信息。在该实现方式中，当用户不允许使用用户相关数据时，则第一响应还可以包括不允许使用的原因信息，以告知不允许被使用的具体原因。
第二方面，本申请实施例提供了一种通信方法，包括：第二网元接收第一网元发送的第一请求，该第一请求用于请求用户相关数据的授权信息，第一请求包括用户信息和用户相关数据的第一使用范围，该第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；所述第二网元根据所述第一请求确定授权信息；第二网元向第一网元发送第一响应，其中，第一响应包括授权信息，该授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于第一使用范围。
在一种可能的实现方式中，第二网元根据第一请求确定授权信息，包括：第一网元根据第一请求和保存的网络用户的授权信息是否匹配确定用户信息对应的所述授权信息。在该实现方式中，第二网元可以预先存储网络中用户的授权信息，当接收到第一网元发送的第一请求时，根据该第一请求中的用户信息以及用户的授权信息是否匹配来确定该用户信息对应的授权信息。
在一种可能的实现方式中，第二网元根据第一请求确定授权信息，包括：第二网元根据第一请求向用户信息对应的终端设备发送第三请求，该第三请求用于向终端设备请求所述用户信息对应的授权信息；第二网元接收终端设备发送的第三响应，该第三响应中包括用户信息对应的授权信息。在该实现方式中，第二网元通过向终端设备发送第三请求的方式来获取用户信息对应的授权信息。
在一种可能的实现方式中，第二网元根据第一请求确定授权信息，包括：第二网元根据第一请求向第四网元发起第四请求，该第四请求用于向第四网元请求用户信息对应的授权信息；第二网元接收第四网元发送的第四响应，该第四响应中包括用户信息对应的授权信息。在该实现方式中，第二网元通过向第四网元发送第四请求的方式来获取用户信息对应的授权信息。
在一种可能的实现方式中，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
在一种可能的实现方式中，所述第一请求中还包括第一类型标识，所述第一类型标识用于指示所述用户相关数据的类型，所述第一请求用于请求用户相关数据的授权信息，包括：所述第一请求用户请求所述第一类型标识对应的用户相关数据的授权信息。
在一种可能的实现方式中，所述第一网元为网络数据分析功能NWDAF网元，所述第二网元为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，当所述用户相关数据为第一数据时，所述第一使用对象为所述网络数据分析功能NWDAF网元。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用目的包括进行数据分析。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用范围还包括数据分析标识，所述数据分析标识用于指示对所述第一数据进行数据分析以获得所述数据分析标识对应的数据分析结果。
在一种可能的实现方式中，所述第一请求还包括所述数据分析结果对应的第二使用范围，所述第二使用范围包括以下信息的至少一种：第二使用对象、第二使用目的、第二使用时间。
在一种可能的实现方式中，当所述用户数据为所述第二数据时，所述第一类型标识为数据分析标识。
在一种可能的实现方式中，所述第一网元为网络能力开放功能NEF网元，所述第二网元为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF或终端设备。
在一种可能的实现方式中，所述第一使用对象为应用服务器AF。
在一种可能的实现方式中，所述第一网元为接入和移动性管理功能网元AMF，所述第二网元为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，当授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，第一响应还包括用于指示不允许使用的原因信息。
第三方面，本申请实施提供了一种通信方法，包括：第三网元向第一网元发送第二请求，该第二请求用于请求获取用户相关数据，该第二请求包括用户信息和第三使用范围，其中，第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间；第三网元接收第一网元发送的第二响应，该第二响应包括用户相关数据或指示信息，该指示信息用于指示获取用户相关数据失败。
在一种可能的实现方式中，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
在一种可能的实现方式中，第二响应包括指示信息时，第二响应还包括失败原因信息，以通过该失败原因信息告知第三网元具体失败原因。
在一种可能的实现方式中，所述第二请求还包括第二类型标识，该第二类型标识用于标识第三网元所请求获取用户相关数据的类型。在该实现方式中，第二类型标识用于标识用户相关数据中的第一数据或第二数据，当第三网元所请求的用户相关数据为第一数据时，该第二类型标识为事件标识；当第三网元所请求的用户相关数据为第二数据时，该第二类型标识为数据分析标识。
在一种可能的实现方式中，第三网元可以为应用服务器AF或网络功能NF网元。
第四方面，本申请实施例提供了一种通信方法，包括：终端设备接收第二网元发送的 第三请求，所述第三请求用于请求用户相关数据的授权信息，所述第三请求包括所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；终端设备根据所述第三请求确定授权信息，并向所述第二网元发送第三响应，所述第三响应包括所述授权信息。
在一种可能的实现方式中，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
第五方面，一种通信设备，包括：
发送单元，用于向第二网元发送第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求中包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象，第一使用目的，第一使用时间；
接收单元，用于接收所述第二网元发送的第一响应，所述第一响应中包括所述授权信息，所述授权信息用于指示所述用户信息对应的用户是否允许所述用户相关数据被用于所述第一使用范围。
在一种可能的实现方式中，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
在一种可能的实现方式中，所述第一请求中还包括第一类型标识，所述第一类型标识用于标识所述用户相关数据的类型，
所述第一请求用于请求用户相关数据的授权信息，包括：
所述第一请求用于请求所述第一类型标识对应的用户相关数据的授权信息。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一类型标识为事件标识，所述第一数据为所述事件标识对应的相关事件的数据。
在一种可能的实现方式中，所述第一网元为网络数据分析功能NWDAF网元，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用对象为所述网络数据分析功能NWDAF网元。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用目的包括进行数据分析。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用范围还包括数据分析标识，所述数据分析标识用于指示对所述第一数据进行数据分析以获得所述数据分析标识对应的数据分析结果。
在一种可能的实现方式中，所述第一请求还包括所述数据分析结果对应的第二使用范围，所述第二使用范围包括以下信息的至少一种：第二使用对象、第二使用目的、第二使用时间。
在一种可能的实现方式中，当所述用户相关数据为所述第二数据时，所述第一类型标 识为数据分析标识，所述第二数据是所述数据分析标识对应的数据分析结果。
在一种可能的实现方式中，所述通信设备为网络能力开放功能NEF网元，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，所述第一使用对象为应用服务器AF。
在一种可能的实现方式中，当所述通信设备为接入和移动性管理功能网元AMF时，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，所述接收单元，还用于接收第三网元发送的第二请求，所述第二请求用于请求获取用户相关数据，
所述发送单元，具体用于根据所述第二请求向所述第二网元发送所述第一请求。
在一种可能的实现方式中，所述第二请求包括用户信息和第三使用范围，所述第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间，所述设备还包括：
处理单元，用于根据所述第三使用范围获取所述第一使用范围。
在一种可能的实现方式中，所述第二请求中包括第二类型标识，所述第二类型标识用于标识所述第三网元请求的用户相关数据的类型，
处理单元，还用于根据所述第二类型标识确定第一类型标识。
在一种可能的实现方式中，所述处理单元，具体用于将所述第二数据类型标识确定为第一类型标识。
在一种可能的实现方式中，所述处理单元，具体用于根据配置信息以及第二数据类型标识确定第一类型标识，所述配置信息用于指示所述第一类型标识与所述第二数据类型标识之间的对应关系。
在一种可能的实现方式中，所述第三网元为应用服务器AF或网络功能NF网元。
第六方面，一种通信设备，所述设备包括：
接收单元，用于接收第一网元发送的第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；
处理单元，用于根据所述第一请求确定所述授权信息；
发送单元，还用于向所述第一网元发送第一响应，所述第一响应包括所述授权信息，所述授权信息用于指示所述用户信息对应的用户是否允许所述用户相关数据被用于所述第一使用范围。
在一种可能的实现方式中，所述处理单元，具体用于根据所述第一请求和保存的网络用户的授权信息是否匹配，确定所述用户信息对应的所述授权信息。
在一种可能的实现方式中，所述处理单元，具体用于根据所述第一请求通过所述收发器向所述用户信息对应的终端设备发起第三请求，所述第三请求用于向终端设备请求所述用户信息对应的所述授权信息；并通过所述收发器接收所述终端设备发送的第三响应，所 述第三响应中包括所述用户信息对应的所述授权信息。
在一种可能的实现方式中，所述处理单元，具体用于根据所述第一请求通过所述收发器向第四网元发起第四请求，所述第四请求用于向所述第四网元请求所述用户信息对应的所述授权信息；并通过所述收发器接收所述第四网元发送的第四响应，所述第四响应中包括所述用户信息对应的所述授权信息。
在一种可能的实现方式中，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
在一种可能的实现方式中，所述第一请求中还包括第一类型标识，所述第一类型标识用于指示所述用户相关数据的类型，
所述第一请求用于请求用户相关数据的授权信息，包括：
所述第一请求用户请求所述第一类型标识对应的用户相关数据的授权信息。
在一种可能的实现方式中，所述第一网元为网络数据分析功能NWDAF网元，所述通信设备为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
在一种可能的实现方式中，当所述用户相关数据为第一数据时，所述第一使用对象为所述网络数据分析功能NWDAF网元。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用目的包括进行数据分析。
在一种可能的实现方式中，当所述用户相关数据为所述第一数据时，所述第一使用范围还包括数据分析标识，所述数据分析标识用于指示对所述第一数据进行数据分析以获得所述数据分析标识对应的数据分析结果。
在一种可能的实现方式中，所述第一请求还包括所述数据分析结果对应的第二使用范围，所述第二使用范围包括以下信息的至少一种：第二使用对象、第二使用目的、第二使用时间。
在一种可能的实现方式中，当所述用户数据为所述第二数据时，所述第一类型标识为数据分析标识。
在一种可能的实现方式中，所述第一网元为网络能力开放功能NEF网元，所述通信设备为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF或终端设备。
在一种可能的实现方式中，所述第一使用对象为应用服务器AF。
在一种可能的实现方式中，所述第一网元为接入和移动性管理功能网元AMF，所述通信设备为统一数据管理UDM网元或用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
第七方面，提供了一种通信设备，包括处理器。该处理器与存储器耦合，可用于执行第一方面至第四方面任一方面，以及第一方面至第四方面中任一种可能实现方式中的方法。可选地，该通信设备还包括存储器。可选地，该通信设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信设备为终端设备。当该通信设备为终端设备时，所述通信接口可以是收发器，或，输入/输出接口。可选地，所述收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
在另一种实现方式中，该通信设备为网络设备。当该通信设备为网络设备时，比如上述第一网元、第二网元、第三网元、第四网元中的任一项或任多项等，所述通信接口可以是收发器，或，输入/输出接口。可选地，所述收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
在又一种实现方式中，该通信设备为芯片或芯片系统。当该通信设备为芯片或芯片系统时，所述通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
第八方面，提供了一种系统，系统包括上述终端设备和网络设备。本申请实施例中的网络设备是指网络侧的网元，比如上述第一网元、第二网元、第三网元、第四网元等均可以称为网络设备。本申请实施例中的网络设备可以是指第一网元、第二网元、第三网元、第四网元中的任一项或任多项。
第九方面，提供了一种计算机程序产品，计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当计算机程序被运行时，使得计算机执行上述第一方面中任一种可能实现方式中的方法，或者使得计算机执行上述第一方面至第四方面任一种实现方式中的方法。
第十方面，提供了一种计算机可读存储介质，计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一方面中任一种可能实现方式中的方法，或者使得计算机执行上述第一方面至第四方面任一种实现方式中的方法。
附图说明
图1为本申请实施例提供的一种通信系统架构图；
图2为本申请实施例提供的一种通信方法流程图；
图3为本申请实施例提供的另一种通信方法流程图；
图4为本申请实施例提供的另一种通信方法流程图；
图5为本申请实施例提供的一种通信设备结构示意图；
图6为本申请实施例提供的另一种通信设备结构示意图；
图7为本申请实施例提供的另一种通信设备结构示意图。
具体实施方式
在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B。本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。在本申请的描述中，除非另有说明，“至少一个”是指一个或多个，“多个”是指两个或多于 两个。
另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
其中，本申请实施例的技术方案可以应用于第四代(4th Generation，4G)系统、基于4G系统演进的各种系统、第五代(5th Generation，5G)系统、基于5G系统演进的各种系统中。其中，4G系统也可以称为演进分组系统(evolved packet system，EPS)。4G系统的核心网(core network，CN)可以称为演进分组核心网(evolved packet core，EPC)，接入网可以称为长期演进(long term evolution，LTE)。5G系统的核心网可以称为5GC(5G core)，接入网可以称为新无线(new radio，NR)。为了方便描述，下文中以本申请应用于5G系统为例对本申请作示例性说明。在本申请应用于4G系统或其他的通信系统中时，将本申请涉及到的网元替换为相应通信系统中具有相同或相似功能的网元即可。
图1示例性的示出了基于服务化接口的5G系统的一种网络架构示意图。在该示意图中，5G系统可以包括：鉴权服务器功能(authentication server function，AUSF)网元、接入和移动性管理功能(access and mobility management function，AMF)网元、数据网络(data network，DN)、统一数据管理(unified data management，UDM)网元、用户数据库(user data repository，UDR)、策略控制功能(policy control function，PCF)网元、(无线)接入网((radio)access network，(R)AN)网元、用户面功能(user plane function，UPF)网元、终端(terminal)、应用功能(application function，AF)网元、会话管理功能(session management function，SMF)网元、绑定支持功能(binding support function，BSF)网元、网络数据分析功能(network data analytics function，NWDAF)网元、网络开放功能(network exposure function，NEF)网元、网络存储功能(network repository function，NRF)网元。
为方便描述，在下文中将(R)AN网元、AMF网元、SMF网元、UDM网元、UDR网元、AUSF网元、UPF网元、PCF网元、BSF网元、NWDAF网元、NRF网元、NEF网元等分别通过RAN、AMF、SMF、UDM、UDR、AUSF、UPF、PCF、BSF、NWDAF、NRF、NEF等指代。
5G系统分为接入网和核心网两部分。接入网用于实现无线接入有关的功能，主要包括RAN。核心网用于网络业务的控制、数据的传输等，核心网由多个网元组成，主要包括：AMF、SMF、UPF、PCF、UDM等。
图1中部分网元的功能如下：
PCF，负责向AMF、SMF提供策略，如服务质量(quality of service，QoS)策略、切片选择策略等。
UDM，用于处理第三代合作伙伴计划(3rd generation partnership project，3GPP)的认证和密钥协商(authentication and key agreement，AKA)、认证凭据，用户识别处理，访问授权，注册/移动性管理，订购管理，短信管理等。在本申请中，UDM可提供存储当前为终端服务的网元(服务NF(serving NF)，例如，服务AMF(serving AMF)、服务SMF (serving SMF)、服务NWDAF(serving NWDAF)等)信息的功能。
UDR，作为存储用户数据的逻辑存储库，实现用户相关数据的共享和发放。
AUSF，为网络提供用户的认证鉴权服务。
AF，可以是应用服务器，其可以属于运营商，也可以属于第三方。主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。
NEF，用于提供网络能力开放的定制功能，还支持对第三方AF的认证鉴权功能。
AMF，主要负责信令处理部分，例如，终端的注册管理、终端的连接管理、终端的可达性管理、终端的接入授权和接入鉴权、终端的安全功能，终端的移动性管理(如终端位置更新、终端注册网络、终端切换等)，网络切片(network slice)选择，SMF选择，终端的注册或去注册等功能。
SMF，主要负责终端会话管理的所有控制面功能，包括UPF的选择、控制以及重定向，网络互连协议(internet protocol，IP)地址分配及管理，会话的QoS管理，从PCF获取策略与计费控制(policy and charging control，PCC)策略，承载或会话的建立、修改以及释放等。
UPF，作为协议数据单元(protocol data unit，PDU)会话连接的锚定点，负责对终端的数据报文过滤、数据传输/转发、速率控制、生成计费信息、用户面QoS处理、上行传输认证、传输等级验证、下行数据包缓存及下行数据通知触发等。UPF还可以作为多宿主(multi-homed)PDU会话的分支点。UPF中为终端提供服务的传输资源和调度功能由SMF进行管理控制。
NRF，一种网元属性、网元状态、网络拓扑关系等信息的存储网元，其具备网元发现功能、网元管理功能。
BSF，具备为PDU会话绑定或存储对应的终端地址、终端标识、数据网络名称(data network name，DNN)、单一网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI)、PCF实例、PCF集标识的功能。例如，可以从BSF中查询出终端对应的PCF。
NWDAF，具备以下至少一种功能：数据收集功能、数据分析功能、。其中，数据收集功能是指用于收集来自网络网元、第三方业务服务器、终端或网管系统中的相关数据；数据分析功能是指基于相关输入数据做分析训练，并向网络网元、第三方业务服务器、提供终端或网管系统提供数据分析结果，该分析结果可协助网络选择业务的服务质量参数，或协助网络执行流量路由，或协助网络选择背景流量传输策略等。本申请中主要涉及的是NWDAF的数据收集功能，因NWDAF只有基于收集的数据才能做相关的训练、分析功能，所以其前提是能够收集和获取相关的数据。在一种可能的实现方式中，NWDAF网元可以与其他NF合设，或NWDAF独立部署。并且网络中可以部署多个NWDAF。
RAN，由一个或多个接入网设备(也可以称为RAN节点或网络设备)组成的网络，实现无线物理层功能、资源调度和无线资源管理、无线接入控制以及移动性管理功能，服务质量管理，数据压缩和加密等功能。接入网设备通过用户面接口N3和UPF相连，用于 传送终端的数据。接入网设备通过控制面接口N2和AMF建立控制面信令连接，用于实现无线接入承载控制等功能。
接入网设备，可以为基站、无线保真(wireless fidelity，WiFi)接入点(access point，AP)、全球微波接入互操作性(worldwide interoperability for microwave access，WiMAX)站点等。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。具体可以为：无线局域网(wireless local area network，WLAN)中的AP，全球移动通信系统(global system for mobile communications，GSM)或码分多址接入(code division multiple access，CDMA)中的基站(base transceiver station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)中的基站(NodeB，NB)，还可以是LTE中的演进型基站(evolved node B，eNB或eNodeB)，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G系统中的下一代节点B(the next generation node B，gNB)或者未来演进的公用陆地移动网(public land mobile network，PLMN)网络中的基站等。
终端可以是无线终端，或者，也可以是有线终端。无线终端可以是指向用户提供语音和/或数据连通性的设备，具有无线连接功能的手持式设备或连接到无线调制解调器的其他处理设备。终端与接入网设备之间采用某种空口技术(如NR技术或LTE技术)相互通信。终端与终端之间也可以采用某种空口技术(如NR技术或LTE技术)相互通信。无线终端可以经接入网设备与一个或多个核心网设备通信，如与AMF、SMF等进行通信。无线终端可以是移动终端，如移动电话(或称为“蜂窝”电话)、智能电话、卫星无线设备、无线调制解调器卡以及具有移动终端的计算机，例如，可以是膝上型、便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与接入网设备交换语音和/或数据。示例性的，无线终端可以为个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、虚拟现实(virtual reality，VR)眼镜、增强现实(augmented reality，AR)眼镜、机器类型通信终端、物联网终端等设备。在车联网通信中，车辆上装载的通信设备是一种终端，路边单元(road side unit，RSU)也可以作为一种终端。无人机上装载的通信设备，也可以看做是一种终端。无线终端也可以称为用户设备(user equipment，UE)、终端设备、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile)、远程站(remote station)、接入点(access point)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)等。
DN指的是为用户提供数据传输服务的运营商网络，如网络互连协议多媒体业务(IP multi-media service，IMS)、互联网(Internet)等。终端通过建立终端到接入网设备到UPF到DN之间的PDU会话(PDU session)，访问DN。
可以理解的是，除图1所示功能网元之外，5G网络的网络架构还可以包括其他功能网元。在本申请实施例中，网元也可以称为实体或设备等。
需要说明的是，图1中的RAN、AMF、SMF、AUSF、UDM、UPF、PCF、BSF、 NWDAF、NRF、NEF等仅是一个名字，名字对网元本身不构成限定。在5G系统以及未来其它的网络中，这些网元所对应的实体或设备也可以是其他的名字，本申请实施例对此不作具体限定。例如，UDM还有可能被替换为用户归属服务器(home subscriber server，HSS)或者用户签约数据库(user subscription database，USD)或者数据库网元，等等，在此进行统一说明，以下不再赘述。
在上述5G系统的网络架构中，NWDAF网元是在3GPP版本15(Release15，R15)开始引入的，目的是为了获取终端，网络(例如，RAN，CN，传输网(transmission network，TN)等)，AF，操作、管理和维护(operation,administration and maintenance，OAM)等各个域的相关数据，并基于获取的大量数据利用机器学习方法做训练分析工作，生成分析结果，该分析结果可用于辅助网络的策略制定和执行。例如，NWDAF基于从网络获取的数据和从AF获取的数据生成业务体验分析结果，该业务体验分析结果可有助于PCF制定与终端业务相关的PCC和QoS策略。
通信网络中可以同时部署多个NWDAF，从一种维度来说，不同的NWDAF负责不同目的的分析工作，例如有些NWDAF负责终端的移动轨迹的分析，有些NWDAF负责业务体验的分析，有的NWDAF负责终端行为异常的分析；从另一种维度来说，不同的NWDAF负责不同的服务区域，例如有些NWDAF负责区域1的数据分析工作，另一个NWDAF负责区域2的数据分析工作。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能的实例、或上述功能中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
需要说明的是，本申请实施例并不限定于上述的系统架构，还可以应用于未来其它的通信系统，例如第六代通信(the 6th generation，6G)系统架构等。并且，本申请实施例上述所使用的各个网元的名称，在未来通信系统中，可能保持功能相同，但名称会改变。
本申请实施例中的用户可以是使用某终端设备在网络中进行通信业务的人或物，另外，用户也可以是终端设备本身，例如物联网的终端设备。本申请实施例中的用户信息用于标识用户，其表现形式不限，只要能起到识别和区分用户的作用即可。用户信息可以是国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI),用户永久标识(subscription permanent identifier，SUPI)，一般公共订阅标识符(generic public subscription identifier，GPSI),用户网际协议(Internet Protocol，IP)过滤器/五元组(UE IP filter/5-tuple)，移动台国际ISDN号码(mobile station international ISDN number，MSISDN)，国际移动设备识别码(International Mobile Equipment Identification Number，IMEI)等。用户信息还可以是用户所在区域的标识、所述用户的标识、所述用户所在用户群组的标识、所述用户对应的网络切片的标识、所述用户所在数据网络名称DNN和所述用户所属的网元的标识。
用户的相关数据属于GDPR所保护的用户级数据。本申请实施例中用户相关数据可以 包括以下第一数据、第二数据中的一种或多种：第一数据包括原始数据和/或处理数据，其中，原始数据包括终端设备、应用服务器或网络设备针对用户所产生的数据。这些数据可以是已经上报至运营商网络的数据。
其中，终端设备针对用户所产生的数据可以包括以下数据的一种或多种：所述用户在终端设备上产生的数据,终端设备本身的数据，终端设备针对所述用户产生的数据。例如，用户在终端设备上产生的数据比如可以是终端设备的全球定位系统(Global Positioning System，GPS)信息、用户在终端设备上输入习惯等等。用户使用的终端设备本身的数据比如可以是该终端设备的型号批准码(type approval code，TAC)，内存容量，CPU型号等。终端设备针对所述用户产生的数据比如可以是终端设备分配给用户的端口号、分配给用户的存储空间等。
应用服务器对用户所产生的数据，可以描述为用户对应的应用层数据。本申请实施例中用户的应用层数据包括以下数据中的一种或多种：用户在应用服务器中产生的数据；用户对应的应用服务器本身的数据；应用服务器针对用户产生的数据。其中，用户在应用服务器中产生的数据比如可以是用户使用的业务类型、用户业务对应的IP五元组信息等；用户对应的应用服务器本身的数据可以是该应用服务器能提供的业务类型、每种业务类型对应的IP地址和端口号、每种业务的基本功能等、应用服务器自身的存储空间等；应用服务器针对用户产生的数据比如可以是业务服务器为用户分配的应用层标识信息、为用户的业务分配的业务要求、用户的业务质量信息等。
网络设备对用户产生的数据，可以包括以下数据中的一种或多种：用户在接入网和/或核心网中产生的数据；用户所对应的接入网和/或核心网本身的数据；接入网和/或核心网针对所述用户产生的数据。其中，用户在接入网和/或核心网中产生的数据比如可以是用户的位置信息(如小区标识或TA标识)或用户请求接入的网络切片信息等；用户所对应的接入网和/或核心网本身的数据比如可以是接入网的小区容量或AMF的负载信息或UPF的带宽信息等；接入网和/或核心网针对所述用户产生的数据比如可以是接入网为用户的业务所分配带宽或核心网AMF为用户所选择的切片信息或PCF为用户的业务所定制的QoS策略信息等。具体来说，本申请实施例中用户的网络数据包括用户对应的接入网数据。或者，本申请实施例中用户的网络数据包括用户对应的核心网数据。或者，本申请实施例中用户的网络数据包括用户对应的接入网和核心网数据。接入网也可以描述为通信运营商的接入网，核心网也可以描述为通信运营商的核心网。
处理数据是指对原始数据进行相应处理后产生的数据，例如，经过聚合处理(多个UE的数据加权、单个UE在一段时间内的数据平均)，或者匿名化处理(去除UE的标识信息)等。
具体地，为区分第一数据中的不同数据，可以使用数据类型或事件标识来区分第一数据中不同的数据。例如，用data type或event ID。如data type＝UE所在小区位置的参考信号接收功率(reference signal receiving power，RSRP)，又如event ID＝UE location。
第二数据是指基于第一数据进行数据分析而获取的数据分析结果，例如NWDAF产生的UE移动信息分析结果、UE异常行为分析结果、UE业务行为分析结果。具体地，为区分 不同的数据分析结果，可以采用数据分析标识analytics ID来进行标识。
本实施例中的第一网元作为授权信息的请求，可以仅请求获取授权信息；第一网元也可以同时作为数据请求方，在请求授权信息时，请求获取用户相关数据。其中，第一网元可以为NWDAF网元，也可以为其它需要获取用户相关数据的网元，例如NEF网元、AMF网元、AF网元等。第一网元在请求用户相关数据的授权信息时，在发送的请求中可以包括使用范围，其中，使用范围可以包括使用对象、使用目的、使用时间等信息。其中，使用对象用于指示所获取的用户相关数据将被使用的对象，该对象的表现形式存在多种，如公共陆地移动网(public land mobile network，PLMN)标识、网络域(核心网域、RAN域、OAM域)、NF网元类型(AMF类型、SMF类型)、NF网元实例标识、AF类型、AF实例标识或应用程序application标识。例如，当对象为核心网域时，表明使用对象为整个核心网的网元。
使用目的用于指示用户相关数据将被使用的目的，也就是指用户相关数据将作何使用。其中，使用目的可以根据所获取的用户相关数据中的具体数据进行不同的定义。例如，当所请求的数据为第一数据时，使用目的可以为获取数据分析结果或者为开放给第三方AF使用，也可以进一步限定具体获取的是哪种数据分析结果，如获取用户的移动轨迹分析结果。当所请求的数据为第二数据时，使用目的可以为开放给第三方AF使用，也可以进一步限定开放给第三方AF的具体用途，例如进行疫情监控、业务应用层参数调整、寻呼区域优化等。
使用时间用于指示使用对象使用用户相关数据的时间，可以包括时间段和/或时长。例如，使用对象在获取用户相关数据后在2020年1月1日-12月31日时间段使用，或使用对象在获取用户相关数据后，自获取时间起将使用6个月。
本申请实施例中第二网元用于获取、保存、处理用户相关数据的授权信息。该第二网元可以是数据管理UDM网元或数据存储库(UDR网元、鉴权服务功能AUSF网元、网络能力开放功能NEF网元、终端设备等。在未来通信系统中，第二网元仍可以是UDM网元、UDR网元，或者，还可以有其它的名称，本申请不做限定。
本申请实施例中，第二网元可以通过以下方式获取用户相关数据的授权信息：
一种是，第二网元通过动态获取的方式来获取用户相关数据的授权信息，具体包括：终端设备在入网初始注册或移动性注册流程时，触发上报用户的授权信息给网络侧的网元(如AMF)，该网元再将用户的授权信息保存到第二网元(如UDM)中。或者。终端设备在发起PDU回话建立或流程修改时，触发上报用户的授权信息给网络侧的网元(如SMF)，再由该网元将授权信息保存至第二网元(如UDM)中。或者是，第二网元因触发条件(其它网元向第二网元查询)而向用户的终端设备询问用户的授权信息，终端设备将授权信息发送给第二网元，从而使得第二网元存储用户的授权信息。
另一种是，第二网元通过静态配置的方式获取，具体可以为，用户在入网前的开户阶段，通过终端设备将授权信息作为签约信息保存至第二网元中。当用户的授权信息发生改变时，则更新第二网元中的签约信息，从而实现授权信息的更新。
其中，授权信息可以包括用户信息(标识用户)、数据类型(如第一数据、第二数据)、 使用范围(使用对象、使用目的、使用时间)、授权状态信息(是、否、未知等)。当第二网元接收到多个用户的终端设备发送的授权信息时，针对每个用户保存该用户所对应的授权信息。通过授权信息所包括的内容可以获知哪些数据允许被使用、允许哪些对象使用、允许被使用的目的、允许使用的时间等。具体地，第二网元在获取到用户的授权信息后，可以将用户的授权信息作为用户的签约信息进行保存，同时保存签约信息与用户标识的对应关系；也可以将用户的授权信息作为用户的上下文信息进行保存，同时保存上下文信息与用户标识的对应关系。
本实施例中的用户相关数据的授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于所请求的使用范围。具体可以存在多种选择，例如，授权信息可以为：“是”、“否”和“未知”中的任一项。授权信息为“是”，则指示允许使用用户相关数据。授权信息为“否”时，则指示不允许使用用户相关数据。授权信息为“未知”，则指示用户关于是否允许使用用户相关数据的态度尚不明确，即当前不确定用户是否允许使用用户相关数据，这种情况下可以理解为用户未授权，即未允许使用用户相关数据。结合上面用户相关数据的多种情况，本申请实施例中的授权信息可以用于指示：是否允许使用第一数据、是否允许使用第二数据、是否允许使用第一数据中的某一数据或某些数据、是否允许使用第二数据中的某一数据或某些数据等中的任一项或多项。例如，授权信息指示允许使用第一数据。再比如，授权信息指示允许使用第一数据，但不允许使用第二数据。再例如，授权信息用于指示允许使用第一数据中的数据a1，但不允许使用第一数据中的数据a2。再例如，授权信息用于指示不允许使用第一数据，允许使用第二数据中的数据b1，不允许使用第二数据中的数据b2。
例如，表1示例性示出一种用户相关数据的授权信息的表现形式，以表1中的第一行和第三行为例进行说明。如第一行所示，数据请求方请求的用户相关数据为第一数据中event ID1对应的数据，用户的标识为ID1，对应的使用范围包括使用对象为NWDAF类型的网元、使用目的是进行analytics ID1分析，使用时间为UE在网注册期间，授权信息为“是”，则第一行表示：ID1用户允许event ID1对应的数据被使用于使用对象为NWDAF类型的网元、使用目的为进行Analytics ID1对应的数据分析、使用时间为UE在网注册期间对应的使用范围。如第三行所示，用户相关数据为第二数据中Analytics ID1对应的数据，用户的标识为ID1，使用对象为AF实例ID，使用目的为疫情监控，使用时间为2020.1.1-12.30，授权信息为“否”，则第三行表示：ID1的用户不允许Analytics ID1对应的数据被使用于使用对象为AF实例ID、使用目的为疫情监控、使用时间为2020.1.1-12.30对应的使用范围。
表1用户的授权信息的表现形式
Figure PCTCN2020107538-appb-000001
Figure PCTCN2020107538-appb-000002
针对第一数据，授权信息还可以用于指示：是否允许使用用户对应的终端设备数据、是否允许使用用户的网络数据以及是否允许使用所述用户对应的应用服务器数据中的任一项或任多项。比如，授权信息指示允许使用用户对应的终端设备数据。再比如，授权信息指示允许使用用户对应的终端设备数据，但不允许使用用户的网络数据。再比如，授权信息指示允许使用用户对应的终端设备数据，允许使用用户的网络数据，但不允许使用所述用户对应的应用服务器数据。
本实施例中授权信息还可以包括其他限定信息，该其他限定信息用于限定用户相关数据。其他限定信息包括以下内容中的任一项或任多项：时间信息、位置信息、业务类型、数据网络名称(data network name，DNN)信息、业务标识和网络切片信息。其中，网络切片信息可以是网络切片标识信息，如网络切片选择辅助信息(Network Slice Selection Assistance Information，NSSAI)，单一-网络切片选择辅助信息(single-Network Slice Selection Assistance Information，S-NSSAI)，网络分片实例(network slice instance，NSI)标识，网络分片子网实例(Network Slice Subnet Instance，NSSI)标识等。比如限定信息为预设时间段和预设位置范围，则授权信息用于指示在该预设时间段和预设位置范围内产生的用户相关数据是否允许被使用。需要说明的时，本实施例中的时间信息标识、位置信息、业务类型、DNN信息等均是指示产生用户相关数据时对应的时间，区域，业务，DNN等信息。
在本实施例中：若按位置信息、时间信息、业务类型、业务标识、DNN、网络切片信息等限定信息对用户相关数据的授权信息进行划分，按照上述实现方式，用户可以是一次性上报其所有区域、所有时间、所有业务类型、所有业务标识、所有DNN、所有切片对应的授权信息。也可以分次上报不同区域、不同时间、不同业务类型、不同DNN、不同切片对应的授权信息。
基于上述内容，为便于理解本申请实施例的具体实现，下面将结合附图进行说明。
参见图2，该图为本申请实施例提供的一种通信方法的流程图，如图2所示，该方法可以包括：
S201：第一网元向第二网元发送第一请求。
本实施例中，第二网元为获取用户相关数据的授权信息，可以向第二网元发送第一请求，该第一请求用于请求用户相关数据的授权信息。其中，第一请求中可以包括用户信息和用户信息对应的数据的第一使用范围。
第一使用范围可以包括第一使用对象、第一使用目的以及第一使用时间中的一种或多种。其中，第一使用对象是指使用所述用户相关数据的对象、第一使用目的是指使用所述用户相关数据的具体目的、第一使用时间是指使用所述用户相关数据的时间。其中，第一使用时间可以包括使用时长和/或具体使用时间段。
其中，第二网元可以为UDM、UDR、AUSF、NEF等网元以及终端设备，为便于理解，将以第二网元为UDM为例进行说明。可以在UDM存储的用户签约信息中存储用户相关数据 的授权信息，例如，用户在进行签约时，可以对用户的授权信息进行设置，将授权信息作为签约信息的一部分，存储在UDM中。第一网元通过服务化接口调用UDM提供的Nudm SDM Get服务以获取用户的签约信息。
具体地，第一网元可以一次只向UDM获取一个用户的授权信息，此种场景下，第一网元仅向UDM提供一个用户的标识，相应地，UDM一次仅向第一网元反馈一个用户的授权信息。另一种实施方式中，第一网元也可以一次向UDM获取多个用户的授权信息，此种场景下，第一网元向UDM提供能够指示出多个用户的标识的信息。该用户的标识可以是用户群组标识、或者多个用户所在区域标识、网元标识、网络切片标识、DNN等。相应地，UDM一次向第一网元反馈多个用户的授权信息。
在一些实现中，第一请求还可以包括第一类型标识，该第一类型标识用于标识用户相关数据的类型，则第一请求用于请求第一类型标识对应的用户相关数据的授权信息。具体地，第一类型标识用于标识用户相关数据中的第一数据和第二数据。当用户相关数据为第一数据时，第一类型标识可以为事件标识，第一数据为该事件标识对应的事件相关的数据。当用户相关数据为第二数据时，第一类型标识可以为数据分析标识，第二数据为数据分析标识对应的数据分析结果。
在一些实现方式中，第一请求中还可以包括过滤条件，则第一请求用于请求获取满足过滤条件的用户的授权信息，其中，过滤条件可以包括以下内容中的任一项或任多项：时间信息、位置信息、业务类型、数据网络名称DNN信息、网络切片信息。本实施例中，时间信息用于指示产生用户相关数据的时间、位置信息用于指示产生用户相关数据的位置、业务类型用于指示产生用户相关数据的业务、数据网络名称DNN信息用于指示产生用户相关数据的DNN信息、网络切片信息用于指示产生用户相关数据的切片信息。
其中，第一网元向第二网元发送第一请求以请求用户的授权信息的触发条件可以为第一网元自身的需求，主动向第二网元发送第一请求，也可以为第一网元在接收到第三网元(如AF、NF等)发送的第二请求后，第一网元根据第二请求向第二网元发送第一请求。其中，第二请求用于请求获取用户相关数据。也就是，第一网元向第二网元发送第一请求的触发条件是接收了第三网元所发送的第二请求，在该情况下，第一网元根据第二请求生成第一请求，并向第二网元发送第一请求。
其中，第二请求中可以包括用户信息以及第二类型标识，该第二类型标识用于标识第三网元所请求的用户相关数据的类型，该第二类型标识可以标识用户相关数据中的第一数据和/或第二数据。第二请求还可以包括第三使用范围，该第三使用范围可以包括以下信息中的一种或多种：第三使用对象、第三使用目的以及第三使用时间等。第一网元在接收到第三网元发送的第二请求后，根据第二请求中所包括的信息生成第一请求。具体地，第一网元根据第三使用范围获取第一使用范围；第一网元根据第二类型标识确定第一类型标识。其中，第一网元根据第三使用范围获取第一使用范围，可以包括第一网元直接将第三使用范围确定为第一使用范围，或者，第一网元根据第三使用范围以及配置信息获得第一使用范围。其中，配置信息用于指示第三使用范围到第一使用范围之间的映射关系。同时，第一网元根据第二类型标识确定第一类型标识，可以包括第一网元直接将第二类型标识确定 为第一类型标识，或者，第一网元根据第二类型标识以及配置信息获得第一类型标识，其中，配置信息用于标识第一类型标识与第二类型标识之间的映射关系。例如，第三网元请求的用户相关数据为第一数据中某事件标识对应的数据时，则第二类型标识为event ID，若第一网元欲向第二网元请求该event ID对应的授权信息事，则第一网元可将该event ID确定为第一类型标识。又如，第三网元请求的用户相关数据为第二数据中的某一数据分析结果，则第二类型标识为数据分析标识analytic ID，若第一网元欲向第二网元请求该analytic ID对应的授权信息时，则第二网元将analytic ID确定为第一类型标识。又如，第三网元请求的用户相关数据为第二数据中的某一数据分析结果，则第二类型标识为数据分析标识analytic ID，则第一网元需要根据该数据分析标识以及配置信息确定该数据分析标识对应的第一数据的事件标识，则第一类型标识为事件标识。其中，事件标识可以用event ID或data type来表示。S203：第二网元向第一网元发送第一响应。
本实施例中，当第二网元接收到第一网元发送的第一请求时，可以根据第一请求获取对应的用户相关数据的授权信息，以通过第一响应将所述授权信息发送给第一网元，从而使得第一网元获取用户的授权信息。其中，授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于第一使用范围。例如，授权信息用于指示用户信息对应的用户是否允许用户相关数据被第一使用对象所使用、是否允许用户相关数据被用于第一使用目的、是否允许用户相关数据在第一使用时间被使用等。
其中，第二网元可以直接将第一响应发送给第一网元，也可以通过其它中间网元向第一网元发送第一响应。
在发送第一响应之前，第二网元还可以执行步骤S202。
S202，第二网元根据第一请求确定用户的授权信息。
其中，第二网元根据第一请求确定用户的授权信息可以通过以下多种方式实现：
一种是，第二网元根据第一请求和保存的网络用户的授权信息是否匹配，确定用户信息对应的授权信息。该实现方式中，第二网元可以预先存储网络中用户的授权信息，当接收到第一网元发送的第一请求时，可以根据第一请求中的用户信息以及预先存储的网络中用户的授权信息进行匹配，如果预先存储的网络中用户的授权信息中存在所述用户信息对应的用户的授权信息，则确定用户的授权信息。具体地，第二网元根据第一请求中的第一使用范围所包括的每项内容进行一一匹配，并根据每一项的匹配结果来确定授权信息。例如，当第一使用范围仅包括第一使用对象时，则将该第一使用对象与网络用户的授权信息中的使用对象进行匹配，如果二者匹配，则确定授权信息为允许用户相关数据被用于第一使用范围；如果二者不匹配，则确定授权信息为不允许用户相关数据被用于第一使用范围。再例如，当第一使用范围包括第一使用对象和第一使用时间时，则将第一使用对象与网络用户的授权信息中的使用对象进行匹配，获得第一结果；同时，将第一使用时间与网络用户的授权信息中的使用时间进行匹配，获得第二结果。当第一结果和第二结果均为匹配时，则确定授权信息为允许用户相关数据被用于第一使用范围；当第一结果或第二结果为不匹配时，则确定授权信息为不允许用户相关数据被用于第一使用范围。
另一种，第二网元在接收到第一网元发送的第一请求后，通过第一请求中的用户信息 确定该用户信息对应的终端设备。第二网元根据第一请求向该终端设备发送第三请求，该第三请求用于向用终端设备请求用户信息对应的授权信息。终端设备在接收到第三请求后，向第二网元发送第三响应，该第三响应中包括用户信息对应的授权信息。
再一种是，第二网元在接收到第一网元发送的第一请求后，根据第一请求向第四网元发送第四请求，该第四请求用于请求用户信息对应的授权信息。第四网元在接收到第四请求后，根据该第四请求确定用户信息对应的授权信息，并向第二网元发送第四响应，该第四响应中包括用户信息对应的授权信息。在该实现方式中，第四网元可以预先存储用户的授权信息。此部分相关内容与前述内容类似，在此不再赘述。其中，第四网元可以为AF、UE等。其中，第二网元可以直接向第四网元发送第四请求，也可以经过其它网元向第四网元发送第四请求。例如，当第四网元为AF网元时，第二网元经过NEF网元向第四网元发送第四请求。
步骤S203之后，所述方法还可以包括以下步骤：
S204：若授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围，则第一网元获取用户相关数据。
本实施例中，当第一网元从第二网元所接收的第一响应中授权信息用于指示允许用户信息对应用户的用户相关数据被用于第一使用范围，则第一网元可以获取用户相关数据。
在一些实现方式中，当第一网元向第二网元发送的第一请求的触发条件为第三网元向第一网元发送第二请求时，当授权信息指示允许用户信息对应的用户相关数据被用于第一使用范围时，第一网元可以向第三网元发送第二响应，该第二响应包括用户相关数据，从而使得第三网元获取用户相关数据。
具体地，当第三网元请求的用户相关数据为第一数据时，第一网元在获取到用户相关数据时，可以将该用户相关数据发送给第三网元。当第三网元请求的用户相关数据为第二数据时，在一种实现方式中，若第一网元从其他具备数据分析功能的网元获取该第二数据，再将第二数据发送给第三网元；在另一种实现方式中，若第一网元本身就具备数据分析功能，则第一网元也可以首先获取该第二数据对应的第一数据，对该第一数据进行数据分析获取对应的第二数据，再将第二数据发送给第三网元。在该实现方式中，第三网元可以为应用服务器AF或网络功能NF网元或网管系统网元或终端设备等。
在一些实现方式中，当授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，则第一响应还可以包括指示不允许使用的原因信息。其中，原因信息用于指示某一数据或某些数据不允许被使用的原因，例如，数据类型不在UE授权范围内、使用对象不在UE授权范围内、使用目的非法、使用时间不在UE授权范围内等。
通过上述步骤可知，第一网元在获取用户相关数据之前，预先获取用户的授权信息，当用户相关数据允许被使用时，第一网元才会获取用户相关数据，从而实现禁止用户相关数据被随意获取，实现对用户相关数据的保护。
在一些实现方式中，第一网元获取用户相关数据可以分为以下实现方式，一种是，当用户相关数据为第一数据时，第一请求中可以包括事件标识(如event ID)，以通过数据标识来标识具体所想要获取的数据类别。第一网元向第五网元发送第五请求，第五请求包括 事件标识；第一网元接收第五网元发送的第五响应，其中，第五响应中包括事件标识对应的第一数据。也就是，第一网元通过向第五网元发送第五请求的方式获取用户相关数据。其中，第五网元为第一网元想要获取的用户相关数据所在的网元。例如，第五网元可以为NF、AF、UE、OAM等。
另一种是，当用户相关数据为第二数据时，第一请求中可以包括数据分析标识(如analytics ID)，该数据分析标识用于标识第一网元想要获取的具体数据分析结果的类别。由于第二数据是基于第一数据进行数据分析获得的数据，第一网元在获取第二数据之前，可以先获取第二数据对应的第一数据。具体地，第一网元根据第二数据对应的数据分析标识确定第一数据对应的事件标识(如event ID)；第一网元根据事件标识获取第一数据；第一网元根据第一数据生成用户相关数据。在该实现方式中，第一网元获取第一数据可以存在以下方式，比如可以预先存储在第一网元上的，也可以是向其它网元，其中，其它网元可以为NF、AF、UE、OAM等。
在一些实现方式中，当第一网元所获取的用户相关数据的授权信息为第一数据对应的授权信息时，则第一使用范围中的第一使用目的可以为进行数据分析，也就是说明第一数据将用于进行数据分析。进一步地，第一使用范围还可以包括事件标识，第一数据为该事件标识对应的事件相关的数据。进一步地，在第一使用目的为进行数据分析时，第一使用范围还可以包括数据分析标识，该数据分析标识用于指示对第一数据进行数据分析以获得该数据分析标识对应的数据分析结果。例如，事件标识event ID＝用户位置数据，数据分析标识analytics ID＝用户的移动性分析，则指示对用户位置数据进行数据分析，以获得用户的移动性分析结果。
进一步地，第一请求还可以包括第二使用范围，该第二使用范围包括以下信息中的至少一种：第二使用对象、第二使用目的、第二使用时间等。其中，第二使用对象用于指示数据分析结果将被使用的对象，第二使用目的用于指示数据分析结果将被使用的目的，第二使用时间用于指示数据分析结果将被使用的时间。例如，数据分析结果为用户的移动性分析结果，则第二使用对象用于指示用户的移动性分析结果将被使用的对象，如AF、AMF网元，第二使用目的用于指示用户的移动性分析结果将被使用的目的，如疫情监控、寻呼区域优化等，第二使用时间用于指示用户的移动性分析结果将被使用的时间，如2020.1.1-12.30。
在一些实现方式中，当第一网元为网络数据分析功能NWDAF网元时，第二网元可以为统一数据管理UDM网元、统一用户数据库UDR、鉴权服务功能AUSF网元、终端设备。
在一些实现方式中，当第一网元为网络能能力开放功能NEF网元时，第二网元为统一数据管理UDM网元、统一数据库UDR网元、鉴权服务功能AUSF网元或中断设备。
在一些实现方式中，当第一网元为接入和移动性管理功能网元AMF时，第二网元为统一管理UDM网元、统一用户数据库UDR网元、鉴权服务功能AUSF网元或终端设备。
在一些实现方式中，当第一网元为应用功能AF网元时，第二网元为网络能力开放功能NEF网元。
需要说明的是，无论第一网元和第二网元具体为哪些网元，均可以按照图2所示的实 施例来获取用户相关数据的授权信息。
需要注意的是，上述图2所提供的方法实施例中并不是每个步骤都是必选的。上述图2所提供的方法实施例中的一些步骤是可选地，比如上述图2中的S202和S204。
为便于理解上述流程，下面将以第三方AF(第三网元)向NWDAF(第一网元)请求用户的某一数据分析结果，以及NWDAF向UDM查询授权信息为例进行说明。
参见图3，该图为本申请实施例提供的另一种通信方法流程图。本申请实施例与图2实施例相同的内容具体可以参见图2所述实施例的描述。如图3所示，该方法可以包括：
S301：第三网元向第一网元发送第二请求，该第二请求中用于请求获取用户相关数据。
本实施例中，当第三网元想要获取第二数据时，可以向第一网元发送第二请求，该第二请求中第二类型标识可以为具体的数据分析标识(analytics ID)，以通过该数据分析标识来标识第三网元请求的具体数据分析结果。该数据分析结果需要第一网元基于对应的第一数据进行数据分析获得的。其中，第二请求中可以包括第三网元的标识或业务标识(application ID)，以通过该标识说明使用第二数据的对象。第二请求中还可以包括用户信息，该用户信息用于指示第三网元所请求的是哪个用户的第二数据。其中，关于用户信息的具体表现形式可以参见上述实施例，本实施例在此不再赘述。
其中，第二请求还可以包括第三使用范围，该第三使用范围包括以下信息中的一种：第三使用对象、第三使用目的、第三使用时间等。其中，第三使用对象标识使用数据分析结果的对象、第三使用目的标识使用数据分析结果的具体目的、第三使用时间标识使用数据分析结果的具体时间。
S302：第一网元基于第二请求向第二网元发送第一请求，该第一请求用于请求用户相关数据的授权信息。
本实施例中，第一网元在确定第三网元所发送的第二请求后，可以基于所接收的第二请求生成第一请求，并向第二网元发送第一请求，以获取用户相关数据的授权信息。也就是，第一网元将第三网元发送的第二请求作为向第二网元查询用户授权信息的触发条件。其中，第一网元可以根据第二请求生成第一请求，具体实现可以参见上述实施例的说明，本实施例在此不再赘述。例如，当第二请求中的用户信息为用户的外部标识时，第一网元可以根据配置信息将用户的网络外部标识转换成用户的网络内部标识，以在第一请求中包括该用户的网络内部标识。
S303：第二网元根据第一请求确定用户的授权信息。
本实施例中，第二网元可以根据自身保存的用户的授权信息以及第一请求获取用户信息对应的用户的授权信息。
具体地，第二网元根据第一请求中的第一使用范围以及用户信息确定analytics ID是否包含在用户的授权信息的数据类型中、第三网元ID或application ID是否包含在用户允许该analytics ID数据分析结果使用的对象中、请求使用该analytics ID数据分析结果的目的是否与用户允许使用的目的相匹配、请求使用该analytics ID数据分析结果的使用时间是否与用户允许使用时间相匹配。如果上述条件均满足，则第二网元确定允许用户相关数据用于第一使用范围；否则，第二网元确定不允许用户相关数据用于第一使用范围或对应授权未知。
此外，第二网元还可以通过向其它网元发送请求的方式确定用户的授权信息，具体实现上述内容类似，本实施例在此不再赘述。
S304：第二网元向第一网元发送第一响应，该第一响应包括授权信息。
其中，授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于第一使用范围。具体地，授权信息可以为用户信息对应的用户允许用户相关数据被用于第一使用范围、或不允许用户相关数据被用于第一使用范围，或用户相关数据是否被允许未知。
当授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，第一响应中还可以包括不允许使用的数据类型(当第三网元同时请求多个数据分析结果时)、不允许使用的原因信息等。
S305：第一网元获取第一数据，并对该第一数据进行数据分析获取数据分析结果。
当第一网元接收到第二网元发送的授权信息时，可以基于该授权信息获取第一数据，以对所述第一数据进行数据分析获得第三网元所要获得的数据分析结果。
具体地，第一网元根据第二请求中的数据分析标识确定用于生成该数据分析结果而需使用的第一数据，进而第一网元获取该第一数据。其中，第一网元获取第一数据的方式可以有多种，一种是第一网元自身存储有第一数据；另一种是第一网元向其它网元发送请求，以请求获取第一数据。关于，第一网元获取第一数据的具体实现将在后续实施例进行说明。
当第一网元获取到第一数据时，基于获取的第一数据进行数据分析以获取analytics ID对应的数据分析结果。
S306：当授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围时，第一网元向第三网元发送第二响应，该第二响应包括用户相关数据。
本实施例中，当授权信息指示用户信息对应的用户允许相关数据被第三网元使用时，则第一网元将S305中所获取的数据分析结果发送给第三网元。相应地，第三网元接收该数据分析结果，并利用该数据分析结果进行疫情监控、寻呼区域优化等操作。
S307：当授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，第一网元向第三网元发送反馈消息，该反馈消息中可以包括不允许使用的原因值。
当授权信息指示用户信息对应的用户不允许相关数据被第三网元使用时，则第一网元向第三网元发送反馈信息，该反馈信息用于指示第三网元所请求的数据分析结果被拒绝，同时表明被拒绝使用的原因。
需要说明的是，本实施例中，S305执行条件可以包括以下两种情况：一种是，当第一网元确定用户信息对应的用户允许用户相关数据被用于第一使用范围时，第一网元获取第一数据，并对第一数据进行数据分析获取相应的数据分析结果，并执行S306。也就是说，如果授权信息指示用户信息对应的用户不允许用户相关数据被用于第一使用范围时，则第一网元不获取第一数据，且不执行数据分析操作。
另一种是，无论用户信息对应的用户是否允许用户相关数据被用于第一使用范围，第一网元均获取第一数据，并基于第一数据进行数据分析操作，获取数据分析结果。当授权信息指示用户信息对应的用户允许用户相关数据被用于第一使用范围时，第一网元将数据分析结果发送给第三网元。当授权信息指示用户信息对应的用户不允许用户相关数据被用 于第一使用范围时，第一网元不执行S306操作。也就是，无论用户是否允许用户相关数据被用于第一使用范围，第一网元均可以先获取第一数据，并进行数据分析获得数据分析结果。然后，第一网元再根据授权信息的具体指示决定是否向第三网元发送数据分析结果。
需要注意的是，上述图3所提供的方法实施例中并不是每个步骤都是必选的。上述图3所提供的方法实施例中的一些步骤是可选地，比如上述图2中的S305-S307。
上述实施例中可知，第一网元获取第一数据的方式有多种，除了第一网元可以预先存储用户的相关数据之外，还可以通过向其它网元请求获取。第一网元在获取第一数据时，也可以向第二网元请求获取用户的授权信息，在授权信息指示用户信息对应的用户允许用户相关数据被使用时，第一网元获取第一数据。下述实施例仍以第一网元为NWDAF、第二网元为UDM为例进行说明。
参见图4所示的一种通信方法的流程图，本申请实施例与图2、图3实施例相同的内容可以具体参见图2、图3所述实施例的描述，如图4所示，该方法可以包括：
S401：第一网元向第二网元发送第一请求，该第一请求用于请求用户相关数据的授权信息。
本实施例中，第一网元为获取第一数据，首先向第二网元发送第一请求，该第一请求包括用户信息以及第一使用范围，该第一使用范围可以包括以下信息的一种：第一使用对象(如NWDAF ID)、第一使用目的(如进行某一数据分析analytics ID)、第一使用时间(如2020.1.1-6.1)。具体地，第一请求中第一类型标识为事件标识(如event ID)，以通过该事件标识指示第一数据中具体的数据类型。当第一使用目的为进行数据分析时，第一使用范围还可以包括数据分析标识(如analytics ID)，该数据分析标识用于指示对第一数据进行数据分析以获得数据分析标识对应的数据分析结果。同时，第一请求还可以包括第二使用范围，该第二使用范围可以包括第二使用对象、第二使用目的、第二使用时间中的一种或多种。其中，第二使用对象指示进行数据分析对应的数据分析结果的使用对象，第二使用目的指示数据分析结果的使用目的。第二使用时间指示数据分析结果的使用时间。也就是，第二使用范围是对第四使用目的(获取某一数据分析结果)的进一步限定。
S402：第二网元根据第一请求确定用户的授权信息。
其中，第二网元根据第一请求确定用户的授权信息的方式可以参见上述S302的具体实现，本实施例在此不再赘述。
需要说明的是，当第一请求中还包括数据分析结果对应的第二使用范围时，第二网元将根据用户信息以及第二使用范围确定analytics ID对应的数据分析结果是否包含在用户的授权信息的数据类型中、第二使用对象是否包含在用户允许该analytics ID对应的数据分析结果使用的对象中、第二使用目的是否与用户允许使用的目的相匹配、第二使用时间是否与用户允许使用时间相匹配，从而获取针对第二使用范围的授权信息。
S403：第二网元向第一网元发送第一响应，该第一响应包括授权信息。
S404：当授权信息指示用户信息对应的用户允许第一数据使用第一使用范围时，第一网元获取第一数据。
在本实施例中，当第一请求还包括数据分析结果对应的第二使用范围时，第二网元所 发送的授权信息中既包括针对第一使用范围的授权信息，也包括针对第二使用范围的授权信息。该情况下，授权信息可以指示用户信息对应的用户允许第一数据使用第一范围，同时，指示用户信息对应的用户允许第一数据对应的数据分析结果使用第二范围。
如此，第一网元可以在允许获取用户相关数据的情况下去获取用户相关数据。在符合GDPR立法的前提下获取用户在通信运营商网络中产生的相关数据，一方面可以实现对用户级数据的保护，另一方面也可以满足抓取数据做训练分析以辅助网络的策略制定和执行的目的。
需要注意的是，上述图4所提供的方法实施例中并不是每个步骤都是必选的。上述图4所提供的方法实施例中的一些步骤是可选地，比如上述图4中的S404。
根据前述方法，图5为本申请实施例提供的通信设备的结构示意图，如图5所示，该通信设备可以为终端设备或网络设备，也可以为芯片或电路，比如可设置于终端设备的芯片或电路，再比如可设置于网络设备内的芯片或电路。本申请实施例中的网络设备可以是指第一网元、第二网元、第三网元、第四网元或终端设备中的任一项或任多项。
进一步的，该通信设备501还可以进一步包括总线系统，其中，处理器502、存储器504、收发器503可以通过总线系统相连。
应理解，上述处理器502可以是一个芯片。例如，该处理器502可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器502中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器502中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器504，处理器502读取存储器504中的信息，结合其硬件完成上述方法的步骤。
应注意，本申请实施例中的处理器502可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的 步骤。
收发器可以是收发单元，例如包括接收单元和发送单元。收发器也可以是收发电路或者接口电路。该收发器用于该处理器与外部网元或者元件进行通信。
可以理解，本申请实施例中的存储器504可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
该通信设备501对应上述方法中的第一网元的情况下，该通信设备可以包括处理器502、收发器503和存储器504。该存储器504用于存储指令，该处理器502用于执行该存储器504存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第一网元的相关方案。具体地，收发器503，用于向第二网元发送第一请求，该第一请求用于请求用户相关数据的授权信息，第一请求包括用户信息和所述用户相关数据的第一使用范围，第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；接收第二网元发送的第一响应，所述第一响应包括授权信息，该授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于第一使用范围。
通信设备501为上述第一网元的情况下，所述收发器503，具体用于：接收第三网元发送的第二请求，所述第二请求用于请求用户相关数据；根据所述第二请求向所述第二网元发送第一请求。
通信设备501为上述第一网元的情况下，所述处理器502，用于：根据所述第二请求向所述第三使用范围获取第一使用范围。
通信设备501为上述第一网元的情况下，所述处理器502，还用于：根据所述第二类型标识确定第一类型标识。
通信设备501为上述第一网元的情况下，所述处理器502，具体用于：根据配置信息以及第二数据类型标识确定第一类型标识，所述配置信息用于指示第一类型标识与第二类型标识之间的对应关系。
通信设备501为上述第一网元的情况下，所述处理器502，具体用于：将所述第二数据类型标识确定为第一类型标识。
通信设备501为上述数据获取网元的情况下，所述收发器503，还用于：向第三网元发送第二响应，所述第二响应包括所述第三网元请求的用户相关数据。
通信设备501为上述第一网元的情况下，当所述授权信息指示所述用户信息对应的用户允许所述用户相关数据被用于第一使用范围时，所述处理器502，具体用于：获取所述用户相关数据。
通信设备501为上述第一网元的情况下，当所述授权信息指示所述用户信息对应的用户不允许所述用户相关数据被用于第一使用范围时，所述处理器502，具体用于：删除所述用户相关数据或停止获取所述用户相关数据。
该通信设备501对应上述方法中的第二网元的情况下，该通信设备可以包括处理器502、收发器503和存储器504。该存储器504用于存储指令，该处理器502用于执行该存储器504存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第二网元的相关方案。收发器503，用于接收第一网元发送的第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；所述处理器502，用于根据所述第一请求确定所述授权信息；向所述第一网元发送第一响应，所述第一响应中包括所述用户相关数据的授权信息。
该通信设备501对应上述方法中的第二网元的情况下，所述处理502，具体用于：根据所述第一请求和保存的网络用户的授权信息是否匹配，确定所述用户信息对应的所述授权信息。
该通信设备501对应上述方法中的第二网元的情况下，所述处理502，具体用于：所述第二网元根据所述第一请求向所述用户信息对应的终端设备发起第三请求，所述第三请求用于向终端设备请求所述用户信息对应的所述授权信息；所述第二网元接收所述终端设备发送的第三响应，所述第三响应中包括所述用户信息对应的所述授权信息。
该通信设备501对应上述方法中的第二网元的情况下，所述处理502，具体用于：所述收发器503根据所述第一请求向第四网元发起第四请求，所述第四请求用于向所述第四网元请求所述用户信息对应的所述授权信息；接收所述第四网元发送的第四响应，所述第四响应中包括所述用户信息对应的所述授权信息。
该通信设备501对应上述方法中的第三网元的情况下，该通信设备可以包括处理器502、收发器503和存储器504。该存储器504用于存储指令，该处理器502用于执行该存储器504存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第三网元的相关方案。收发器503，向第一网元发送第二请求，所述第二请求用于请求获取用户相关数据，所述第二请求包括用户信息和第三使用范围，所述第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间。接收所述第一网元发送的第二响应，所述第二响应包括所述用户相关数据或指示信息，所述指示信息用于指示获取所述用户相关数据失败。。
该通信设备501对应上述方法中的终端设备的情况下，该通信设备可以包括处理器502、收发器503和存储器504。该存储器504用于存储指令，该处理器502用于执行该存储器904存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中数据提供网元的相关方案。收发器503，接收第二网元发送的第三请求，所述第三请求用于请求用户相关 数据的授权信息，所述第三请求包括所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；所述处理器502根据所述第三请求确定授权信息，并通过所述收发器503向所述第二网元发送第三响应，所述第三响应包括所述授权信息。
该通信设备501对应上述方法中的数据提供网元的情况下，所述收发器503，具体用于：向数据管理网元发送第五请求，所述第五请求用于请求获取所述用户的授权信息；从所述数据管理网元接收第五响应，所述第五响应中携带所述用户的授权信息。
该通信设备所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
根据前述方法，图6为本申请实施例提供的通信设备的结构示意图，如图6所示，通信设备601可以包括通信接口604、处理器602和收发器603。所述通信接口604，用于输入和/或输出信息；所述处理器602，用于执行计算机程序或指令，使得通信设备601实现上述图2至图4的相关方案中终端设备侧的方法，或使得通信设备601实现上述图2至图4的相关方案中网络设备侧的方法。网络设备侧比如为上述第一网元、第二网元、第三网元、第四网元、第五网元中的任一项或任多项。本申请实施例中，收发器603可以实现上述图5的收发器503所实现的方案，处理器602可以实现上述图5的处理器502所实现的方案，在此不再赘述。
根据本申请实施例提供的方法，本申请实施例还提供一种通信系统，其包括前述的网络设备和一个或多于一个终端设备。网络设备比如为上述第一网元、第二网元、第三网元、第四网元、第五网元中的任一项或任多项。
基于以上实施例以及相同构思，图7为本申请实施例提供的通信设备的示意图，如图7所示，该通信设备701可以为终端设备或网络设备，也可以为芯片或电路，比如可设置于终端设备或网络设备的芯片或电路。
该通信设备701对应上述方法中的第一网元的情况下，该通信设备可以包括处理单元702、收发单元703和存储单元704。该存储单元704用于存储指令，该处理单元702用于执行该存储单元704存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第一网元的相关方案。收发单元703，用于向第二网元发送第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求中包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；接收所述第二网元发送的第一响应，所述第一响应包括授权信息，所述授权信息用于指示所述用户信息对应的用户是否允许所述相关数据被用于所述第一使用范围。
该通信设备701对应上述方法中的第二网元的情况下，该通信设备可以包括处理单元702、收发单元703和存储单元704。该存储单元704用于存储指令，该处理单元702用于执行该存储单元704存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第二网元的相关方案。收发单元703，接收第一网元发送的第一请求，该第一请求用于请求用户相关数据的授权信息，第一请求包括用户信息和用户相关数据的第一使用范围，该第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；处理单元702根据所述第一请求确定授权信息；收发单元703,向第一网元发送第一响应，其中， 第一响应包括授权信息，该授权信息用于指示用户信息对应的用户是否允许用户相关数据被用于第一使用范围。
该通信设备701对应上述方法中的第三网元的情况下，该通信设备可以包括处理单元702、收发单元703和存储单元704。该存储单元704用于存储指令，该处理单元702用于执行该存储单元704存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中第三网元的相关方案。收发单元703，向第一网元发送第二请求，该第二请求用于请求获取用户相关数据，该第二请求包括用户信息和第三使用范围，其中，第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间；接收第一网元发送的第二响应，该第二响应包括用户相关数据或指示信息，该指示信息用于指示获取用户相关数据失败。
该通信设备701对应上述方法中的终端设备的情况下，该通信设备可以包括处理单元702、收发单元703和存储单元704。该存储单元704用于存储指令，该处理单元702用于执行该存储单元704存储的指令，以实现如上图2至图4中所示的任一项或任多项对应的方法中终端设备的相关方案。收发单元703，接收第二网元发送的第三请求，所述第三请求用于请求用户相关数据的授权信息，所述第三请求包括所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象、第一使用目的、第一使用时间；终端设备根据所述第三请求确定授权信息，并向所述第二网元发送第三响应，所述第三响应包括所述授权信息。
该通信设备所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
可以理解的是，上述通信设备701中各个单元的功能可以参考相应方法实施例的实现，此处不再赘述。
应理解，以上通信设备的单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。本申请实施例中，收发单元702可以由上述图5的收发器503实现，处理单元702可以由上述图5的处理器502实现。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图2至图84示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读存储介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图2至图4所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的一个或多个终端设备以及一个或多个网络设备。
需要说明的是，本实施例中各个模块的具体实现可以参见上述方法实施例，本实施例在此不做赘述。
应当理解，在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/ 或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，“a和b”，“a和c”，“b和c”，或“a和b和c”，其中a，b，c可以是单个，也可以是多个。
还需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本申请。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文所示的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。

Claims (22)

  1. 一种通信方法，其特征在于，所述方法包括
    第一网元向第二网元发送第一请求，所述第一请求用于请求用户相关数据的授权信息，所述第一请求中包括用户信息和所述用户相关数据的第一使用范围，所述第一使用范围包括以下信息的至少一种：第一使用对象，第一使用目的，第一使用时间；
    所述第一网元接收所述第二网元发送的第一响应，所述第一响应中包括所述授权信息，所述授权信息用于指示所述用户信息对应的用户是否允许所述用户相关数据被用于所述第一使用范围。
  2. 根据权利1所述的方法，其特征在于，所述用户相关数据包括所述用户相关的第一数据和/或第二数据，所述第一数据包括终端设备、应用服务器或网络设备中的至少一个产生的所述用户对应的数据，所述第二数据包括基于所述第一数据进行数据分析而获取的数据分析结果。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一请求中还包括第一类型标识，所述第一类型标识用于标识所述用户相关数据的类型，
    所述第一请求用于请求用户相关数据的授权信息，包括：
    所述第一请求用于请求所述第一类型标识对应的用户相关数据的授权信息。
  4. 根据权利要求3所述的方法，其特征在于，当所述用户相关数据为所述第一数据时，所述第一类型标识为事件标识，所述第一数据为所述事件标识对应的相关事件的数据。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一网元为网络数据分析功能NWDAF网元，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
  6. 根据权利要求5所述的方法，其特征在于，当所述用户相关数据为所述第一数据时，所述第一使用对象为所述网络数据分析功能NWDAF网元。
  7. 根据权利要求5或6任一项所述方法，其特征在于，当所述用户相关数据为所述第一数据时，所述第一使用目的包括进行数据分析。
  8. 根据权利要求5所述的方法，其特征在于，当所述用户相关数据为所述第一数据时，所述第一使用范围还包括数据分析标识，所述数据分析标识用于指示对所述第一数据进行数据分析以获得所述数据分析标识对应的数据分析结果。
  9. 根据权利要求8所述的方法，其特征在于，所述第一请求还包括所述数据分析结果对应的第二使用范围，所述第二使用范围包括以下信息的至少一种：第二使用对象、第二使用目的、第二使用时间。
  10. 根据权利要求3所述的方法，其特征在于，当所述用户相关数据为所述第二数据时，所述第一类型标识为数据分析标识，所述第二数据是所述数据分析标识对应的数据分析结果。
  11. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一网元为网络能力开放功能NEF网元，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
  12. 根据权利要求11所述的方法，其特征在于，所述第一使用对象为应用服务器AF。
  13. 根据权利要求1-4任一项所述的方法，其特征在于，当所述第一网元为接入和移动性管理功能网元AMF时，所述第二网元为统一数据管理UDM网元或统一用户数据库UDR网元或鉴权服务功能AUSF网元或终端设备。
  14. 根据权利要求5至13任一项所述方法，其特征在于，方法还包括：
    所述第一网元接收第三网元发送的第二请求，所述第二请求用于请求获取用户相关数据，
    第一网元向第二网元发送第一请求，包括：
    所述第一网元根据所述第二请求向所述第二网元发送所述第一请求。
  15. 根据权利要求14所述的方法，其特征在于，所述第二请求包括用户信息和第三使用范围，所述第三使用范围包括以下信息的至少一种：第三使用对象、第三使用目的、第三使用时间，所述方法还包括：
    所述第一网元根据所述第三使用范围获取所述第一使用范围。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第二请求中包括第二类型标识，所述第二类型标识用于标识所述第三网元请求的用户相关数据的类型，所述方法还包括：
    所述第一网元根据所述第二类型标识确定第一类型标识。
  17. 根据权利要求16所述的方法，其特征在于，所述第一网元根据所述第二类型标识确定第一类型标识，包括：
    所述第一网元将所述第二数据类型标识确定为第一类型标识。
  18. 根据权利要求16所述的方法，其特征在于，所述第一网元根据所述第二类型标识确定第一类型标识，包括：
    所述第一网元根据配置信息以及第二数据类型标识确定第一类型标识，所述配置信息用于指示所述第一类型标识与所述第二数据类型标识之间的对应关系。
  19. 根据权利要求15-18任一项所述的方法，其特征在于，所述第三网元为应用服务器AF或网络功能NF网元。
  20. 一种通信设备，其特征在于，包括：
    存储器，所述存储器包括计算机可读指令；
    与所述存储器通信的处理器，所述处理器用于执行所述计算机可读指令，使得所述通信装置执行权利要求1-19任一项所述的方法。
  21. 一种通信系统，其特征在于，包括：第一网元和第二网元，
    所述第一网元，用于接收第二网元发送的第一请求，并执行权利要求1-19任一项所述的方法；
    所述第二网元，用于接收所述第一网元发送的第一响应，并执行权利要求1-19任一项所述的方法。
  22. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令在被计算机调用时，使所述计算机执行如权利要求1 至19任一项所述的方法。
PCT/CN2020/107538 2020-08-06 2020-08-06 一种通信方法、设备及系统 WO2022027492A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
EP20948462.5A EP4187856A4 (en) 2020-08-06 2020-08-06 COMMUNICATION METHOD, DEVICE AND SYSTEM
PCT/CN2020/107538 WO2022027492A1 (zh) 2020-08-06 2020-08-06 一种通信方法、设备及系统
JP2023507744A JP2023536969A (ja) 2020-08-06 2020-08-06 通信方法、デバイス、およびシステム
CN202080104314.XA CN116210253A (zh) 2020-08-06 2020-08-06 一种通信方法、设备及系统
AU2020462414A AU2020462414A1 (en) 2020-08-06 2020-08-06 Communication method, device and system
US18/164,416 US20230185933A1 (en) 2020-08-06 2023-02-03 Communication method, device, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/107538 WO2022027492A1 (zh) 2020-08-06 2020-08-06 一种通信方法、设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/164,416 Continuation US20230185933A1 (en) 2020-08-06 2023-02-03 Communication method, device, and system

Publications (1)

Publication Number Publication Date
WO2022027492A1 true WO2022027492A1 (zh) 2022-02-10

Family

ID=80119858

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/107538 WO2022027492A1 (zh) 2020-08-06 2020-08-06 一种通信方法、设备及系统

Country Status (6)

Country Link
US (1) US20230185933A1 (zh)
EP (1) EP4187856A4 (zh)
JP (1) JP2023536969A (zh)
CN (1) CN116210253A (zh)
AU (1) AU2020462414A1 (zh)
WO (1) WO2022027492A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114996347A (zh) * 2022-06-24 2022-09-02 中国电信股份有限公司 一种用户画像管理方法、装置、电子设备及存储介质
WO2023168620A1 (zh) * 2022-03-09 2023-09-14 Oppo广东移动通信有限公司 获取用户同意的方法、装置、设备及存储介质
WO2023213177A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 一种通信方法及装置
WO2023213226A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 一种授权的方法和装置
WO2024001897A1 (zh) * 2022-06-27 2024-01-04 华为技术有限公司 通信方法和装置
WO2024016954A1 (zh) * 2022-07-17 2024-01-25 华为技术有限公司 一种授权方法和通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101277234A (zh) * 2007-03-28 2008-10-01 华为技术有限公司 一种家庭网络及登录方法
US20180270778A1 (en) * 2017-03-17 2018-09-20 Samsung Electronics Co., Ltd. Af influenced pdu session management and subscription procedures
CN109511115A (zh) * 2017-09-14 2019-03-22 华为技术有限公司 一种授权方法和网元
CN110830422A (zh) * 2018-08-10 2020-02-21 中国移动通信有限公司研究院 一种终端行为数据处理方法及设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020066890A1 (en) * 2018-09-26 2020-04-02 Nec Corporation Network data analytics function, access and mobility function, and control method for ue analytics assistance for network automation and optimisation

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101277234A (zh) * 2007-03-28 2008-10-01 华为技术有限公司 一种家庭网络及登录方法
US20180270778A1 (en) * 2017-03-17 2018-09-20 Samsung Electronics Co., Ltd. Af influenced pdu session management and subscription procedures
CN109511115A (zh) * 2017-09-14 2019-03-22 华为技术有限公司 一种授权方法和网元
CN110830422A (zh) * 2018-08-10 2020-02-21 中国移动通信有限公司研究院 一种终端行为数据处理方法及设备

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023168620A1 (zh) * 2022-03-09 2023-09-14 Oppo广东移动通信有限公司 获取用户同意的方法、装置、设备及存储介质
WO2023213177A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 一种通信方法及装置
WO2023213226A1 (zh) * 2022-05-06 2023-11-09 华为技术有限公司 一种授权的方法和装置
CN114996347A (zh) * 2022-06-24 2022-09-02 中国电信股份有限公司 一种用户画像管理方法、装置、电子设备及存储介质
WO2024001897A1 (zh) * 2022-06-27 2024-01-04 华为技术有限公司 通信方法和装置
WO2024016954A1 (zh) * 2022-07-17 2024-01-25 华为技术有限公司 一种授权方法和通信装置

Also Published As

Publication number Publication date
AU2020462414A1 (en) 2023-03-16
CN116210253A (zh) 2023-06-02
EP4187856A4 (en) 2023-09-13
EP4187856A1 (en) 2023-05-31
JP2023536969A (ja) 2023-08-30
US20230185933A1 (en) 2023-06-15

Similar Documents

Publication Publication Date Title
WO2022027492A1 (zh) 一种通信方法、设备及系统
US20230093339A1 (en) Session Management Method, Apparatus, and System
US20220330361A1 (en) Method for establishing connection and obtaining relay service code and communications apparatus
US20210168151A1 (en) Method for implementing user plane security policy, apparatus, and system
WO2020224622A1 (zh) 一种信息配置方法及装置
US20210282053A1 (en) Transfer policy determining method, and apparatus
WO2017156706A1 (zh) 用于处理数据包的方法及设备
WO2021197185A1 (zh) 一种通信方法和通信装置
WO2020034919A1 (zh) 定位方法和通信装置
EP3753299A1 (en) Enforcement of service exemption on a per access network technology type
WO2019024650A1 (zh) 一种资源配置方法和装置
US20220225094A1 (en) Communication method, device, and system, and storage medium
WO2022001318A1 (zh) 通信方法和装置
WO2018058365A1 (zh) 一种网络接入授权方法、相关设备及系统
US9603080B2 (en) Network assisted ANDSF policy updating
WO2019028794A1 (zh) 确定业务路径的方法和设备
WO2022151967A1 (en) Methods, network nodes, and computer readable media for dynamically discovering serving network node in core network
WO2020001465A1 (zh) 管理用户数据的方法和装置
WO2022032546A1 (zh) 通信方法及装置
WO2022237857A1 (zh) 确定安全保护开启方式的方法、通信方法及通信装置
WO2023246649A1 (zh) 通信方法、通信装置及通信系统
WO2023040728A1 (zh) 一种网元的选择方法、通信装置及通信系统
CN109525979B (zh) 一种上下文信息管理方法及装置
WO2019028795A1 (zh) 确定业务路径的方法和设备
WO2016150115A1 (zh) 一种承载建立方法、分组数据网关、服务网关及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20948462

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023507744

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020948462

Country of ref document: EP

Effective date: 20230222

ENP Entry into the national phase

Ref document number: 2020462414

Country of ref document: AU

Date of ref document: 20200806

Kind code of ref document: A