WO2022141132A1 - Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé - Google Patents

Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé Download PDF

Info

Publication number
WO2022141132A1
WO2022141132A1 PCT/CN2020/141127 CN2020141127W WO2022141132A1 WO 2022141132 A1 WO2022141132 A1 WO 2022141132A1 CN 2020141127 W CN2020141127 W CN 2020141127W WO 2022141132 A1 WO2022141132 A1 WO 2022141132A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
client
identifier
client network
request message
Prior art date
Application number
PCT/CN2020/141127
Other languages
English (en)
Chinese (zh)
Inventor
张金碧
靳炜
郑小青
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2020/141127 priority Critical patent/WO2022141132A1/fr
Publication of WO2022141132A1 publication Critical patent/WO2022141132A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/142—Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/48—Security arrangements using identity modules using secure binding, e.g. securely binding identity modules to devices, services or applications

Definitions

  • the present application relates to the field of communications, and in particular, to a service-oriented interface-oriented resource verification method and related equipment.
  • the 5G system architecture control plane adopts service-oriented interface technology.
  • the communication between the client and the server needs to be legalized, and the user resource identifier is one of the methods of legalization.
  • the 3GPP Release 16 protocol does not provide a reliable verification method for the user resource identifier of the application layer. Therefore, a new service-oriented interface resource verification method is required to solve the verification problem of the user resource identifier of the application layer.
  • the present application provides a service-oriented interface-oriented resource verification method and related equipment, which can verify the validity of client requests, avoid the server from operating resources according to unexpected client requests, and improve the operation efficiency of the server. Accuracy and Safety.
  • the present application provides a resource verification method for a service-oriented interface, the method may include: a server network element receiving a first request message sent by a first client network element, the first request message carrying Information to be verified, the information to be verified is used to verify the validity of the first client network element; the server network element performs verification on the first client network element according to the information to be verified Legality verification; the server network element executes the first request message after verifying that the first client network element is legal.
  • the server network element after receiving the message from the client network element, the server network element will verify the validity of the client network element, which prevents the server network element from operating resources according to unexpected client requests. , that is, to avoid misoperation, reduce the risk of wrong deletion of resources, accidental tampering and improper transmission, etc., and improve the accuracy and security of network element operations on the server side.
  • the server network element receiving the first request message sent by the first client network element includes: receiving, by the server network element, the first request message sent by the first client network element.
  • An HTTP request message sent by a client network element according to the hypertext transfer protocol the HTTP request message includes an HTTP protocol header and a message body, and the HTTP protocol header includes the type of the first client network element and the identifier of the first client network element .
  • the message sent by the client network element to the server network element may be an HTTP request message
  • the HTTP request includes information to be verified
  • the server network element can
  • legality verification which prevents the server-side network element from operating resources according to unexpected client requests, and improves the accuracy and security of the server-side network element operation.
  • the message body includes the identifier of the first client network element
  • the server network element interprets the first client network element according to the information to be verified.
  • a client-side network element performing legality verification comprising: comparing, by the server-side network element, whether the first client-side network element identifier in the HTTP protocol header is consistent with the first client-side network element identifier in the message body; If they are consistent, it is confirmed that the first client network element is legal.
  • the server network element can judge whether the client network element is legal by comparing the client network element identifier in the HTTP protocol header with the client network element identifier in the message body, avoiding the need for When the client network element is illegal, the server network element is still operating, and the resources are deleted by mistake, accidentally tampered with, and improperly transmitted, which improves the accuracy and security of the server network element operation.
  • the server network element performs legality verification on the first client network element according to the information to be verified, including: when the When the type of the first client network element in the HTTP protocol header is consistent with the network element type of the server network element itself, the server network element compares the identifier of the first client network element in the HTTP protocol header with that of the server network element. Whether the identity of the network element instance of the server network element itself is consistent, if not, confirming that the first client network element is legal.
  • the server network element can verify the network element type and network element identification respectively when verifying the legitimacy of the client network element, so as to avoid wrong execution of the old client network element.
  • the resource deletion, tampering, and improper transmission may occur due to the request of the network element, which improves the accuracy and security of the operation of the network element on the server side.
  • the method further includes: the server network element saves the first client After the server network element performs legality verification on the first client network element according to the information to be verified, the method further includes: the server network element receives the first A second request message sent by the client network element, where the second request message carries the identifier of the first client network element; the server network element compares the identifier of the first client network element in the second request message Whether it is consistent with the identifier of the first client network element saved by the server network element, if they are consistent, confirm that the first client network element is legal; the server network element is verifying the first client network element.
  • the second request message is executed after being valid.
  • the server network element after the server network element receives the message sent by the client network element for the first time, it will verify the legitimacy of the client network element.
  • the client network element identifier is saved locally, and when the message sent by the client network element is received again, the server network element compares the client network element identifier carried in the request with the saved client network element.
  • the element identifier is used to verify the legitimacy of the client network element, which prevents the server from operating resources according to unexpected client requests, and improves the accuracy and security of the server operation.
  • the method before the server network element receives the first request message sent by the first client network element, the method further includes: the server network element element receives the third request message sent by the second client network element, the third request message carries the identifier of the second client network element; the server network element performs legality verification according to the identifier of the second client network element ; the server network element saves the identifier of the second client network element after verifying that the first client network element is legal; after the server network element receives the first request message sent by the first client network element , the method further includes: comparing, by the server network element, whether the identifier of the first client network element in the HTTP protocol header is consistent with the stored identifier of the second client network element.
  • the new client network element sends a message to the server network element, and the server network element can perform two verifications, and compare the client network element carried in the message. Whether the element identifier is consistent with the client network element stored locally by the server network element, if not, then compare the HTTP protocol header in the request with the client network element identifier in the message body, which improves the accuracy of legality verification. This means that the accuracy and security of server-side operations are improved.
  • the information to be verified includes a first resource verification identifier
  • the method further includes: receiving, by the server network element, a fourth request message sent by the first client network element, where the fourth request message carries the first resource verification identifier, and the first resource verification
  • the identifier is used to uniquely identify the first client network element; the server network element saves the first resource verification identifier; the server network element checks the first client network element according to the information to be verified.
  • the validity verification of the element includes: comparing, by the server network element, whether the first resource verification identifier carried in the first request message is consistent with the stored first resource verification identifier, and if they are consistent, confirming the first client The network element is legal.
  • the server network element can also verify the client network element according to the resource verification identifier, and the server network element to verify the legitimacy of the client through the resource verification identifier needs to first save the resource verification identifier, which can be It is understood that when the client network element sends a message to the server network element for the first time, the server network element will save the resource verification identifier in the message. If the client network element sends a message to the server network element again, the server network element will The element verifies the legitimacy of the client network element by comparing the saved resource verification identifier with the resource verification identifier in the message received later, which prevents the server from operating resources according to unexpected client requests, and improves the operation efficiency of the server. Accuracy and Safety.
  • the method further includes: receiving, by the server network element, a third client network element
  • the fifth request message sent by the client, the fifth request message carries the first resource verification identifier and the second resource verification identifier, and the second resource verification identifier is used to uniquely identify the third client network element; the The server network element compares whether the first resource verification identifier carried in the fifth request message is consistent with the saved first resource verification identifier, and if they are consistent, the server network element deletes the first resource verification identifier, The second resource verification identifier is saved.
  • the server network element will update the resource verification identifier of the old client network element stored locally to the changed resource verification identifier of the client network element , so as to facilitate the subsequent legality verification of the changed client network element, so that the accuracy and security of the server operation are greatly improved.
  • the server network element includes an address mapping table, and the address mapping table includes a first client network element identifier and the first client network element.
  • the client address information corresponding to the element identifier, the information to be verified includes the client address information, and the server network element performs legality verification on the first client network element according to the information to be verified, Including: the server network element traverses the address mapping table, and determines whether the address mapping table contains the client address information carried in the first request message, if the address mapping table contains the client address information, it is confirmed that the first client network element is legal.
  • the server network element can also verify the legitimacy of the client network element through the client address information, thereby avoiding the server operating resources according to unexpected client requests, and improving the accuracy of the server operation. sex and safety.
  • a network device may include: a receiving unit configured to receive a first request message sent by a first client network element, where the first request message carries information to be verified, and the The information to be verified is used to verify the validity of the first client network element; the processing unit is used to verify the legality of the first client network element according to the information to be verified; The first request message is executed after the first client network element is legal.
  • the receiving unit when the receiving unit is configured to receive the first request message sent by the first client network element, the receiving unit is specifically configured to: receive the first request message sent by the first client network element.
  • the HTTP request message sent by the client network element according to the hypertext transfer protocol the HTTP request message includes an HTTP protocol header and a message body, and the HTTP protocol header includes the first client network element type and the first client network element identifier.
  • the message body includes the identifier of the network element of the first client
  • the processing unit is configured to perform an analysis on the information to be verified according to the information to be verified.
  • the first client network element performs legality verification, it is specifically used to: compare whether the first client network element identifier in the HTTP protocol header is consistent with the first client network element identifier in the message body, and if If they are consistent, it is confirmed that the first client network element is legal.
  • the processing unit when used to verify the validity of the first client network element according to the information to be verified, specifically use In: when the first client network element type in the HTTP protocol header is consistent with the network element type of the server network element itself, compare the first client network element identifier in the HTTP protocol header with the Whether the network element instance identifiers of the server network element itself are consistent, if not, it is confirmed that the first client network element is legal.
  • the processing unit is further configured to save the first request message Client network element identifier; after the processing unit verifies the validity of the first client network element according to the information to be verified, the receiving unit is further configured to receive the information sent by the first client network element a second request message, where the second request message carries the identifier of the network element of the first client; the processing unit is further configured to: compare the identifier of the network element of the first client in the second request message with the identifier of the network element of the first client Whether the identifiers of the first client NEs saved by the server NE are consistent, if they are consistent, confirm that the first client NE is legal; execute the second request message after verifying that the first client NE is legal .
  • the receiving unit before the receiving unit receives the first request message sent by the first client network element, the receiving unit is further configured to: receive the second client a third request message sent by the end network element, where the third request message carries the identifier of the second client network element; the processing unit is further configured to: perform legality verification according to the identifier of the second client network element; After verifying that the first client network element is legal, save the identifier of the second client network element; after the receiving unit receives the first request message sent by the first client network element, the processing unit is further configured to: Compare whether the identifier of the first client network element in the HTTP protocol header is consistent with the stored identifier of the second client network element.
  • the information to be verified includes a first resource verification identifier
  • the receiving unit is further configured to: receive a fourth request message sent by the first client network element, where the fourth request message carries the first resource verification identifier, and the first resource verification identifier is used to uniquely Identifies the first client network element;
  • the processing unit is further configured to: save the first resource verification identifier; perform legality verification on the first client network element according to the information to be verified, including : Compare whether the first resource verification identifier carried in the first request message is consistent with the stored first resource verification identifier, and if they are consistent, confirm that the first client network element is legal.
  • the receiving unit is further configured to: receive the data sent by the third client network element. a fifth request message, where the fifth request message carries the first resource verification identifier and the second resource verification identifier, and the second resource verification identifier is used to uniquely identify the third client network element; the processing unit , and is also used to: compare whether the first resource verification identifier carried in the fifth request message is consistent with the saved first resource verification identifier, and if they are consistent, delete the first resource verification identifier and save the second resource Check mark.
  • the device includes an address mapping table, and the address mapping table includes a first client network element identifier corresponding to the first client network element identifier
  • the client address information, the information to be verified includes the client address information
  • the processing unit when used to verify the validity of the first client network element according to the information to be verified, It is specifically used for: traversing the address mapping table, judging whether the address mapping table contains the client address information carried in the first request message, and confirming if the address mapping table contains the client address information The first client network element is legal.
  • a computing device in a third aspect, includes a processor, and the processor is configured to support the electronic device to implement the first aspect and the service-oriented provided in combination with any one of the above-mentioned first aspects.
  • the corresponding function in the resource verification method of the interface may also include a memory for coupling with the processor that holds program instructions and data necessary for the electronic device.
  • the computing device may also include a communication interface for the computing device to communicate with other devices or a communication network.
  • a computer-readable storage medium stores a computer program.
  • the computer program is executed by the processor, the first aspect and any one of the first aspect can be implemented.
  • the function of the resource verification method for the service-oriented interface provided by this implementation.
  • the present application provides a computer program product, the computer program includes instructions that, when the computer program is executed by a computer, enables the computer to execute the above-mentioned first aspect and any implementation manner in combination with the above-mentioned first aspect The process of the provided service-oriented interface resource verification method.
  • the present application provides a chip system
  • the chip system includes a processor for supporting a network device to implement the functions involved in the first aspect, for example, generating or processing the service-oriented interface of the first aspect. Information involved in the resource verification method.
  • the chip system further includes a memory for storing necessary program instructions and data of the data sending device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the network device provided by the second aspect, the computing device provided by the third aspect, the computer-readable storage medium provided by the fourth aspect, and the computer program product provided by the fifth aspect , and the chip system provided by the sixth aspect is used to execute the service-oriented interface-oriented resource verification method provided by the first aspect. Therefore, for the beneficial effects that can be achieved, reference may be made to the beneficial effects of the service-oriented interface-oriented resource verification method provided in the first aspect, which will not be repeated here.
  • FIG. 1 is a schematic diagram of a session creation process provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a PDU session reconstruction process provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of a 5G service-oriented architecture provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a resource verification method for a service-oriented interface provided by an embodiment of the present application
  • FIG. 5 is a schematic flowchart of a user mobile update provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a correspondence between a first client network element identifier and client address information according to an embodiment of the present application
  • FIG. 7 is a schematic diagram of an address mapping table provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of yet another service-oriented interface-oriented resource verification method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of yet another service-oriented interface-oriented resource verification method provided by an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of yet another service-oriented interface-oriented resource verification method provided by an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of yet another service-oriented interface-oriented resource verification method provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of AMF and SMF registering NRF provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of an AMF client address information configuration provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of the SMF verifying the validity of the AMF provided by the embodiment of the present application.
  • FIG. 15 is a schematic diagram of an AMF verifying the validity of an SMF provided by an embodiment of the present application.
  • FIG. 16 is a schematic diagram of a network device according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a computing device according to an embodiment of the present application.
  • Uniform Resource Identifier means that every resource available on the web, such as HTML documents, images, video clips, programs, etc., is identified by a URI.
  • the International Mobile Subscriber Identity is an identification code used to distinguish different users in a cellular network and will not be repeated in all cellular networks.
  • the phone stores the IMSI in a 64-bit field and sends it to the network.
  • the IMSI can be used to query the user's information in the Home Location Register (HLR) or the Visitor Location Register (VLR).
  • HLR Home Location Register
  • VLR Visitor Location Register
  • the 5G Globally Unique Temporary UE Identity (G-GUTI) consists of two parts: the first part identifies the 5G-GUTI allocated by which AMF; the second part represents the UE's unique id within the AMF.
  • the purpose of using 5G-GUTI under the 5G system is to reduce the display of the permanent identity of the UE in communication, which can improve security.
  • GPSI Generic Public Subscription Identifier
  • SUPI Subscription Permanent Identifier
  • the PDU Session ID (PDU Session ID) is an ID used to identify the PDU session. This ID is unique to each terminal, and the number range is limited to the UE that initiated the PDU session.
  • the session context identifier (SM context reference assigned by the SMF during the Create SM Context service operation, smContextRef) assigned by the SMF is used to respond to the AMF request, indicating that the SMF can process subsequent processes.
  • User Equipment also known as terminal equipment, mobile station (Mobile Station, MS), mobile terminal (Mobile Terminal, MT), etc.
  • the terminal device can be a handheld terminal, a notebook computer, a subscriber unit (Subscriber Unit), a cellular phone (Cellular Phone), a smart phone (Smart Phone), a wireless data card, a personal digital assistant (Personal Digital Assistant, PDA) computer, tablet computer , Wireless Modem (Modem), Handheld Device (Handheld), Laptop Computer (Laptop Computer), Cordless Phone (Cordless Phone) or Wireless Local Loop (WLL) station, Machine Type Communication, MTC) terminals, wearable devices (such as smart watches, smart bracelets, pedometers, etc.), in-vehicle devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed rail, etc.), virtual reality (Virtual Reality, VR) equipment, Augmented Reality (AR) equipment, wireless
  • VR Virtual Reality
  • AR Augmented Reality
  • the terminal device in FIG. 3 is shown as a UE, which is only an example and does not limit the terminal device.
  • the UE can access the DN by establishing a session between the UE-(R)AN device-UPF-DN, that is, a protocol data unit (Protocol Data Unit, PDU) session.
  • a protocol data unit Protocol Data Unit, PDU
  • the (Radio) Access Network ((R)AN) device is a device that provides wireless access to the UE, and is mainly responsible for radio resource management, Quality of Service (QoS) flow management on the air interface side, Features such as data compression and encryption.
  • (R)AN devices may include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, access points, and the like.
  • the (R)AN device may also include a Wireless Fidelity (Wi-Fi) access node (Access Point, AP).
  • Wi-Fi Wireless Fidelity
  • the (R)AN device may also include a Worldwide Interoperability for Microwave Access (WiMAX) base station (Base Station, BS).
  • WiMAX Worldwide Interoperability for Microwave Access
  • the user plane function (UPF) network element is mainly responsible for processing user packets, such as forwarding and charging.
  • the user packet can be received from the DN and transmitted to the UE through the RAN device; the user packet can also be received from the UE through the RAN device and forwarded to the DN.
  • the transmission resources and scheduling functions provided by the UPF network element to serve the UE are managed and controlled by the SMF network element.
  • the data network can be the Internet (Internet), IP Multimedia Service (IP Multimedia Service, IMS) network, regional network, that is, local network, such as Multi-Access Edge Computing (Multi-Access Edge Computing, MEC) network ,Wait.
  • IP Multimedia Service IP Multimedia Service
  • IMS IP Multimedia Service
  • MEC Multi-Access Edge Computing
  • the DN is the destination of the UE's PDU session access.
  • An application server is included or deployed in the DN, and the application server can perform data transmission with the UE and provide business services for the UE.
  • the authentication server function (Authentication Server Function, AUSF) network element can be responsible for the authentication and authentication of the access of the UE, and also responsible for the charging.
  • AUSF Authentication Server Function
  • the Access and Mobility Management Function (AMF) network element can access the UE's non-access stratum (Non Access Stratum, NAS) signaling (including session management (Session Management, SM) signaling through the N1 interface. Command) and the N2 interface to access the RAN signaling to complete the UE registration process and SM signaling forwarding and mobility management.
  • NAS non-access stratum
  • Session Management, SM Session Management
  • the session management function Session Management Function, SMF
  • SMF Session Management Function
  • SMF Session Management Function
  • Specific functions include assigning IP addresses to users and selecting UPF network elements that provide packet forwarding functions.
  • the Network Slice Selection Function (NSSF) network element is a new network element of 5G. It is mainly used in 5G slice services and is responsible for managing network slice-related confidence.
  • the Network Exposure Function (NEF) network element is responsible for opening network data to the outside world.
  • the network element data warehouse function (NF Repository Function, NRF) network element is responsible for the registration, management and status detection of the NF, which can realize the automatic management of all NFs.
  • NRF Network element Repository Function
  • the Policy Control Function (PCF) network element can be responsible for terminal device policy management, including both mobility-related policies and PDU session-related policies, such as QoS policies and charging policies.
  • PCF Policy Control Function
  • the Unified Data Management (UDM) network element is responsible for user key management, user identification processing, access authorization for subscription data, UE network function entity management, session and business continuity management, short message push, legal interception, Contract management, short message management, used to manage and control user data, such as contract information management.
  • UDM Unified Data Management
  • the Application Function (AF) network element mainly supports interaction with the 3rd Generation Partnership Project (3GPP) core network to provide services to affect service flow routing, access network capability opening, policy control, etc. .
  • 3GPP 3rd Generation Partnership Project
  • the service-oriented interface is a modeled interaction method between different network entities introduced by the 5G architecture.
  • the 5G network can be used for various specific tasks.
  • a service interface is only for one network function block, the network function block interacts with other function blocks through this interface, and other function blocks interact with this function block through another corresponding interface.
  • Policy and Charging Control is an architecture that maps the QoS requirements of application-level session service data streams to IP-CAN, and accesses the QoS requirements of transport network bearer-level services to ensure data transmission.
  • the operator's charging policy implements the charging function at the service data flow level.
  • Hyper Text Transfer Protocol is a simple request-response protocol that usually runs on top of TCP. It specifies what kind of messages the client might send to the server and what kind of response it gets.
  • the headers of the request and response messages are given in ASCII; the message content has a format similar to Multipurpose Internet Mail Extensions (MIME).
  • MIME Multipurpose Internet Mail Extensions
  • HTTP messages consist of client-to-server requests and server-to-client responses. Both the request message and the response message consist of a start line (for a request message, the start line is the request line, for a response message, the start line is the status line), message header (optional), blank line (only CRLF lines), message body (Optional) Composition.
  • HTTP message headers include normal headers, request headers, response headers, and entity headers.
  • Request headers allow the client to pass additional information about the request to the server as well as information about the client itself.
  • Accept image/gif, indicating that the client wants to accept resources in GIF image format
  • Accept text/html, indicating that the client wants to accept html text.
  • Accept-Charset which is used to specify the character set accepted by the client.
  • Accept-Charset iso-8859-1, gb2312, indicating that if this field is not set in the request message, the default is that any character set is acceptable.
  • Accept-Encoding similar to Accept, but it is used to specify acceptable content encodings.
  • Accept-Encoding gzip.deflate. If this is not set in the request message, the domain server assumes that the client accepts various content encodings.
  • Accept-Language similar to Accept, but it is used to specify a natural language.
  • Authorization is mainly used to prove that the client has the right to view a resource.
  • a browser accesses a page, if it receives a response code of 401 (unauthorized) from the server, it can send a request containing the Authorization request header field, asking the server to authenticate it.
  • Host (this header field is required when sending a request) is mainly used to specify the Internet host and port number of the requested resource, which is usually extracted from the HTTP URL.
  • User-Agent used to obtain the client's operating system, browser and other properties.
  • the User-Agent request header field allows the client to tell the server its operating system, browser, and other attributes.
  • Response headers allow the server to pass additional response information that cannot be placed in the status line, as well as information about the server and further access to the resource identified by the Request-URI.
  • the Location response header field is often used when changing the domain name.
  • Server contains software information that the server uses to process requests. Corresponds to the User-Agent request header field.
  • Both request and response messages can convey an entity.
  • An entity consists of the entity header field and the entity body, but it does not mean that the entity header field and the entity body should be sent together, and only the entity header field can be sent.
  • the entity header defines meta-information about the entity body (eg, the presence or absence of an entity body) and the resource identified by the request.
  • Content-Encoding used as a modifier for the media type, its value indicates the encoding of the additional content that has been applied to the entity body, so to obtain the media type referenced in the Content-Type header field, the corresponding decoding must be used mechanism.
  • Content-Length used to indicate the length of the entity body, expressed as a decimal number stored in bytes.
  • Content-Type used to indicate the media type of the entity body sent to the recipient.
  • Last-Modified which indicates the date and time when the resource was last modified.
  • UUID Universally Unique Identifier
  • GUID Globals Unique Identifier
  • Bits 1 to 8 adopt the system time, and the system time is accurate to the millisecond level to ensure the uniqueness of time;
  • Bits 17 to 24 adopt the Hash Code value of the current object to ensure uniqueness on an internal object
  • the request message sent by the client will carry URI, user identifier (such as IMSI, 5G-GUTI, GPSI, etc.) and special resource identifiers (such as PDU Session ID, smContextRef, subscription identifier, etc.), and the server uses these identifiers Locate the local user context, and then complete the client request operation.
  • user identifier such as IMSI, 5G-GUTI, GPSI, etc.
  • special resource identifiers such as PDU Session ID, smContextRef, subscription identifier, etc.
  • FIG. 1 is a schematic diagram of a session creation process provided by an embodiment of the present application.
  • the user requests to create a PDU session
  • the session ID of the PDU session is 5
  • the SMF associated before PDU5 is SMF1
  • the currently associated SMF is SMF2
  • session PDU5 There is a context for session PDU5. If the SMF1 requests the AMF to release the user's session, the AMF performs the service request incorrectly.
  • FIG. 2 is a schematic diagram of a PDU session reestablishment process provided by an embodiment of the present application.
  • the SMF associated with PDU5 before is SMF1
  • AMF selects a new SMF-SMF2 for session PDU5
  • the SMF associated with PDU5 is SMF2 at this time.
  • the AMF notifies the SMF1 that the request to delete the context of the PDU5 is not sent successfully, resulting in the context of the PDU5 still existing in the SMF1, and the AMF continues to process the session re-establishment process.
  • the SMF1 releases the context of the PDU5 and notifies the AMF to delete the context of the PDU5 due to reasons such as the maintenance command triggering or the resource release timer timeout triggering the resource release. If the SMF2 then requests to process the context of PDU5 at this time, the AMF will reply abnormally because there is no context, resulting in an abnormal session re-establishment process.
  • SMF1 is the client network element, and its identifier is PDU5, which is a general identifier and has a limited range (1-15).
  • PDU5 is a general identifier and has a limited range (1-15).
  • AMF cannot verify the legitimacy of the client network element, which will lead to wrong operation.
  • SMF1 when SMF1 notifies AMF to delete the context of PDU5, SMF1 is a client network element, and the identifier it carries is PDU5, which is a general identifier and has a limited range (1-15).
  • AMF as a server network element, cannot verify the client The validity of the network element causes the AMF to delete the PDU5 context by mistake, resulting in an abnormality in the subsequent session re-establishment process.
  • the present application provides a service-oriented interface-oriented resource verification method and related equipment, which can allow the client network element to carry more information, so as to support the server network element to perform legal verification and avoid occurrence of Misoperations such as wrong deletion, wrong tampering, and improper transmission of resources improve the accuracy and security of server-side network element operations.
  • FIG. 3 is a schematic diagram of a 5G service-oriented architecture disclosed in an embodiment of the present application.
  • the 5G service-oriented architecture may include UE, (R)AN equipment, UPF network element, DN, AUSF network element, AMF network element, SMF network element, NSSF network element, NEF network element, NRF network element element, PCF network element, UDM network element, AF network element, etc., also includes Service Based Interface (SBI), such as Nnssf, Nnef, Nnrf, Npcf, etc., and also includes reference points, such as N1, N2, N3, N4, N6, where N1 is the reference point between UE and AMF, N2 is the reference point between (R)AN and AMF, N3 is the reference point between (R)AN and UPF, and N4 is SMF and UPF N6 is the reference point between UPF and DN.
  • SBI Service Based Interface
  • N1 is the reference point between UE and AMF
  • N2 is the reference point between (R)AN and AMF
  • N3 is the reference point between (R)AN and UPF
  • N4 is
  • Each of the above network elements in the core network can also be referred to as functional entities, which can be either network elements implemented on dedicated hardware, software instances running on dedicated hardware, or instances of virtualized functions on an appropriate platform
  • the above-mentioned virtualization platform may be a cloud platform.
  • the network element in FIG. 3 may be a server network element or a client network element. After the information is sent, it is necessary to verify the validity of the client network element, and then determine whether to perform subsequent operations according to the verification result.
  • system architecture shown in FIG. 3 is not limited to the network elements shown in the figure, and may also include other devices not shown in the figure, which will not be listed one by one here.
  • the 5G network architecture shown in FIG. 3 does not constitute a limitation on the 5G network.
  • the methods in the embodiments of the present application are also applicable to various future communication systems, such as 6G or other communication networks.
  • FIG. 4 is a schematic flowchart of a service-oriented interface-oriented resource verification method provided by an embodiment of the present application. The method can be applied to the 5G service-oriented architecture shown in FIG. 3. The The method includes but is not limited to the following steps:
  • S401 The server network element receives the first request message sent by the first client network element.
  • the first client network element sends a first request message to the server network element, and the server network element receives the first request message sent by the first client network element, where the first request message carries the information to be verified,
  • the to-be-verified information is used to verify the validity of the first client network element.
  • the server network element receives an HTTP request message sent by the first client network element according to the hypertext transfer protocol, that is, the first request message may be an HTTP request message, and the The HTTP request message includes an HTTP protocol header and a message body, the HTTP protocol header includes the first client network element type and the first client network element identifier, and the message body includes the first client network element identifier, that is, the The information to be verified includes the first client network element type and the first client network element identifier.
  • the first client network element identifier can be a network element instance identifier.
  • the HTTP protocol header includes Accept, Accept-Encoding, Context-Length, Context-Type, User -Agent and other information, where the protocol defines User-Agent in the form of "NF Type-", NF Type refers to the network element type, and the content after "-" is optional information, which can be customized by equipment manufacturers.
  • the optional information can be customized as a network element instance ID (NF Instance ID), and the NF Instance ID can be changed to mandatory content in the User-Agent, that is, the customization operation is completed
  • NF Type-NF Instance ID which means that the HTTP protocol header can include the NE type and NE instance ID.
  • the User-Agent in the HTTP protocol header is the AMF-AMF Instance ID, and the AMF Instance ID refers to the instance identifier of the AMF.
  • the User-Agent may be AMF-00000000-0000 -0000-000000000011, at this time, the instance identifier of AMF is 00000000-0000-0000-000000000011.
  • the first client network element identifier may also be a serving network element identifier (Serving NF ID), and the Serving NF ID may be carried by the HTTP protocol header like the above-mentioned NF Instance ID.
  • the first request message carries information to be verified
  • the information to be verified includes a first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client
  • the end network element that is, the first request information carries the first resource verification identifier.
  • the first request message may be an HTTP request message or other types of messages. Therefore, the first resource verification identifier may be carried by the HTTP request message or by the HTTP protocol layer. This is not limited.
  • the resource verification identifier includes but is not limited to a network element instance identifier (NF Instance ID), and the network element instance identifier can be carried through the HTTP protocol layer.
  • NF Instance ID network element instance identifier
  • the server network element includes an address mapping table
  • the information to be verified includes a first client network element identifier and client address information corresponding to the first client network element identifier
  • there is a mapping relationship between the first client network element identifier and the client address information which means that the client address information can be found through the first client network element identifier
  • the first client network element identifier may be a network element instance identifier or a service network element identifier.
  • S402 The server network element performs legality verification on the first client network element.
  • the server network element After receiving the first request message sent by the first client network element, the server network element performs legality verification on the first client network element according to the information to be verified carried in the first request message.
  • the first request message is an HTTP request message
  • the HTTP request message includes an HTTP protocol header and a message body
  • the HTTP protocol header includes the first client network element type and the first client network element identifier
  • the message body includes the network element identifier of the first client.
  • the legality verification may have the following forms:
  • the server network element compares whether the first client network element identifier in the HTTP protocol header is consistent with the first client network element identifier in the message body, and if they are consistent, confirms The first client network element is legal.
  • the above-mentioned validity process may occur when the server network element receives the message from the first client network element for the first time, that is, the first request message may be the message sent by the first client network element to the server network element for the first time.
  • the server network element after the server network element confirms that the first client network element that sent the first request message is legal, the server network element saves the identifier of the first client network element.
  • the network element sends a second request message to the server network element, where the second request message includes the first client network element identifier, and the server network element checks the validity of the first client network element according to the first client network element identifier Verification, specifically, the server network element compares whether the first client network element identifier in the second request message is consistent with the first client network element identifier saved by the server network element, and if they are consistent, confirms sending the second request The first client network element of the message is legal.
  • the server network element and the first client The end network elements are different network elements of the same type.
  • the server network element needs to be changed to the first client network element
  • the first client network element sends a first request message to the server network element to obtain the information in the server network element.
  • the server network element will compare whether the first client network element type in the HTTP protocol header is consistent with the server network element's own network element type.
  • the server network element continues to compare whether the identifier of the first client network element in the HTTP protocol header is consistent with the identifier of the network element instance of the server network element itself, and if not, confirm the first client network element legitimate.
  • the UE sends a registration request to the NEW AMF, and the NEW AMF determines that the UE initiates a registration request after receiving the registration request sent by the UE.
  • the NEW AMF sends a context transfer request to the OLD AMF to obtain the user context.
  • the NEW AMF and the OLD AMF are different network elements of the same type.
  • the NEW AMF is the first client network element
  • the OLD AMF is the server network element
  • the context transmission request is the first request message.
  • the context transfer request is an HTTP request message
  • the User-Agent in the HTTP protocol header is the AMF-AMF Instance ID
  • the first client network element type in the HTTP protocol header is AMF
  • the HTTP protocol header is AMF.
  • the first client network element identifier in the header is AMF Instance ID, for example, the first client network element identifier may be AMF-00000000-0000-0000-000000000011.
  • the OLD AMF receives the context transmission request, and compares whether the first client network element type in the HTTP protocol header is consistent with the network element type of the OLD AMF itself. It can be seen that both the NEW AMF and the OLD AMF are AMF network elements.
  • the NEW AMF may continue to process the context transfer request and send a context transfer response to the OLD AMF.
  • the context transfer request may be a Namf_Communication_UEContextTransfer Request.
  • the first client network element is a changed network element of the second client network element, which means that the first client network element sends the first request message to the server network element.
  • a process occurs after the above modification process. It can be understood that before the server network element receives the first request message sent by the first client, the server network element receives the third request message sent by the second client network element.
  • the third request message carries the identifier of the second client network element, the server network element will verify the validity of the second client network element according to the second client network element identifier, and the server network element is verifying the second client network element. After the end network element is legal, the second client instance identifier will be saved.
  • the server-side network element After the server-side network element receives the first request message sent by the first client-side network element, the server-side network element compares the identifier of the first client-side network element in the HTTP protocol header with the second client-side network element stored therein If they are inconsistent, the server network element will continue to compare whether the first client network element identifier in the HTTP protocol header is consistent with the first client network element identifier in the message body. The element confirms that the first client network element is legal.
  • the NEW AMF may initiate a session update process. Specifically, the NEW AMF sends a context update request to the SMF.
  • the NEW AMF is the first client network. element, SMF is a server network element, and the update context request is a first request message.
  • the update context request is an HTTP request message
  • the User-Agent in the HTTP protocol header is the AMF-AMF Instance ID, that is, the first client network element type in the HTTP protocol header is AMF
  • the HTTP protocol The first client network element identifier in the header is AMF Instance ID
  • the User-Agent may be AMF-00000000-0000-0000-0000-000000000012.
  • the update context request may be an Nsmf_PDUSession_UpdateSMContext Request.
  • the OLD AMF will send a session creation request to the SMF, that is, before the SMF receives the update context request sent by the NEW AMF, the SMF will receive the session creation request sent by the OLD AMF.
  • the OLD AMF is the second client network element
  • the SMF is the server network element
  • the session creation request is a third request message
  • the third request message carries the identifier of the second client network element.
  • the session creation request is an HTTP request message
  • the User-Agent in the HTTP protocol header is the AMF-AMF Instance ID, that is, the first client network element type in the HTTP protocol header is AMF, and the HTTP protocol header is AMF.
  • the second client network element identifier in the header is AMF Instance ID, for example, the User-Agent may be AMF-00000000-0000-0000-0000-000000000011.
  • the SMF After the SMF receives the update context request sent by the NEW AMF, the SMF will compare whether the first client network element identifier in the HTTP protocol header of the update context request is consistent with the second client network element identifier stored in it. SMF will continue to compare whether the first client network element identifier in the HTTP protocol header is consistent with the first client network element identifier in the message body of the update context request. If they are consistent, SMF confirms the first client network element identifier. The end network element is legal. At this time, the SMF can continue to process the update context request and send the update context response to the NEW AMF.
  • the NEW AMF can also send a context release request to the SMF, and the process of SMF's verification of the validity of the NEW AMF can be referred to above, and will not be repeated here.
  • the above-mentioned relevant process of the NEW AMF sending the update context request and the release context request to the SMF is an optional process of the user mobile update process shown in FIG. 5.
  • some content is omitted in the user mobile update process shown in FIG. 5. , for details, please refer to 3GPP related protocols, which will not be repeated here.
  • the first request message includes the information to be verified
  • the information to be verified includes a first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client A network element, that is, the first request information carries the first resource verification identifier.
  • the legality verification may have the following forms:
  • the first client network element before sending the first request message to the server network element, the first client network element will also send a fourth request message to the server network element, where the fourth request message carries the first request message.
  • a resource verification identifier the first resource verification identifier is used to uniquely identify the first client network element
  • the server network element after receiving the fourth request message, the server network element will save the first resource verification identifier, and then The client network element performs legality verification. Specifically, the server network element compares the first resource verification identifier carried in the first request message with the stored first resource verification identifier. If they are consistent, the server network element confirms the first resource verification identifier. A client NE is legal.
  • the fourth request message may be an HTTP request message or other types of messages
  • the first resource verification identifier may be carried by the HTTP request message or by the HTTP protocol layer, which is not made in this application. limit.
  • the legality verification process is different from the above content.
  • the first client network element is changed to a third client network element.
  • the server network element After the server network element confirms that the first client network element is legal, the server network element receives the fifth request message sent by the third client network element, and the fifth request message carries the first resource verification identifier and the third request message.
  • the second resource verification identifier is used to uniquely identify the third client network element, and the server network element will compare the first resource verification identifier carried in the fifth request message with the saved Whether the first resource verification identifier of the first client is consistent, and if so, the server network element updates the resource verification identifier (first resource verification identifier) of the first client network element before the change to the changed resource of the third client network element
  • the verification identifier (second resource verification identifier), that is, the server network element deletes the first resource verification identifier and saves the second resource verification identifier.
  • the server network element includes an address mapping table
  • the information to be verified includes a first client network element identifier and client address information corresponding to the first client network element identifier.
  • the legality verification may have the following forms:
  • the server network element traverses the address mapping table to determine whether the address mapping table contains the client address information carried in the first request message, if the address mapping table contains If the address information of the client is present, it is confirmed that the network element of the first client is legal.
  • the server network element performs legality verification, it can first check whether the first client network element identifier is included in the address mapping table. If so, the server network element then checks the address mapping table for the first client network element identifier. Whether the address information corresponding to the association includes the client address information, and if so, confirming that the first client network element is legal.
  • FIG. 6 is a schematic diagram of a correspondence between a first client network element identifier and client address information provided by an embodiment of the present application.
  • the first client network element identifier may correspond to one or more client address information, where the client address information may be the IP address of the client.
  • the address mapping table in the server network element may include one or more client address information, and may also include one or more client network element identifiers, and the one or more client address information may be the same as the One or more client network element identifiers are associated with each other, and may not be associated with the one or more client network element identifiers, and may also be partially associated with the one or more client network element identifiers, and some are not associated with the one or more client network element identifiers.
  • FIG. 7 which is a schematic diagram of an address mapping table provided by an embodiment of the present application, the address mapping table shown in FIG.
  • the 7 includes a first client network element identifier and a second client network element identifier,
  • the first client network element identifier corresponds to the IP addresses of the three clients
  • the second client network element identifier also corresponds to the IP addresses of the three clients
  • four client addresses are not associated with the client network element identifiers. correspond.
  • S403 The server network element executes the first request message after verifying that the first client network element is legal.
  • the server network element can confirm that the first client network element sending the first request message is a legal network element, and execute the first client network element. a request message.
  • An embodiment of the present application further provides a resource verification method for a service-oriented interface, as shown in FIG. 8 , which is a schematic flowchart of another resource verification method for a service-oriented interface.
  • the method may include the following step:
  • S801 The UE sends a session creation request.
  • the UE sends a session creation request to the AMF, where the session creation request includes a session identifier.
  • the session creation request may be a PDU Session Establishment Request
  • the session identifier may be a PDU Session ID
  • the PDU Session Establishment Request includes the PDU Session ID.
  • S802 The AMF sends a context creation request to the SMF.
  • the AMF sends a context creation request to the SMF.
  • the AMF is the first client network element
  • the SMF is the server network element
  • the context creation request is the first request message.
  • the context creation request is HTTP request message
  • the context creation request includes an HTTP protocol header and a message body
  • the HTTP protocol header includes the first client network element type and the first client network element identifier
  • the message body includes the first client NE ID.
  • the first client network element identifier may be a network element instance identifier, that is, the first client network element identifier may be an AMF-AMF Instance ID, for example, the first client network element identifier may be AMF-00000000-0000-0000-000000000011, for details, please refer to step S401, which will not be repeated here.
  • the create context request may be an Nsmf_PDUSession_CreateSMContext Request.
  • the SMF is the SMF selected by the AMF.
  • the AMF In the 3GPP related protocols, there are roughly two methods for the AMF to select the SMF: one is to use the local configuration of the AMF; the other is to use the NRF discover service, which will not be repeated here, refer to 3GPP relevant agreement. It should be noted that the AMF will save the network element identifier of the selected SMF locally.
  • the SMF receives the context creation request sent by the AMF, and verifies the validity of the AMF. Specifically, the first client network element identifier in the HTTP protocol header is matched with the first client network element in the message body. The identifiers are compared, and if they are consistent, the SMF confirms that the AMF is legal, saves the first client network element identifier locally, and performs subsequent operations; if not, the SMF replies a rejection response, and the process ends.
  • the SMF sends a registration request, an acquisition request and a subscription request to the UDM.
  • the SMF selects the UDM, sends a registration request, an acquisition request, and a subscription request to the UDM to register with the UDM, and acquires contract data and subscribes to the contract data.
  • the specific content of the process refers to the relevant 3GPP protocol, which will not be repeated here.
  • the registration request may be a Numd_UECM_Registration Request
  • the acquisition request may be a Numd_SDM_Get Request
  • the subscription request may be a Numd_SDM_Subscribe Request.
  • the SMF initiates a registration request to the UDM
  • the Nudm_Registration SMF Request service can be used.
  • the SMF is the first client network element
  • the UDM is the server network element
  • the registration request is the first request message.
  • the registration request includes an HTTP protocol header and a message body
  • the HTTP protocol header includes a first client network element type and a first client network element identifier
  • the message body includes the first client network element identifier.
  • the first client network element identifier may be a network element instance identifier, that is, the first client network element identifier may be an SMF-SMF Instance ID, for example, the first client network element identifier may be SMF-00000000-0000-0000-000000000012.
  • the UDM After receiving the registration request sent by the SMF, the UDM verifies the validity of the SMF, and specifically, compares the first client network element identifier in the HTTP protocol header with the first client network element identifier in the message body. , if they are consistent, the UDM confirms that the SMF network element is legal, saves the identifier of the first client network element locally, and returns a registration response to the SMF, and then continues to process the subsequent process; if not, the UDM responds with a rejection response, and the process ends.
  • the SMF sends an acquisition request and a subscription request to the UDM.
  • the SMF is the first client network element
  • the UDM is the server network element
  • the acquisition request and the subscription request are the first request messages.
  • the UDM After receiving the acquisition request and subscription request sent by the SMF, the validity of the SMF will be verified. For the specific process, please refer to the relevant content of the registration request initiated by the SMF to the UDM, and will not be repeated here.
  • S804 The SMF sends a create context response to the AMF.
  • the AMF receives the context creation response sent by the SMF, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • S805 The SMF sends a session policy creation request to the PCF.
  • the SMF sends a session policy creation request to the PCF.
  • the SMF is the first client network element and the PCF is the server network element
  • the session policy creation request is the first request message
  • the session policy creation request includes an HTTP protocol header and a message body
  • the HTTP protocol header includes the first client network element type and the first client network element identifier
  • the message body includes the first client network element. Meta ID.
  • the first client network element identifier may be a network element instance identifier, that is, the first client network element identifier may be an SMF-SMF Instance ID, for example, the first client network element identifier may be SMF-00000000-0000-0000-000000000012.
  • the session policy creation request may be an Npcf_SMPolicyControl_Create Request
  • the SMF determines that PCC authorization is required by sending the Npcf_SMPolicyControl_Create Request and requests to establish an SMPolicy association with the PCF.
  • the PCF receives the session policy creation request sent by the SMF, and verifies the validity of the SMF. For details, refer to the processing of the UDM in step 803, and details are not repeated here.
  • S806 The SMF sends an N4 session establishment request to the UPF.
  • the UPF receives the N4 session establishment request sent by the SMF, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF is the first client network element
  • the PCF is the server network element.
  • the N1N2 information transmission request is a second request message
  • the N1N2 information transmission request includes An HTTP protocol header and a message body, where the HTTP protocol header includes the first client network element type and the first client network element identifier, and the message body includes the first client network element identifier.
  • the first client network element identifier may be a network element instance identifier, that is, the first client network element identifier may be an SMF-SMF Instance ID, for example, the first client network element identifier may be SMF-00000000-0000-0000-000000000012.
  • the N1N2 information transfer request may be a Namf_Communication_N1N2MessageTransfer Request.
  • the AMF receives the N1N2 information transmission request sent by the SMF, verifies the validity of the SMF, and compares the locally stored first client network element identifier (step S802) with the first client network element identifier in the message body. If they are consistent, the AMF will reply to the SMF with a N1N2 information transmission response, and continue to process the subsequent process; if not, the AMF will reply with a rejection response, and the process will end.
  • the SMF sends an N1N2 information transmission request to the AMF, and the AMF responds, the AMF also needs to interact with the (R)AN and the UE, that is, the N2 interface process.
  • the N2 interface process For the specific content of the N2 interface process, refer to 3GPP related protocols. , and will not be repeated here.
  • S808 The AMF sends an update context request to the SMF.
  • the AMF sends an update context request to the SMF.
  • the AMF is the first client network element
  • the SMF is the server network element
  • the update context request is the second request message
  • the context creation request in step S802 is a first request message
  • the update context request includes an HTTP protocol header and a message body
  • the HTTP protocol header includes the first client network element type and the first client network element identifier (for example, AMF-AMF Instance ID)
  • the message body includes the network element identifier of the first client. It can be understood that, for the specific content of the first client network element identifier, reference may be made to step S401 and step S802, and details are not repeated here.
  • the update context request may be an Nsmf_PDUSession_UpdateSMContext Request.
  • the SMF receives the update context request sent by the AMF, and verifies the validity of the AMF, specifically, compares the first client network element identifier stored locally by the SMF (step S802 ) with the first client in the message body If the identifiers of the network elements are consistent, the SMF confirms that the AMF is valid and performs subsequent operations; if not, the SMF replies with a rejection response, and the process ends.
  • S809 The SMF sends an N4 session modification request to the UPF.
  • the UPF receives the N4 session modification request sent by the SMF.
  • the relevant 3GPP protocol which will not be repeated here.
  • the SMF sends an update context response to the AMF.
  • the AMF receives the update context response sent by the SMF, and the specific content of the process refers to the relevant 3GPP protocol, which will not be repeated here.
  • the update context response may be an Nsmf_PDUSession_UpdateSMContext Response.
  • the SMF after the SMF replies to the AMF (step S804), if the session creation fails, the SMF notifies the AMF by sending Nsmf_PDUSession_SMContextStatusNotify (context status notification) to the AMF.
  • Nsmf_PDUSession_SMContextStatusNotify Context status notification
  • the specific content of the process refers to 3GPP related protocols, which will not be repeated here. .
  • An embodiment of the present application further provides a resource verification method for a service-oriented interface, as shown in FIG. 9 , which is a schematic flowchart of another resource verification method for a service-oriented interface.
  • the method may include the following step:
  • S901 The UE sends a session creation request.
  • the UE sends a session creation request to the AMF, where the session creation request includes a session identifier.
  • the session creation request may be a PDU Session Establishment Request
  • the session identifier may be a PDU Session ID
  • the PDU Session Establishment Request includes the PDU Session ID.
  • S902 The AMF sends a context creation request to the SMF.
  • the AMF sends a context creation request to the SMF.
  • the AMF is the first client network element
  • the SMF is the server network element
  • the context creation request is a fourth request message
  • the fourth request message carries the first A resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-A.
  • the fourth request message may be an HTTP request message or other types of messages, and the resource verification identifier may be carried by the HTTP request message or by the HTTP protocol layer. There are no restrictions on the application.
  • the create context request may be an Nsmf_PDUSession_CreateSMContext Request.
  • the SMF receives the context creation request sent by the AMF, allocates session resources, and then saves the first resource verification identifier (ID-A).
  • S903 The SMF sends a registration request to the UDM.
  • the SMF selects the UDM and sends a registration request to the UDM.
  • the SMF is the first client network element
  • the UDM is the server network element
  • the registration request is a fourth request message
  • the fourth request message carries the first A resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-C.
  • the registration request may be a Numd_UECM_Registration Request.
  • the UDM receives the registration request sent by the UDM, and saves the first resource verification identifier (ID-C).
  • S904 The UDM sends a registration response to the SMF.
  • the UDM sends a registration response to the SMF.
  • the UDM is the first client network element
  • the SMF is the server network element
  • the registration response is a fourth request message
  • the fourth request message carries the first resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-D.
  • the registration response may be a Numd_UECM_Registration Response.
  • the SMF receives the registration response sent by the UDM, and saves the first resource verification identifier (ID-D).
  • the SMF sends an acquisition request and a subscription request to the UDM.
  • the SMF sends an acquisition request and a subscription request to the UDM, thereby acquiring the subscription data and subscribing the subscription data.
  • the SMF is the first client network element
  • the UDM is the server network element
  • the acquisition request and the subscription request are the first network element.
  • a request message, the registration request is a fourth request message
  • the first request message carries information to be verified
  • the information to be verified includes a first resource verification identifier, that is, the acquisition request and the subscription request carry the first Resource verification ID.
  • the first resource verification identifier may be ID-C.
  • the get request may be a Numd_SDM_Get Request
  • the subscription request may be a Numd_SDM_Subscribe Request.
  • the UDM receives the acquisition request and the subscription request sent by the SMF, and verifies the validity of the SMF. Specifically, the UDM compares the stored first resource verification identifier (step S903) with the information carried in the acquisition request and the subscription request. The first resource checks whether the identifiers are consistent. If they are consistent, the UDM continues to process the subsequent process, and sends an acquisition response and a subscription response to the SMF. Otherwise, the UDM replies with an abnormal response.
  • S906 The SMF sends an update context response to the AMF.
  • the SMF sends an update context response to the AMF.
  • the SMF is the first client network element
  • the AMF is the server network element
  • the update context response is a fourth request message
  • the fourth request message carries the first A resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-B.
  • the update context response may be an Nsmf_PDUSession_UpdateSMContext Response.
  • the AMF receives the update context response sent by the SMF, and saves the first resource verification identifier (ID-B).
  • S907 The SMF sends a session policy creation request to the PCF.
  • the SMF sends a session policy creation request to the PCF.
  • the SMF is the first client network element
  • the PCF is the server network element
  • the session policy creation request is the fourth request message
  • the fourth request message carries a first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-E.
  • the session policy creation request may be an Npcf_SMPolicyControl_Create Request.
  • the PCF receives the session policy creation request sent by the SMF, and stores the first resource verification identifier (ID-E).
  • S908 The PCF sends a session policy creation response to the SMF.
  • the PCF sends a session policy creation response to the SMF.
  • the PCF is the first client network element
  • the SMF is the server network element
  • the session policy creation response is a fourth request message
  • the fourth request message carries A first resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-F.
  • the session policy creation response may be Npcf_SMPolicyControl_Create Response.
  • the SMF receives the session creation response sent by the PCF, and stores the first resource verification identifier (ID-F).
  • S909 The SMF sends a session policy update request to the PCF.
  • the SMF sends a session policy update request to the PCF.
  • the SMF is the first client network element
  • the PCF is the server network element
  • the session policy update request is the first request message
  • the session policy creation request is A fourth request message, where the first request message carries information to be verified, and the information to be verified includes a first resource verification identifier, that is, the session policy update request carries the first resource verification identifier, and the fourth request message Carrying a first resource verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-E.
  • the session policy update request may be an Npcf_SMPolicyControl_Update Request.
  • the PCF receives the session policy update request sent by the SMF, and verifies the validity of the SMF. Specifically, the PCF compares the saved first resource verification identifier (step S907) with the first resource verification identifier carried in the session policy update request. Check whether the resource verification identifiers are consistent. If they are consistent, the PCF replies with a session policy update response and continues to process the subsequent process. Otherwise, the PCF replies with an abnormal response.
  • step S909 part of the N4 interface process is omitted after step S909, and the relevant specific content refers to the relevant 3GPP protocol, which will not be repeated here.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF is the first client network element
  • the AMF is the server network element
  • the N1N2 information transmission request is the first request message
  • the update context response is the first request message.
  • the first request message carries the information to be verified
  • the information to be verified includes the first resource verification identifier, that is, the N1N2 information transmission request carries the first resource verification identifier
  • the fourth request message carries the first resource verification identifier.
  • a first resource verification identifier where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-B.
  • the N1N2 information transfer request may be a Namf_Communication_N1N2MessageTransfer Request.
  • the AMF receives the N1N2 information transmission request sent by the SMF, and verifies the validity of the SMF. Specifically, the AMF compares the stored first resource verification identifier (step S906) with the first resource carried in the N1N2 information transmission request. Check whether the resource verification identifiers are consistent. If they are consistent, the AMF will reply to the N1N2 information transmission response and continue to process the subsequent process. Otherwise, the AMF will reply with an abnormal response.
  • the SMF sends an N1N2 information transmission request to the AMF, and the AMF responds, the AMF also needs to interact with the (R)AN and the UE, that is, the N2 interface process.
  • the N2 interface process For the specific content of the N2 interface process, refer to 3GPP related protocols. , and will not be repeated here.
  • S911 The AMF sends an update context request to the SMF.
  • the AMF sends an update context request to the SMF.
  • the AMF is the first client network element
  • the SMF is the server network element
  • the update context request is the first request message
  • the context creation request is the fourth request message
  • the first request message carries the information to be verified
  • the information to be verified includes the first resource verification identifier, that is, the update context request carries the first resource verification identifier
  • the fourth request message carries the first resource A verification identifier, where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-A.
  • the update context request may be an Nsmf_PDUSession_UpdateSMContext Request.
  • the SMF receives the update context request sent by the AMF, and verifies the validity of the AMF. Specifically, the SMF compares the saved first resource verification identifier (step S902) with the first resource verification carried in the update context request. Whether the identifiers are consistent, if so, SMF sends an update context response to AMF, and continues to process the subsequent process, otherwise, SMF replies with an abnormal response.
  • step S911 part of the N4 interface process is omitted.
  • the SMF sends an N4 session modification request to the UPF.
  • the specific content of the process refers to 3GPP related protocols, and details are not repeated here.
  • the SMF sends a request for releasing session resources to the AMF.
  • the SMF sends a session resource release request to the AMF.
  • the SMF is the first client network element
  • the AMF is the server network element
  • the session resource release request is the first request message
  • the update context response is the first request message.
  • the first request message carries the information to be verified
  • the information to be verified includes the first resource verification identifier, that is, the release session resource request carries the first resource verification identifier
  • the fourth request message carries the first resource verification identifier.
  • a first resource verification identifier where the first resource verification identifier is used to uniquely identify the first client network element.
  • the first resource verification identifier may be ID-B.
  • the request for releasing session resources may be Nsmf_PDUSession_SMContextStatusNotify.
  • the AMF receives the request for releasing session resources sent by the SMF, and verifies the validity of the SMF. It can be understood that the verification process here is the same as the verification process in step S911 , and reference may be made to step S911 , and details are not repeated here.
  • step S909 and step S912 are optional processes of the above session creation process, that is, step S909 and step S912 are optional steps.
  • An embodiment of the present application further provides a resource verification method for a service-oriented interface, as shown in FIG. 10 , which is a schematic flowchart of another resource verification method for a service-oriented interface.
  • the method may include the following step:
  • S1001 The UE sends a registration request to the NEW AMF.
  • the NEW AMF receives the registration request sent by the UE, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • the registration request may be a Registration Request.
  • the context transfer request may be a Namf_Communication_UEContextTransfer Request.
  • the OLD AMF receives the context transmission request sent by the NEW AMF, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • the OLD AMF locates user resources, checks the integrity of the context transfer request, and then sends a context transfer response to the NEW AMF, where the context transfer response carries the data stored in the OLD AMF.
  • Resource verification marks, the resource verification marks saved in the OLD AMF include but are not limited to session-related resource verification marks and policy-related resource verification marks, and the session-related resource verification marks include but are not limited to session-related network elements
  • the identifier of the first client network element when serving as the first client network element, the resource verification identifier related to the policy includes but is not limited to the first client network element when the network element related to the policy is used as the first client network element logo.
  • session-related network elements include AMF, SMF, UDM, etc.
  • the session-related resource verification identifiers include the first client network element identifier when the AMF is the first client network element, and the SMF as the first client network element.
  • the context transfer response may be a Namf_Communication_UEContextTransfer Response.
  • the NEW AMF receives the context transmission response sent by the OLD AMF, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • the NEW AMF needs to register with the UDM, obtain the subscription data, and subscribe to the subscription data.
  • the specific content of these processes refers to the relevant 3GPP protocols, and will not be repeated here.
  • the UDM sends a deregistration request to the OLD AMF.
  • the UDM is the first client network element
  • the OLD AMF is the server network element
  • the deregistration request is a first request message
  • the first request message carries Information to be verified
  • the information to be verified includes a first resource verification identifier, that is, the deregistration request carries a first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client network element .
  • the UDM sends the fourth request message to the OLD AMF.
  • the UDM is the first client network element
  • the OLD AMF is the server network element
  • the fourth request message Carrying the first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client network element
  • the OLD AMF saves the first resource verification identifier.
  • the deregistration request may be Nudm_UECM_DeregistrationNotify Request.
  • the OLD AMF receives the de-registration request sent by the UDM, and verifies the validity of the UDM. Specifically, the OLD AMF compares the stored first resource verification identifier with the first resource verification identifier carried by the de-registration request. If they are consistent, OLD AMF sends a deregistration response to UDM and continues to process the subsequent process, otherwise, OLD AMF replies with an abnormal response.
  • the OLD AMF sends an unsubscribe request to the UDM.
  • the OLD AMF is the first client network element
  • the UDM is the server network element
  • the unsubscribe request is a first request message
  • the first request message carries Information to be verified
  • the information to be verified includes a first resource verification identifier, that is, the deregistration request carries a first resource verification identifier
  • the first resource verification identifier is used to uniquely identify the first client network element .
  • the OLD AMF sends the fourth request message to the UDM.
  • the OLD AMF is the first client network element
  • the UDM is the server network element.
  • the fourth request message Carrying the first resource verification identifier, the first resource verification identifier is used to uniquely identify the first client network element, and the UDM saves the first resource verification identifier.
  • the unsubscribe request may be Nudm_SDM_Unsubscribe Request.
  • UDM receives the de-subscription request sent by OLD AMF, and verifies the legitimacy of OLD AMF, specifically, UDM compares the first resource verification identifier of the preservation and the first resource verification identifier carried by the de-subscription request. If they are consistent, the UDM sends an unsubscribe response to the OLD AMF and continues to process the subsequent process. Otherwise, the UDM responds with an abnormal response.
  • the NEW AMF sends a policy update request to the PCF.
  • the NEW AMF is the third client network element
  • the OLD AMF is the server network element.
  • the policy update request is a fifth request message, and the policy update request carries The second resource verification identifier, the second resource verification identifier is used to uniquely identify the NEW AMF.
  • the OLD AMF sends a first request message to the PCF, and the first request message may be a policy update request.
  • the OLD AMF is the first client network element
  • the PCF is the server network element.
  • the first request message includes information to be verified, and the information to be verified includes a first resource verification identifier, and the first resource verification identifier is used to uniquely identify the OLD AMF. It is understandable that the PCF will verify the validity of the OLD AMF, and after verifying that the OLD AMF is legal, the PCF will save the first resource verification identifier.
  • the policy update request sent by the NEW AMF to the PCF also carries the first resource verification identifier. It is understandable that after the PCF receives the policy update request sent by the NEW AMF, it will verify the validity of the NEW AMF, and the PCF will compare the Whether the first resource verification identifier carried in the policy update request sent by the NEW AMF to the PCF is consistent with the saved first resource verification identifier, and if they are consistent, the PCF updates the saved first resource verification identifier to the second resource verification identifier , that is, delete the saved first resource verification identifier, save the second resource verification identifier, the PCF replies with a policy update response, and continues to process the subsequent process.
  • the policy update request may be an Npcf_AMPolicyControl_Update Request.
  • the NEW AMF sends an update context request to the SMF, at this time, the NEW AMF is the third client network element, the OLD AMF is the server network element, the update context request is a fifth request message, and the update context request carries The second resource verification identifier, the second resource verification identifier is used to uniquely identify the NEW AMF.
  • the OLD AMF sends a first request message to the SMF, and the first request message may be an update context request.
  • the OLD AMF is the first client network element
  • the SMF is the server network element.
  • the first request message includes information to be verified, and the information to be verified includes a first resource verification identifier, and the first resource verification identifier is used to uniquely identify the OLD AMF. Understandably, the SMF will verify the validity of the OLD AMF, and after the SMF verifies that the OLD AMF is legal, it will save the first resource verification identifier.
  • the policy update request sent by the NEW AMF to the SMF also carries the first resource verification identifier. It is understandable that after receiving the policy update request sent by the NEW AMF, the SMF will verify the validity of the NEW AMF, and the SMF will compare the Whether the first resource verification identifier carried in the policy update request sent by the NEW AMF to the PCF is consistent with the stored first resource verification identifier, and if they are consistent, the SMF updates the stored first resource verification identifier to the second resource verification identifier , that is, delete the saved first resource verification identifier, save the second resource verification identifier, and the SMF responds with an update context response, and continues to process the subsequent process.
  • the update context request may be an Nsmf_PDUSession_UpdateSMContext Request.
  • the NEW AMF sends a context release request to the SMF, and accordingly, the SMF receives the release context request sent by the NEW AMF, and verifies the validity of the NEW AMF.
  • the specific process is the same as that of step S1007, and reference may be made to step S1007, which will not be repeated here. .
  • the SMF verifies that the NEW AMF is valid, it responds to the release context request and continues to process the subsequent process.
  • the release context request may be an Nsmf_PDUSession_ReleaseSMContext Request.
  • the NEW AMF will send a registration response to the UE, and the specific content of the process refers to 3GPP related protocols, which will not be repeated here.
  • An embodiment of the present application further provides a resource verification method for a service-oriented interface, as shown in FIG. 11 , which is a schematic flowchart of another resource verification method for a service-oriented interface.
  • the method may include the following step:
  • S1101 The UE sends a session creation request.
  • the UE sends a session creation request to the AMF, where the session creation request includes a session identifier.
  • the session creation request may be a PDU Session Establishment Request
  • the session identifier may be a PDU Session ID
  • the PDU Session Establishment Request includes the PDU Session ID.
  • the network element when the network element registers the NRF, the network element can add the client address information planned by the network element in the registration request, that is, the registration request will carry the client address information planned by the network element. Therefore, the NRF receives the After the registration request, the client address information of the network element can be obtained. Understandably, the client address information includes but is not limited to the user's IP address.
  • FIG. 12 is a schematic diagram of an AMF and an SMF registering an NRF according to an embodiment of the present application.
  • the AMF sends a registration request to the NRF, and the registration request carries the client address information planned by the AMF, and the SMF sends a registration request to the NRF.
  • a registration request is sent, where the registration request carries the client address information planned by the SMF.
  • the AMF sends a request for querying network elements to the NRF.
  • the AMF sends a query network element request to the NRF, where the query network element request is used to query the Nsmf_PDUSession service.
  • the request for querying network elements may be an Nnrf_NFDiscovery Request.
  • S1103 The NRF sends a query network element response to the AMF.
  • the NRF after receiving the query network element request sent by the AMF, the NRF queries the SMF that meets the query network element request, and sends a query network element response to the AMF, where the query network element response includes the query network element request that meets the query network element request.
  • SMF planning client address information After receiving the query network element request sent by the AMF, the NRF queries the SMF that meets the query network element request, and sends a query network element response to the AMF, where the query network element response includes the query network element request that meets the query network element request.
  • the query network element response may be Nnrf_NFDiscovery Response.
  • the AMF receives the query network element response sent by the NRF, and saves the client address information planned by the SMF included in the query network element response into the address mapping table of the AMF.
  • S1104 The AMF sends a context creation request to the SMF.
  • the AMF sends a context creation request to the SMF.
  • the AMF is the first client network element
  • the SMF is the server network element
  • the SMF network element includes an address mapping table
  • the address mapping table includes the first client network element.
  • the context creation request is the first request message
  • the first request message includes information to be verified
  • the information to be verified includes the client address information, that is, the context creation request includes the client address information.
  • the client address and the server address must be available to send and/or receive HTTP requests. It can be understood that the context creation request belongs to an HTTP request. Therefore, the context creation request It also includes the client address and the server address, that is, the context creation request also includes the client address of the AMF.
  • the create context request may be an Nsmf_PDUSession_CreateSMContext Request.
  • the first client network element identifier includes but is not limited to a network element instance identifier (NF Instance ID), and the NF Instance ID can be carried through the HTTP protocol layer, or can be carried through an HTTP request.
  • NF Instance ID network element instance identifier
  • the SMF can configure the client address information of one or more AMFs into the address mapping table of the SMF, and associate one or more network element identifiers with the one or more AMFs.
  • the client address information is associated and corresponding, thereby distinguishing the one or more AMFs, and the SMF only uses the client address information of the currently associated AMF (restricts the use of the client address information of other AMFs).
  • the SMF may also not store the network element identifier of the AMF in the address mapping table of the SMF, that is, only the client address information of the AMF is stored in the SMF, and the client address information is not associated with the SMF.
  • the network element identification of the AMF is associated.
  • FIG. 13 is a schematic diagram of the configuration of AMF client address information provided by an embodiment of the present application.
  • the SMF configures and saves the client address information of the AMF
  • the network element identifier of the AMF is associated with its client address information, so that the SMF can query the corresponding client address information of the AMF through the network element identifier of the AMF.
  • FIG. 14 is a schematic diagram of the SMF verifying the validity of the AMF provided by the embodiment of the present application.
  • traverse its address mapping table specifically, query the address mapping table of the SMF according to the identifier of the first client network element in the creating context request, if the address mapping table of the SMF contains the address mapping table
  • the identifier of the first client network element is to search for the client address information carried in the context creation request in the client address information corresponding to the identifier of the first client network element in the address mapping table of the SMF.
  • the client address information carried in the context request is included, and the SMF continues to process the subsequent process and sends a context creation response to the AMF, otherwise, the process terminates; if there is no identifier of the first client network element in the address mapping table of the SMF related records, then directly look up the client address information carried in the context creation request in the address mapping table of the SMF. If the client address information carried in the context creation request is in it, the SMF continues to process the subsequent process and sends the AMF sends a create context response, otherwise, the process terminates.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF sends an N1N2 information transmission request to the AMF.
  • the SMF is the first client network element
  • the AMF is the server network element
  • the AMF network element includes an address mapping table
  • the address mapping table includes the first client network element.
  • the context creation request is the first request message
  • the first request message includes information to be verified
  • the information to be verified includes the client address information
  • the context creation request includes the client address information.
  • the client address and the server address must be available to send and/or receive HTTP requests. It is understood that the N1N2 information transmission request is an HTTP request. Therefore, the N1N2 information The transmission request further includes the client address and the server address, that is, the N1N2 information transmission request further includes the client address of the SMF.
  • the N1N2 information transfer request may be a Namf_Communication_N1N2MessageTransfer Request.
  • the first client network element identifier includes but is not limited to a network element instance identifier (NF Instance ID), and the NF Instance ID can be carried through the HTTP protocol layer, or can be carried through an HTTP request.
  • NF Instance ID network element instance identifier
  • the AMF can configure one or more SMF client address information into the address mapping table of the AMF, and the related content of the configuration is the same as that of step S1104.
  • FIG. 15 is a schematic diagram of the AMF verifying the validity of the SMF provided by the embodiment of the present application.
  • the N1N2 information transmission request traverse its address mapping table, specifically, query the address mapping table of the AMF according to the first client network element identifier in the N1N2 information transmission request, if the address mapping table of the AMF is in the address mapping table
  • the first client network element identifier exists, and the client address information carried in the N1N2 information transmission request is searched for in the client address information corresponding to the first client network element identifier in the address mapping table of the AMF, If the client address information carried in the N1N2 information transmission request is included, the AMF continues to process the subsequent process and sends an N1N2 information transmission response to the SMF, otherwise, the process terminates; if the AMF address mapping table does not contain the first The relevant record of the client network element identifier, then directly look up the client address information carried in the N1N2 information transmission request in the address mapping table of the AMF, if the client address information carried in the N1N2 information transmission request is in it, The AMF continues to process the subsequent process and sends
  • the AMF sends an update context request to the SMF.
  • the SMF receives the update context request sent by the AMF, and verifies the validity of the AMF.
  • the specific verification method may refer to step S1104, which will not be repeated here.
  • the update context request may be an Nsmf_PDUSession_UpdateSMContext Request.
  • the SMF will verify the validity of the NEW AMF, and the specific content can refer to step S1104, which will not be repeated here. After the SMF verifies that the NEW AMF is valid, it continues to process the subsequent process, and returns an update context response to the AMF.
  • the SMF may send a session resource release request to the AMF.
  • the session resource release request may be Nsmf_PDUSession_SMContextStatusNotify (context status notification).
  • the AMF will verify the session resource release request after receiving the request. For the validity of the SMF, refer to step S1105 for details of the verification method, and refer to the relevant 3GPP protocol for the specific content of the process, which will not be repeated here.
  • the above session creation process omits part of the process after AMF sends a context creation request to SMF, after AMF sends a N1N2 information transmission response to SMF, and after AMF sends an update context request to SMF, the omitted part of the process and
  • AMF sends a context creation request to SMF
  • N1N2 information transmission response to SMF after AMF sends a N1N2 information transmission response to SMF
  • AMF sends an update context request to SMF
  • FIG. 16 is a schematic diagram of a network device provided by this application, and the network device is used to execute the service-oriented interface described in FIG. 4 , FIG. 8 , FIG. 9 , FIG. 10 and FIG. 11 .
  • Resource verification method This application does not limit the division of the functional units of the network device, and each unit in the network device can be added, decreased or combined as required.
  • the operations and/or functions of each unit in the network device are respectively to implement the corresponding processes of the methods described in the above-mentioned FIG. 4 , FIG. 8 , FIG. 9 , FIG. 10 and FIG. .
  • Figure 16 exemplarily provides a division of functional units:
  • the network device 1600 includes a receiving unit 1610 and a processing unit 1620 .
  • the receiving unit 1610 is configured to receive a first request message sent by a first client network element, where the first request message carries information to be verified, and the information to be verified is used to perform verification on the first client network element. Legality verification.
  • the processing unit 1620 is configured to verify the validity of the first client network element according to the information to be verified; and execute the first request message after verifying that the first client network element is legal.
  • each unit included in the network device 1600 may be a software unit, a hardware unit, or a part of a software unit and a part of a hardware unit.
  • the network device shown in FIG. 16 is only an exemplary implementation in the embodiment of the present application, and the network device applicable to the resource verification method for the service-oriented interface in the embodiment of the present application includes but Not limited to the above structure.
  • FIG. 17 is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • the computing device 1700 includes a processor 1710 , a communication interface 1720 and a memory 1730 , and the processor 1710 , the communication interface 1720 and the memory 1730 are connected to each other through an internal bus 1740 .
  • the computing device 1700 may be the network device in FIG. 16 , and the functions performed by the network device 1600 in FIG. 16 are actually performed by the processor 1710 of the network device 1600 .
  • the processor 1710 may be composed of one or more general-purpose processors, such as a central processing unit (Central Processing Unit, CPU), or a combination of a CPU and a hardware chip.
  • the above-mentioned hardware chip may be an application-specific integrated circuit (Application-Specific Integrated Circuit, ASIC), a programmable logic device (Programmable Logic Device, PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field programmable gate array (Field-Programmable Gate Array, FPGA), a general array logic (Generic Array Logic, GAL) or any combination thereof.
  • the communication interface 1720 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Core Network, Wireless Local Area Networks (WLAN) and the like.
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the bus 1740 may be a peripheral component interconnect standard (Peripheral Component Interconnect, PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like.
  • PCI peripheral component interconnect standard
  • EISA Extended Industry Standard Architecture
  • the bus 1740 can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is shown in Figure 17, but it does not mean that there is only one bus or one type of bus.
  • the memory 1730 may include a volatile memory (Volatile Memory), such as a random access memory (Random Access Memory, RAM); the memory 1730 may also include a non-volatile memory (Non-Volatile Memory), such as a read-only memory (Read- Only Memory (ROM), flash memory (Flash Memory), hard disk (Hard Disk Drive, HDD) or solid-state drive (Solid-State Drive, SSD); the memory 1730 may also include a combination of the above types.
  • the memory 1730 is used to store the program code for executing the above embodiment of the resource verification method for the service-oriented interface. In one embodiment, the memory 1730 can also cache other data, and the execution is controlled by the processor 1710 to realize the above.
  • the functional units shown in the network device 1600 are used to implement the method steps in the method embodiments shown in FIG. 4 , FIG. 8 , FIG. 9 , FIG. 10 and FIG. details as follows:
  • the processor 1710 controls the communication interface 1720 to receive a first request message sent by the first client network element, where the first request message carries information to be verified, and the to-be-verified information is used to communicate to the first client network element. conduct legality verification;
  • the processor 1710 performs legality verification on the first client network element according to the information to be verified;
  • the processor 1710 executes the first request message after verifying that the first client network element is legitimate.
  • the processor 1710 controls the communication interface 1720 to receive the first request message sent by the first client network element, including: the processor 1710 controls the communication interface 1720 to receive the first client network element according to the hypertext An HTTP request message sent by a transmission protocol, the HTTP request message includes an HTTP protocol header and a message body, the HTTP protocol header includes the first client network element type and the first client network element identifier, and the message body includes the The identifier of the first client network element.
  • the processor 1710 performs legality verification on the first client network element according to the information to be verified, including: the processor 1710 compares the first client network element in the HTTP protocol header Whether the element identifier and the first client network element identifier in the message body are consistent, if they are consistent, it is confirmed that the first client network element is legal.
  • the processor 1710 performs legality verification on the first client network element according to the to-be-verified information, including: when the first client network element type in the HTTP protocol header is the same as the When the network element types of the server network element are consistent, the processor 1710 compares whether the first client network element identifier in the HTTP protocol header is consistent with the network element instance identifier of the server network element itself. , it is confirmed that the first client network element is legal.
  • the method further includes: the processor 1710 saves the identifier of the first client network element; After verifying the validity of the first client network element with the verification information, the method further includes: the processor 1710 controls the communication interface 1720 to receive a second request message sent by the first client network element, the first client network element The second request message carries the identifier of the first client network element; the processor 1710 verifies the validity of the first client network element according to the identifier of the first client network element; the processor 1710 compares the second request Whether the identifier of the first client network element in the message is consistent with the identifier of the first client network element stored by the server network element, if they are the same, the first client network element is confirmed to be legal; the processor 1710 is verifying The second request message is executed after the first client network element is legal.
  • the method further includes: the processor 1710 controls the communication interface 1720 to receive the first request message sent by the first client network element
  • the method further includes: the processor 1710 controls the communication interface 1720 to receive the second client network element
  • the third request message sent, the third request message carries the network element identifier of the second client; the processor 1710 performs legality verification according to the identifier of the second client network element; the processor 1710 is verifying the first client After the end network element is legal, the identifier of the second client network element is stored; before the processor 1710 controls the communication interface 1720 to receive the first request message sent by the first client network element, the method further includes: the processor 1710 compares the Whether the identifier of the first client network element in the HTTP protocol header is consistent with the stored identifier of the second client network element.
  • the information to be verified includes a first resource verification identifier
  • the method further includes: processing The controller 1710 controls the communication interface 1720 to receive a fourth request message sent by the first client network element, the fourth request message carries the first resource verification identifier, and the first resource verification identifier is used to uniquely identify the the first client network element; the processor 1710 saves the first resource verification identifier; the processor 1710 performs legality verification on the first client network element according to the information to be verified, including: the processor 1710 compares the Whether the first resource verification identifier carried in the first request message and the stored first resource verification identifier are consistent, and if they are consistent, it is confirmed that the first client network element is legal.
  • the method further includes: the processor 1710 controls the communication interface 1720 to receive the fifth request message sent by the third client network element, The fifth request message carries the first resource verification identifier and the second resource verification identifier, and the second resource verification identifier is used to uniquely identify the third client network element; the processor 1710 compares the fifth request Whether the first resource verification identifier carried in the message is consistent with the stored first resource verification identifier, and if so, the processor 1710 deletes the first resource verification identifier and saves the second resource verification identifier.
  • the memory 1730 includes an address mapping table, and the address mapping table includes a first client network element identifier and client address information corresponding to the first client network element identifier.
  • the information includes the client address information
  • the processor 1710 performs legality verification on the first client network element according to the information to be verified, including: the processor 1710 traverses the address mapping table to determine the address mapping Whether the table contains the client address information carried in the first request message, and if the address mapping table contains the client address information, it is confirmed that the first client network element is legal.
  • Embodiments of the present application further provide a computer-readable storage medium, on which a computer program is stored.
  • the program When the program is executed by a processor, it can implement some or all of the steps described in the above method embodiments, and realize the above The function of any one of the functional units described in Figure 16.
  • Embodiments of the present application also provide a computer program product, which, when run on a computer or a processor, causes the computer or processor to execute one or more steps in any one of the above methods. If each component module of the above-mentioned device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in the computer-readable storage medium.
  • Embodiments of the present application further provide a chip system, where the chip system includes a processor, configured to support the network device 1600 to implement one or more steps of the method steps in any of the above methods with the network device 1600 as the main body of execution.
  • the chip system further includes a memory for storing necessary program instructions and data of the data sending device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be implemented in the present application.
  • the implementation of the examples constitutes no limitation.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .
  • the modules in the apparatus of the embodiment of the present application may be combined, divided and deleted according to actual needs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

La présente demande concerne un procédé de vérification de ressource pour une interface basée sur un service, ainsi qu'un dispositif associé. Le procédé comprend les étapes suivantes : un élément de réseau serveur reçoit un premier message de demande envoyé par un élément de réseau client, le premier message de demande portant des informations à vérifier, et les informations à vérifier étant utilisées pour effectuer une vérification de légitimité sur l'élément de réseau client ; l'élément de réseau serveur effectue une vérification de légitimité sur l'élément de réseau client en fonction des informations à vérifier ; et après vérification du fait que l'élément de réseau client est légitime, l'élément de réseau serveur exécute le premier message de demande. Le procédé peut vérifier la légitimité de l'élément de réseau client et réduire des risques tels qu'une suppression par erreur, une altération accidentelle et une transmission incorrecte de ressources.
PCT/CN2020/141127 2020-12-29 2020-12-29 Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé WO2022141132A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/141127 WO2022141132A1 (fr) 2020-12-29 2020-12-29 Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/141127 WO2022141132A1 (fr) 2020-12-29 2020-12-29 Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé

Publications (1)

Publication Number Publication Date
WO2022141132A1 true WO2022141132A1 (fr) 2022-07-07

Family

ID=82259937

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/141127 WO2022141132A1 (fr) 2020-12-29 2020-12-29 Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé

Country Status (1)

Country Link
WO (1) WO2022141132A1 (fr)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110784434A (zh) * 2018-07-31 2020-02-11 华为技术有限公司 通信方法及装置
WO2020141356A1 (fr) * 2019-01-04 2020-07-09 Telefonaktiebolaget Lm Ericsson (Publ) Autorisation flexible dans un réseau central basé sur un service 5g
CN112087412A (zh) * 2019-06-14 2020-12-15 大唐移动通信设备有限公司 一种基于唯一令牌的服务访问处理方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110784434A (zh) * 2018-07-31 2020-02-11 华为技术有限公司 通信方法及装置
WO2020141356A1 (fr) * 2019-01-04 2020-07-09 Telefonaktiebolaget Lm Ericsson (Publ) Autorisation flexible dans un réseau central basé sur un service 5g
CN112087412A (zh) * 2019-06-14 2020-12-15 大唐移动通信设备有限公司 一种基于唯一令牌的服务访问处理方法及装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
CHINA MOBILE: "Living Document:Security of Service Based Architecture of 5G phase 1", 3GPP TSG SA WG3 (SECURITY) MEETING #91BIS, S3-181812, 25 May 2018 (2018-05-25), XP051502434 *
NOKIA: "OAuth based service authorization framework for SBA", 3GPP TSG SA WG3 (SECURITY) MEETING #90BIS, S3-180678, 2 March 2018 (2018-03-02), XP051409103 *
NOKIA: "OAuth based service authorization framework for SBA", 3GPP TSG SA WG3 (SECURITY) MEETING #90BIS, S3-180680, 2 March 2018 (2018-03-02), XP051409105 *

Similar Documents

Publication Publication Date Title
US10659952B2 (en) Network slice selection policy updating method and apparatus
WO2020147760A1 (fr) Procédé, dispositif, et système de communication de réseau local
EP3726806B1 (fr) Procédé de commande à distance d'un véhicule sur la base d'un appareil intelligent
EP3800934A1 (fr) Procédé de routage d'un service de l'internet des objets
JP4541411B2 (ja) モバイル・デバイスおよびサービスを管理する統合された方法および装置
WO2021093438A1 (fr) Procédé d'accès au réseau et appareil de communication
WO2019042378A1 (fr) Procédé et appareil permettant de fournir des informations d'identité d'utilisateur et support d'informations
US9225579B2 (en) Renewing registrations for a plurality of client applications that are associated with the same host server via an explicit piggybacking scheme
EP4131808A1 (fr) Procédé de commande de transmission de service de flux multimédia, dispositif électronique, terminal utilisateur, noeud de réseau, système et support d'enregistrement
WO2018112327A1 (fr) Procédés de commande de simultanéité pour transfert de bloc dans une architecture de publication-abonnement coap
RU2473184C2 (ru) Способ и устройство для абонентской базы данных
KR102647498B1 (ko) M2m 시스템에서 통지 메시지 전송 방법 및 그 장치
CN110771117B (zh) 一种采用面向id的网络的会话层通信
US20220248228A1 (en) Methods and Apparatus for Device Authentication and Authorisation
WO2019154017A1 (fr) Procédé et appareil d'établissement de trajets multiples
JP2024511907A (ja) ネットワーク機能登録方法、発見方法、装置、デバイス及び媒体
WO2022067831A1 (fr) Procédé et appareil d'établissement d'une communication sécurisée
WO2022141132A1 (fr) Procédé de vérification de ressource pour une interface basée sur un service et dispositif associé
US7774464B2 (en) Automatic syncML client profile creation for new servers
WO2022110919A1 (fr) Procédé et appareil d'abonnement à des informations
US12028341B2 (en) Network slice authentication
WO2022067509A1 (fr) Procédé et appareil de commande de mise à niveau de dispositif, ainsi que dispositif informatique et support de stockage
US20230139780A1 (en) Network slice authentication
WO2022165787A1 (fr) Procédé et appareil de configuration de paramètres, dispositif, et support de stockage
CN115209522B (zh) 网络功能注册方法、发现方法、装置、设备及介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20967480

Country of ref document: EP

Kind code of ref document: A1