WO2022110836A1 - 通信的方法及通信装置 - Google Patents

通信的方法及通信装置 Download PDF

Info

Publication number
WO2022110836A1
WO2022110836A1 PCT/CN2021/106736 CN2021106736W WO2022110836A1 WO 2022110836 A1 WO2022110836 A1 WO 2022110836A1 CN 2021106736 W CN2021106736 W CN 2021106736W WO 2022110836 A1 WO2022110836 A1 WO 2022110836A1
Authority
WO
WIPO (PCT)
Prior art keywords
usn
node
network device
identifier
network
Prior art date
Application number
PCT/CN2021/106736
Other languages
English (en)
French (fr)
Inventor
赵明宇
严学强
吴建军
安雪莉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022110836A1 publication Critical patent/WO2022110836A1/zh
Priority to US18/323,222 priority Critical patent/US20230300716A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/24—Connectivity information management, e.g. connectivity discovery or connectivity update
    • H04W40/248—Connectivity information update
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing
    • H04W40/20—Communication route or path selection, e.g. power-based or shortest path routing based on geographic position or location

Definitions

  • the present application relates to the field of communication, and more particularly, to a communication method and a communication device.
  • the node identifiers of each node are randomly assigned, and the location relationship of the nodes is not considered in the process of assigning the node identifiers, resulting in the underlying physical network (underlay network). ) is inconsistent with the topology of the overlay network, which makes the end-to-end delay of the logic network high.
  • DHT distributed hash table
  • the present application provides a communication method and communication device, so as to reduce the end-to-end delay.
  • a first aspect provides a communication method, the method comprising: a first network device generating a node identification, the node identification including a global part and a local part, the global part is based on the area covered by the second network device where the node is located The location information is determined, and the local part is determined according to the identity information of the terminal device associated with the node; the first network device sends the node identification to the terminal device.
  • the second network device is mobile edge computing (mobile edge computing, MEC).
  • the geographic location information can be introduced into the node identifier, so that the adjacent nodes on the logical network can be
  • the physical network is also close to each other, so that routing can be optimized and end-to-end delay can be reduced.
  • the geographic location information of the area includes geographic location information of the second network device
  • the geographic location information of the second network device includes one or more of the following: The mobile country code, the mobile network code, the identifier of the geographic area where the second network device is located, the identifier of the set where the second network device is located, and the serial number of the second network device in the set.
  • the geographic location information of the second network device is used as a global part of the node identification, and there is no need to introduce a centralized landmark server, so the risks of single-point failure and distributed denial-of-service attacks can be avoided.
  • the geographic location information of the area is determined according to the geographic location information of N access network devices in the area that meet a preset condition, and the preset condition is: The access network device exists for a predefined time, and N is a positive integer.
  • the geographic location information of multiple access network devices in the area covered by the second network device is used as a global part of the node identification, and there is no need to introduce a centralized landmark server, so single-point failure and distributed rejection can be avoided Risk of service attack.
  • the geographic location information of the area includes geographic coordinates, and the geographic coordinates are an average of geographic coordinates of the N access network devices that meet the preset conditions.
  • the geographic coordinates of multiple access network devices in the area covered by the second network device are used as a global part of the node identification, and there is no need to introduce a centralized landmark server, so single-point failure and distributed rejection can be avoided Risk of service attack.
  • the method is applied to a communication system including a network service node (NSN) and a user service node (user service node, USN), the NSN and the The USN communicates through an external interface, the NSN includes an authentication function entity and/or a session management function entity, the USN is associated with the terminal device, and the USN includes the following function entities: data forwarding function entity, session management function entity, user data storage A functional entity, the functional entities included in the USN communicate with each other through an internal interface, the node is the USN, and the node identifier is the identifier of the USN node.
  • NSN network service node
  • USN user service node
  • the USN communicates through an external interface
  • the NSN includes an authentication function entity and/or a session management function entity
  • the USN is associated with the terminal device
  • the USN includes the following function entities: data forwarding function entity, session management function entity, user data storage A functional entity, the functional entities included in the USN communicate with each other through an internal interface
  • the solutions for generating node identifiers provided in the embodiments of the present application can be applied to a user-centric network architecture.
  • the USN node identifier is used for an authentication process between the terminal device and the USN node.
  • the USN node identifier since the USN node identifier includes a global part that can reflect the geographic location of the USN, the USN node identifier is used in the authentication process of the USN node and the terminal device to facilitate addressing the USN node.
  • the global part of the node identification is used to identify the second network device.
  • the second network device where the terminal device is located can be determined.
  • the MEC where the terminal device is located can be determined according to the global part of the node identification.
  • the terminal device identity information includes any one of the following: an Internet protocol (Internet protocol, IP) address, a port (port) number, an application identifier (application identifier, APP) ID), international mobile subscriber identification number (IMSI), subscriber permanent identifier (SUPI), telephone number.
  • IP Internet protocol
  • port port
  • application identifier application identifier
  • SUPI subscriber permanent identifier
  • a communication device including a transceiver unit and a processing unit, the processing unit is configured to generate a node identifier, the node identifier includes a global part and a local part, and the global part is based on the coverage of the second network device where the node is located The local part is determined according to the identity information of the terminal equipment associated with the node; the transceiver unit is used for sending the node identification to the terminal equipment.
  • the geographic location information of the area includes geographic location information of the second network device
  • the geographic location information of the second network device includes one or more of the following: The mobile country code, the mobile network code, the identifier of the geographic area where the second network device is located, the identifier of the set where the second network device is located, and the serial number of the second network device in the set.
  • the geographic location information of the area is determined according to the geographic location information of N access network devices in the area that meet a preset condition, and the preset condition is: The access network device always exists within a predefined time, and N is a positive integer.
  • the geographic location information of the area includes geographic coordinates, and the geographic coordinates are an average of geographic coordinates of the N access network devices that meet the preset conditions.
  • the communication device is an NSN in a communication system including an NSN and a USN
  • the NSN communicates with the USN through an external interface
  • the NSN includes an authentication function entity and/or Or a session management functional entity
  • the USN is associated with the terminal device
  • the USN includes the following functional entities: a data forwarding functional entity, a session management functional entity, and a user data storage functional entity, and the functional entities included in the USN communicate through an internal interface
  • the node is the USN, and the node ID is the ID of the USN node.
  • the USN node identifier is used for an authentication process between the terminal device and the USN node.
  • the node identifier is used to identify the second network device.
  • the terminal device identity information includes any of the following: Internet Protocol IP address, port number, application identifier, international mobile subscriber identity, user permanent identifier, telephone number .
  • a communication apparatus including a processor.
  • the processor is coupled to the memory, and can be used to execute instructions in the memory, so as to implement the method in the first aspect and any possible implementation manner of the first aspect.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication apparatus is a first network device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the communication apparatus is a chip configured in the first network device.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • a processor including: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in the first aspect and any possible implementation manner of the first aspect.
  • the above-mentioned processor may be one or more chips
  • the input circuit may be input pins
  • the output circuit may be output pins
  • the processing circuit may be transistors, gate circuits, flip-flops and various logic circuits, etc. .
  • the input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver
  • the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by a transmitter
  • the circuit can be the same circuit that acts as an input circuit and an output circuit at different times.
  • the embodiments of the present application do not limit the specific implementation manners of the processor and various circuits.
  • a processing apparatus including a processor and a memory.
  • the processor is configured to read instructions stored in the memory, and can receive signals through the receiver and transmit signals through the transmitter, so as to execute the first aspect and the method in any possible implementation manner of the first aspect.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • the memory can be a non-transitory memory, such as a read only memory (ROM), which can be integrated with the processor on the same chip, or can be separately set in different On the chip, the embodiment of the present application does not limit the type of the memory and the setting manner of the memory and the processor.
  • ROM read only memory
  • the relevant data interaction process such as sending indication information, may be a process of outputting indication information from the processor, and receiving capability information may be a process of receiving input capability information by the processor.
  • the data output by the processor can be output to the transmitter, and the input data received by the processor can be from the receiver.
  • the transmitter and the receiver may be collectively referred to as a transceiver.
  • the processing device in the fifth aspect above may be one or more chips.
  • the processor in the processing device may be implemented by hardware or by software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, implemented by reading software codes stored in a memory, which can Integrated in the processor, can be located outside the processor, independent existence.
  • a computer program product comprising: a computer program (also referred to as code, or instructions), which, when the computer program is executed, causes a computer to execute the above-mentioned first aspect and the first The method of any of the possible implementations of an aspect.
  • a computer program also referred to as code, or instructions
  • a computer-readable storage medium stores a computer program (also referred to as code, or instruction) when it is run on a computer, so that the above-mentioned first aspect and the first The method of any of the possible implementations in an aspect is performed.
  • a computer program also referred to as code, or instruction
  • FIG. 1 shows a schematic diagram of a communication system applicable to the method provided by this embodiment of the present application.
  • FIG. 2 shows a schematic diagram of a communication interface between NSN, USN and access network equipment.
  • Figure 3 shows a schematic diagram of the structure of the NSN.
  • FIG. 4 shows a schematic diagram of the structure of the USN.
  • FIG. 5 shows a schematic diagram of another communication system applicable to the method provided by this embodiment of the present application.
  • Figure 6 shows a schematic diagram of the widespread deployment of edge clouds.
  • FIG. 7 shows a schematic flowchart of a method provided by an embodiment of the present application.
  • FIG. 8 shows a schematic structural diagram of a node identification provided by an embodiment of the present application.
  • FIG. 9 shows a schematic structural diagram of a globally unique MEC identifier provided by an embodiment of the present application.
  • Figure 10 shows a schematic diagram of the structure of the MEC region.
  • FIG. 11 shows a schematic flowchart of an initial authentication method provided by an embodiment of the present application.
  • FIG. 12 shows a schematic diagram of a USN node identifier provided by an embodiment of the present application.
  • FIG. 13 shows a schematic flowchart of a method for mutual authentication provided by an embodiment of the present application.
  • Figure 14 shows a schematic diagram of configuring a visited USN for a terminal device.
  • FIG. 15 shows a schematic diagram of a communication apparatus provided by an embodiment of the present application.
  • FIG. 16 shows a schematic block diagram of a communication apparatus provided by another embodiment of the present application.
  • FIG. 17 shows a schematic diagram of a chip system provided by an embodiment of the present application.
  • the technical solutions of the embodiments of the present application can be applied to various communication systems, for example, the sixth generation (6th Generation, 6G) or future communication systems.
  • 6G sixth generation
  • future communication systems for example, the sixth generation (6th Generation, 6G) or future communication systems.
  • the terminal equipment involved in the embodiments of this application may be referred to as user equipment (UE), access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, and user terminal , terminal, wireless communication device, user agent or user equipment.
  • UE user equipment
  • access terminal subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, and user terminal , terminal, wireless communication device, user agent or user equipment.
  • the terminal device may be a device that provides voice/data connectivity to the user, such as a handheld device with a wireless connection function, a vehicle-mounted device, and the like.
  • some examples of terminals can be: mobile phone (mobile phone), tablet computer (pad), computer with wireless transceiver function (such as notebook computer, palmtop computer, etc.), mobile internet device (mobile internet device, MID), virtual reality (virtual reality, VR) equipment, augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control (industrial control), wireless terminals in unmanned driving (self driving), wireless terminals in remote medical (remote medical) Terminal, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, cellular phone, cordless Telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital assistant (PDA), handheld device, computing device or connection with wireless communication capabilities
  • the terminal device may also be a terminal device in an internet of things (Internet of things, IoT) system.
  • IoT Internet of things
  • IoT is an important part of the development of information technology in the future. Its main technical feature is to connect items to the network through communication technology, so as to realize the intelligent network of human-machine interconnection and interconnection of things.
  • IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrow band (NB) technology.
  • NB narrow band
  • the existing mobile communication systems are all network-centric, and the user adapts to the network, that is, the user can only choose the functions provided by the network, especially the functions provided by the centralized core network are of large granularity and cannot meet the individual needs of users. .
  • users are increasingly pursuing personalized services.
  • the Internet of Everything has brought about a sharp increase in the types of terminals. Different terminals require on-demand functions. For example, terminals that do not move do not need paging, and some IoT terminals do not need voice functions. Wait.
  • centralized core network elements eg, mobility management function network element, session management function network element, user data management function network element, policy management function network element
  • DDoS distributed denial of service
  • the communication system 100 may include a network service node (NSN) 110 and a user service node (user). service node, USN) 120.
  • NSN network service node
  • USN user service node
  • FIG. 3 is for illustration only, showing that the communication system 100 includes 4 NSNs 110 and 9 USNs 120. In actual deployment, the communication system 100 may include a larger number of NSNs 110 and/or a larger number of USNs 120.
  • the NSN 110 is the initial access point of the terminal device on the core network side, and is directly deployed and managed by the network operator.
  • the NSN 110 can be deployed independently, or can be deployed on the edge cloud or the access network device 130.
  • the NSN 110 can activate the USN 120, and can perform lifecycle management on the USN 120.
  • the NSN 110 may manage one or more USNs 120, and the NSN 110 may communicate with the USNs 120 it manages through an external interface.
  • the NSN 110 serves one or more access network devices 130, and the NSN 110 and the access network devices 130 it serves may communicate through a communication interface.
  • Terminal device 140 may communicate with NSN 110 through access network device 130.
  • the standard interface may be an existing standard interface, or may be a newly defined standard interface.
  • the standard communication protocol may be an existing standard communication protocol, or may be a newly defined standard communication protocol.
  • NSN 110 is the initial access point of the terminal device on the core network side. It can be understood that, in the process of accessing the core network through the access network device, the terminal device first connects to the NSN 120, and then the terminal device can connect to the NSN 120 through the NSN 120. USN 120.
  • the activation of the USN 120 by the NSN 110 can be understood as: during the initial access of the terminal device 140 to the network, the NSN 110 will activate the USN 120 served by the terminal device based on the request of the terminal device, and associate the terminal device 140 with the USN 120.
  • the steps for NSN 110 to activate USN 120 may be as follows:
  • the NSN receives a request message from the terminal device through the serving access network device, the request message is used to request access, and the request message includes the identification information of the terminal device.
  • the NSN acquires the identity of the USN, and the identity of the USN is associated with the identity information of the terminal device.
  • the NSN associates the USN with the terminal device.
  • the association between the identifier of the USN and the identifier information of the terminal device can be understood as that there is a correspondence or mapping relationship between the identifier of the USN and the identifier information of the terminal device, that is, when the identifier information of the terminal device is acquired , according to the relationship between the identity information of the terminal device and the identity of the USN, such as correspondence or mapping, the identity of the USN can be obtained.
  • the identification of the USN is associated with the identification information of the terminal device.
  • the identification of the USN may be obtained by processing the identification information of the terminal device.
  • the identification of the USN may be obtained by hashing the identification information of the terminal device. .
  • NSN 110 may also configure USN 120 with one or more of the following: storage resources, computing resources, network resources, central processing unit (CPU), storage database, and personalized parameters.
  • storage resources computing resources, network resources, central processing unit (CPU), storage database, and personalized parameters.
  • CPU central processing unit
  • the storage resource may be a resource required by the USN 120 to store computer instructions, etc.
  • the first information will be described in detail below, and will not be described in detail here.
  • the computing resources may be resources required by the USN 120 in the process of executing computer instructions, for example, may be powerful graphics processing unit (GPU) computing resources.
  • the network resources may be resources required for the USN 120 to communicate with the NSN 110, terminal devices, and the like.
  • a central processing unit may be used to execute computer instructions and the like.
  • the database may be used to store the first information and the like.
  • the database may also be a distributed storage database.
  • the personalized parameters may be configured by the NSN according to the type or number of terminal devices served by the USN. For example, if the terminal equipment served by the USN is an immobile terminal equipment, the NSN may not configure the paging function in the mobility management for the USN. For another example, if the terminal device served by the USN is a machine-type IoT terminal device, the NSN may not configure the voice function in session management for the USN. For another example, the NSN may configure different resources such as storage, computing, and network for the USN, depending on the number of terminal devices served by the USN. For another example, for the customized service opened by the terminal equipment of the USN service through negotiation with the operator, the NSN can configure powerful GPU computing resources and artificial intelligence (AI) capabilities for the USN.
  • AI artificial intelligence
  • the USN 120 is associated with the terminal device 140, is exclusive to the terminal device 140, and provides all network services for the terminal device 140, such as mobility management (mobile management, MM), session management (session management, SM), policy management (policy management) management, PM), data forwarding, etc.
  • Communication between the USN 120 and its associated terminal device 140 may be performed through the access network device 130, that is, communication between the USN 120 and the access network device 130 may be performed through a communication interface.
  • the first USN receives data from the first terminal device, where the data includes identification information of the second terminal device.
  • the first USN acquires the identifier of the second USN, and the identifier of the second USN is associated with the identifier information of the second terminal device.
  • the first USN sends data to the second USN, and the data is sent to the second terminal device through the second USN.
  • R1 is the communication interface between the NSN 110 and the access network equipment 130
  • R2 is the communication interface between the NSN 110 and the corresponding USN 120
  • R3 is the communication interface between the NSN 110 and other NSNs 110
  • R4 is the connection
  • the communication interface between the network access device 130 and the USN 120, the access network device 130 and the USN 120 realize all control plane signaling and data forwarding through the R4 interface
  • R5 is the communication interface between the USN 120 and another USN 120 .
  • the USN 120 may be associated with a terminal device or a group of terminal devices and be exclusive to the one terminal device or a group of terminal devices. All terminal devices 140 in the group of terminal devices may be terminal devices in the same area, or may be terminal devices in the same enterprise, or may be terminal devices with the same network requirements, and so on. This embodiment of the present application does not limit this.
  • the USN 120 may form a distributed hash table (DHT), and the USN 120 may be regarded as a node in the DHT. It should be understood that in this case the NSN 110 would operate outside of the DHT, but would help the USN 120 configure the DHT, ie the NSN 110 is the initial point of contact for the USN 120 to join the DHT.
  • DHT distributed hash table
  • the USN 120 can be distributed and deployed in the edge cloud.
  • NSN 110 is the initial access point of terminal equipment on the core network side. NSN 110 has some lightweight core network functions, such as authentication and default connection establishment.
  • the NSN 110 may include an access management function entity and/or an authentication (AUTH) function entity.
  • AUTH authentication
  • the NSN 110 shown in FIG. 3 includes an access management function entity 111 and an authentication function entity 112.
  • the access management function entity is used for interfacing with access network equipment, and performing registration, reachability management, and access authorization for terminal equipment. If the terminal device does not need registration, reachability management, access authorization, etc., the NSN 110 may not include an access management function entity.
  • the access management function entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing the access management function, it may be equivalent to the access management function entity in the embodiment of the present application. .
  • the AUTH functional entity is used to authenticate users. If user authentication is not required, the NSN 110 may not include an AUTH functional entity.
  • the AUTH functional entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing an authentication function, it can be equivalent to the AUTH functional entity in the embodiment of the present application.
  • the NSN 110 may also have the function of performing life cycle management on the USN 120.
  • the NSN 110 may also include an LCM functional entity 113.
  • the LCM functional entity 113 is used for multi-USN 120 to perform lifecycle management, such as activating the USN 120 or deactivating the USN 120.
  • the LCM functional entity may be software, hardware, or a combination of software and hardware, etc., as long as it is an entity capable of implementing the life cycle management function, it may be equivalent to the LCM functional entity in the embodiments of the present application.
  • the access management functional entity, the AUTH functional entity or the LCM functional entity may be integrated together, or may be set separately.
  • the two or more functional entities included in the NSN 110 may communicate through an internal interface.
  • the two functional entities included in the NSN 110 are implemented by software, the two functional entities can communicate through simple internal function calls.
  • the internal interface does not need to define standard interfaces and communication protocols.
  • the USN 120 may include the following functional entities: a data forwarding functional entity, a session management functional entity, and a user data storage functional entity.
  • the functional entities included in the USN can communicate through the internal interface. For example, if the two functional entities included in the USN 120 are implemented by software, the two functional entities can communicate through simple internal function calls. Compared with the external interface between NSN 110 and USN 120, the internal interface does not need to define standard interfaces and communication protocols.
  • the SM functional entity is used to establish the connection between the USN 120 and the terminal equipment.
  • the SM functional entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing a session management function, it may be equivalent to the SM functional entity in the embodiment of the present application.
  • the data forwarding function entity is used for receiving or sending data, for example, receiving data from a radio access network (radio access network, RAN) device, or sending data to a RAN device.
  • the data forwarding function entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing the data forwarding function, it may be equivalent to the data forwarding function entity in the embodiments of the present application.
  • the user data storage functional entity is used to store the first information.
  • the first information may include one or more of the following: information requiring privacy protection, identity information of the terminal device served by the USN 120, and identity information of the user.
  • the information requiring privacy protection may include any of the following: user's contract data, personal information, and property account information.
  • the user's identity information may include any of the following: name, gender, ID number.
  • the identification information of the terminal device may include any of the following: an international mobile subscriber identification number (IMSI), a subscriber permanent identifier (SUPI), and a telephone number.
  • the user data storage functional entity may also store the mapping relationship between the user's identity information and the address, and/or the mapping relationship between the user's identity information and the user's identity in the application.
  • the identity of the user in the application may be the account name registered by the user in the application, and the address includes a routable address (routing locator, RLOC) and a local address (local locator, LL
  • the user data storage function entity may also provide a third party with part or all of the stored first information according to the instruction of the terminal device served by the USN 120.
  • the third party may be an operator other than the home operator of the terminal device, or may be an application on the terminal device, or may be another terminal device, which is not limited in this embodiment of the present application.
  • the USN 120 may further include at least one of the following functional entities communicated through an internal interface: a PM functional entity, an authentication (authentication authorization accounting, AAA) functional entity or an MM functional entity.
  • a PM functional entity can communicate with any one of the data forwarding functional entity, the session management functional entity, and the user data storage functional entity through an internal interface.
  • AAA functional entity or the MM functional entity can also communicate with any one of the data forwarding functional entity, the session management functional entity, and the user data storage functional entity through the internal interface.
  • the PM functional entity and the AAA functional entity can communicate through an internal interface, and the PM functional entity and the AAA functional entity can also communicate with the data forwarding functional entity, the AAA functional entity, and the data forwarding functional entity respectively. Any one of the session management functional entity and the user data storage functional entity communicates through the internal interface.
  • the PM functional entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing a policy management function, it may be equivalent to the PM functional entity in the embodiments of the present application.
  • the AAA functional entity is used to authenticate, authenticate, and charge users.
  • the AAA functional entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity that can implement authentication, authentication, and accounting functions, it can be equivalent to the AAA functional entity in the embodiments of the present application.
  • the MM functional entity is used for mobility management, etc., eg, lawful interception, etc.
  • the MM functional entity may be software, hardware, or a combination of software and hardware, etc. As long as it is an entity capable of implementing a mobility management function, it may be equivalent to the MM functional entity in the embodiments of the present application.
  • FIG. 4 shows an example of a schematic structural diagram of the USN 120 .
  • the USN 120 can send data to and receive data from a radio access network (RAN) device, and the USN 120 can also receive data from a data network (DN) device, or Send data to the DN device.
  • RAN radio access network
  • DN data network
  • the USN 120 shown in FIG. 4 includes an operating module 121 .
  • the operation module 121 mainly includes a data forwarding functional entity, an SM functional entity, a PM functional entity, an AAA functional entity, and an MM functional entity.
  • the data forwarding functional entity and other functional entities can be integrated together, and can also be set separately.
  • the data forwarding functional entity may be set independently from other functional entities, that is, the data packet forwarding functional entity may be an independent module, such as a data module 1211 .
  • the SM functional entity, the PM functional entity, the AAA functional entity and the MM functional entity can be set up together or separately.
  • the SM functional entity, the PM functional entity, the AAA functional entity and the MM functional entity can be set up together, called is the control module 1212.
  • the USN 120 shown in FIG. 4 also includes a management and storage module 122.
  • the management and storage module 122 may correspond to the user data storage functional entity described above.
  • the management and storage module 122 may store the user's personal information, and may also store the mapping relationship between the user's personal information and a temporary identifier (TID), and/or the relationship between the user's personal information and the RLOC and LLOC mapping relationship.
  • TID may correspond to the identity of the user in the application as described above.
  • the USN 120 has an identifier corresponding to it, and the identifier information of the terminal device, the identifier of the USN 120 and the information stored in the USN 120 can be stored in a key-value pair (key-value).
  • the key in Figure 4 may correspond to the identification information of the terminal device
  • the key identification may correspond to the identification of the USN 120
  • the value may correspond to the information stored by the USN 120.
  • the identification (key identification) of the USN 120 can be obtained according to the identification information of the terminal device, and further, the information stored in the USN 120 can be indexed according to the identification of the USN 120.
  • USNs 120 serving different terminal devices 140 may include different functional entities.
  • a USN 120 serving an immobile terminal device 140 may not include an MM functional entity.
  • the USN 120 that provides services for the terminal equipment 140 that does not require authentication, authentication, and accounting functions may not include the AAA functional entity.
  • each module included in the USN 120 in the embodiment of the present application is only an example, and should not be construed as a limitation to the embodiment of the present application.
  • Each module included in the USN 120 may also be named with other names, for example, the management and storage module may be named as a user data storage function entity, or a user data storage module, or a user data management function entity, etc.
  • the communication system 100 provided by the embodiment of the present application may further include a consortium blockchain (consortium blockchain, CBC) 150 .
  • consortium blockchain consortium blockchain
  • the CBC 150 may include multiple operator networks, and its main function is to store secondary information.
  • the second information may include one or more of the following: transaction records between the user and the operator, and the public key of the operator's network.
  • the storage address of the second information in the CBC 150 may be indicated by the first information stored in the USN 120. For example, after the user signs a contract with the operator, the operator saves the transaction record in the CBC 150, and sends the specific contract content to the terminal device, which is stored in the USN 120 serving it by the terminal device. That is to say, many operators included in CBC 150 can only see transaction records between users and operators in CBC 150, and there is no specific contract content at CBC 150.
  • CBC 150 may also include digital asset management institutions of multiple banks, or, may also include multiple identity management institutions, or may also include digital asset management institutions of multiple universities. In this case, the CBC 150 can also store the public key of the bank's digital asset management institution, the public key of the identity management institution or the public key of the digital asset management institution of the university. The CBC 150 can also store the bank, the identity management institution or the university as the user's public key. A record of the provision of services or transactions.
  • the CBC 150 may be replaced by a distributed ledger technology (DL/DLT).
  • DLTs are databases distributed across multiple nodes or computer devices that are geographically distributed across multiple networks, institutions or countries. It can be seen that CBC 150 is a form of DLT. In the case where the CBC 150 is replaced by DLT, more users can see the contract record between the operator and the user.
  • the CBC 150 or DLT can communicate with the USN 120 through a communication interface.
  • the communication interface R6 between the USN 120 and the DL is shown in FIG. 2 . It should be understood that in the embodiment of the present application, the communication interface between the USN 120 and the DL is named as R6 as an example, and no limitation should be imposed on the embodiment of the present application.
  • the embodiments of the present application propose a solution of introducing a distributed hash table (DHT) into the network architecture of UCN, that is, by different UEs
  • DHT distributed hash table
  • the USNs make up the nodes of the DHT.
  • the traditional DHT randomly assigns the node identifiers of each node without considering the positional relationship of the nodes, which will lead to inconsistent topological structures of the underlying physical network (underlay network) and the logical network (overlay network) superimposed on it, thus making the logical The end-to-end delay of the network is high.
  • the present application proposes to introduce geographic location awareness information into the DHT node identification to optimize routing, so as to reduce the end-to-end delay of the overlay network.
  • the embodiments of the present application propose a node identification based on geographic location information perception, which can ensure that nodes that are close in space are also close in a physical network, and do not need to introduce a centralized landmark server. And based on the node identification based on the geographic location information perception proposed by the embodiment of the present application, the embodiment of the present application also proposes an authentication method.
  • the implementation of the UCN network architecture proposed in the embodiments of the present application may be based on the assumption that the edge cloud has been widely deployed.
  • the edge cloud will be described with reference to FIG. 6 .
  • the edge cloud and the core cloud form synergy and complement each other.
  • the edge cloud is closer to the user and can better support applications with high requirements such as latency and data privacy, and is suitable for distributed deployment of network functions.
  • the UE can access the edge cloud through the access network device.
  • Edge cloud is a kind of public cloud, based on widely covered small sites, generally content delivery network (CDN), Internet access point (point of presence, POP), mobile edge computing (mobile edge computing, MEC) ), each node provides public cloud services in the form of small clusters.
  • CDN content delivery network
  • POP Internet access point
  • MEC mobile edge computing
  • FIG. 7 shows a schematic interaction diagram of a method for a terminal device to access a network according to an embodiment of the present application.
  • the method shown in FIG. 7 can be applied to the UCN network architecture shown in FIG. 1 or FIG. 5 , and of course can also be applied to other network architectures.
  • the method 700 may include S710 and S720, and each step will be described in detail below.
  • the network device #1 (an example of the first network device) generates a node identifier.
  • the network device #1 may be an NSN, and the node may be a USN.
  • Network device #1 may also be other devices with wireless transceiver functions, such as Node B (Node, NB), evolved Node B (evolved Node B, eNB), base station controller (basic station controller, BSC), base station The transceiver station (basic transceiver station, BTS), etc., can also be 5G, such as gNB in the NR system.
  • the nodes may be nodes in the DHT.
  • FIG. 8 shows a schematic structural diagram of an identifier of a node provided by an embodiment of the present application.
  • the node identification may include a global part and a local part.
  • the global part of the node identification is determined according to the geographic location information of the area covered by the network device #2 (an example of the second network device) where the node is located. This embodiment of the present application does not limit the geographic location information of the area covered by the network device #2.
  • the geographic location information of the area covered by the network device #2 includes the geographic location information of the network device #2. It should be understood that one network device #2 can be uniquely identified according to the geographic location information of the network device #2. It should also be understood that the network device #1 and the network device #2 may be the same network device, and the network device #1 may also be a network device managed by the network device #2.
  • the network device #2 may be any device with wireless transceiver function, such as eNB, BSC, BTS, etc., and may also be 5G, such as gNB in NR system.
  • the network device #2 can also be a site in the edge cloud, such as CDN, POP, MEC, etc.
  • the network device #2 may also be an NSN.
  • network device #2 there are multiple network devices #2 in the area covered by the network device #2.
  • network device #2 is gNB#1, and gNB#2, gNB#3, etc. may also exist in the area covered by gNB#1.
  • the network device #2 there is only one network device #2 in the area covered by the network device #2.
  • one site is generally deployed, for example, the deployed site may be an MEC.
  • the network device #2 is the edge cloud site #1 (eg CDN, POP or MEC), there is no other edge cloud site except the edge cloud site #1 in the area covered by the edge cloud site #1.
  • the embodiments of the present application only take the example that the network device #2 is the gNB #1 or the edge cloud site #1 for description, and no limitation should be imposed on the embodiments of the present application.
  • network device #2 is gNB#1
  • network device #2 is edge cloud site #1, at In the area covered by edge cloud site #1, there may also be other edge cloud sites besides edge cloud site #1.
  • This embodiment of the present application does not limit the geographic location information of the network device #2.
  • the geographic location information of the network device #2 may include one or more of the following: a mobile country code (MCC), a mobile network code (MNC), the geographic location where the network device #2 is located The identifier of the area, the identifier of the network device set where the network device #2 is located, and the number of the network device #2 in the network device set.
  • MCC mobile country code
  • MNC mobile network code
  • the MCC is a three-digit code that uniquely identifies the country to which a mobile user belongs.
  • MNC is the code of the operator's network in a country, which consists of 2-3 digits and is used to identify the mobile communication network to which the mobile user belongs.
  • the geographic location information of network device #2 may not include MCC and MNC.
  • the geographic location information of the network device #2 may not include the identifier of the network device set where the network device #2 is located and the network device #2 is located in. The number in the network device collection.
  • the geographic location information of the network device #2 may not include the identifier of the network device set where the network device #2 is located.
  • FIG. 9 shows an encoding scheme of the geographic location information of the MEC by taking the network device #2 as an MEC as an example.
  • the geographic location information of the MEC can also be called a globally unique MEC identity (GUMEI).
  • the GUMEI may include an attribution identity and a MEC identity (identity, ID), the attribution identity may include MCC and MNC, and the MEC ID may include MEC region ID, MEC set ID, and MEC number (pointer).
  • the MEC region ID is the identifier of the geographical area where the MEC is located.
  • the geographical area can be an administrative unit in a certain district, such as Shanghai Pudong; the MEC set ID is composed of MECs in a smaller first-level area under the geographical area where the MEC is located.
  • the identifier of the collection, the smaller first-level area under the geographical area where the MEC is located can be a township-level administrative unit, such as Shanghai Pudong Jinqiao; the MEC number is the number of the MEC in the collection, such as 008.
  • FIG. 10 shows a schematic diagram of the structure of the MEC region.
  • the MEC area includes one or more MEC sets, and the MEC set may include one or more MECs.
  • MEC area A includes MEC set 01 and MEC set 02
  • MEC set 01 includes MEC1 to MEC3.
  • FIG. 10 is only an example, showing that the MEC service consists of two MEC areas, and the MEC set may also include more MEC areas; and FIG. 10 is only an example, showing that the MEC area includes two MEC sets, The MEC area may also include more or fewer MEC sets; and Figure 10 is only an example, showing that the MEC set includes two MECs, and the MEC set may include more or fewer MECs.
  • the geographic location information of network device #2 may be the latitude and longitude where network device #2 is located.
  • the geographic location information of the area covered by the network device #2 is determined according to the geographic location information of multiple access network devices in the area.
  • the geographic location of network device #2 determined according to the geographic location information of multiple access network devices
  • the geographic location information of the area can be determined according to the geographic location information of N access network devices in the area covered by the network device #2 that meet the preset condition. It always exists for the defined time, and N is a positive integer.
  • the predefined time can be in years, for example, 1 year, 3 years, 5 years, etc.
  • the predefined time may be the period of updating and updating the communication system, for example, the period of updating from the third generation (3rd Generation, 3G) communication system to the fourth generation (4th Generation, 4G), and for example, the period from 4G communication
  • the system is updated to the cycle of the 5th Generation (5th Generation) communication system.
  • 5th Generation 5th Generation
  • the geographic location information of the area covered by the network device #2 may be geographic coordinates (ie, latitude and longitude), and the geographic coordinates may be the average of the geographic coordinates of N access network devices that meet the preset conditions value, or the geographic coordinate may be the sum of the geographic coordinates of N access network devices that meet the preset condition, or the geographic coordinate may be the variance of the geographic coordinates of the N access network devices that meet the preset condition, or the like.
  • the geographic location information of the area covered by the network device #2 may be spatial geographic coordinates, and the spatial geographic coordinates may be an average value of spatial geographic coordinates of N access devices that meet preset conditions, As shown in formula (1), where L network device #2 represents the spatial geographic coordinates of the area covered by network device #2, and L NBi represents the spatial geographic coordinates of the ith access device.
  • the spatial geographic coordinate system may be the world geodetic system (WGS)-84 geocentric coordinate system, or may be based on the 1954 Beijing coordinate system or the 1980 Xi'an coordinate system.
  • WGS world geodetic system
  • Xi Yi
  • Zi respectively represent the coordinates of the i-th access network device in the spatial geographic coordinate system.
  • the spatial geographic coordinate system may be the world geodetic system (WGS)-84 geocentric coordinate system, or may be based on the 1954 Beijing coordinate system or the 1980 Xi'an coordinate system.
  • WGS world geodetic system
  • the local part is determined based on the identity information of the terminal device associated with the node.
  • the identity information of the terminal device may include at least one of the following: an IP address of the terminal device, a port number, an APP ID, a media access control (media access control, MAC) address, IMSI, SUPI, a phone number, etc., to which the embodiments of the present application Not limited.
  • the manner of determining the local part according to the identity information of the terminal device associated with the node may be to perform hash processing on the identity information of the terminal device to obtain the local part of the node identification.
  • the IMSI of the terminal device may be hashed to obtain the local part
  • the IP address of the terminal device may be hashed to obtain the local part.
  • the method of generating the node identifier by the network device #1 will be described below by taking an example that the node identifier is the identifier of the USN.
  • the network device #1 belonging to the operator will allocate a nearby USN to the terminal device (the USN may be called the terminal device's home USN), and according to the The home USN node identifier is generated from the geographic location information of the area covered by the network device #2 where the home USN is located and the identity information of the terminal device.
  • the network device #1 of the visited place will allocate a nearby network device to the terminal device.
  • the USN (the USN may be referred to as the visited USN of the terminal device), and the visited USN node identifier is generated according to the geographic location information of the area covered by the network device #2 where the visited USN is located and the identity information of the terminal device.
  • the visited USN node identifier The global part in can also be used to identify the network device #2 that the terminal device accesses.
  • the network device #1 sends the node identifier to the terminal device.
  • the terminal device receives the node identification from the network device #1.
  • the node identifier can be used to uniquely identify the node during the communication between the terminal device and the node.
  • the node identifier can be used in the authentication process between the terminal device and the USN, and the authentication process between the USN and the terminal device will be performed in the following in conjunction with other embodiments. Note, the authentication process between the USN and the terminal device is not described in detail here.
  • the geographic location information can be introduced into the node identifier, so that adjacent nodes on the overlay network can be implemented. , it is also close to the physical network, which can optimize routing and reduce end-to-end delay.
  • the solution for determining the global part of the node identification provided by the embodiments of the present application does not require the introduction of a centralized landmark server, so the risks of single point failure and DDoS attack can be avoided.
  • the node identifier provided by the embodiment of the present application can be used in the authentication process between the terminal device and the USN , so as to provide technical support for session establishment and mobility management, etc., and can identify the network device #2 accessed by the terminal device.
  • the following describes a method for authenticating a terminal device and a USN based on the node identifier provided by the embodiment of the present application with reference to FIG. 11 to FIG. 13 .
  • the scenario in which authentication between the terminal device and the USN is required may be when the user is powered on for the first time, or may be a scenario where the user needs to perform two-way authentication again when the user is powered off for a long time.
  • FIG. 11 shows a schematic flowchart of an initial authentication method provided by an embodiment of the present application.
  • the method 1100 may be applied in a communication system as shown in FIG. 1 or FIG. 5 .
  • the method 1100 may include S1110 to S1160, and each step will be described in detail below.
  • the network device #2 is the MEC
  • the global part of the node identification is the MEC_ID as an example for description.
  • the UE sends a first message to the access network device.
  • the access network device receives the first message from the UE.
  • the first message includes a user concealed identifier (subscription concealed identifier, SUCI) of the UE, and the SUCI of the UE is obtained by the UE encrypting the non-routing information in the SUPI of the UE using the public key of the home network (home network, HN).
  • the first message may further include the identity of the home USN transmitted in plain text, where the identity of the home USN is used to address the home USN.
  • the public key of the home network is denoted as K P HN
  • the identity of the home USN is denoted as USN ID home .
  • the USN ID home is generated by the network device #1 deployed by the operator for the terminal device in the process of signing the contract between the UE and the operator.
  • the MEC_ID in the USN ID home is the MEC_ID of the MEC where the UE signs the contract with the operator.
  • the operator will allocate a nearby home USN for the UE, so the MEC of the contract place is the MEC where the home USN is located (it can be called the home MEC), that is to say, the global part of the USN ID home is the home MEC_ID of the MEC where the USN is located.
  • the home MEC the MEC_ID of the MEC where the USN is located.
  • FIG. 12 is only an example, and the MEC_ID is 2 bits (bit) and the hash (IMSI/SUPI) is 3 bits as an example, but as mentioned above, the MEC_ID is 29-30 bits, and the IMSI/SUPI is actually 29-30 bits. The number of bits after hashing is also far more than 3 bits.
  • the access network device sends a first authentication request message to the NSN.
  • the NSN receives the first authentication request message from the access network device.
  • the MEC_ID can be determined according to the USN ID home included in the first message, and the home MEC can be addressed according to the MEC_ID, and further, the access network device can send to the home MEC.
  • the deployed NSN sends a first authentication request message. It should be understood that one NSN is generally deployed under one MEC, so an NSN can also be uniquely addressed according to the MEC_ID.
  • the first authentication request message sent by the access network device to the NSN may include the SUCI of the UE and the USN ID home .
  • the first authentication request message may further include an identifier of a service network (service network, SN) where the access network device is located, and the USN ID home is a USN ID signed with a private key of the service network. home .
  • service network service network
  • the identifier of the SN is denoted as SNid
  • the private key of the SN is denoted as K S SN .
  • the NSN sends a second authentication request message to the home USN.
  • the home USN receives the second authentication request message from the NSN.
  • the NSN addresses the home USN according to the USN ID home in the first authentication request message sent by the access network device, and sends a second authentication request message to the home USN.
  • the second authentication request message includes the SUCI of the UE.
  • the second authentication request message may include the SNid and the USN ID home encrypted by KS SN .
  • the method 1100 may further include S1140.
  • the home USN verifies the validity of the SN.
  • the home USN decrypts the USN ID home encrypted by K S SN according to the public key of the serving network, and can obtain the correct USN ID home , the SN is determined to be valid, otherwise the SN is determined to be invalid.
  • the public key of the serving network is denoted as K P SN .
  • the method 1100 may further include S1141 and S1142.
  • the home USN sends a second message to the CBC. Accordingly, in S1141, the CBC receives the second message from the home USN.
  • the second message includes the SNid, and the second message is used to request to obtain K P SN .
  • the second message may be a request message, or may be a message requesting to obtain the SN public key
  • the CBC sends a response message to the home USN. Accordingly, in S1142, the home USN receives the response message from the CBC.
  • the response message includes ⁇ SNid, K P SN ⁇ .
  • the home USN uses the private key of the home network (referred to as K S HN ) to decrypt SUCI to obtain SUPI.
  • K S HN the private key of the home network
  • KSHN may be stored at the home USN .
  • the home USN can decrypt the SUCI included in the authentication request message #2 according to the KS HN to obtain the SUPI of the UE, and determine which UE to authenticate with according to the SUPI.
  • the home USN selects an authentication method, and performs bidirectional authentication with the UE.
  • the way of bidirectional authentication between the home USN and the UE can be CBC-based bidirectional authentication, or it can be Internet of things (IoT) type authentication.
  • the home USN can select the authentication method according to the subscription content of the UE, or select the authentication method according to the type of the UE. For example, if the authentication mode selected by the UE when signing the contract is the CBC-based two-way authentication, the home USN can select the CBC-based two-way authentication mode. For another example, if the type of the UE is an IoT terminal, the home USN can select the IoT type authentication method.
  • IoT type authentication reference may be made to the prior art, and the CBC-based two-way authentication process is described in conjunction with FIG. 13 .
  • FIG. 13 shows a schematic flowchart of a method for bidirectional authentication between a home USN and a UE based on CBC.
  • the method 1300 may include S1310 to S1380, and each step will be described in detail below.
  • the home USN sends message #1 to the CBC. Accordingly, in S1310, the CBC receives message #1 from the home USN.
  • the message #1 includes SUPI, and the message #1 is used to request to obtain the public key of the UE.
  • the message #1 may be a request message or a message requesting to obtain the public key of the UE.
  • the CBC sends a response message #1 to the home USN. Accordingly, in S1320, the home USN receives the response message #1 from the CBC.
  • Response message #1 includes ⁇ SUPI, K P UE ⁇ .
  • the home USN generates a random number (denoted as R USN ), encrypts the R USN with K P UE and sends it to the UE.
  • the UE decrypts with its own private key (referred to as K S UE ) to obtain R USN .
  • the home USN sends message #2 to the CBC. Accordingly, in S1340, the CBC receives message #2 from the home USN.
  • the USN ID home is included in the message #2, and the message #2 is used to request to obtain the public key of the USN (denoted as K P USN ).
  • the CBC sends a response message #2 to the home USN. Accordingly, at S1350, the home USN receives the response message #2. from the CBC.
  • Response message #2 includes ⁇ USN ID home , K P USN ⁇ . It should be understood that the K P USN obtained by the home USN from the CBC is registered with the CBC by the home network, and the K P USN is signed by the K S HN .
  • the home USN sends a response message #2 to the UE.
  • the UE receives the response message #2 from the home USN.
  • the UE After receiving the response message #2, the UE confirms the signature of the home network with K P HN , thereby verifies the transaction, and obtains K P USN .
  • the UE generates a new random number (referred to as R UE ) by itself, and splices it with R USN before and after to form a random number R UE
  • R UE random number
  • R USN a new random number
  • R USN a new random number
  • R USN encrypts R UE
  • R UE is 12 and the R USN is 14
  • R USN formed by splicing the R UE and the R USN before and after is 1214.
  • the R UE is 0101 and the R USN is 1111
  • the home USN After the home USN receives the encrypted R UE
  • the home USN encrypts the R UE with the K P UE , and sends it to the UE.
  • the UE receives the encrypted R UE , it decrypts it by using K S UE , and if the decoded R UE is equal to the R UE generated by itself, the authentication of the home USN is completed.
  • the authentication between the UE and the USN must be the authentication with the home USN, not the authentication with the visited USN.
  • the visited USN is configured for the UE by the NSN of the visited place when the UE is in the visited place. For example, in Figure 14, if UE#1 moves to the area where MEC#2 is located, the NSN under MEC#2 will configure a visited USN for the UE, and generate it according to the identity information of the MEC and UE#1 where the visited USN is located. Node ID of the visiting USN.
  • the MEC_ID in the node identifier of the visiting USN can be regarded as the temporary identifier of UE#1, which is similar to the globally unique user temporary identifier (GUTI) in 5G.
  • GUI globally unique user temporary identifier
  • the UE After the two-way authentication between the UE and the home USN is completed, the UE establishes a connection with the home USN, and implements processes such as user plane data forwarding through the home USN. Alternatively, after the two-way authentication between the UE and the home USN is completed, if the UE is not in the home place, a connection is established with the visited USN, and user plane data forwarding and other processes are implemented through the visited USN.
  • Figure 12 shows the route maintenance information of the USN node.
  • the routing information table maintained by USN node 00 As an example, if the USN node 00 processes a certain data and obtains the storage address of 01, because the USN node 01 has been activated, the data will be stored on the USN node 01. Similarly, USN node 00 stores the data whose storage address is 03 on node 03, and stores the data whose storage address is 04 on node 04.
  • FIG. 15 is a schematic block diagram of a communication apparatus 1500 provided by an embodiment of the present application.
  • the apparatus 1500 may include a transceiver unit 1510 and a processing unit 1520 .
  • the transceiver unit 1510 can communicate with the outside, and the processing unit 1520 is used for data processing.
  • Transceiver unit 1510 may also be referred to as a communication interface or a communication unit.
  • the apparatus 1500 may implement the steps or processes corresponding to the network device #1 in the above embodiment, for example, it may be the network device #1, or a chip configured in the network device #1 or circuit.
  • the transceiving unit 1510 is configured to perform the transceiving-related operations on the network device #1 side in the above embodiments
  • the processing unit 1520 is configured to perform the processing-related operations on the network device #1 in the above embodiments.
  • the apparatus 1500 may implement steps or processes corresponding to those performed by the network device #1 in the method 700 according to the embodiment of the present application, and the apparatus 1500 may include a method for performing the Element of a method performed by network device #1.
  • each unit in the apparatus 1500 and the above-mentioned other operations and/or functions are respectively to implement the corresponding flow of the method 700 in FIG. 7 .
  • FIG. 16 is a schematic block diagram of a communication apparatus according to another embodiment of the present application.
  • the communication apparatus 1600 shown in FIG. 16 may include: a memory 1610 , a processor 1620 , and a communication interface 1630 .
  • the memory 1610 , the processor 1620 , and the communication interface 1630 are connected through an internal connection path.
  • the memory 1610 is used for storing instructions
  • the processor 1620 is used for executing the instructions stored in the memory 1610 .
  • the memory 1610 may be coupled with the processor 1620 through an interface, or may be integrated with the processor 1620 .
  • the above-mentioned communication interface 1630 uses a transceiver such as but not limited to a transceiver to implement communication between the communication device 1600 and other devices or communication networks.
  • the above-mentioned communication interface 1630 may also include an input/output interface.
  • each step of the above-mentioned method may be completed by an integrated logic circuit of hardware in the processor 1620 or an instruction in the form of software.
  • the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory 1610, and the processor 1620 reads the information in the memory 1610, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.
  • the processor may be a central processing unit (central processing unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), dedicated integrated Circuit (application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor.
  • a portion of the processor may also include non-volatile random access memory.
  • the processor may also store device type information.
  • FIG. 17 is a schematic diagram of a chip system according to an embodiment of the present application.
  • the chip system 1700 shown in FIG. 17 includes: a logic circuit 1710 and an input/output interface (input/output interface) 1720, the logic circuit is configured to be coupled with the input interface and transmit data through the input/output interface to execute the diagram 7 the method described.
  • a logic circuit 1710 and an input/output interface (input/output interface) 1720
  • the logic circuit is configured to be coupled with the input interface and transmit data through the input/output interface to execute the diagram 7 the method described.
  • An embodiment of the present application further provides a processing apparatus, including a processor and an interface, where the processor is configured to execute the method in any of the foregoing method embodiments.
  • the above-mentioned processing device may be one or more chips.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a It is a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (microcontroller unit). , MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • MCU microcontroller unit
  • MCU programmable logic device
  • PLD programmable logic device
  • each step of the above-mentioned method can be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.
  • the processor in this embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above method embodiments may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the aforementioned processors may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable gate arrays
  • the methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in this embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computer program product, the computer program product includes: computer program code, when the computer program code runs on a computer, the computer is made to execute the embodiment shown in method 700 The method of any one of the embodiments.
  • the present application further provides a computer-readable medium, where program codes are stored in the computer-readable medium, and when the program codes are run on a computer, the computer is made to execute the embodiment shown in method 700 .
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state discs, SSD)) etc.
  • a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device may be components.
  • One or more components may reside within a process and/or thread of execution, and a component may be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more data packets (eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals) Communicate through local and/or remote processes.
  • data packets eg, data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet interacting with other systems via signals
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种通信的方法及通信系统。该方法可以包括：第一网络设备生成节点标识，该节点标识包括全局部分和本地部分，该全局部分是根据节点所在的第二网络设备覆盖的区域的地理位置信息确定的，例如，第二网络设备可以是MEC，该本地部分是根据与节点关联的终端设备的身份信息确定的；该第一网络设备向所述终端设备发送所述节点标识。根据本申请实施例，通过在节点标识中引入地理位置信息，可以使得标识空间上近距离的节点在物理网络中也是近距离的，从而减小端到端时延。

Description

通信的方法及通信装置
本申请要求于2020年11月24日提交国家知识产权局、申请号为202011331897.8、申请名称为“通信的方法及通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，并且更具体地，涉及一种通信的方法及通信装置。
背景技术
在传统的分布式哈希表(distributed hash table，DHT)协议中，各个节点的节点标识是随机分配的，并且在分配节点标识的过程中没有考虑节点的位置关系，导致下层物理网络(underlay network)和叠加在其上的逻辑网络(overlay network)的拓扑结构不一致，从而使得逻辑网络的端到端时延高。
发明内容
本申请提供一种通信的方法和通信装置，以期减小端到端时延。
第一方面，提供了一种通信的方法，该方法包括：第一网络设备生成节点标识，该节点标识包括全局部分和本地部分，该全局部分是根据节点所在的第二网络设备覆盖的区域的地理位置信息确定的，该本地部分是根据与节点关联的终端设备的身份信息确定的；该第一网络设备向该终端设备发送该节点标识。
在一种可能的实现方式中，第二网络设备是移动边缘计算(mobile edge computing，MEC)。
基于上述技术方案，通过根据节点所在的第二网络设备覆盖的区域的地理位置信息确定节点标识的全局部分，可以在节点标识中引入地理位置信息，从而可以实现在逻辑网络上邻近的节点，在物理网络上也是近距离的，从而可以优化路由，降低端到端时延。
结合第一方面，在第一方面的某些实现方式中，该区域的地理位置信息包括该第二网络设备的地理位置信息，该第二网络设备的地理位置信息包括以下一项或多项：移动国家码、移动网络码、该第二网络设备所在的地理区域的标识、该第二网络设备所在的集合的标识、该第二网络设备在该集合中的编号。
基于上述方案，将第二网络设备的地理位置信息作为节点标识的全局部分，不需要引入集中式的地标服务器，因此可以避免单点失效和分布式拒绝服务攻击的风险。
结合第一方面，在第一方面的某些实现方式中，该区域的地理位置信息根据该区域内的N个满足预设条件的接入网设备的地理位置信息确定的，该预设条件为该接入网设备在预定义的时间内一直存在，N为正整数。
基于上述方案，将第二网络设备覆盖的区域内的多个接入网设备的地理位置信息作为 节点标识的全局部分，不需要引入集中式的地标服务器，因此可以避免单点失效和分布式拒绝服务攻击的风险。
结合第一方面，在第一方面的某些实现方式中，该区域的地理位置信息包括地理坐标，该地理坐标是该N个满足预设条件的接入网设备的地理坐标的平均值。
基于上述技术方案，将第二网络设备覆盖的区域内的多个接入网设备的地理坐标作为节点标识的全局部分，不需要引入集中式的地标服务器，因此可以避免单点失效和分布式拒绝服务攻击的风险。
结合第一方面，在第一方面的某些实现方式中，该方法应用于包括网络服务节点(network service node，NSN)和用户服务节点(user service node，USN)的通信系统中，该NSN与该USN通过外部接口通信，该NSN包括鉴权功能实体和/或会话管理功能实体，该USN与该终端设备关联，该USN包括以下功能实体：数据转发功能实体、会话管理功能实体、用户数据存储功能实体，该USN包括的功能实体之间通过内部接口通信，该节点是该USN，该节点标识是该USN节点的标识。
基于上述技术方案，本申请实施例提供的生成节点标识的方案可以应用于以用户为中心的网络架构中。
结合第一方面，在第一方面的某些实现方式中，该USN节点标识用于该终端设备与该USN节点的认证过程。
基于上述技术方案，由于USN节点标识包括可以体现USN的地理位置的全局部分，因此将USN节点标识用于USN节点与终端设备的认证过程中，可以便于对USN节点进行寻址。
结合第一方面，在第一方面的某些实现方式中，该节点标识的全局部分用于标识该第二网络设备。
基于上述技术方案，根据节点标识的全局部分，可以确定终端设备所在的第二网络设备。例如，在第二网络设备是MEC的情况下，根据节点标识的全局部分可以确定终端设备所在的MEC。
结合第一方面，在第一方面的某些实现方式中，该终端设备身份信息包括以下任意一项：网际协议(Internet protocol，IP)地址、端口(port)号、应用标识(application identifier，APP ID)、国际移动用户识别码(international mobile subscriber identification number，IMSI)、用户永久标识符(subscriber permanent identifier，SUPI)、电话号码。
第二方面，提供了一种通信装置，包括收发单元和处理单元，该处理单元用于生成节点标识，该节点标识包括全局部分和本地部分，该全局部分是根据节点所在的第二网络设备覆盖的区域的地理位置信息确定的，该本地部分是根据与节点关联的终端设备的身份信息确定的；该收发单元用于向该终端设备发送所述节点标识。
结合第二方面，在第二方面的某些实现方式中，该区域的地理位置信息包括该第二网络设备的地理位置信息，该第二网络设备的地理位置信息包括以下一项或多项：移动国家码、移动网络码、该第二网络设备所在的地理区域的标识、该第二网络设备所在的集合的标识、该第二网络设备在该集合中的编号。
结合第二方面，在第二方面的某些实现方式中，该区域的地理位置信息根据该区域内的N个满足预设条件的接入网设备的地理位置信息确定的，该预设条件为所述接入网设备 在预定义的时间内一直存在，N为正整数。
结合第二方面，在第二方面的某些实现方式中，该区域的地理位置信息包括地理坐标，该地理坐标是该N个满足预设条件的接入网设备的地理坐标的平均值。
结合第二方面，在第二方面的某些实现方式中，该通信装置是包括NSN和USN的通信系统中的NSN，该NSN与该USN通过外部接口通信，该NSN包括鉴权功能实体和/或会话管理功能实体，该USN与该终端设备关联，该USN包括以下功能实体：数据转发功能实体、会话管理功能实体、用户数据存储功能实体，该USN包括的功能实体之间通过内部接口通信，
该节点是该USN，该节点标识是该USN节点的标识。
结合第二方面，在第二方面的某些实现方式中，该USN节点标识用于该终端设备与该USN节点的认证过程。
结合第二方面，在第二方面的某些实现方式中，该节点标识用于标识该第二网络设备。
结合第二方面，在第二方面的某些实现方式中，该终端设备身份信息包括以下任意一项：网际协议IP地址、端口号、应用标识、国际移动用户识别码、用户永久标识、电话号码。
第三方面，提供了一种通信装置，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面及第一方面中任一种可能实现方式中的方法。可选地，该通信装置还包括存储器。可选地，该通信装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信装置为第一网络设备。当该通信装置为第一网络设备时，该通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该通信装置为配置于第一网络设备中的芯片。当该通信装置为配置于第一网络设备中的芯片时，该通信接口可以是输入/输出接口。
可选地，该收发器可以为收发电路。可选地，该输入/输出接口可以为输入/输出电路。
第四方面，提供了一种处理器，包括：输入电路、输出电路和处理电路。所述处理电路用于通过所述输入电路接收信号，并通过所述输出电路发射信号，使得所述处理器执行第一方面及第一方面中任一种可能实现方式中的方法。
在具体实现过程中，上述处理器可以为一个或多个芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第五方面，提供了一种处理装置，包括处理器和存储器。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以执行第一方面及第一方面中任一种可能实现方式中的方法。
可选地，所述处理器为一个或多个，所述存储器为一个或多个。
可选地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
应理解，相关的数据交互过程例如发送指示信息可以为从处理器输出指示信息的过程，接收能力信息可以为处理器接收输入能力信息的过程。具体地，处理器输出的数据可以输出给发射器，处理器接收的输入数据可以来自接收器。其中，发射器和接收器可以统称为收发器。
上述第五方面中的处理装置可以是一个或多个芯片。该处理装置中的处理器可以通过硬件来实现也可以通过软件来实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第六方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得计算机执行上述第一方面及第一方面中任一种可能实现方式中的方法。
第七方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得上述第一方面及第一方面中任一种可能实现方式中的方法被执行。
附图说明
图1示出了适用于本申请实施例提供的方法的通信系统的示意图。
图2示出了NSN、USN以及接入网设备之间的通信接口的示意图。
图3示出了NSN的结构示意图。
图4示出了USN的结构示意图。
图5示出了适用于本申请实施例提供的方法的另一通信系统的示意图。
图6示出了边缘云广泛部署的示意图。
图7示出了本申请实施例提供的方法的示意性流程图。
图8示出了本申请实施例提供的节点标识的结构示意图。
图9示出了本申请实施例提供的全球唯一MEC标识的结构示意图。
图10示出了MEC区域的结构示意图。
图11示出了本申请实施例提供的初始认证的方法的示意性流程图。
图12示出了本申请实施例提供的USN节点标识的示意图。
图13示出了本申请实施例提供的双向认证的方法的示意性流程图。
图14示出了为终端设备配置拜访USN的示意图。
图15示出了本申请实施例提供的通信装置的示意图。
图16示出了本申请另一实施例提供的通信装置的示意性框图。
图17示出了本申请实施例提供的一种芯片系统的示意图。
具体实施方式
下面结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：第六代(6th Generation，6G)或未来的通信系统等。
本申请实施例中所涉及到的终端设备可以称为用户设备(user equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。
终端设备可以是一种向用户提供语音/数据连通性的设备，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端的举例可以为：手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑(如笔记本电脑、掌上电脑等)、移动互联网设备(mobile internet device，MID)、虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。。
此外，终端设备还可以是物联网(internet of things，IoT)系统中的终端设备。IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。IoT技术可以通过例如窄带(narrow band，NB)技术，做到海量连接，深度覆盖，终端省电。
现有的通信网络越来越复杂，网元极度庞大，种类众多，导致接口、协议以及信令交互过多，带来高成本，同时也增加了易遭受攻击的风险点。
现有的移动通信系统都是以网络为中心，用户适应网络，即用户只能选择网络提供的功能，尤其是集中式的核心网提供的功能都是大颗粒度的，无法满足用户个性化需求。而用户越来越追求个性化服务，同时万物互联带来终端的类型剧增，不同的终端需要按需定制的功能，比如，不移动的终端就不用寻呼，有些物联终端不需要语音功能等。
此外，现有集中式的核心网网元(例如，移动性管理功能网元、会话管理功能网元、用户数据管理功能网元、策略管理功能网元)实体一般能处理大量的用户，且集中部署，因此可能存在单点失效和分布式拒绝服务攻击(distributed deny of service，DDoS)的风险，从而造成用户巨大财产和声誉损失。
为解决上述问题，提出了以用户为中心(user centric network，UCN)的网络架构，如图1所示，通信系统100可以包括网络服务节点(network service node，NSN)110和用户服务节点(user service node，USN)120。应理解，图3仅为示意，示出了通信系统100包括4个NSN 110和9个USN 120，在实际部署中，通信系统100可以包括更多数量的NSN 110和/或更多数量的USN 120。
NSN 110是终端设备在核心网侧的初始接入点，由网络运营商直接部署和管理，NSN 110可以单独部署，也可以部署在边缘云或者接入网设备130上。NSN 110可以激活USN  120，并且可以对USN 120进行生命周期管理。NSN 110可以管理一个或多个USN 120，NSN 110与其管理的USN 120可以通过外部接口通信。NSN 110服务于一个或多个接入网设备130，NSN 110与其服务的接入网设备130之间可以通过通信接口通信。终端设备140可以通过接入网设备130与NSN 110进行通信。
应理解，NSN和USN通过外部接口通信表示，对于NSN和USN之间的接口需要定义标准的接口和标准的通信协议。标准的接口可以是现有的标准接口，或者可以是新定义的标准接口。标准的通信协议可以是现有的标准通信协议，或者可以是新定义的标准通信协议。
NSN 110是终端设备在核心网侧的初始接入点可以理解为，终端设备在通过接入网设备接入核心网的过程中，首先连接到NSN 120，然后终端设备可以通过NSN 120与连接到USN 120。
NSN 110激活USN 120可以理解为：在终端设备140初始接入网络的过程中，NSN 110基于终端设备的请求将为该终端设备服务的USN 120激活，并将终端设备140与USN 120进行关联。例如，NSN 110对USN 120进行激活的步骤可以如下所述：
NSN通过服务的接入网设备接收来自终端设备的请求消息，请求消息用于请求接入，请求消息中包括终端设备的标识信息。NSN获取USN的标识，USN的标识与终端设备的标识信息相关联。NSN将USN与终端设备关联。
其中，USN的标识与终端设备的标识信息相关联可以理解为，USN的标识与终端设备的标识信息之间存在对应或映射等关系，也就是说，在获取到终端设备的标识信息的情况下，根据终端设备的标识信息与USN的标识之间的对应或映射等关系，可以获取到USN的标识。
USN的标识与终端设备的标识信息相关联也可以理解为，USN的标识可以是对终端设备的标识信息进行处理得到，例如，USN的标识可以是对终端设备的标识信息进行哈希计算得到的。
NSN 110还可以为USN 120配置以下内容中的一种或多种：存储资源、计算资源、网络资源、中央处理器(central processing unit，CPU)、存储数据库、个性化参数。
存储资源可以是USN 120存储计算机指令等所需的资源，下文中会对第一信息做详细说明，此处暂不详述。计算资源可以是USN 120执行计算机指令的过程中所需的资源，例如可以是强大的图形处理(graphics processing unit，GPU)计算资源。网络资源可以是USN 120与NSN 110、终端设备等通信所需的资源。中央处理器可以用于执行计算机指令等。数据库可以用于存储第一信息等。数据库还可以是分布式存储数据库。
个性化参数可以是NSN根据USN服务的终端设备的类型或数量等配置的。例如，USN服务的终端设备是不移动的终端设备，则NSN可以不为USN配置移动性管理中的寻呼功能。又例如，USN服务的终端设备是机器类的物联网终端设备，则NSN可以不为USN配置会话管理中的语音功能。再例如，针对USN服务的终端设备的数量不同，NSN可以为USN配置不同的存储、计算、网络等资源。再例如，针对USN服务的终端设备与运营商协商而开通的定制化服务，NSN可以为USN配置强大的GPU计算资源、人工智能(artificial intelligence，AI)能力等。
USN 120与终端设备140关联，专属于该终端设备140，为该终端设备140提供所有 的网络服务，例如移动性管理(mobile management，MM)、会话管理(session management，SM)、策略管理(policy management，PM)、数据转发等。USN 120与其关联的终端设备140之间可以通过接入网设备130进行通信，也就是说，USN 120与接入网设备130之间可以通过通信接口通信。
以USN 120是第一USN为例，USN 120在为终端设备提供数据转发服务的步骤可以如下所述：
第一USN接收来自第一终端设备的数据，数据中包括第二终端设备的标识信息。第一USN获取第二USN的标识，第二USN的标识与第二终端设备的标识信息相关联。第一USN向第二USN发送数据，数据通过第二USN发送给第二终端设备。
NSN 110、USN 120以及接入网设备130之间的通信接口如图2所示。其中，R1为NSN 110与接入网设备130之间的通信接口；R2为NSN 110与对应的USN 120之间的通信接口；R3为NSN 110与其他NSN 110之间的通信接口；R4为接入网设备130与USN 120之间的通信接口，接入网设备130与USN 120通过R4接口实现所有的控制面信令和数据的转发；R5为USN 120与另一个USN 120之间的通信接口。应理解，本申请实施例仅以NSN 110、USN 120以及接入网设备130之间的通信接口被命名为R1-R5为例，不应对本申请实施例造成任何限定。
在一种可能的实现方式中，USN 120可以与一个终端设备或一组终端设备关联，并且专属于该一个终端设备或一组终端设备。该一组终端设备中的所有终端设备140可以是同一个区域内的终端设备，或者可以是同一个企业内的终端设备，或者可以是具有相同网络需求的终端设备，等等。本申请实施例对此不做限定。
在一种可能的实现方式中，USN 120可以组成分布式哈希表(distributed hash table，DHT)，USN 120可以看成是DHT中的节点。应理解，在此情况下，NSN 110将运行在DHT之外，但会帮助USN 120配置DHT，即NSN 110是USN 120加入DHT的初始接触点。
在一种可能的实现方式中，结合下文图6所示的应用场景，USN 120可以分布式部署在边缘云中。
下面结合图3和图4对NSN 110和USN 120的结构进行说明。
NSN 110是终端设备在核心网侧的初始接入点，NSN 110具备一些轻量级的核心网功能，例如，鉴权和默认连接建立等。NSN 110可以包括接入管理功能实体和/或鉴权(authentication，AUTH)功能实体。例如图3示出的NSN 110包括接入管理功能实体111和鉴权功能实体112。
接入管理功能实体用于与接入网设备进行对接，对终端设备进行注册、可达管理、接入授权等。若终端设备不需要注册、可达管理、接入授权等，则NSN 110可以不包括接入管理功能实体。接入管理功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现接入管理功能的实体就可以等同于本申请实施例中的接入管理功能实体。。
AUTH功能实体用于对用户进行鉴权。若不需要对用户进行鉴权，则NSN 110可以不包括AUTH功能实体。AUTH功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现鉴权功能的实体就可以等同于本申请实施例中AUTH功能实体。
在一种可能的实现方式中，NSN 110还可以具备对USN 120进行生命周期管理的功 能，例如图3所示，NSN 110还可以包括LCM功能实体113。LCM功能实体113用于多USN 120进行生命周期管理，例如激活USN 120或去激活USN 120。LCM功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现生命周期管理功能的实体就可以等同于本申请实施例中的LCM功能实体。
在一种可能的实现方式中，接入管理功能实体、AUTH功能实体或LCM功能实体可以集成在一起，也可以分离设置。
应理解，在NSN 110包括两个或两个以上功能实体的情况下，NSN 110包括的两个或两个以上功能实体之间可以通过内部接口进行通信。例如，若NSN 110包括的两个功能实体是通过软件实现的，则两个功能实体可以通过简单的内部函数调用通信。与NSN 110与USN 120之间的外部接口相比，内部接口不需要定义标准的接口和通信协议。
USN 120可以包括以下功能实体：数据转发功能实体、会话管理功能实体、用户数据存储功能实体。USN包括的功能实体之间可以通过内部接口通信。例如，若USN 120包括的两个功能实体是通过软件实现的，则两个功能实体可以通过简单的内部函数调用通信。与NSN 110与USN 120之间的外部接口相比，内部接口不需要定义标准的接口和通信协议。
SM功能实体用于建立USN 120与终端设备之间的连接。SM功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现会话管理功能的实体就可以等同于本申请实施例中的SM功能实体。
数据转发功能实体用于对数据进行接收或发送等，例如，从无线接入网(radio access network，RAN)设备接收数据，或，向RAN设备发送数据。数据转发功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现数据转发功能的实体就可以等同于本申请实施例中的数据转发功能实体。
用户数据存储功能实体用于存储第一信息。第一信息可以包括以下一项或多项：需要隐私保护的信息、USN 120服务的终端设备的身份信息、用户的身份信息。需要隐私保护的信息可以包括以下任意一项：用户的签约数据、个人信息、财产账户信息。用户的身份信息可以包括以下任意一项：姓名、性别、身份证号码。终端设备的标识信息可以包括以下任意一项：国际移动用户识别码(international mobile subscriber identification number，IMSI)、用户永久标识符(subscriber permanent identifier，SUPI)、电话号码。用户数据存储功能实体还可以对用户的身份信息与地址的映射关系进行存储，和/或，对用户的身份信息与在应用中用户的身份之间的映射关系。其中，在应用中用户的身份可以是用户在应用中注册的账户名，地址包括可路由地址(routing locator，RLOC)和本地地址(local locator，LLOC)。
用户数据存储功能实体还可以根据USN 120服务的终端设备的指示向第三方提供存储的第一信息的部分或全部。第三方可以是不同于终端设备的归属运营商的其他运营商，或者，可以是终端设备上的一个应用，或者可以是另一个终端设备，本申请实施例对此不做限定。
在一种可能的实现方式中，USN 120还可以包括通过内部接口通信的以下至少一个功能实体：PM功能实体、鉴权认证(authentication authorization accounting，AAA)功能实体或MM功能实体。例如，在USN 120还包括PM功能实体的情况下，PM功能实体可以 与数据转发功能实体、会话管理功能实体、用户数据存储功能实体中的任意一个通过内部接口通信。同样地，AAA功能实体或MM功能实体也可以与数据转发功能实体、会话管理功能实体、用户数据存储功能实体中的任意一个通过内部接口通信。又例如，在USN 120还包括PM功能实体和AAA功能实体的情况下，PM功能实体和AAA功能实体之间可以通过内部接口通信，PM功能实体和AAA功能实体还可以分别与数据转发功能实体、会话管理功能实体、用户数据存储功能实体中的任意一个通过内部接口通信。
PM功能实体用于指导网络行为的统一策略框架。PM功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现策略管理功能的实体就可以等同于本申请实施例中的PM功能实体。
AAA功能实体用于对用户进行鉴权、认证、计费等。AAA功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现鉴权、认证、计费功能的实体就可以等同于本申请实施例中的AAA功能实体。
MM功能实体用于移动性管理等，例如，合法监听等。MM功能实体可以是软件、硬件或软件和硬件的结合等，只要是能实现移动性管理功能的实体就可以等同于本申请实施例中的MM功能实体。
应理解，USN 120包括的多个功能实体之间可以分离设置，也可以集成在一起，本申请实施例对此不做限定。
图4示出了USN 120的结构示意图的一例。如图4所示，USN 120可以向无线接入网(radio access network，RAN)设备发送数据，或者从RAN设备接收数据，USN 120也可以从数据网(data network，DN)设备接收数据，或者向DN设备发送数据。
图4所示的USN 120包括运行模块121。运行模块121主要包括数据转发功能实体、SM功能实体、PM功能实体、AAA功能实体、MM功能实体。其中，数据转发功能实体与其他功能实体可以集成在一起，也可以分离设置。例如，数据转发功能实体可以与其他功能实体独立设置，即数据包转发功能实体可以是独立的一个模块，例如可以叫做数据模块1211。SM功能实体、PM功能实体、AAA功能实体以及MM功能实体可以集成在一起设置，也可以分离设置，例如，SM功能实体、PM功能实体、AAA功能实体以及MM功能实体可以集成在一起设置，称为控制模块1212。
图4所示的USN 120还包括管理和存储模块122。管理和存储模块122可以对应于上文所述的用户数据存储功能实体。例如图4所示，管理和存储模块122可以存储用户个人信息，还可以存储用户的个人信息与临时标识(temporary identifier，TID)的映射关系，和/或用户的个人信息与RLOC和LLOC之间的映射关系。TID可以对应于上文所述的在应用中用户的身份。
如上文所述，USN 120有一个与其对应的标识，终端设备的标识信息、USN 120的标识以及USN 120存储的信息可以采用键值对(key-value)的方式进行存储。如图4所示，图4中的键可以对应于终端设备的标识信息，键标识可以对应于USN 120的标识，值可以对应于USN 120存储的信息。在获取到终端设备的标识信息(键)的情况下，根据终端设备的标识信息可以获取到USN 120的标识(键标识)，进一步地，根据USN 120的标识可以索引到USN 120存储的信息。
应理解，本申请实施例仅以图4为例，对USN 120的结构进行了说明，不应对本申 请实施例造成任何限定。服务于不同终端设备140的USN 120可以包括不同的功能实体。例如，为不移动的终端设备140提供服务的USN 120可以不包括MM功能实体。又例如，为不需要鉴权、认证、计费功能的终端设备140提供服务的USN 120可以不包括AAA功能实体。
还应理解，本申请实施例对USN 120包括的各个模块的命名仅为示例，不应对本申请实施例构成限定。USN 120包括的各个模块也可以被命名为其他名称，例如，管理和存储模块可以被命名为用户数据存储功能实体，或者用户数据存储模块，或者用户数据管理功能实体等。
在一种可能的实现方式中，如图5所示，本申请实施例提供的通信系统100还可以包括联盟区块链(consortium blockchain，CBC)150。
CBC 150可以包括多家运营商网络，主要作用是存储第二信息。第二信息可以包括以下一项或多项：用户与运营商之间的交易记录、运营商网络的公钥。第二信息在CBC 150中的存储地址可由USN 120中存储的第一信息指示的。例如，用户与运营商签约之后，运营商将交易记录保存在CBC 150中，而将具体的签约内容发送给终端设备，由终端设备保存在为其服务的USN 120中。也就是说，CBC 150包括的多家运营商只能在CBC 150看到用户与运营商之间的交易记录，而CBC 150处没有具体的签约内容。
CBC 150还可以包括多家银行的数字资产管理机构，或者，还可以包括多家身份管理机构，或者，还可以包括多家高校的数字资产管理机构。在此情况下，CBC 150还可以存储银行数字资产管理机构的公钥、身份管理机构的公钥或高校的数字资产管理机构的公钥，CBC 150还可以存储银行、身份管理机构或高校为用户提供服务或交易的记录。
在一种可能的实现方式中，CBC 150可以由分布式账本(distributed ledge technology，DL/DLT)代替。DLT是分布在多个节点或计算机设备上的数据库，这些节点在地理上分布在多个网络、机构或国家。由此可知，CBC 150是DLT的一种形式。在CBC 150由DLT代替的情况下，可以有更多的用户看到运营商与用户之间的签约记录。
CBC 150或DLT可以通过通信接口与USN 120进行通信。例如，图2中示出了USN 120与DL之间的通信接口R6。应理解，本申请实施例仅以USN 120与DL之间的通信接口被命名为R6为例，不应对本申请实施例造成任何限定。
在UCN的网络架构中，为了实现对不同UE的USN的快速查找，本申请实施例提出在UCN的网络架构中引入分布式哈希表(distributed hash table，DHT)的方案，即由不同的UE的USN组成DHT的节点。传统的DHT是随机分配各个节点的节点标识符，而没有考虑节点的位置关系，会导致下层物理网络(underlay network)和叠加在其上的逻辑网络(overlay network)的拓扑结构不一致，从而使得逻辑网络的端到端时延高。本申请提出在DHT节点标识中引入地理位置感知信息，优化路由，以降低overlay网络的端到端时延。
本申请实施例提出一种基于地理位置信息感知的节点标识，能够保证标识空间上近距离的节点在物理网络中也是近距离的，并且不需要引入集中式的地标服务器。以及基于本申请实施例提出的基于地理位置信息感知的节点标识，本申请实施例还提出了一种认证的方法。
下面将结合附图详细说明本申请实施例提供的各个实施例。
本申请实施例所提出的UCN网络架构的实现可以基于假设边缘云已广泛部署的场景，首先结合图6对边缘云进行说明。如图6所示，边缘云和核心云形成协同互补，边缘云更靠近用户，能够更好地支持对时延、数据隐私等高要求的应用，适合网络功能的分布式部署。UE可以通过接入网设备接入边缘云。
边缘云是公有云的一种，基于广泛覆盖的小站点，一般是内容分发网络(content delivery network，CDN)、因特网接入点(point of presence，POP)、移动边缘计算(mobile edge computing，MEC)，每个节点小集群形态对外提供公有云服务。
图7示出了本申请实施例提供的终端设备接入网络的方法的示意性交互图。图7所示的方法可以应用在图1或图5所示的UCN网络架构中，当然也可应用在其他网络架构。如图7所述，方法700可以包括S710和S720，下面详细说明各个步骤。
S710，网络设备#1(第一网络设备的一例)生成节点标识。
基于本申请实施例提供的UCN网络架构，网络设备#1可以是NSN，节点可以是USN。网络设备#1也可以是其他具有无线收发功能的设备，例如可以是节点B(Node，NB)、演进型节点B(evolved Node B，eNB)、基站控制器(basic station controller，BSC)、基站收发台(basic transceiver station，BTS)等，还可以为5G，如，NR系统中的gNB等。
在一种可能的实现方式中，节点可以是DHT中的节点。
图8示出了本申请实施例提供的节点的标识的结构示意图。如图8所示，该节点标识可以包括全局部分和本地部分。
节点标识的全局部分是根据节点所在的网络设备#2(第二网络设备的一例)覆盖的区域的地理位置信息确定的。本申请实施例对网络设备#2覆盖的区域的地理位置信息不做限定。
在一种实现方式中，网络设备#2覆盖的区域的地理位置信息包括网络设备#2的地理位置信息。应理解，根据网络设备#2的地理位置信息可以唯一识别一个网络设备#2。还应理解，网络设备#1与网络设备#2可以是同一个网络设备，网络设备#1也可以是网络设备#2管理的网络设备。
其中，网络设备#2可以是任意一种具有无线收发功能的设备，例如可以是eNB、BSC、BTS等，还可以为5G，如，NR系统中的gNB等。
网络设备#2还可以是边缘云中的站点，例如可以是CDN、POP、MEC等。
基于本申请实施例提出的UCN网络架构，网络设备#2还可以是NSN。
在一种可能的实现方式中，网络设备#2覆盖的区域内有多个网络设备#2。例如，网络设备#2是gNB#1，在gNB#1覆盖的区域内还可以存在gNB#2、gNB#3等。
在一种可能的实现方式中，网络设备#2覆盖的区域内只有一个网络设备#2。例如，在部署边缘云的过程中，在一个地理区域内，一般部署一个站点，例如部署的站点可以是MEC。若网络设备#2是边缘云站点#1(例如CDN、POP或MEC)，则边缘云站点#1覆盖的区域内除边缘云站点#1之外没有其他的边缘云站点。
应理解，本申请实施例仅以网络设备#2是gNB#1或边缘云站点#1为例进行说明，不应对本申请实施例造成任何限定。当然，在网络设备#2是gNB#1的情况下，gNB#1覆盖的区域内可能除gNB#1之外没有其他的gNB；在网络设备#2是边缘云站点#1的情况下，在边缘云站点#1覆盖的区域内除边缘云站点#1之外也可能存在其他的边缘云站点。
本申请实施例对网络设备#2的地理位置信息不做限定。
作为一个示例，网络设备#2的地理位置信息可以包括以下一项或多项：移动国家码(mobile country code，MCC)、移动网络码(mobile network code，MNC)、网络设备#2所在的地理区域的标识、网络设备#2所在的网络设备集合的标识、网络设备#2在网络设备集合中的编号。
MCC是唯一标识移动用户所属国家的三位数字代码。MNC是一个国家内运营商网络的码，由2-3位数组成，用于识别移动用户所归属的移动通信网。
例如，若网络设备#2所在的地理区域内，没有网络设备#2所属的运营商以外的运营商部署的网络设备，则网络设备#2的地理位置信息可以不包括MCC和MNC。又例如，若网络设备#2所在的地理区域内，只有一个网络设备#2，则网络设备#2的地理位置信息可以不包括网络设备#2所在的网络设备集合的标识和网络设备#2在网络设备集合中的编号。再例如，若网络设备#2所在的地理区域内只有一个网络设备集合，则网络设备#2的地理位置信息可以不包括网络设备#2所在的网络设备集合的标识。
图9以网络设备#2是MEC为例，示出了MEC的地理位置信息的编码方案。
如图9所示，由于MEC的地理位置信息可以唯一识别一个MEC，因此MEC的地理位置信息也可以叫做全球唯一MEC标识(globally unique MEC identity，GUMEI)。GUMEI可以包括归属地标识和MEC标识(identity，ID)，归属地标识可以包括MCC和MNC，MEC ID可以包括MEC区域(region)ID、MEC集合(set)ID以及MEC编号(pointer)。MEC region ID即MEC所在的地理区域的标识，该地理区域例如可以是某一区行政单位，例如上海浦东；MEC set ID即由MEC所在的地理区域下的更小一级区域内的MEC组成的集合的标识，MEC所在的地理区域下的更小一级区域可以是镇乡级行政单位，例如上海浦东金桥；MEC编号即MEC在所在的集合中的编号，例如008。
图10示出了MEC区域的结构示意图。如图10所示，MEC区域包括一个或多个MEC集合，MEC集合可以包括一个或多个MEC。例如MEC区域A包括MEC集合01和MEC集合02，MEC集合01中包括MEC1至MEC3。应理解，图10仅为示例，示出了MEC服务由两个MEC区域组成，MEC集合也可以包括更多的MEC区域；以及图10仅为示例，示出了MEC区域包括两个MEC集合，MEC区域也可以包括更多或更少的MEC集合；以及图10仅为示例，示出了MEC集合包括两个MEC，MEC集合可以包括更多或更少的MEC。
作为另一个示例，网络设备#2的地理位置信息可以是网络设备#2所在的经纬度。
在另一种实现方式中，网络设备#2覆盖的区域的地理位置信息包括根据该区域内的多个接入网设备的地理位置信息确定。
在一种可能的实现方式中，为了避免由于扩容或减少网络设备#2覆盖的区域内的接入网设备，而使得根据多个接入网设备的地理位置信息确定的网络设备#2的地理位置信息发生变化，可以根据网络设备#2覆盖的区域内的N个满足预设条件的接入网设备的地理位置信息确定该区域的地理位置信息，该预设条件为接入网设备在预定义的时间内一直存在，N为正整数。预定义的时间可以是以年为单位，例如，1年，3年，5年等。具体地，预定义的时间可以是通信系统更新换代的周期，例如，从第三代(3rd Generation，3G)通信系统更新到第四代(4th Generation，4G)的周期，又例如，从4G通信系统更新到第 五代(5th Generation)通信系统的周期。可以理解，在通信系统更新换代的过程中，网络设备#2覆盖区域内的主要的接入设备的地理位置信息是不变的，也就是说，在通信系统更新换代的过程中，对主要接入网设备的更新是在原址上更新。当然，预定义的时间也可以是其他的时间。
在一种可能的实现方式中，网络设备#2覆盖的区域的地理位置信息可以是地理坐标(即经纬度)，该地理坐标可以是N个满足预设条件的接入网设备的地理坐标的平均值，或者该地理坐标可以是N个满足预设条件的接入网设备的地理坐标的和，或者该地理坐标可以是N个满足预设条件的接入网设备的地理坐标的方差等。
在一种可能的实现方式中，网络设备#2覆盖的区域的地理位置信息可以是空间地理坐标，该空间地理坐标可以是N个满足预设条件的接入设备的空间地理坐标的平均值，如公式(1)所示，其中，L 网络设备#2表示网络设备#2覆盖的区域的空间地理位置坐标，L NBi表示第i个接入设备的空间地理坐标。
Figure PCTCN2021106736-appb-000001
Xi、Yi、Zi分别表示第i个接入网设备在空间地理坐标系中的坐标。该空间地理坐标系可以是世界大地测量(world geodetic system，WGS)-84地心坐标系，也可以根据1954北京坐标系或1980西安坐标系，具体地，更多关于空间地理坐标的描述可以参考现有技术，本申请实施例在此不再详述。
本地部分是根据与节点关联的终端设备的身份信息确定的。终端设备的身份信息可以包括以下至少一项：终端设备的IP地址，端口号、APP ID、媒体访问控制(media access control，MAC)地址、IMSI、SUPI、电话号码等，本申请实施例对此不做限定。
根据与节点关联的终端设备的身份信息确定本地部分的方式可以是，对终端设备的身份信息进行哈希(hash)处理，得到节点标识的本地部分。例如，可以对终端设备的IMSI进行哈希处理得到本地部分，又例如，可以对终端设备的IP地址进行哈希处理得到本地部分。
下面以节点标识是USN的标识为例，对网络设备#1生成节点标识的方式进行说明。
在一种可能的实现方式中，在终端设备与运营商签约之后，属于该运营商的网络设备#1会为终端设备就近分配一个USN(该USN可以称为终端设备的归属USN)，并根据该归属USN所在的网络设备#2覆盖的区域的地理位置信息和该终端设备的身份信息生成归属USN节点标识。
在另一种可能的实现方式中，若终端设备从归属地移动到一个拜访地，则终端设备接入拜访地的网络设备#1之后，拜访地的网络设备#1会就近为终端设备分配一个USN(该USN可以称为终端设备的拜访USN)，并根据该拜访USN所在的网络设备#2覆盖的区域的地理位置信息和该终端设备的身份信息生成拜访USN节点标识，该拜访USN节点标识中的全局部分还可以用于标识终端设备接入的网络设备#2。
S720，网络设备#1向终端设备发送节点标识。相应地，在S720中，终端设备接收来自网络设备#1的节点标识。
该节点标识可以用于在终端设备与节点通信的过程中，唯一标识该节点。
在一种可能的实现方式中，在节点是USN的情况下，该节点标识可以用于终端设备与USN的认证过程中，下文中会结合其他实施例对USN与终端设备之间的认证过程进行说明，此处暂不对USN与终端设备之间的认证过程进行详述。
在本申请实施例中，通过根据节点所在的网络设备#2覆盖的区域的地理位置信息确定节点标识的全局部分，可以在节点标识中引入地理位置信息，从而可以实现在overlay网络上邻近的节点，在物理网络上也是近距离的，从而可以优化路由，降低端到端时延。此外，与现有技术相比，本申请实施例提供的确定节点标识的全局部分的方案不需要引入集中式的地标服务器，因此可以避免单点失效和DDoS攻击的风险。
此外，基于本申请实施例提供的UCN网络架构，在节点是USN，节点标识是USN节点的标识的情况下，根据本申请实施例提供的节点标识，可以用于终端设备与USN的认证过程中，从而为会话的建立和移动性管理等提供技术支持，以及可以标识终端设备接入的网络设备#2。
下面结合图11至图13对终端设备和USN基于本申请实施例提供的节点标识进行认证的方法进行说明。
需要说明的是，终端设备与USN之间需要进行认证的场景可以是用户首次开机时，或者，可以是由于用户长时间的关机，再开机时，需要重新进行双向认证的场景。
图11示出了本申请实施例提供的初始认证的方法的示意性流程图。方法1100可以应用如图1或图5所示的通信系统中。如图11所示，该方法1100可以包括S1110至S1160，下面详细说明各个步骤。
需要说明的是，下文中以网络设备#2是MEC，以及以节点标识的全局部分是MEC_ID为例进行说明。
S1110，UE向接入网设备发送第一消息。相应地，在S1110中，接入网设备接收来自UE的第一消息。
第一消息中包括UE的用户隐藏标识符(subscription concealed identifier，SUCI)，UE的SUCI是UE使用归属网络(home network，HN)的公钥加密UE的SUPI中的非路由信息得到的。第一消息中还可包括明文传输的归属USN的标识，该归属USN的标识用于寻址归属USN。下文中将归属网络的公钥记为K P HN，将归属USN的标识记为USN ID home。
USN ID home是UE与运营商签约的过程中，由运营商部署的网络设备#1为终端设备生成的。例如图12所示，USN ID home包括高字节位的MEC_ID和低字节位的哈希(IMSI/SUPI)，低字节位由UE的IMSI或SUPI进行哈希运算得到。例如，MEC_ID为2，哈希(IMSI/SUPI)＝7，则可以得到USN ID home＝27。
应理解，USN ID home中的MEC_ID是UE与运营商签约时，签约地的MEC的MEC_ID。在UE于运营商签约的过程中运营商会为UE就近分配一个归属USN，因此签约地的MEC即归属USN所在的MEC(可以称为归属MEC)，也就是说，USN ID home的全局部分是归属USN所在的MEC的MEC_ID。关于MEC_ID的结构可以参考上文S710中的描述，为了简洁，本申请实施例不再详述。
还应理解，图12仅为示例，以MEC_ID为2比特(bit)，哈希(IMSI/SUPI)为3比特为例，但实际如前文所述，MEC_ID为29-30比特，以及IMSI/SUPI进行哈希后的位数也远超3比特。
S1120，接入网设备向NSN发送第一认证请求消息。相应地，在S1120中，NSN接收来自接入网设备的第一认证请求消息。
接入网设备接收到来自UE的第一消息中，根据第一消息中包括的USN ID home可以确定MEC_ID，进一步根据MEC_ID可以寻址到归属MEC，进一步地，接入网设备可以向归属MEC下部署的NSN发送第一认证请求消息。应理解，一个MEC下一般会部署一个NSN，因此根据MEC_ID也可以唯一寻址到一个NSN。
接入网设备向NSN发送的第一认证请求消息中可以包括UE的SUCI和USN ID home。
在一种可能的实现方式中，第一认证请求消息中还可以包括接入网设备所在的服务网络(service network，SN)的标识，以及USN ID home是利用服务网络的私钥签名的USN ID home。下文中将SN的标识记为SNid，将SN的私钥记为K S SN。
S1130，NSN向归属USN发送第二认证请求消息。相应地，在S1130中，归属USN接收来自NSN的第二认证请求消息。
NSN根据接入网设备发送的第一认证请求消息中的USN ID home寻址到归属USN，并向归属USN发送第二认证请求消息。
第二认证请求消息中包括UE的SUCI。
在一种可能的实现方式中，若第一认证请求消息中包括SNid和利用K S SN签名的USN ID home，则第二认证请求消息中可以包括SNid和利用K S SN加密的USN ID home。
在一种可能的实现方式中，若第二认证请求消息中包括SNid和利用K S SN加密的USN ID home，则方法1100还可以包括S1140。
S1140，归属USN对SN的合法性进行验证。
若归属USN根据服务网络的公钥对利用K S SN加密的USN ID home解密，可以得到正确的USN ID home，则确定SN合法，否则确定SN不合法。下文中将服务网络的公钥记为K P SN。在归属USN确定SN合法的情况下，继续执行方法1100；在归属USN确定SN不合法的情况下，则结束认证过程。
在一种可能的实现方式中，若归属USN处没有保存K P SN，则方法1100还可以包括S1141和S1142。
S1141，归属USN向CBC发送第二消息。相应地，在S1141中，CBC接收来自归属USN的第二消息。
第二消息中包括SNid，第二消息用于请求获取K P SN。第二消息可以是请求消息，或者可以是请求获取SN公钥的消息
S1142，CBC向归属USN发送响应消息。相应地，在S1142中，归属USN接收来自CBC的响应消息。
响应消息中包括{SNid，K P SN}。
S1150，归属USN利用归属地网络的私钥(记为K S HN)解密SUCI获得SUPI。
应理解，归属USN处可以保存K S HN。归属USN收到来自NSN的认证请求消息#2之后，可以根据K S HN解密认证请求消息#2中包括的SUCI，从而获得UE的SUPI，以根据SUPI确定是与哪个UE进行认证。
S1160，归属USN选择认证方式，并与UE进行双向认证。
归属USN与UE进行双向认证的方式可以是基于CBC的双向认证，或者可以是万物 互联(internet of things，IoT)类型认证等。归属USN可以根据UE的签约内容选择认证方式，或者根据UE的类型选择认证方式。例如，UE在签约时选择的认证方式是基于CBC的双向认证，则归属USN可以选择基于CBC的双向认证方式。又例如，UE的类型是物联网终端，则归属USN可以选择IoT类型认证的方式。关于IoT类型认证的方式可以参考现有技术，文中结合图13对基于CBC的双向认证过程进行说明。
图13示出了归属USN与UE基于CBC进行双向认证的方法的流程示意图。如图13所示，方法1300可以包括S1310至S1380，下面详细说明各个步骤。
S1310，归属USN向CBC发送消息#1。相应地，在S1310中，CBC接收来自归属USN的消息#1。
消息#1中包括SUPI，消息#1用于请求获取UE的公钥。消息#1可以是一个请求消息，也可以是请求获取UE的公钥的消息。
S1320，CBC向归属USN发送响应消息#1。相应地，在S1320中，归属USN接收来自CBC的响应消息#1。
响应消息#1中包括{SUPI，K P UE}。
S1330，归属USN产生一个随机数(记为R USN)，并用K P UE对R USN加密后发送给UE。相应地，UE接收到归属USN发送的用K P UE加密的R USN之后，用自己的私钥(记为K S UE)解密得到R USN。
S1340，归属USN向CBC发送消息#2。相应地，在S1340中，CBC接收来自归属USN的消息#2。
消息#2中包括USN ID home，消息#2用于请求获取USN的公钥(记为K P USN)。
S1350，CBC向归属USN发送响应消息#2。相应地，在S1350，归属USN接收来自CBC的响应消息#2.。
响应消息#2中包括{USN ID home，K P USN}。应理解，归属USN从CBC获取的K P USN是归属地网络向CBC注册的，并且K P USN由K S HN签名过的。
S1360，归属USN向UE发送响应消息#2。相应地，在S1360中，UE接收来自归属USN的响应消息#2。
UE接收到响应消息#2之后，利用K P HN确认归属地网络的签名，从而验证该交易，并取得K P USN。
S1370，UE自己产生一个新的随机数(记为R UE)，并和R USN前后拼接，组成一个随机数R UE|R USN，并用K P USN对R UE|R USN进行加密后发送给归属USN。例如，R UE是12，R USN是14，则将R UE和R USN前后拼接组成的R UE|R USN是1214。再例如，R UE是0101，R USN是1111，则将R UE和R USN前后拼接组成的R UE|R USN是01011111。相应地，归属USN接收到加密的R UE|R USN之后，若利用K S USN对加密的R UE|R USN解密之后，解出的R USN等于自己之前产生的R USN，则归属USN对UE验证完成。
S1380，归属USN用K P UE对R UE加密，并发送给UE。相应地，UE接收到加密的R UE之后，利用K S UE对其解密，若解出的R UE等于自己之前产生的R UE，则完成对归属USN的认证。
需要说明的是，UE与USN之间的认证一定是与归属USN之间的认证，而不是与拜访USN之间的认证。拜访USN是UE处在拜访地时，由拜访地的NSN为UE配置的。例 如，图14中，若UE#1移动到MEC#2所在的区域内，则MEC#2下的NSN会为UE配置一个拜访USN，并按照拜访USN所在的MEC和UE#1的身份信息生成拜访USN的节点标识。在后续通信的过程中，拜访USN的节点标识中的MEC_ID可以看做UE#1的临时标识，类似于5G中的全球唯一的用户临时标识(globally unique temporary identifier，GUTI)。应理解，图14中仅以MEC#1下部署了三个USN、MEC#2下部署了三个USN、MEC#3下部署了四个USN为例，在实际的部署中，可能会部署更多数量的MEC，以及在每个MEC下可能部署更多数量的USN。
UE与归属USN双向认证完成之后，则与归属USN建立连接，并通过归属USN实现用户面数据转发等流程。或者，在UE与归属USN双向认证完成之后，若UE不在归属地，则与拜访USN建立连接，并通过拜访USN实现用户面数据转发等流程。
在UE通过USN实现用户面数据转发等流程时，USN需要维护节点的路由信息。USN节点的路由维护信息如图12所示。以00号USN节点维护的路由信息表为例，00号USN节点如果对某数据处理得出存储地址为01，因为01号USN节点已经激活，所以会将数据存储在01号USN节点上。同理，00号USN节点将存储地址为03的数据存储到03号节点上，将存储地址为04的数据存储到04号节点上。而如果00号节点对某数据处理得出存储地址是06，而06号USN节点未激活，则00号USN节点会将该数据存储到顺时针方向的下一个激活节点上，所以对于存储地址为06的数据，00号USN节点会将其存储到07号USN节点上。应理解，为了满足对数据进行就近存储，则要求每个MEC下的最大号节点是激活的，这样不会将存储地址为该MEC下的地址的数据存储到下一个MEC节点上。例如，图12中，全局部分都是0的USN节点部署在同一个MEC下，并且07号USN节点是该MEC下的最大号节点，假如07号USN节点没有激活，则按顺时针方向，对于存储地址为07号USN节点的数据就需要存储到10号USN节点上了，而10号USN节点与07号USN节点在不同的MEC下，不能满足就近存储。
本文中描述的各个实施例可以为独立的方案，也可以根据内在逻辑进行组合，这些方案都落入本申请的保护范围中。
以上，结合图7至图14详细说明了本申请实施例提供的通信的方法。以下，结合图15至图17详细说明本申请实施例提供的通信装置。
图15是本申请实施例提供的通信装置1500的示意性框图。如图所示，该装置1500可以包括收发单元1510和处理单元1520。收发单元1510可以与外部进行通信，处理单元1520用于进行数据处理。收发单元1510还可以称为通信接口或通信单元。
在一种可能的设计中，该装置1500可实现对应于上文实施例中的网络设备#1执行的步骤或者流程，例如，可以为网络设备#1，或者配置于网络设备#1中的芯片或电路。收发单元1510用于执行上文实施例中的网络设备#1侧的收发相关操作，处理单元1520用于执行上文实施例中的网络设备#1的处理相关操作。
一种可能的实现方式，该装置1500可实现对应于根据本申请实施例的方法700中的网络设备#1执行的步骤或者流程，该装置1500可以包括用于执行图7中的方法700中的网络设备#1执行的方法的单元。并且，该装置1500中的各单元和上述其他操作和/或功能分别为了实现图7中的方法700的相应流程。
应理解，各单元执行上述相应步骤的具体过程在上述实施例中已经详细说明，为了简 洁，在此不再赘述。
图16是本申请另一实施例的通信装置的示意性框图。图16所示的通信装置1600可以包括：存储器1610、处理器1620、以及通信接口1630。其中，存储器1610、处理器1620，通信接口1630通过内部连接通路相连，该存储器1610用于存储指令，该处理器1620用于执行该存储器1610存储的指令。可选地，存储器1610既可以和处理器1620通过接口耦合，也可以和处理器1620集成在一起。
需要说明的是，上述通信接口1630使用例如但不限于收发器一类的收发装置，来实现通信装置1600与其他设备或通信网络之间的通信。上述通信接口1630还可以包括输入/输出接口(input/output interface)。
在实现过程中，上述方法的各步骤可以通过处理器1620中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1610，处理器1620读取存储器1610中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应理解，本申请实施例中，该处理器可以为中央处理单元(central processing unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中，该存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。处理器的一部分还可以包括非易失性随机存取存储器。例如，处理器还可以存储设备类型的信息。
图17是本申请实施例的一种芯片系统的示意图。图17所示的芯片系统1700包括：逻辑电路1710以及输入/输出接口(input/output interface)1720，所述逻辑电路用于与输入接口耦合，通过所述输入/输出接口传输数据，以执行图7所述的方法。
本申请实施例还提供了一种处理装置，包括处理器和接口；所述处理器用于执行上述任一方法实施例中的方法。
应理解，上述处理装置可以是一个或多个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器， 闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行方法700所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行方法700所示实施例中任意一个实施例的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数 字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机 存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (21)

  1. 一种通信的方法，其特征在于，包括：
    第一网络设备生成节点标识，所述节点标识包括全局部分和本地部分，所述全局部分是根据节点所在的第二网络设备覆盖的区域的地理位置信息确定的，所述本地部分是根据与节点关联的终端设备的身份信息确定的；
    所述第一网络设备向所述终端设备发送所述节点标识。
  2. 根据权利要求1所述的方法，其特征在于，所述区域的地理位置信息包括所述第二网络设备的地理位置信息，所述第二网络设备的地理位置信息包括以下一项或多项：移动国家码、移动网络码、所述第二网络设备所在的地理区域的标识、所述第二网络设备所在的集合的标识、所述第二网络设备在所述集合中的编号。
  3. 根据权利要求1所述的方法，其特征在于，所述区域的地理位置信息根据所述区域内的N个满足预设条件的接入网设备的地理位置信息确定的，所述预设条件为所述接入网设备在预定义的时间内一直存在，N为正整数。
  4. 根据权利要求3所述的方法，其特征在于，所述区域的地理位置信息包括地理坐标，所述地理坐标包括所述N个满足预设条件的接入网设备的地理坐标的平均值。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述方法应用于包括网络服务节点NSN和用户服务节点USN的通信系统中，所述NSN与所述USN通过外部接口通信，所述NSN包括鉴权功能实体和/或会话管理功能实体，所述USN与所述终端设备关联，所述USN包括以下功能实体：数据转发功能实体、会话管理功能实体、用户数据管理功能实体，所述USN包括的功能实体之间通过内部接口通信，
    所述节点是所述USN，所述节点标识是所述USN节点的标识。
  6. 根据权利要求5所述的方法，其特征在于，所述USN节点标识用于所述终端设备与所述USN节点的认证过程。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述节点标识的全局部分用于标识所述第二网络设备。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述终端设备的身份信息包括以下任意一项：网际协议IP地址、端口号、应用标识、国际移动用户识别码、用户永久标识、电话号码。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第二网络设备是移动边缘计算MEC。
  10. 一种通信装置，其特征在于，包括收发单元和处理单元，
    所述处理单元用于生成节点标识，所述节点标识包括全局部分和本地部分，所述全局部分是根据节点所在的第二网络设备覆盖的区域的地理位置信息确定的，所述本地部分是根据与节点关联的终端设备的身份信息确定的；
    所述收发单元用于向所述终端设备发送所述节点标识。
  11. 根据权利要求10所述的通信装置，其特征在于，所述区域的地理位置信息包括所述第二网络设备的地理位置信息，所述第二网络设备的地理位置信息包括以下一项或多 项：移动国家码、移动网络码、所述第二网络设备所在的地理区域的标识、所述第二网络设备所在的集合的标识、所述第二网络设备在所述集合中的编号。
  12. 根据权利要求10所述的通信装置，其特征在于，所述区域的地理位置信息根据所述区域内的N个满足预设条件的接入网设备的地理位置信息确定的，所述预设条件为所述接入网设备在预定义的时间内一直存在，N为正整数。
  13. 根据权利要求12所述的通信装置，其特征在于，所述区域的地理位置信息包括地理坐标，所述地理坐标是所述N个满足预设条件的接入网设备的地理坐标的平均值。
  14. 根据权利要求10至13中任一项所述的通信装置，其特征在于，所述通信装置是包括网络服务节点NSN和用户服务节点USN的通信系统中的NSN，所述NSN与所述USN通过外部接口通信，所述NSN包括鉴权功能实体和/或会话管理功能实体，所述USN与所述终端设备关联，所述USN包括以下功能实体：数据转发功能实体、会话管理功能实体、用户数据存储功能实体，所述USN包括的功能实体之间通过内部接口通信，
    所述节点是所述USN，所述节点标识是所述USN节点的标识。
  15. 根据权利要求14所述的通信装置，其特征在于，所述USN节点标识用于所述终端设备与所述USN节点的认证过程。
  16. 根据权利要求10至15中任一项所述的通信装置，其特征在于，所述节点标识的全局部分用于标识所述第二网络设备。
  17. 根据权利要求10至16中任一项所述的方法，其特征在于，所述终端设备的身份信息包括以下任意一项：网际协议IP地址、端口号、应用标识、国际移动用户识别码、用户永久标识、电话号码。
  18. 根据权利要求10至17中任一项所述的通信装置，其特征在于，所述第二网络设备是移动边缘计算MEC。
  19. 一种通信装置，其特征在于，包括至少一个处理器，所述至少一个处理器用于执行存储器中存储的计算机指令，以使得所述通信装置实现如权利要求1至9中任一项所述的方法。
  20. 一种芯片系统，其特征在于，包括：逻辑电路，所述逻辑电路用于与输入/输出接口耦合，通过所述输入/输出接口传输数据，以执行如权利要求1至9中任一项所述的方法。
  21. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机指令，其特征在于，当所述计算机指令被计算设备执行时，使得如权利要求1至9中任一项所述的方法被执行。
PCT/CN2021/106736 2020-11-24 2021-07-16 通信的方法及通信装置 WO2022110836A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/323,222 US20230300716A1 (en) 2020-11-24 2023-05-24 Communication method and communication apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011331897.8A CN114554567A (zh) 2020-11-24 2020-11-24 通信的方法及通信装置
CN202011331897.8 2020-11-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/323,222 Continuation US20230300716A1 (en) 2020-11-24 2023-05-24 Communication method and communication apparatus

Publications (1)

Publication Number Publication Date
WO2022110836A1 true WO2022110836A1 (zh) 2022-06-02

Family

ID=81659995

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/106736 WO2022110836A1 (zh) 2020-11-24 2021-07-16 通信的方法及通信装置

Country Status (3)

Country Link
US (1) US20230300716A1 (zh)
CN (1) CN114554567A (zh)
WO (1) WO2022110836A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023241429A1 (zh) * 2022-06-16 2023-12-21 华为技术有限公司 通信方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101860474A (zh) * 2009-04-08 2010-10-13 中兴通讯股份有限公司 基于对等网络的资源信息处理方法及对等网络
WO2017129742A1 (en) * 2016-01-27 2017-08-03 Nokia Solutions And Networks Oy Method and apparatus for implementing mobile edge application session connectivity and mobility
CN110138885A (zh) * 2018-02-02 2019-08-16 华为技术有限公司 地址分配方法及装置
CN111373704A (zh) * 2019-01-28 2020-07-03 北京大学深圳研究生院 一种支持多模标识网络寻址渐进去ip的方法、系统及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101860474A (zh) * 2009-04-08 2010-10-13 中兴通讯股份有限公司 基于对等网络的资源信息处理方法及对等网络
WO2017129742A1 (en) * 2016-01-27 2017-08-03 Nokia Solutions And Networks Oy Method and apparatus for implementing mobile edge application session connectivity and mobility
CN110138885A (zh) * 2018-02-02 2019-08-16 华为技术有限公司 地址分配方法及装置
CN111373704A (zh) * 2019-01-28 2020-07-03 北京大学深圳研究生院 一种支持多模标识网络寻址渐进去ip的方法、系统及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023241429A1 (zh) * 2022-06-16 2023-12-21 华为技术有限公司 通信方法及装置

Also Published As

Publication number Publication date
CN114554567A (zh) 2022-05-27
US20230300716A1 (en) 2023-09-21

Similar Documents

Publication Publication Date Title
US11354136B2 (en) Machine-to-machine bootstrapping
WO2020048512A1 (zh) 通信方法和装置
US7926098B2 (en) Handoff of a secure connection among gateways
KR20220154845A (ko) 5g 슬라이스 식별자의 프라이버시 보호를 위한 방법 및 시스템
WO2020029730A1 (zh) 一种身份信息的处理方法、设备及系统
JP2020527914A (ja) ネットワークセキュリティ管理方法および装置
KR20160122992A (ko) 정책 기반으로 네트워크 간에 연결성을 제공하기 위한 네트워크 통합 관리 방법 및 장치
US10693866B2 (en) System, apparatus and method for first hop security
KR20220128993A (ko) 서비스 애플리케이션들과의 암호화된 통신을 위한 통신 네트워크에서의 앵커 키 생성 및 관리를 위한 방법, 디바이스, 및 시스템
TW202142010A (zh) 用戶資料更新方法、裝置、節點和儲存媒體
US20230300716A1 (en) Communication method and communication apparatus
US20230300622A1 (en) Communication system, communication method, and communication apparatus
US20240073685A1 (en) Method for authentication for nswo service, device, and storage medium
US20240048986A1 (en) Communication method and apparatus
ES2809156T3 (es) Técnicas para proporcionar un enrutamiento específico para un abonado de un equipo de usuario en itinerancia en una red de comunicación visitada
CN114946153A (zh) 与服务应用进行加密通信的通信网络中的应用密钥生成与管理的方法、设备及系统
KR20240002666A (ko) 메신저 서비스를 제공하기 위한 방법, 시스템 및 비일시성의 컴퓨터 판독 가능한 기록 매체
WO2022032692A1 (zh) 通信方法、装置及系统
WO2021035740A1 (zh) 访问控制方法、服务器、访问设备及存储介质
WO2022237794A1 (zh) 一种报文传输方法及装置
WO2017206125A1 (zh) 网络连接方法、安全节点的确定方法及装置
WO2024092624A1 (en) Encryption key transfer method and device for roaming users in communication networks
WO2022178888A1 (zh) 一种通信方法及装置
US20220368524A1 (en) Systems and methods for blockchain-based secure key exchange with key escrow fallback
US20220368546A1 (en) Systems and methods for group messaging using blockchain-based secure key exchange with key escrow fallback

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21896343

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21896343

Country of ref document: EP

Kind code of ref document: A1