WO2022148244A1 - Communication method, apparatus and system - Google Patents

Abstract

Provided are a communication method, apparatus and system, which are used for solving the risk of leakage of network data caused when an existing client credential assertion mechanism is used in a roaming scenario. The method comprises: a first network function entity receiving a first client credential assertion from a second network function entity, wherein the first client credential assertion comprises a network identifier of a network in which a desired receiver network function entity of the first client credential assertion is located, the first network function entity belongs to a first network, the second network function entity belongs to a second network, and the first network and the second network are different networks; and the first network function entity verifying whether the network identifier of the network in which the desired receiver network function entity of the first client credential assertion is located is a network identifier of the first network.

Description

Communication method, device and system

This application claims the priority of the Chinese patent application with the application number 202110034375.X and the application name "Communication Method, Device and System" filed with the State Intellectual Property Office on January 11, 2021, the entire contents of which are incorporated herein by reference Applying.

technical field

The present application relates to the field of communication technologies, and in particular, to a communication method, device, and system.

Background technique

In the current fifth-generation (5G) network, a new client credential assertion (CCA) mechanism is introduced in the indirect communication scenario. Specifically, the originator network function entity sends the client credential statement as an identity certification parameter for proving the originator network function entity to the recipient network function entity, and the recipient network function entity certifies the identity of the originator network function entity according to the client credential statement. correctness. When the identity certificate is correct, the receiver network function entity can directly provide services for the initiator network function entity. For example, even if there are service communication proxy (SCP) network elements in between, receivers such as producer of the network function (pNF) or network exposure function Repository Function (NRF) A party network function entity may also verify the identity of an initiator network function entity, such as a consumer of network function (cNF), through client credential assertions. When the identity is correct, the pNF or NRF can directly provide services to the cNF.

Wherein, when the client credential declaration mechanism is used in a roaming scenario, the initiator network function entity and the recipient network function entity belong to different operator networks. Assume that the client credential assertion is generated by the originating network function entity in network C and used to access the recipient network function entity in network A. According to the solution in the prior art, if the client credential statement is leaked and obtained by an attacker, the attacker can use the client credential statement in any network other than network C (eg, network B) in the recipient network function entity . However, if the client credentials are authenticated by the recipient network function entity in another network, it may provide services to attackers, resulting in risks such as network data leakage.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a communication method, device, and system, which are used to solve the risk that the existing client credential declaration mechanism may lead to network data leakage when used in a roaming scenario.

To achieve the above object, the embodiments of the present application adopt the following technical solutions:

In a first aspect, a communication method is provided, and a communication device executing the communication method may be a first network function entity; or may be a module applied in the first network function entity, such as a chip or a chip system. The following description will be given by taking the execution subject as the first network function entity as an example. The first network function entity receives the first client credential statement from the second network function entity, the first client credential statement includes the network identifier of the network where the network function entity of the intended recipient of the first client credential statement is located, the first network The functional entity belongs to the first network, the second network functional entity belongs to the second network, and the first network and the second network are different networks; the first network functional entity verifies the expected recipient network functional entity of the first client credential statement Whether the network identifier of the network where it is located is the network identifier of the first network. Because in the embodiment of this application, the first client credential statement sent by the sender network function entity (corresponding to the second network function entity) to the receiver network function entity (corresponding to the first network function entity) is bound with the first client The network identifier of the network where the network function entity of the expected recipient of the credential statement is located, and the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is used to verify whether it is the same as the network identifier of the network where the network function entity of the recipient is located (corresponding to the The network identifier of the above-mentioned first network) is the same. Wherein, the network function entity of the receiver will only provide services to the network function entity of the sender when the network identity of the network where the network function entity of the expected receiver is located as declared by the first client credential is the network identity of the network function entity of the receiver side. , so it is possible to avoid the possibility that the first client credential statement is used in a network other than the network where the network function entity of the expected recipient of the first client credential statement is located, thereby avoiding the possibility that the first client credential statement is used in the Risks such as network data leakage caused by other networks other than the network where the network functional entity of the client's credential statement is expected to be located, improves the reliability of network data transmission.

With reference to the above first aspect, in a possible implementation manner, the first network function entity receives the first client credential declaration from the second network function entity, including: the first network function entity receives the first security edge protection proxy entity through the first security edge protection proxy entity. a first message, the first message including the first client credential assertion from the second network function entity.

With reference to the above first aspect, in a possible implementation manner, the first message further includes a first root certificate, where the first root certificate is the root certificate of the second network; the method further includes: the first network function entity according to The first root certificate verifies whether the certificate information declared by the first client certificate is correct. Compared with the prior art solution in which the recipient network function entity cannot verify whether the certificate in the client credential statement is correct in scenarios such as no cross-certificate between different operators, the embodiment of the present application can verify the first root certificate according to the first root certificate. Check whether the certificate information of the client certificate statement is correct, so as to realize the verification of the certificate in the client certificate statement, and then realize the verification of the digital signature of the client certificate statement and the signed content.

With reference to the above first aspect, in a possible implementation manner, the first message further includes a first authorization token used by the second network function entity to request services of the first network function entity, the first authorization token The card includes the network identifier of the second network; the method further includes: verifying by the first network function entity whether the network identifier of the second network is the network identifier in the certificate information declared by the first client credential.

With reference to the above-mentioned first aspect, in a possible implementation manner, the first message further includes an identifier of the network function set to which the network function entity of the expected recipient declared by the first client credential belongs; the method further includes: a first network function The entity verifies whether the identity of the network function set to which the intended recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs.

With reference to the above first aspect, in a possible implementation manner, the first client credential statement further includes an identifier of the network function set where the network function entity of the expected recipient of the first client credential statement is located; the method further includes: a first The network function entity verifies whether the identity of the network function set to which the intended recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs.

With reference to the above first aspect, in a possible implementation manner, the signed content of the first client credential statement includes the network identifier of the network where the network function entity of the originator of the first client credential statement is located; the method further includes: The first network function entity verifies whether the network identification of the network where the network function entity of the first client credential assertion is located is the network identification in the certificate information of the first client credential assertion.

With reference to the above-mentioned first aspect, in a possible implementation manner, after the first network function entity verifies that the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is the network identifier of the first network , the method further includes: the first network function entity sends a second client credential declaration to the second network function entity, the second client credential declaration includes at least one of the following parameters: a desired recipient network function of the second client credential declaration the identity of the entity; the identity of the network function set to which the network function entity of the expected recipient of the second client credential statement belongs; the network identity of the network where the network function entity of the expected recipient of the second client credential statement is located; The type of network function entity of the expected recipient; the first client credential assertion, or the hash value of the first client credential assertion; the data of the first service request, or the hash value of the data of the first service request, the first A service request is a service request carrying the first client credential statement; the identifier of the originating network function entity of the second client credential statement; the identity of the network function set to which the originating network functional entity of the second client credential statement belongs; or , the network identifier of the network where the network function entity of the originator of the second client credential statement is located. Based on this solution, the sender network function entity (corresponding to the second network function entity) can reversely verify whether the identity of the receiver network function entity (corresponding to the first network function entity) is correct.

With reference to the above-mentioned first aspect, in a possible implementation manner, the first client credential statement is included in the second service request, wherein the data of the second service request is included in the first client credential statement, the method It also includes: the first network function entity verifies the correctness of the data requested by the second service. Based on this solution, the enhancement of the client credential declaration can be realized, making the design of the client credential declaration more flexible and diverse.

In a second aspect, a communication method is provided, and a communication device executing the communication method may be a second network function entity; or may be a module applied in the second network function entity, such as a chip or a chip system. The following description will be given by taking the execution subject as the second network function entity as an example. The second network function entity obtains the first client credential statement, and the first client credential statement includes the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located; the second network function entity reports to the first network function entity Sending the first client credential statement, wherein the network identity of the network where the network function entity of the expected recipient of the first client credential statement is located is used to verify whether it is the same as the network identity of the first network, wherein the first network function entity belongs to The first network and the second network function entity belong to a second network, and the first network and the second network are different networks. For the technical effect of the second aspect, reference may be made to the above-mentioned first aspect, which will not be repeated here.

With reference to the above-mentioned second aspect, in a possible design, the method further includes: the second network function entity sends to the first network function entity a message used by the second network function entity to request the service of the first network function entity A first authorization token, where the first authorization token includes a network identification of the second network, and the identification of the second network is used to verify whether the identification is the same as the network identification in the certificate information in the first client credential statement.

With reference to the above-mentioned second aspect, in a possible design, the method further includes: the second network function entity sends to the first network function entity the information of the network function set to which the network function entity of the expected recipient of the first client credential statement belongs. identifier, the identifier of the network function set to which the expected recipient network function entity of the first client credential statement belongs is used to verify whether it is the same as the identifier of the network function set to which the first network function entity belongs.

With reference to the above second aspect, in a possible design, the first client credential statement further includes an identifier of the network function set to which the network function entity of the expected recipient of the first client credential statement belongs, and the expected The identifier of the network function set to which the recipient network function entity belongs is used to verify whether it is the same as the identifier of the network function set to which the first network function entity belongs.

With reference to the above second aspect, in a possible design, the method further includes: the second network function entity receives a second client credential statement from the first network function entity, where the second client credential statement includes the second The network identity of the network where the network function entity of the expected recipient of the client credential statement is located; the second network function entity verifies whether the network identity of the network where the network function entity of the expected recipient of the second client certificate statement is located is the network identity of the second network.

With reference to the above second aspect, in a possible design, the method further includes: the second network function entity receives a second client credential statement from the first network function entity, where the second client credential statement further includes at least one of the following Parameters: the identifier of the network function entity of the intended recipient of the second client credential statement; the identifier of the network function set to which the intended recipient of the second client credential statement belongs; the network function of the intended recipient of the second client credential statement The type of entity; the first client credential declaration, or the hash value of the first client credential declaration; the data of the first service request, or the hash value of the data of the first service request, the first service request is a bearer The service request of the first client credential assertion; the identifier of the originator network function entity of the second client credential assertion; the identifier of the network function set to which the originator network function entity of the second client credential assertion belongs; or, the second client The network identity of the network where the originating network function entity of the credential claim is located.

With reference to the above second aspect, in a possible design, the second client credential statement includes an identifier of a network function entity that is expected to receive the second client credential statement; the method further includes: the second network function entity verifies the first 2. Whether the identity of the expected recipient network function entity declared by the client credential is the identity of the second network function entity.

With reference to the above second aspect, in a possible design, the second client credential statement includes an identifier of the network function set where the network function entity of the intended recipient of the second client credential statement is located; the method further includes: a second network function The entity verifies whether the identity of the network function set to which the intended recipient network function entity of the second client credential statement belongs is the identity of the network function set to which the second network function entity belongs.

With reference to the above second aspect, in a possible design, the second client credential statement includes the type of the intended recipient network function entity of the second client credential statement; the method further includes: the second network function entity verifies the first 2. Whether the type of the expected recipient network function entity declared by the client credential is the type of the second network function entity.

With reference to the above second aspect, in a possible design, the second client credential statement includes the first client credential statement; the method further includes: the second network function entity verifies that the second client credential statement includes the first client credential statement client credential assertion; alternatively, the second client credential assertion includes a hash value of the first client credential assertion; the method further includes: a second network function entity verifying that the second client credential assertion includes the first client credential assertion hash value.

With reference to the above second aspect, in a possible design, the second client credential statement includes the data of the first service request; the method further includes: verifying by the second network function entity that the second client credential statement includes the first service request. data of a service request; or, the second client credential statement includes a hash value of the data requested by the first service; the method further includes: a second network function entity verifying that the second client credential statement includes the first service The hash of the requested data.

With reference to the above second aspect, in a possible design, the second client credential statement includes the identity of the originator network function entity of the second client credential statement, including: in the signed content of the second client credential statement including the identity of the originator network function entity of the second client credential statement; the method further includes: the second network function entity verifies the originator of the second client credential statement included in the signed content of the second client credential statement Whether the identity of the network function entity is the identity of the network function entity in the certificate information in the second client credential statement.

In combination with the above second aspect, in a possible design, the first client credential declaration is included in a second service request sent by the second network function entity to the first network function entity; the second service request further includes The network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located; the second client credential statement includes the identifier of the network function set to which the originator network function entity of the second client credential statement belongs; the method further includes: The second network function entity verifies whether the identity of the network function set to which the originator network function entity of the second client credential assertion belongs is the identity of the network where the network function entity of the intended recipient of the first client credential assertion included in the second service request is located. network identity.

With reference to the above second aspect, in a possible design, the second client credential statement includes the network identifier of the network where the network function entity of the originator of the second client credential statement is located, including: the second client credential statement is signed The content of the second client credential statement includes the network identity of the network where the originator network function entity of the second client credential statement is located; the method further includes: the second network function entity verifies the second client credential statement included in the signed content. Whether the network identifier of the network where the network function entity that initiates the client credential statement is located is the network identifier in the certificate information in the second client credential statement.

Based on the solution of the second client credential declaration, the sender network function entity (corresponding to the second network function entity) can reversely verify whether the identity of the receiver network function entity (corresponding to the first network function entity) is correct.

In a third aspect, a communication method is provided, and a communication device executing the communication method may be a first security edge protection proxy entity; or a module applied in the first security edge protection proxy entity, such as a chip or a chip system. The following description will be given by taking the execution subject as the first security edge protection proxy entity as an example. The first security edge protection proxy entity receives the first client credential statement from the second network function entity, where the first client credential statement includes the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located; the first The security edge protection proxy entity sends the first client credential statement to the first network function entity, wherein the network identity of the network where the network function entity of the expected recipient of the first client credential statement is located is used to verify whether it is consistent with the network identity of the first network The same, wherein the first network function entity and the first security edge protection proxy entity belong to the first network, the second network function entity belongs to the second network, and the first network and the second network are different networks. For the technical effect of the third aspect, reference may be made to the above-mentioned first aspect, which will not be repeated here.

With reference to the above third aspect, in a possible implementation manner, the first security edge protection proxy entity sends the first client credential declaration to the first network function entity, including: the first security edge protection proxy entity sends the first network function entity to the first network function entity. The functional entity sends a first message, the first message includes the first client credential statement; the first message also includes a first root certificate, the first root certificate is the root certificate of the second network, and the first root certificate uses It is used to verify whether the certificate information declared by the first client certificate is correct. Compared with the prior art solution in which the recipient network function entity cannot verify whether the certificate in the client credential statement is correct in scenarios such as no cross-certificate between different operators, the embodiment of the present application can verify the first root certificate according to the first root certificate. Check whether the certificate information of the client certificate statement is correct, so as to realize the verification of the certificate in the client certificate statement, and then realize the verification of the digital signature of the client certificate statement and the signed content.

With reference to the above third aspect, in a possible implementation manner, the method further includes: the first security edge protection proxy entity receives the first root certificate from the second security edge protection proxy entity, the second security edge protection proxy entity The entity belongs to this second network. Based on this solution, the first security edge protection agent can obtain the first root certificate.

With reference to the above third aspect, in a possible implementation manner, the first client credential statement includes the network identifier of the second network; the first security edge protection proxy entity sends the first network function entity to the first network function entity Before the message, the method further includes: the first security edge protection proxy entity determines the first root certificate according to the network identifier of the second network and the mapping relationship between the first root certificate and the network identifier of the second network. Based on this solution, the first security edge protection agent can obtain the first root certificate.

With reference to the above third aspect, in a possible implementation manner, the mapping relationship between the first root certificate and the network identifier of the second network is preconfigured in the first security edge protection proxy entity; or, the first root certificate The certificate is the root certificate used by the first security edge protection proxy entity to verify the certificate information of the first security edge protection proxy entity when the first security edge protection proxy entity establishes a secure connection with the second security edge protection proxy entity; the The mapping relationship between the first root certificate and the network identifier of the second network is stored in the first security edge protection proxy entity after the first security edge protection proxy entity and the second security edge protection proxy entity establish a secure connection, The second security edge protection proxy entity belongs to the second network.

With reference to the above third aspect, in a possible implementation manner, before the first security edge protection proxy entity sends the first client credential declaration to the first network function entity, the method further includes: the first security edge protection proxy entity Verifying the digital signature of the first client credential claim is successful.

With reference to the above third aspect, in a possible implementation manner, before the first security edge protection proxy entity sends the first client credential declaration to the first network function entity, the method further includes: a first security edge protection proxy The entity verifies that the network identity of the network where the network function entity of the intended recipient of the first client credential statement is located is the network identity of the first network.

With reference to the above third aspect, in a possible implementation manner, the first client credential statement includes the network identifier of the network where the originator network function entity of the first client credential statement is located; the proxy entity is protected at the first security edge Before sending the first client credential statement to the first network function entity, the method further includes: the first security edge protection proxy entity verifies the network identity and N32-f context of the network where the network function entity of the originator of the first client credential statement is located The remote network identifiers in are the same, and the N32-f context is a shared context established when an N32 connection is established between the first security edge protection proxy entity and the second security edge protection proxy entity.

With reference to the above third aspect, in a possible implementation manner, the first client credential statement includes the network identifier of the network where the originator network function entity of the first client credential statement is located; the proxy entity is protected at the first security edge Before sending the first client credential statement to the first network function entity, the method further includes: the first security edge protection proxy entity receiving a first authorization token used by the second network function entity to request a service of the first network function entity , the first authorization token includes the network identifier of the second network; the first security edge protection proxy entity verifies that the network identifier of the second network in the first authorization token is the originator network of the first client credential statement Network ID of the network where the functional entity is located.

With reference to the above third aspect, in a possible implementation manner, before the first security edge protection proxy entity sends the first client credential declaration to the first network function entity, the method further includes: a first security edge protection proxy The entity verifies that the network identifier of the network where the network function entity of the originator of the first client credential statement included in the signed content of the first client credential statement is the network identifier in the certificate information of the first client credential statement.

Based on the above-mentioned solution of verifying whether the first client credential statement is correct by the first security edge protection proxy entity, the subsequent process can be terminated in advance if the first client credential statement cannot be verified, which reduces the steps of signaling interaction between network elements. System resources are saved.

With reference to the above third aspect, in a possible implementation manner, the method further includes: the first security edge protection proxy entity receives the second client credential declaration from the first network function entity; the first security edge protection proxy entity sends The second network function entity sends the second client credential assertion, wherein the second client credential assertion includes at least one of the following parameters: the identifier of the intended recipient network function entity of the second client credential assertion; the second client credential The identifier of the network function set to which the declared intended recipient NF entity belongs; the network identifier of the network where the intended recipient NF entity declared by the second client credential is located; the type of the intended recipient NF declared by the second client credential claim; The first client credential declaration, or the hash value of the first client credential declaration; the data of the first service request, or the hash value of the data of the first service request, the first service request is to carry the first client The service request of the credential assertion; the identifier of the network function entity of the originator of the second client credential assertion; the identifier of the network function set to which the originator of the second client credential assertion belongs; or, the origination of the second client credential assertion The network identifier of the network where the party network function entity is located. Based on this solution, the sender network function entity (corresponding to the second network function entity) can reversely verify whether the identity of the receiver network function entity (corresponding to the first network function entity) is correct.

In a fourth aspect, a communication method is provided, and a communication device executing the communication method may be a first network function entity; or a module applied in the first network function entity, such as a chip or a chip system. The following description will be given by taking the execution subject as the first network function entity as an example. The first network function entity receives the first client credential statement and the first root certificate from the second network function entity, where the first root certificate is the root certificate of the second network; the first network function entity verifies according to the first root certificate Whether the certificate information declared by the first client certificate is correct; wherein, the first network function entity belongs to the first network, the second network function entity belongs to the second network, and the first network and the second network are different networks. Compared with the prior art solution in which the recipient network function entity cannot verify whether the certificate in the client credential statement is correct in scenarios such as no cross-certificate between different operators, the embodiment of the present application can verify the first root certificate according to the first root certificate. Check whether the certificate information of the client certificate statement is correct, so as to realize the verification of the certificate in the client certificate statement, and then realize the verification of the digital signature of the client certificate statement and the signed content.

In a fifth aspect, a communication method is provided, and a communication device executing the communication method may be a first network function entity; or may be a module applied in the first network function entity, such as a chip or a chip system. The following description will be given by taking the execution subject as the first network function entity as an example. The first network function entity receives the first client credential declaration from the second network function entity; after the first network function entity verifies that the first client credential declaration passes, it sends the second client credential declaration to the second network function entity. The client credential assertion includes at least one of the following parameters: the identifier of the network function entity of the intended recipient of the second client credential assertion; the identifier of the network function set to which the intended recipient of the second client credential assertion belongs; the network function set to which the second client credential assertion belongs; The network identity of the network where the network function entity of the intended recipient of the credential claim is located; the type of the intended recipient of the second client credential claim; the first client credential claim, or the hash value of the first client credential claim; The data of the first service request, or the hash value of the data of the first service request, the first service request is the service request that carries the first client credential statement; the originating network function entity of the second client credential statement identifier; the identifier of the network function set to which the originator network function entity of the second client credential assertion belongs; or the network identifier of the network where the originator network function entity of the second client credential assertion is located. Based on this solution, the sender network function entity (corresponding to the second network function entity) can reversely verify whether the identity of the receiver network function entity (corresponding to the first network function entity) is correct.

In a sixth aspect, a communication apparatus is provided for implementing the above method. The communication device may be the first network function entity in the first aspect, the fourth aspect or the fifth aspect, or a device including the first network function entity; or, the communication device may be the first network function entity in the second aspect. two network function entities, or a device including the second network function entity; or, the communication device may be the first security edge protection proxy entity in the third aspect, or a device including the first security edge protection proxy entity . The communication device includes corresponding modules, units, or means (means) for implementing the above method, and the modules, units, or means may be implemented by hardware, software, or hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions.

With reference to the above sixth aspect, in some possible implementations, the communication apparatus may include a processing module and a transceiver module. The transceiver module, also referred to as a transceiver unit, is used to implement the sending and/or receiving functions in any of the above aspects and any possible implementation manners. The transceiver module can be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface. The processing module may be used to implement the processing functions in any of the foregoing aspects and any possible implementation manners thereof. The processing module can be, for example, a processor.

With reference to the above sixth aspect, in some possible implementations, the transceiver module includes a transmitting module and a receiving module, which are respectively used to implement the transmitting and receiving functions in any of the above aspects and any possible implementation manners thereof.

In a seventh aspect, a communication device is provided, comprising: a processor; the processor is configured to be coupled to a memory, and after reading an instruction in the memory, execute the method according to any one of the preceding aspects according to the instruction. The communication device may be the first network function entity in the first aspect, the fourth aspect or the fifth aspect, or a device including the first network function entity; or, the communication device may be the first network function entity in the second aspect. two network function entities, or a device including the second network function entity; or, the communication device may be the first security edge protection proxy entity in the third aspect, or a device including the first security edge protection proxy entity .

With reference to the above seventh aspect, in a possible implementation manner, the communication device further includes a memory for storing necessary program instructions and data.

With reference to the above seventh aspect, in a possible implementation manner, the communication device is a chip or a chip system. Optionally, when the communication device is a chip system, it may be constituted by a chip, or may include a chip and other discrete devices.

In an eighth aspect, a communication device is provided, comprising: a processor interface circuit; an interface circuit for receiving a computer program or instruction and transmitting it to a processor; the processor for executing the computer program or instruction, so that the communication device A method as described in any of the preceding aspects is performed.

In a ninth aspect, a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer can execute the method described in any one of the above aspects.

In a tenth aspect, there is provided a computer program product comprising instructions which, when run on a computer, enable the computer to perform the method of any of the preceding aspects.

Wherein, for the technical effect brought by any possible implementation manner of the sixth aspect to the tenth aspect, reference may be made to the technology brought by any one of the above-mentioned first aspect to the sixth aspect or different design manners in any aspect The effect will not be repeated here.

In an eleventh aspect, a communication system is provided, and the communication system includes the first network function entity described in the foregoing aspect and the second network function entity described in the foregoing aspect. Optionally, the communication system includes the first security edge protection proxy entity described in the above aspect.

Description of drawings

FIG. 1 is a schematic structural diagram of a communication system according to an embodiment of the present application;

2a is a schematic structural diagram of another communication system provided by an embodiment of the present application;

FIG. 2b is a schematic structural diagram of another communication system provided by an embodiment of the present application;

FIG. 3a is a schematic diagram of an application of the communication system described in FIG. 2a in a 5G network according to an embodiment of the application;

FIG. 3b is a schematic diagram of an application of the communication system described in FIG. 2a in a 5G network according to an embodiment of the application;

FIG. 4 is a schematic structural diagram of a communication device according to an embodiment of the present application;

FIG. 5 is an interactive schematic diagram 1 of a communication method provided by an embodiment of the present application;

FIG. 6 is a second interactive schematic diagram of a communication method provided by an embodiment of the present application;

FIG. 7 is a schematic diagram three of interaction of the communication method provided by the embodiment of the present application;

FIG. 8 is a fourth interactive schematic diagram of a communication method provided by an embodiment of the present application;

FIG. 9 is a schematic diagram five of interaction of the communication method provided by the embodiment of the present application;

FIG. 10 is a schematic diagram 6 of interaction of the communication method provided by the embodiment of the present application;

FIG. 11 is a seventh interactive schematic diagram of a communication method provided by an embodiment of the present application;

FIG. 12 is an eighth interactive schematic diagram of a communication method provided by an embodiment of the present application;

FIG. 13 is a schematic structural diagram of another communication apparatus provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. Wherein, in the description of this application, unless otherwise specified, "/" indicates that the objects associated before and after are an "or" relationship, for example, A/B can indicate A or B; in this application, "and/or" "It is only an association relationship that describes an associated object, which means that there can be three kinds of relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A exists , B can be singular or plural. Also, in the description of the present application, unless stated otherwise, "plurality" means two or more than two. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple . In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with basically the same function and effect. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like are not necessarily different. Meanwhile, in the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner to facilitate understanding.

In addition, the network architecture and service scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute limitations on the technical solutions provided by the embodiments of the present application. With the evolution of the network architecture and the emergence of new service scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

As shown in FIG. 1 , a communication system is provided in an embodiment of the present application. The communication system includes a first network function entity 101 and a second network function entity 102 . The first network function entity 101 and the second network function entity 102 may communicate directly or communicate through forwarding by other devices, which is not specifically limited in this embodiment of the present application.

Exemplarily, as shown in FIG. 2a, the first network function entity 101 and the second network function entity 102 communicate through a service communication proxy (service communication proxy, SCP) 103.

Or, exemplarily, as shown in FIG. 2b, in the roaming scenario, the first security edge protection proxy entity 104 and the second security edge protection proxy entity 105 are used between the first network function entity 101 and the second network function entity 102. communication. The first network function entity 101 and the first security edge protection proxy entity 104 belong to the first network, and the second network function entity 102 and the second security edge protection proxy entity 105 belong to the second network. The first network and the second network are networks of different operators. For example, the first network is a China Unicom network, and the second network is a mobile network; or, the first network is a mobile network, and the second network is a telecommunication network, etc., which are not specifically limited in this embodiment of the present application.

It should be noted that, although not shown, in a non-direct communication scenario, there may be one or more SCPs between the first network function entity 101 and the first security edge protection proxy entity 104 in FIG. 2b, and the second network function entity 104 may There may be one or more SCPs between the entity 102 and the second security edge protection proxy entity 105, which are described in a unified manner here, and will not be repeated below.

Specifically, for the communication method based on the communication system 10 provided by the embodiment of the present application, reference may be made to the subsequent method embodiments, and details are not described herein again.

Optionally, the communication system shown in FIG. 1 or FIG. 2a or FIG. 2b may be applicable to the 5G network currently under discussion, and may also be applicable to other future networks, etc., which is not specifically limited in this embodiment of the present application.

Exemplarily, taking the communication system shown in FIG. 1 or FIG. 2a or FIG. 2b being applicable to the 5G network currently under discussion as an example, the network element or entity corresponding to the above-mentioned first network function entity may be a cNF in the 5G network. , the network element or entity corresponding to the second network function entity may be a pNF or NRF in the 5G network, and the network element or entity corresponding to the first security edge protection agent entity may be the consumer security edge protection in the 5G network. A proxy entity (consumer of security edge protection proxy, cSEPP), the network element or entity corresponding to the second security edge protection proxy entity may be a provider of security edge protection proxy entity (producer of security edge protection proxy, pSEPP in the 5G network) ). Alternatively, taking the example that the communication system shown in FIG. 1 or FIG. 2a or FIG. 2b is applicable to the 5G network currently under discussion, the network element or entity corresponding to the first network function entity above may be a pNF or NRF in the 5G network , the network element or entity corresponding to the second network function entity may be the cNF in the 5G network, the network element or entity corresponding to the first security edge protection agent entity may be the pSEPP in the 5G network, the second security edge The network element or entity corresponding to the protection proxy entity may be cSEPP in the 5G network. For example, the schematic diagram of the application of FIG. 2a in the 5G network may be as shown in FIG. 3a, and the schematic diagram of the application of FIG. 2b in the 5G network may be as shown in FIG. 3b.

Specifically, the NRF in the embodiment of the present application is responsible for the control of network elements. For example, the NRF performs the registration, discovery and authorization functions of the NF.

Specifically, the NF in the embodiments of the present application includes cNF and pNF. Among them, cNF is the service consumer NF, and pNF is the service provider NF. The cNF obtains the services provided by the pNF from the pNF. In this embodiment of the present application, the cNF may be, for example, an access and mobility management function (core access and mobility management function, AMF) or a session management function (session management function, SMF) of a 5G network. In other scenarios, the NF may also be a terminal device, a base station, a controller, or a server, etc., which are described in a unified manner here, and will not be repeated below.

Specifically, the SCP in this embodiment of the present application may also be referred to as a service communication proxy (SeCoP), which is used to perform forwarding of service communication, proxy verification, or authorization, and the like. Alternatively, the SCP in this embodiment of the present application may also be referred to as a service framework support function (SFSF), which supports at least one of functions such as registration, discovery, authorization, forwarding, and verification, for example, supports forwarding and verification. test. There may be one or more SCPs between the cNF and the pNF, or between the cNF and the NRF, which are uniformly described here, and will not be repeated below.

Specifically, the SEPP in the embodiment of the present application is a network element with a security function roaming between two operator networks, including cCEPP and pCEPP. cSEPP is the SEPP corresponding to the cNF side, and pSEPP is the SEPP corresponding to the pNF side. Among them, SEPP is used to perform operations such as encapsulation, protection, and verification of roaming data, which are uniformly described here, and will not be repeated below.

Optionally, the first network function entity or the first network function entity or the first security edge protection proxy entity or the second security edge protection proxy entity in this embodiment of the present application may also be referred to as a communication device, which may be a general The device or a dedicated device, which is not specifically limited in this embodiment of the present application.

Optionally, the related functions of the first network function entity or the first network function entity or the first security edge protection proxy entity or the second security edge protection proxy entity in this embodiment of the present application may be implemented by one device, or may be implemented by multiple devices. It is implemented jointly by multiple devices, and may also be implemented by one or more functional modules in one device, which is not specifically limited in this embodiment of the present application. It is to be understood that the above-mentioned functions can be either network elements in hardware devices, or software functions running on dedicated hardware, or a combination of hardware and software, or instantiated on a platform (eg, a cloud platform). Virtualization capabilities.

For example, the related functions of the first network function entity or the first network function entity or the first security edge protection proxy entity or the second security edge protection proxy entity in the embodiment of the present application may be implemented by the communication device 400 in FIG. 4 . FIG. 4 is a schematic structural diagram of a communication apparatus 400 according to an embodiment of the present application. The communication device 400 includes one or more processors 401, a communication line 402, and at least one communication interface (in FIG. 4, the communication interface 404 and one processor 401 are used as an example for illustration only), optional may also include memory 403 .

The processor 401 may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more processors for controlling the execution of the programs of the present application. integrated circuit.

Communication line 402 may include a path for connecting the various components.

The communication interface 404 can be a transceiver module for communicating with other devices or communication networks, such as Ethernet, RAN, wireless local area networks (wireless local area networks, WLAN) and the like. For example, the transceiver module may be a device such as a transceiver or a transceiver. Optionally, the communication interface 404 may also be a transceiver circuit located in the processor 401 to implement signal input and signal output of the processor.

The memory 403 may be a device having a storage function. For example, it may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of storage devices that can store information and instructions The dynamic storage device can also be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disk storage ( including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being stored by a computer any other medium taken, but not limited to this. The memory may exist independently and be connected to the processor through communication line 402 . The memory can also be integrated with the processor.

The memory 403 is used for storing computer-executed instructions for executing the solution of the present application, and the execution is controlled by the processor 401 . The processor 401 is configured to execute the computer-executed instructions stored in the memory 403, so as to implement the communication method provided in the embodiments of the present application.

Or, optionally, in this embodiment of the present application, the processor 401 may also perform processing-related functions in the communication methods provided in the following embodiments of the present application, and the communication interface 404 is responsible for communicating with other devices or communication networks. The embodiment does not specifically limit this.

Optionally, the computer-executed instructions in the embodiment of the present application may also be referred to as application code, which is not specifically limited in the embodiment of the present application.

In a specific implementation, as an embodiment, the processor 401 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 4 .

In a specific implementation, as an embodiment, the communication apparatus 400 may include multiple processors, such as the processor 401 and the processor 408 in FIG. 4 . Each of these processors can be a single-core processor or a multi-core processor. The processor here may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller (MCU), or artificial intelligence Processors and other types of computing devices that run software, each computing device may include one or more cores for executing software instructions to perform operations or processing.

In a specific implementation, as an embodiment, the communication apparatus 400 may further include an output device 405 and an input device 406 . The output device 405 is in communication with the processor 401 and can display information in a variety of ways. For example, the output device 405 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait. Input device 406 is in communication with processor 401 and can receive user input in a variety of ways. For example, the input device 406 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.

The above-mentioned communication apparatus 400 may also be sometimes referred to as a communication apparatus, which may be a general-purpose device or a dedicated device. For example, the communication device 400 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, an embedded device, the above-mentioned terminal device, the above-mentioned network device, or a 4 devices of similar structure. This embodiment of the present application does not limit the type of the communication apparatus 400 .

The communication method provided by the embodiment of the present application will be described below with reference to FIG. 1 to FIG. 4 .

It should be noted that the "initiator network function entity" described in the following embodiments can be understood as a network function entity that generates a client credential statement, and the "sender network function entity" can be understood as a network function entity that sends a client credential statement. . Wherein, in some descriptions, "initiator network function entity" and "sender network function entity" can be interchanged with each other, which are described here uniformly, and will not be repeated below.

First, as described in the background art, when the existing client credential declaration mechanism is used in a roaming scenario, network data may be leaked due to an attacker's attack. To solve this problem, in conjunction with the communication system shown in FIG. 2 b , as shown in FIG. 5 , a communication method provided by an embodiment of the present application is as follows.

S501. The second network function entity sends a first client credential statement to the first network function entity. Accordingly, the first network function entity receives the first client credential assertion from the second network function entity. Wherein, the first client credential statement includes the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located.

In this embodiment of the present application, the sending of the first client credential declaration by the second network function entity to the first network function entity includes: the second network function entity sends the first network function entity to the first network through the second security edge protection proxy entity and the first security edge protection proxy entity The functional entity sends a first client credential statement.

The first client credential statement in this embodiment of the present application includes the signed content, the digital signature obtained by calculation, and a certificate that can verify the first client credential statement (it can also be replaced with a certificate chain, which is described here uniformly, and will not be repeated below) . Wherein, the signed content of the first client credential statement includes the identity of the originator network function entity of the first client credential statement (also referred to as an instance ID), the validity period and time stamp, and the identity of the first client credential statement. It is expected that the type of the recipient network function entity, etc., the certificate of the first client credential assertion includes the digital signature of the certificate and the signed content in the certificate, and the signed content in the certificate includes the originating network function entity of the first client credential assertion. Information, such as the identity of the originator network function entity of the first client credential statement and the network identity of the network where the originator network function entity of the first client credential statement is located, can be found in the prior art for details, and will not be repeated here.

In addition, the signed content of the first client credential statement in the embodiment of the present application further includes the network identifier of the network where the network function entity of the intended recipient of the first client credential statement is located.

Optionally, the signed content of the first client credential statement in this embodiment of the present application further includes the network identifier of the network where the network function entity of the originator of the first client credential statement is located, and/or the expected reception of the first client credential statement. The identifier of the network function set to which the party network function entity belongs.

Optionally, the first client credential declaration in this embodiment of the present application is a client credential declaration determined by the second network function entity according to the private key of the second network function entity; or, the first client credential declaration in this embodiment of the present application is: The client credential statement sent by other network function entities (eg, a third network function entity) intercepted by the attacker is not specifically limited in this embodiment of the present application. Wherein, in the scenario where the first client credential declaration is a client credential declaration determined by the second network function entity according to the private key of the second network function entity, the network function entity that initiates the first client credential declaration is the embodiment of the present application The second network function entity in , is described uniformly here, and will not be repeated below.

Optionally, in this embodiment of the present application, the expected recipient network function entity declared by the first client credential is the first network function entity or another network function entity other than the first network function entity, which is not done in this embodiment of the present application. Specific restrictions.

S502: The first network function entity verifies whether the network identifier of the network where the network function entity of the expected recipient declared by the first client credential is located is the network identifier of the first network.

In this embodiment of the present application, after receiving the first client credential statement, the first network function entity can verify the first client credential statement with reference to the existing verification method of the client credential statement, such as verifying the correctness of the certificate of the first client credential statement, If the certificate verification is correct, determine the public key for verifying the digital signature of the first client certificate claim based on the certificate of the first client certificate claim, and verify the correctness of the digital signature of the first client certificate claim based on the public key. If the digital signature of a client credential statement is verified correctly, the correctness of each parameter in the signed content of the first client credential statement is verified. For example, verify the validity of the validity period or the time stamp, verify the type of the expected recipient network function entity declared by the first client credential, etc. The specific implementation can refer to the prior art, which will not be repeated here.

It should be noted that, in the embodiment of the present application, the certificate of the first client credential declaration includes the digital signature of the certificate and the signed content in the certificate, so verifying the correctness of the certificate declared by the first client credential includes verifying the digital signature of the certificate. The correctness of the verification certificate and the correctness of each parameter in the signed content in the verification certificate are uniformly described here, and will not be repeated below.

In addition, in the embodiment of the present application, the first network function entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first network function entity verifies the network function entity of the expected recipient of the first client credential statement is located in the network. Whether the network identifier is the network identifier of the first network. Specifically, in the case where the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is the network identifier of the first network, the first network function entity verifies the network function entity of the expected recipient of the first client credential statement The network identifier of the network where the network is located is the network identifier of the first network, that is, the verification is passed (or successful); or, in the case where the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is not the network identifier of the first network Next, the first network function entity verifies that the network identity of the network where the network function entity of the expected recipient of the first client credential statement is located is not the network identity of the first network, that is, the verification fails.

Optionally, in this embodiment of the present application, the first network function entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first client credential statement also includes an initiator network function of the first client credential statement. In the case of the network identity of the network where the entity is located, the first network function entity verifies whether the network identity of the network where the network function entity of the originator of the first client credential statement in the signed content of the first client credential statement is the first client credential statement The network identity within the certificate information. In the case where the first network function entity verifies that the network identity of the network where the network function entity of the originator of the first client certificate statement is located in the signed content of the first client certificate statement is the network identity in the certificate information of the first client certificate statement , the verification is passed, otherwise the verification is failed.

Optionally, in this embodiment of the present application, the first network function entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first client credential statement also includes a desired recipient network of the first client credential statement. In the case of the identity of the network function set to which the functional entity belongs, the first network function entity verifies whether the identity of the network function set to which the intended recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs. In the case where the first network function entity verifies that the identity of the network function set to which the network function entity of the expected recipient of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs, the verification is deemed to be passed; otherwise, the verification is deemed to be passed. fail.

It should be noted that each parameter in the first client credential statement described in the embodiments of this application may be included in the signed content of the first client credential statement, and/or included in the certificate of the first client credential statement, This is not specifically limited in the embodiments of the present application, which are uniformly described here, and will not be repeated below.

It should be noted that, in some other embodiments, the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located may be optionally included in the first client credential statement, and this embodiment of the present application does not No specific limitation is made, and a unified description is provided here, and details are not repeated below.

In the embodiment of the present application, if the first network function entity verifies that the first client credential statement passes, the subsequent process may continue to be performed, for example, the first network function entity provides services for the second network function entity. If the first network function entity fails to verify the first client credential assertion, the first network function entity discards the data sent by the second network function entity. Optionally, the first network function entity sends a rejection indication or an error indication to the second network function entity, where the rejection indication or error indication is used to indicate that the verification of the first client credential claim fails. Repeat.

Because in the embodiment of this application, the first client credential statement sent by the sender network function entity (corresponding to the second network function entity) to the receiver network function entity (corresponding to the first network function entity) is bound with the first client The network identifier of the network where the network function entity of the expected recipient of the credential statement is located, and the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is used to verify whether it is the same as the network identifier of the network where the network function entity of the recipient is located (corresponding to the The network identifier of the above-mentioned first network) is the same. Wherein, the network function entity of the receiver will only provide services to the network function entity of the sender when the network identity of the network where the network function entity of the expected receiver is located as declared by the first client credential is the network identity of the network function entity of the receiver side. , so it is possible to avoid the possibility that the first client credential statement is used in a network other than the network where the network function entity of the expected recipient of the first client credential statement is located, thereby avoiding the possibility that the first client credential statement is used in the Risks such as network data leakage caused by other networks other than the network where the network functional entity of the client's credential statement is expected to be located, improves the reliability of network data transmission.

Wherein, the actions of the first network function entity in the above steps S501 to S502 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the first network function entity to execute; the above The actions of the second network function entity in steps S501 to S502 may be executed by the processor 401 in the communication device 400 shown in FIG. 4 by calling the application code stored in the memory 403 to instruct the second network function entity to execute; The action of the first edge protection proxy entity in S502 may be executed by the processor 401 in the communication device 400 shown in FIG. 4 by calling the application code stored in the memory 403 to instruct the first edge protection proxy entity to execute; the above step S501 The actions of the second security edge protection proxy entity in step S502 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the second security edge protection proxy entity to execute. The example does not impose any restrictions on this.

Optionally, based on the communication method described in FIG. 5, after the first security edge protection proxy entity receives the first client credential statement, and before the first security edge protection proxy entity sends the first client credential statement to the first network function entity, The communication method provided by the embodiment of the present application further includes: the first security edge protection proxy entity verifies that the first client credential declaration passes.

Specifically, the method for the first security edge protection proxy entity to verify the first client credential assertion may refer to the existing client credential assertion verification method, such as verifying the correctness of the certificate of the first client credential assertion, if the certificate is verified correctly , determine the public key for verifying the digital signature of the first client credential assertion according to the certificate of the first client credential assertion, and verify the correctness of the digital signature of the first client credential assertion based on the public key, and verify the correctness of the digital signature of the first client credential assertion based on the public key. If the verification is correct, verify the correctness of each parameter in the signed content of the first client certificate statement. For example, verify the validity of the validity period or the time stamp, verify the type of the expected recipient network function entity declared by the first client credential, etc. The specific implementation can refer to the prior art, which will not be repeated here.

It should be noted that, in the embodiment of the present application, the certificate of the first client credential declaration includes the digital signature of the certificate and the signed content in the certificate, so verifying the correctness of the certificate declared by the first client credential includes verifying the digital signature of the certificate. The correctness of the verification certificate and the correctness of each parameter in the signed content in the verification certificate are uniformly described here, and will not be repeated below.

In addition, in the embodiment of the present application, the first security edge protection proxy entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first security edge protection proxy entity verifies the expected recipient network function of the first client credential statement Whether the network identifier of the network where the entity is located is the network identifier of the first network. Specifically, in the case where the network identifier of the network where the network functional entity of the first client credential statement is located is the network identifier of the first network, the first security edge protection proxy entity verifies the intended recipient network of the first client credential statement The network identifier of the network where the functional entity is located is the network identifier of the first network, that is, the verification is passed; or, in the case that the network identifier of the network where the network functional entity of the expected recipient of the first client credential statement is located is not the network identifier of the first network, The first security edge protection proxy entity verifies that the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is not the network identifier of the first network, that is, the verification fails.

Optionally, in this embodiment of the present application, the first security edge protection proxy entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first client credential statement also includes an initiator of the first client credential statement. In the case of the network identifier of the network where the network function entity is located, the first security edge protection proxy entity verifies whether the network identifier of the network where the network function entity of the originator of the first client credential statement is located is the same as the remote network identifier in the N32-f context. If the first security edge protection proxy entity verifies that the network identity of the network where the network function entity of the originator of the first client credential statement is located is the same as the remote network identity in the context of N32-f, the verification is deemed to be passed; otherwise, the verification is deemed to be passed. fail. Among them, in the embodiment of the present application, the N32-f context is a shared context established when an N32 connection is established between the first security edge protection proxy entity and the second security edge protection proxy entity, which is uniformly described here and will not be repeated below.

Optionally, in this embodiment of the present application, the first security edge protection proxy entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first client credential statement also includes an initiator of the first client credential statement. In the case of the network identifier of the network where the network function entity is located, the first security edge protection proxy entity verifies whether the network identifier of the network where the network function entity of the originator of the first client credential statement in the signed content of the first client credential statement is the third one. A network identity within the credential information of a client credential assertion. The network identity of the network where the network function entity of the initiator of the first client credential statement in the signed content of the first security edge protection proxy entity verifies that the first client credential statement is located is the network identity in the certificate information of the first client credential statement. In this case, the verification is considered to pass, otherwise, the verification is considered to fail.

Optionally, in this embodiment of the present application, the first security edge protection proxy entity verifies the correctness of each parameter in the first client credential statement, and further includes: the first client credential statement also includes the expected reception of the first client credential statement. In the case of the identity of the network function set to which the party network function entity belongs, the first security edge protection proxy entity verifies whether the identity of the network function set to which the network function entity of the expected recipient of the first client credential statement belongs is the first security edge protection proxy entity connection The identifier of the network function set to which the first network function entity belongs. In the case where the first security edge protection proxy entity verifies the identity of the network function set to which the desired recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity to which the first security edge protection proxy entity is connected belongs below, the verification is considered to pass, otherwise, the verification is considered to fail.

In this embodiment of the present application, if the first security edge protection proxy entity verifies that the first client credential statement passes, the first security edge protection proxy entity sends the first client credential statement to the first network function entity; if the first security edge protection proxy entity passes the first client credential statement If the entity fails to verify the first client credential assertion, the first security edge protection proxy entity discards the data sent by the second network function entity. Optionally, the first security edge protection proxy entity sends a rejection indication or an error indication to the second network function entity, where the rejection indication or the error indication is used to indicate that the verification of the first client credential claim fails. Based on the above solution of verifying the first client credential statement by the first security edge protection proxy entity, the subsequent process can be terminated in advance if the first client credential statement cannot be verified, which reduces the steps of signaling interaction between network elements and saves money. system resources.

On the other hand, the existing client credential assertion mechanism only supports the recipient network function entity to verify the identity of the sender network function entity, and does not support the sender network function entity to reversely verify the identity of the recipient network function entity. If a mechanism for the sender's network function entity to verify the identity of the receiver's network function entity is introduced, how to design the client credential statement sent by the receiver's network function entity to the sender's network function entity is an urgent problem to be solved. For example, in the existing client credential declaration mechanism, the sender network function entity only has the identifier of the network function set to which the expected recipient network function entity of the client credential declaration belongs, and the SCP between the sender network function entity and the receiver network function entity A recipient NF may be randomly selected to provide services to the sender NF according to the identity of the NF set to which the desired recipient NF stated in the client credential. At this time, how does the sender NF determine the recipient NF? The sender network function entity that sends the client credential declaration to the sender network function entity is the network function entity that receives the client credential declaration provided by the sender network function entity to the recipient network function entity. To solve this problem, in conjunction with the communication system shown in FIG. 2a or FIG. 2b, as shown in FIG. 6, a communication method provided by an embodiment of the present application is as follows.

S601. The second network function entity sends a first client credential statement to the first network function entity. Accordingly, the first network function entity receives the first client credential assertion from the second network function entity.

The first client credential statement in the embodiment of the present application may refer to the prior art, or the first client credential statement in the embodiment of the present application may refer to the first client credential statement in the embodiment shown in FIG. 5 . This is not specifically limited in the application examples.

S602, the first network function entity verifies that the first client credential statement passes.

Wherein, in the case where the first client credential declaration is a prior art client credential declaration, the method for verifying the first client credential declaration by the first network function entity may refer to the prior art; when the first client credential declaration is as shown in FIG. 5 In the case of the first client credential declaration in the embodiment of FIG. 5 , the method for verifying the first client credential declaration by the first network function entity may refer to step S502 in the embodiment shown in FIG. 5 , which will not be repeated here.

S603. The first network function entity sends a second client credential statement to the second network function entity. Accordingly, the second network function entity receives the second client credential assertion from the first network function entity.

The second client credential statement in the embodiment of the present application includes the signed content, the digital signature obtained by calculation, and a certificate that can verify the second client credential statement (it can also be replaced with a certificate chain, which is described in a unified manner here, and will not be repeated below) . Wherein, the signed content of the second client credential statement includes the identity of the originator network function entity of the second client credential statement (it may also be referred to as an instance ID (instance ID), a validity period and a timestamp, etc., and the second client credential statement The certificate includes the digital signature of the certificate and the signed content in the certificate, and the signed content in the certificate includes the information of the originator network function entity of the second client credential statement, such as the information of the originator network function entity of the second client credential statement. The identifier and the network identifier of the network where the network function entity of the originator of the second client credential declaration is located, etc., may refer to the prior art for details, and will not be repeated here.

In addition, the second client credential declaration in the embodiment of the present application is a client credential declaration determined by the first network function entity according to the private key of the first network function entity. The signed content of the second client credential statement further includes the first client credential statement, or the hash value of the first client credential statement, or the data of the first service request (such as the data bearer of the first service request, that is, the payload) , or the hash value of the data of the first service request, where the first service request is a service request bearing the first client credential declaration.

Optionally, in this embodiment of the present application, the second client credential statement further includes at least one of the following parameters: the identifier of the desired recipient network function entity of the second client credential statement; the network function entity of the desired recipient of the second client credential statement belongs to The identity of the network function set; the type of network function entity of the intended recipient of the second client credential statement; the identity of the network function entity of the originator of the second client credential statement; the network function set to which the originator network function entity of the second client credential statement belongs or, the network identifier of the network where the network function entity of the originator of the second client credential statement is located.

It should be noted that, in some other embodiments, the above-mentioned first client credential statement, or the hash value of the first client credential statement, or the data of the first service request (such as the data bearer of the first service request, that is, the payload) , or the hash value of the data requested by the first service may be optionally included in the second client credential statement, which is not specifically limited in this embodiment of the present application, which is uniformly described here, and will not be repeated below.

It should be noted that, in this embodiment of the present application, the expected recipient network function entity of the second client credential declaration is the second network function entity, and the initiator network function entity of the second client credential declaration is the first network function entity.

S604. The second network function entity verifies the correctness of the second client credential statement.

In the embodiment of the present application, after receiving the second client credential statement, the second network function entity may verify the second client credential statement with reference to the existing verification method of the client credential statement, such as verifying the correctness of the certificate of the second client credential statement, If the certificate verification is correct, determine the public key for verifying the digital signature of the second client credential claim based on the certificate of the second client credential claim, and verify the correctness of the digital signature of the second client credential claim based on the public key. If the digital signature verification of the second client credential statement is correct, verify the correctness of each parameter in the signed content of the second client credential statement. For example, verify the validity of the validity period or the time stamp, verify the type of the expected recipient network function entity declared by the second client credential, etc. The specific implementation can refer to the prior art, which will not be repeated here.

It should be noted that, in this embodiment of the present application, the certificate of the second client credential declaration includes the digital signature of the certificate and the signed content in the certificate, so verifying the correctness of the certificate declared by the second client credential includes verifying the digital signature of the certificate. The correctness of the verification certificate and the correctness of each parameter in the signed content in the verification certificate are uniformly described here, and will not be repeated below.

In addition, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, further comprising: verifying the first client credential statement and the second client credential statement saved before by the second network function entity Whether the included first client credential statement is consistent, if the second network function entity verifies that the second client credential statement includes the first client credential statement, the verification is deemed passed, otherwise, the verification fails; or, the second network function entity verifies Whether the hash value of the previously saved first client credential statement is consistent with the hash value of the first client credential statement included in the second client credential statement, for example, the second network function entity verifies that the second client credential statement includes the first client credential statement The hash value of the credential declaration is deemed to pass the verification, otherwise, the verification is deemed to have failed; or, the second network function entity verifies the previously saved data of the first service request and the first service request included in the second client credential declaration. Whether the data is consistent, if the second network function entity verifies that the data of the first service request is included in the second client credential statement, the verification is deemed passed, otherwise, the verification fails; or, the second network function entity verifies the previously saved first service request. Whether the hash value of the data of the service request is consistent with the hash value of the data of the first service request included in the second client credential statement, for example, the second network function entity verifies that the second client credential statement includes the data of the first service request The hash value is considered to pass the verification, otherwise it is considered that the verification fails.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, and further includes: the second client credential statement includes a desired recipient network function entity of the second client credential statement. In the case of the identity of the second network function entity, the second network function entity verifies whether the identity of the expected recipient network function entity declared by the second client credential is the identity of the second network function entity. In the case where the identity of the expected recipient network function entity declared by the second client credential is the identity of the second network function entity, it is deemed that the verification has passed; otherwise, the verification is deemed to have failed.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, and further includes: the second client credential statement includes a desired recipient network function entity of the second client credential statement. In the case of the identity of the network function set where the second network function entity belongs, the second network function entity verifies whether the identity of the network function set where the network function entity of the intended recipient of the second client credential statement is located is the identity of the network function set to which the second network function entity belongs. If the identifier of the network function set to which the network function entity of the expected recipient of the second client credential statement is located is the identifier of the network function set to which the second network function entity belongs, the verification is deemed to pass; otherwise, the verification is deemed to fail.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, and further includes: the second client credential statement includes a desired recipient network function entity of the second client credential statement. In the case of the type of the second network function entity, the second network function entity verifies whether the type of the expected recipient network function entity declared by the second client credential is the type of the second network function entity. In the case of whether the type of the expected recipient network function entity declared by the second client credential is the type of the second network function entity, it is deemed that the verification has passed; otherwise, it is deemed that the verification has failed.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential declaration, and further includes: in the second client credential declaration including the second client credential declaration in the originator network function entity of the second client credential declaration. In the case of identification, the second network function entity verifies whether the identity of the originator network function entity of the second client credential statement included in the signed content of the second client credential statement is the network in the certificate information in the second client credential statement. The identity of the functional entity. In the case where the identity of the originator network function entity of the second client credential statement included in the signed content of the second client credential statement is the identity of the network function entity in the certificate information in the second client credential statement, it is deemed to be verified Passed, otherwise it is regarded as verification failure.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, further comprising: sending the second network function entity to the first network function when the first client credential statement is included in the second network function entity. In the second service request of the entity, the second service request further includes the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located, and the second client credential statement includes the originator of the second client credential statement to which the network function entity belongs. In the case of the identity of the network function set, the second network function entity verifies whether the identity of the network function set to which the originator network function entity of the second client credential assertion belongs is the intended recipient of the first client credential assertion included in the second service request The network identifier of the network where the network function entity is located. In the case where the identity of the network function set to which the network function entity of the originator of the second client credential statement belongs is the network identity of the network where the network function entity of the expected recipient of the first client credential statement included in the second service request is located, it is deemed to be verified. Passed, otherwise it is regarded as verification failure.

Optionally, in this embodiment of the present application, the second network function entity verifies the correctness of each parameter in the second client credential statement, and further includes: where the second client credential statement includes the originator network function entity of the second client credential statement. In the case of the network identification of the network, the second network function entity verifies whether the network identification of the network where the network function entity of the originator of the second client credential statement included in the signed content of the second client credential statement is the second client credential statement The network identity in the certificate information in . In the case of whether the network identifier of the network where the network function entity of the originator of the second client credential statement included in the signed content of the second client credential statement is located is the network identifier in the certificate information in the second client credential statement, it is deemed that The verification is passed, otherwise it is regarded as the verification failure.

It should be noted that the embodiment shown in FIG. 6 can be applied to a roaming scenario (the communication architecture described in The embodiment does not specifically limit this. Here, a unified description is provided, and details are not repeated below.

In the embodiment of the present application, after the receiver network function entity (corresponding to the first network function entity) verifies that the first client credential statement sent by the sender network function entity (corresponding to the second network function entity) passes, the network function entity of the sender (corresponding to the second network function entity) sends The second client credential statement sent by the entity includes the first client credential statement, or the hash value of the first client credential statement, or the data requested by the first service, or the hash value of the data requested by the first service. The request is a service request carrying a first client credential claim. Since the above parameters are all parameters related to the first client credential declaration, only the expected recipient network function entity of the first client credential declaration can obtain it. Therefore, after the sender's network function entity verifies that the second client credential declaration is passed, it can reverse the To verify that the identity of the recipient network function entity is correct. That is, the sender network function entity can determine that the sender network function entity of the client credential statement sent by the receiver network function entity to the sender network function entity is the client that receives the client network function entity that the sender network function entity provides to the receiver network function entity. The network function entity of the credential assertion.

Wherein, the actions of the first network function entity in the above steps S601 to S604 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the first network function entity to execute; the above The actions of the second network function entity in steps S601 to S604 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the second network function entity to execute. This does not impose any restrictions.

On the other hand, when the existing client credential declaration mechanism is used in a roaming scenario, the initiator network function entity and the recipient network function entity belong to different operator networks. When a recipient network function entity such as a pNF or NRF cannot verify the correctness of the certificate in the client credential assertion (eg there is no relationship between the operator of the network where the originating network function entity is located and the operator of the network where the receiving network function entity is located) cross certificate), the recipient network function entity cannot further verify the correctness of the client credential assertion based on the certificate in the client credential assertion. In this scenario, how to verify the correctness of the certificate in the client certificate statement is an urgent problem to be solved. To solve this problem, in conjunction with the communication system shown in FIG. 2 b , as shown in FIG. 7 , a communication method provided by an embodiment of the present application is as follows.

S701. The second network function entity sends the first client credential statement to the second security edge protection proxy entity. Correspondingly, the second security edge protection proxy entity receives the first client credential assertion from the second network function entity.

The first client credential statement in the embodiment of the present application may refer to the prior art, or the first client credential statement in the embodiment of the present application may refer to the first client credential statement in the embodiment shown in FIG. 5 . This is not specifically limited in the application examples.

S702. The second security edge protection proxy entity sends the first client credential statement to the first security edge protection proxy entity. Accordingly, the first security edge protection proxy entity receives the first client credential assertion from the second security edge protection proxy entity.

Optionally, in this embodiment of the present application, the second security edge protection proxy entity further sends the first root certificate to the first security edge protection proxy entity. Correspondingly, the first security edge protection proxy entity receives the first root certificate from the second security edge protection proxy entity. The first root certificate is the root certificate of the second network. The first root certificate may be preconfigured in the second security edge protection proxy entity.

Optionally, the second security edge protection proxy entity sends the first root certificate to the first security edge protection proxy entity if and only if the second security edge protection proxy entity receives the first client credential declaration.

S703. The first security edge protection proxy entity sends a first message to the first network function entity. Correspondingly, the first network function entity receives the first message from the first security edge protection proxy entity. The first message includes a first client credential statement and a first root certificate.

Optionally, similar to the implementation described in FIG. 5 , in this embodiment of the present application, the first security edge protection proxy entity sends a first message to the first network function entity after successfully verifying the first client credential declaration. There is no specific limitation on this.

Optionally, the first client credential declaration and the first root certificate are included in a message header of the first message.

In a possible implementation manner, the first root certificate in the first message comes from the second security edge protection proxy entity.

In another possible implementation manner, in this embodiment of the present application, before the first security edge protection proxy entity sends the first message to the first network function entity, the method further includes: the first security edge protection proxy entity according to the second network's The network identifier, and the mapping relationship between the first root certificate and the network identifier of the second network, determine the first root certificate. The network identifier of the second network may be obtained by the first edge protection proxy entity from the signed content of the first client credential statement, or the network identifier of the second network may be obtained by the first edge protection proxy entity from the first edge protection proxy entity. Alternatively, the network identifier of the second network may also be obtained by the first security edge protection proxy entity through other means, which is not specifically limited in this embodiment of the present application.

For the above implementation manner, optionally, the mapping relationship between the first root certificate and the network identifier of the second network is pre-configured in the first security edge protection proxy entity. Alternatively, the first root certificate is the root certificate used by the first security edge protection proxy entity to verify the certificate information of the first security edge protection proxy entity when the first security edge protection proxy entity establishes a secure connection with the second security edge protection proxy entity . The mapping relationship between the first root certificate and the network identifier of the second network is stored after the first security edge protection proxy entity establishes a secure connection with the second security edge protection proxy entity. The first security edge is in the protection proxy entity.

S704. The first network function entity verifies whether the certificate declared by the first client certificate is correct according to the first root certificate.

In the embodiment of this application, the first network function entity verifies whether the certificate information declared by the first client certificate is correct according to the first root certificate, which can be understood as the first network function entity verifies the certificate declared by the first client certificate according to the first root certificate. Whether the digital signature is correct is explained here, and will not be repeated below.

Wherein, compared with the prior art solution in which the recipient network function entity cannot verify whether the certificate in the client credential statement is correct in scenarios such as no cross-certificate between different operators, the embodiment of the present application can verify the correctness of the certificate according to the first root certificate. Check whether the certificate information of the first client credential statement is correct, so as to realize the verification of the certificate in the client credential statement, and then realize the verification of the digital signature of the client credential statement and the signed content. Wherein, when the first client credential declaration is a prior art client credential declaration, the first network function entity can verify the digital signature of the first client credential declaration and the signed content according to the certificate of the first client credential declaration. Referring to the prior art; when the first client credential assertion is the first client credential assertion in the embodiment shown in FIG. 5 , the first network function entity verifies the first client credential assertion according to the certificate of the first client credential assertion. For the solution of the digital signature and the signed content, reference may be made to step S502 of the embodiment shown in FIG. 5 , which will not be repeated here.

Further, in this embodiment of the present application, after the first network function entity verifies that the first client credential statement passes, the second client credential statement may also be sent to the second network function entity. Correspondingly, the second network function entity receives the second client credential statement from the first network function entity, and verifies the correctness of the second client credential statement. For related implementation and technical effects, reference may be made to the embodiment described in FIG. 6 , which will not be repeated here.

Wherein, the actions of the first network function entity in the above steps S701 to S704 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the first network function entity to execute; the above The actions of the second network function entity in steps S701 to S704 may be executed by the processor 401 in the communication device 400 shown in FIG. 4 by calling the application code stored in the memory 403 to instruct the second network function entity to execute; The action of the first security edge protection proxy entity in S704 may be performed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the first security edge protection proxy entity to execute; the above step S701 The actions of the second security edge protection proxy entity in step S704 may be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the second security edge protection proxy entity to execute. The example does not impose any restrictions on this.

Optionally, in the embodiments shown in FIG. 5 to FIG. 7 , the communication method provided in this embodiment of the present application may further include: the first network function entity sends the second network function entity to the second network function entity for requesting the second network function entity. A first authorization token for a service of a network function entity, where the first authorization token includes the network identifier of the second network. Correspondingly, the second network function entity receives the first authorization token from the first network function entity, and verifies whether the network identification of the second network in the first authorization token is the network identification in the certificate information of the first client credential statement . Of course, if the first security edge protection proxy entity verifies the first client credential statement, the first security edge protection proxy entity can verify whether the network identity of the second network in the first authorization token is in the certificate information of the first client credential statement This is not specifically limited in this embodiment of the present application.

On the other hand, in the existing client credential assertion mechanism, there is no client credential assertion integrity protection for the data (payload) or other partial contents of the service request. Among them, the integrity protection of the client credential declaration for the payload or other parts of the service request can be called an enhanced client credential declaration mechanism. If the client credential assertion integrity protection for the payload or other parts of the service request is introduced in the future client credential assertion, the initiator network function entity needs to know whether to adopt the enhanced client credential assertion mechanism. At the same time, if the initiator network function entity adopts the enhanced client credential assertion mechanism, it needs to determine whether the recipient network function entity supports the verification of the enhanced client credential assertion, otherwise the verification will fail. To solve this problem, in this embodiment of the present application, the initiator network function entity may determine the client credential assertion according to the pre-obtained or configured indication information of whether the recipient network function entity supports the enhanced client credential assertion mechanism. For example, the indication information of whether the recipient network function entity supports the enhanced client credential assertion mechanism indicates that the recipient network function entity supports the enhanced client credential assertion mechanism, then the initiator network function entity can generate the enhanced client credential assertion; otherwise, the initiator The network function entity generates a non-enhanced client credential assertion, ie, like the existing client credential assertion mechanism, there is no client credential assertion integrity protection for the payload or other parts of the business request. Further, in this embodiment of the present application, if the network function entity of the initiator sends the enhanced client credential statement to the network function entity of the receiver, the network function entity of the receiver can receive the client certificate statement from the network function entity of the sender. Verify the enhanced client credential assertion. The method of the client credential declaration enhanced by the network function experiment of the recipient is similar to the verification method of the client credential declaration provided by the embodiment of the present application. The payload or other parts of the content will not be repeated here.

Optionally, in this embodiment of the present application, the recipient network function entity may determine that the received client credential declaration is an enhanced client according to the indication information in the received service request that indicates that the client credential declaration is an enhanced client credential declaration. Credential Statement.

Optionally, in this embodiment of the present application, the recipient network function entity may determine the newly added encryption IE parameters according to the received encrypted IE parameters used to indicate which information elements (information elements, IEs) are introduced into the enhanced client credential declaration calculation. Introduce the IE parameters calculated by the client credential declaration, such as the payload or other parts of the business request.

In the following, the communication system shown in Figure 2a will be applied to the 5G network shown in Figure 3a, or the communication system shown in Figure 2b will be applied to the 5G network shown in Figure 3b. The second network functional entity is cNF, and the second network functional entity is cNF. The second security edge protection proxy entity is cSEPP, the first network function entity is pNF (which can also be replaced by NRF), and the first security edge protection proxy entity is pSEPP as an example to illustrate the communication methods described in the above aspects.

It should be noted that the names of messages between network elements or the names of parameters in the messages in the following embodiments of the present application are just an example, and other names may also be used in specific implementations, which are not specified in the embodiments of the present application. limited.

In conjunction with the communication method shown in FIG. 5 , taking the communication system shown in FIG. 2 b applied to the 5G network shown in FIG. 3 b as an example, as shown in FIG. 8 , a communication method provided by an embodiment of the present application includes the following step:

S801. The cNF obtains a first client credential statement.

For the relevant description of the first client credential declaration, reference may be made to step S501 in the embodiment shown in FIG. 5 , which will not be repeated here.

S802, the cNF sends a service request 1 to the cSEPP. Correspondingly, the cSEPP receives the service request 1 from the cNF.

The service request 1 includes the first client credential statement.

S803, cSEPP sends service request 2 to pSEPP. Correspondingly, pSEPP receives service request 2 from cSEPP.

The service request 2 includes the first client credential statement.

S804, pSEPP verifies whether the first client credential statement is correct.

The manner in which pSEPP verifies whether the first client credential statement is correct may refer to the manner in which the first security edge protection proxy entity verifies whether the first client credential statement is correct in the above method embodiments, which will not be repeated here.

S805. After the pSEPP verifies that the first client credential declaration is passed, it sends a service request 3 to the pNF. Correspondingly, the pNF receives the service request 3 from the pSEPP.

The service request 3 includes the first client credential statement.

Optionally, in this embodiment of the present application, if the pSEPP fails to verify the first client credential statement, the pSEPP discards the data sent by the cNF. Optionally, the pSEPP sends a rejection indication or an error indication to the cNF through the cSEPP, where the rejection indication or the error indication is used to indicate that the verification of the first client credential claim fails. Wherein, if pSEPP fails to verify the first client credential declaration, the subsequent process ends, which reduces the steps of signaling interaction between network elements and saves system resources.

It should be noted that, in this embodiment of the present application, the action of verifying the first client credential statement in step S804 is optional, which is described uniformly here, and will not be repeated below.

S806. The pNF verifies whether the first client credential statement is correct.

The manner in which the pNF verifies whether the first client credential statement is correct may refer to step S502 in the embodiment shown in FIG. 5 , and details are not described herein again.

S807. After the pNF verifies that the first client credential declaration is passed, it sends a service response to the cNF through pSEPP and cSEPP. Accordingly, the cNF receives the service response from the pNF.

Optionally, the service request 1, service request 2, and service request 3 in this embodiment of the present application may further include a first authorization token used by the cNF to request the service of the pNF. Further, the pSEPP verifying whether the first client credential claim is correct includes: pSEPP verifying whether the network identifier of the second network in the first authorization token is the network identifier in the certificate information of the first client credential claim. The pNF verifies whether the first client credential claim is correct includes: the pNF verifies whether the network identifier of the second network in the first authorization token is the network identifier in the certificate information of the first client credential claim.

It should be noted that the service request 1, service request 2 and service request 3 in the embodiment of this application may be service requests including the same parameters and/or data, or may be service requests including different parameters and/or data. This is not specifically limited in the application examples.

For the technical effect of the embodiment shown in FIG. 8 , reference may be made to the technical effect of the embodiment shown in FIG. 5 , which will not be repeated here.

Wherein, the actions of the pNF in the above steps S801 to S807 can be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the pNF to execute; the actions of the cNF in the above steps S801 to S807 The processor 401 in the communication device 400 shown in FIG. 4 can call the application code stored in the memory 403 to instruct the cNF to execute; the actions of pSEPP in the above steps S801 to S807 can be executed by the communication device 400 shown in FIG. 4 . The processor 401 of the processor 401 calls the application program code stored in the memory 403 to instruct the pSEPP to execute; the actions of the cSEPP in the above steps S801 to S807 can be called by the processor 401 in the communication device 400 shown in FIG. 4 to call the application stored in the memory 403. The program code is executed by instructing the cSEPP, which is not limited in this embodiment.

With reference to the communication method shown in FIG. 6 , taking the communication system shown in FIG. 2 a applied to the 5G network shown in FIG. 3 a as an example, as shown in FIG. 9 , a communication method provided by an embodiment of the present application includes the following step:

S901. The cNF obtains a first client credential statement.

For the relevant description of the first client credential declaration, reference may be made to step S601 in the embodiment shown in FIG. 6 , which will not be repeated here.

S902, the cNF sends service request 1 to the SCP. Correspondingly, the SCP receives service request 1 from the cNF.

The service request 1 includes the first client credential statement.

S903. The SCP sends service request 2 to the pNF. Correspondingly, the pNF receives the service request 2 from the SCP.

The service request 2 includes the first client credential statement.

S904. The pNF verifies whether the first client credential statement is correct.

The manner in which the pNF verifies whether the first client credential declaration is correct may refer to step S602 in the embodiment shown in FIG. 6 , and details are not described herein again.

S905. After the pNF verifies that the first client credential statement is passed, it sends service request 3 to the SCP. Correspondingly, the SCP receives the service request 3 from the pNF.

The service request 3 includes the second client credential statement.

For the relevant description of the second client credential declaration, reference may be made to step S603 in the embodiment shown in FIG. 6 , which will not be repeated here.

S906, the SCP sends service request 4 to the cNF. Correspondingly, the cNF receives the service request 4 from the SCP.

The service request 4 includes a second client credential statement.

S907, the cNF verifies whether the second client credential statement is correct.

The manner in which the cNF verifies whether the second client credential declaration is correct may refer to step S604 in the embodiment shown in FIG. 6 , and details are not described herein again.

In this embodiment of the present application, if the cNF verifies that the second client credential statement is passed, the subsequent process continues to be executed; otherwise, optionally, the cNF sends a rejection indication or an error indication to the pNF through cSEPP and pSEPP, and the rejection indication or error indication uses to indicate that the verification of the second client credential assertion failed.

Optionally, the service request 1 and the service request 2 in this embodiment of the present application may further include a first authorization token used by the cNF to request the service of the pNF. Furthermore, the pNF verifying whether the first client credential claim is correct includes: the pNF verifying whether the network identifier of the second network in the first authorization token is the network identifier in the certificate information of the first client credential claim.

It should be noted that the service request 1 and the service request 2 in the embodiment of this application may be service requests including the same parameters and/or data, or may be service requests including different parameters and/or data; in the embodiments of this application The service request 3 and the service request 4 may be service requests including the same parameters and/or data, or may be service requests including different parameters and/or data, which are not specifically limited in this embodiment of the present application.

For the technical effect of the embodiment shown in FIG. 9 , reference may be made to the technical effect of the embodiment shown in FIG. 6 , which will not be repeated here.

Wherein, the actions of the pNF in the above steps S901 to S907 can be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the pNF to execute; the actions of the cNF in the above steps S901 to S907 The processor 401 in the communication apparatus 400 shown in FIG. 4 may call the application code stored in the memory 403 to instruct the cNF to execute, which is not limited in this embodiment.

With reference to the communication method shown in FIG. 7 , taking the communication system shown in FIG. 2 b applied to the 5G network shown in FIG. 3 b as an example, as shown in FIG. 10 , a communication method provided by an embodiment of the present application includes the following step:

S1001. The cNF obtains a first client credential statement.

For the relevant description of the first client credential declaration, reference may be made to step S701 in the embodiment shown in FIG. 7 , which will not be repeated here.

S1002, the cNF sends a service request 1 to the cSEPP. Correspondingly, the cSEPP receives the service request 1 from the cNF.

The service request 1 includes the first client credential statement.

S1003, cSEPP sends service request 2 to pSEPP. Correspondingly, pSEPP receives service request 2 from cSEPP.

The service request 2 includes the first client credential statement.

Optionally, the service request 2 further includes the first root certificate, and the related description of the first root certificate can refer to the embodiment shown in FIG. 7 , and details are not repeated here.

Alternatively, the first root certificate may not be carried in the service request 2, but the cSEPP sends the service request 2 and the first root certificate to the pSEPP, which is not specifically limited in this embodiment of the present application.

S1004, pSEPP sends service request 3 to pNF. Correspondingly, the pNF receives the service request 3 from the pSEPP.

The service request 3 includes the first client certificate statement and the first root certificate. For the manner in which pSEPP obtains the first root certificate, reference may be made to step S703 of the embodiment described in FIG. 7 , and details are not described herein again.

It should be noted that, the service request 3 in the embodiment of the present application is only a possible implementation manner of the first message in the embodiment described in FIG. 7 . Alternatively, the first root certificate may not be carried in the service request 3, but the cSEPP sends a first message to the pSEPP, and the first message includes the service request 3 and the first root certificate, which is not specified in this embodiment of the application. limited.

S1005. The pNF verifies whether the first client credential statement is correct.

The manner in which the pNF verifies whether the first client credential declaration is correct may refer to the description in step S704 of the embodiment shown in FIG. 7 , which will not be repeated here.

S1006. After the pNF verifies that the first client credential declaration is passed, it sends a service response to the cNF through pSEPP and cSEPP. Accordingly, the cNF receives the service response from the pNF.

Optionally, the service request 1, service request 2, and service request 3 in this embodiment of the present application may further include a first authorization token used by the cNF to request the service of the pNF. Further, the pSEPP verifying whether the first client credential claim is correct includes: pSEPP verifying whether the network identifier of the second network in the first authorization token is the network identifier in the certificate information of the first client credential claim. The pNF verifies whether the first client credential claim is correct includes: the pNF verifies whether the network identifier of the second network in the first authorization token is the network identifier in the certificate information of the first client credential claim.

It should be noted that the service request 1, service request 2 and service request 3 in the embodiment of this application may be service requests including the same parameters and/or data, or may be service requests including different parameters and/or data. This is not specifically limited in the application examples.

For the technical effect of the embodiment shown in FIG. 10 , reference may be made to the technical effect of the embodiment shown in FIG. 7 , which will not be repeated here.

Wherein, the actions of the pNF in the above steps S1001 to S1006 can be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the pNF to execute; the actions of the cNF in the above steps S1001 to S1006 The application code stored in the memory 403 can be called by the processor 401 in the communication device 400 shown in FIG. 4 to instruct the cNF to execute; the actions of pSEPP in the above steps S1001 to S1006 can be executed by the communication device 400 shown in FIG. 4 . The processor 401 of the processor 401 calls the application program code stored in the memory 403 to instruct the pSEPP to execute; the actions of the cSEPP in the above steps S1001 to S1006 can be called by the processor 401 in the communication device 400 shown in FIG. 4 to call the application stored in the memory 403. The program code is executed by instructing the cSEPP, which is not limited in this embodiment.

In conjunction with the communication method described in FIG. 5 , FIG. 6 or FIG. 7 , taking the communication system described in FIG. 2 b applied to the 5G network described in FIG. 3 b as an example, as shown in FIG. A communication method, comprising the steps of:

S1101. The cNF obtains a first client credential statement.

S1102, the cNF sends a service request 1 to the cSEPP. Correspondingly, the cSEPP receives the service request 1 from the cNF.

S1103, cSEPP sends service request 2 to pSEPP. Accordingly, pSEPP receives service request 2 from cSEPP.

For the specific implementation of steps S1101-S1103, reference may be made to steps S1001-S1003 of the embodiment described in FIG. 10 , which will not be repeated here.

S1104, pSEPP verifies whether the first client credential statement is correct.

The manner in which pSEPP verifies whether the first client credential declaration is correct may refer to the manner in which the first security edge protection proxy entity verifies whether the first client credential declaration is correct in the above method embodiments, which will not be repeated here. Optionally, pSEPP verifies whether the certificate in the first client certificate statement is correct according to the first root certificate, which is not specifically limited in this embodiment of the present application. For the manner in which pSEPP obtains the first root certificate, reference may be made to step S702 in the embodiment described in FIG. 7 , and details are not described herein again.

S1105. After the pSEPP verifies that the first client credential declaration is passed, it sends a service request 3 to the pNF. Correspondingly, the pNF receives the service request 3 from the pSEPP.

The service request 3 includes the first client credential statement. Optionally, the service request 3 includes the first root certificate.

It should be noted that, the service request 3 in the embodiment of the present application is only a possible implementation manner of the first message in the embodiment described in FIG. 7 . Alternatively, the first root certificate may not be carried in the service request 3, but the cSEPP sends a first message to the pSEPP, and the first message includes the service request 3 and the first root certificate, which is not specified in this embodiment of the application. limited.

Optionally, in this embodiment of the present application, if the pSEPP fails to verify the first client credential statement, the pSEPP discards the data sent by the cNF. Optionally, the pSEPP sends a rejection indication or an error indication to the cNF through the cSEPP, where the rejection indication or the error indication is used to indicate that the verification of the first client credential claim fails. Wherein, if pSEPP fails to verify the first client credential declaration, the subsequent process ends, which reduces the steps of signaling interaction between network elements and saves system resources.

It should be noted that, in the embodiment of the present application, the action of verifying the first client credential statement in step S1104 is optional, which is described uniformly here, and will not be repeated below.

S1106. The pNF verifies whether the first client credential statement is correct.

The manner in which the pNF verifies whether the first client credential declaration is correct may refer to step S602 in the embodiment described in FIG. 6 or step S704 in the embodiment described in FIG. 7 , and details are not described herein again.

S1107: After the pNF verifies that the first client credential declaration is passed, it sends a service request 4 to the pSEPP. Correspondingly, the pSEPP receives the service request 4 from the pNF.

Wherein, the service request 4 includes a second client credential statement. For a description of the second client credential declaration, reference may be made to step S603 in the embodiment shown in FIG. 6 , and details are not repeated here.

S1108, pSEPP sends service request 5 to cSEPP. Correspondingly, the cSEPP receives the service request 5 from the pSEPP.

The service request 5 includes a second client credential statement.

Optionally, the service request 5 further includes a first root certificate, where the first root certificate is a root certificate of the first network.

Optionally, the first root certificate and the second client certificate declaration are included in the message header of the service request 5 .

S1109, cSEPP verifies whether the second client credential statement is correct.

The manner in which cSEPP verifies whether the second client credential statement is correct may refer to the above-mentioned pSEPP method for verifying whether the first client credential statement is correct or the above-mentioned method for cNF to verify whether the second client credential statement is correct, which will not be repeated here. Optionally, cSEPP verifies whether the certificate in the second client certificate statement is correct according to the second root certificate. The manner in which cSEPP acquires the second root certificate may refer to the foregoing manner in which pSEPP acquires the first root certificate, and details are not described herein again.

S1110. After the cSEPP verifies that the second client credential declaration is passed, it sends a service request 6 to the cNF. Accordingly, the cNF receives the service request 6 from the cSEPP.

The service request 6 includes a second client credential statement. Optionally, the service request 6 includes the second root certificate.

Alternatively, the second root certificate may not be carried in the service request 6, but the pSEPP sends the service request 6 and the second root certificate to the cSEPP, which is not specifically limited in this embodiment of the present application.

Optionally, in this embodiment of the present application, if cSEPP fails to verify the second client credential claim, cSEPP sends a rejection indication or error indication to pNF through pSEPP, where the rejection indication or error indication is used to indicate that the first client credential claim verification fails.

It should be noted that, in the embodiment of the present application, the action of verifying the second client credential statement in step S1110 is optional, which is described uniformly here, and will not be repeated below.

S1111. The cNF verifies whether the second client credential statement is correct.

The manner in which the cNF verifies whether the second client credential declaration is correct may refer to step S604 in the embodiment shown in FIG. 6 , and details are not described herein again. Optionally, the cNF verifies whether the certificate in the second client certificate statement is correct according to the second root certificate.

In this embodiment of the present application, if the cNF verifies that the second client credential statement is passed, the subsequent process continues to be executed; otherwise, optionally, the cNF sends a rejection indication or an error indication to the pNF through cSEPP and pSEPP, and the rejection indication or error indication uses to indicate that the verification of the second client credential assertion failed.

For the technical effect of the embodiment shown in FIG. 11 , reference may be made to the technical effect of the embodiment shown in FIG. 5 , FIG. 6 or FIG. 7 , which will not be repeated here.

Wherein, the actions of the pNF in the above steps S1101 to S1111 can be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the pNF to execute; the actions of the cNF in the above steps S1101 to S1111 The application code stored in the memory 403 can be called by the processor 401 in the communication device 400 shown in FIG. 4 to instruct the cNF to execute; the actions of pSEPP in the above steps S1101 to S1111 can be executed by the communication device 400 shown in FIG. 4 . The processor 401 of the processor 401 calls the application program code stored in the memory 403 to instruct the pSEPP to execute; the actions of the cSEPP in the above steps S1101 to S1111 can be invoked by the processor 401 in the communication device 400 shown in FIG. 4 to call the application stored in the memory 403 The program code is executed by instructing the cSEPP, which is not limited in this embodiment.

Taking the communication system shown in FIG. 2a applied to the 5G network shown in FIG. 3a as an example, as shown in FIG. 12 , a communication method provided by an embodiment of the present application includes the following steps:

S1201. The cNF sends a discovery request to the NRF. Accordingly, the NRF receives the discovery request from the cNF.

Wherein, the discovery request is used for requesting discovery of pNF.

S1202, the NRF determines the pNF identifier and the corresponding pNF file (pNF profile) according to the discovery request.

Wherein, the pNF file includes indication information for indicating whether to support the enhanced client credential assertion (ie, compared with the existing client credential assertion calculation method, new parameters or data are introduced in calculating the client credential assertion) mechanism. The indication information is, for example, a client credential assertion calculation supporting the data (payload) of the service request, or the indication information can be, for example, a client credential assertion computation that supports other partial contents of the service request.

It should be noted that, in the embodiment of this application, supporting the client credential declaration of the payload or other partial content of the service request can also be understood as supporting the integrity protection of the payload or other partial content of the service request, which is uniformly explained here, as follows. No longer.

Optionally, the pNF file further includes instruction information for adding an IE that is introduced into the calculation of client credential assertion, where the instruction information is used to indicate the payload or other partial content of the service request that is added into the calculation of client credential assertion.

S1203, the NRF sends a discovery response to the cNF. Accordingly, the cNF receives the discovery response from the NRF.

Among them, the above-mentioned pNF file is included in the discovery response.

It should be noted that, in this embodiment of the present application, if the cNF does not need to be discovered, but a pNF identifier is configured, the above pNF file may also be configured in the cNF. That is, steps S1201-S1203 in this embodiment of the present application are optional, and are described in a unified manner here, and are not repeatedly described below.

S1204. The cNF obtains the first client credential statement.

Optionally, in this embodiment of the present application, the cNF determines the first client credential assertion according to the indication information in the pNF file for indicating whether the enhanced client credential assertion mechanism is supported. Wherein, if the indication information used to indicate whether the enhanced client credential assertion mechanism is supported in the pNF file indicates that the enhanced client credential assertion mechanism is supported, the first client credential assertion is an enhanced client credential assertion. For example, when the cNF calculates the first client credential statement, it needs to consider the payload or other content of the service request. Optionally, when the cNF calculates the first client credential statement, it may determine the content to be newly introduced into the calculation of the client credential statement according to the instruction information of the newly added IE for introducing the calculation of the client credential statement, which is not specifically limited in this embodiment of the present application. Optionally, on the basis of the above judgment, the cNF also makes a judgment according to whether it supports the calculation of the enhanced client credential assertion mechanism, and the indication information in the pNF file for indicating whether the enhanced client credential assertion mechanism is supported; when and The cNF will employ an enhanced client credential assertion mechanism only if both are supported.

S1205, the cNF sends service request 1 to the SCP. Correspondingly, the SCP receives service request 1 from the cNF.

The service request 1 includes the first client credential statement.

S1206. The SCP sends service request 2 to the pNF. Correspondingly, the pNF receives the service request 2 from the SCP.

The service request 2 includes the first client credential statement.

Optionally, the above service request 1 and service request 2 further include indication information for indicating that the first client credential declaration is an enhanced client credential declaration.

Optionally, the above-mentioned service request 1 and service request 2 further include encrypted IE parameters, which are used to indicate which IEs are introduced into the calculation of the enhanced client credential declaration.

S1207. The pNF verifies whether the first client credential statement is correct.

Optionally, the pNF verifies whether the first client credential assertion is correct according to the indication information for indicating that the first client credential assertion is an enhanced client credential assertion. For example, the pNF verifies whether the payload or other parts of the service request are correct, or the pNF verifies the correctness of the parameters or data introduced into the enhanced client credential declaration according to the encrypted IE parameters.

S1208. After the pNF verifies that the first client credential declaration is passed, it sends a service response to the cNF through the SCP. Accordingly, the cNF receives the service response from the pNF.

Based on the above solution, the enhanced client credential declaration can be differentiated from the existing client credential declaration, so that the calculation methods of the client credential declaration are more diversified.

Wherein, the actions of the pNF in the above steps S1201 to S1208 can be executed by the processor 401 in the communication device 400 shown in FIG. 4 calling the application code stored in the memory 403 to instruct the pNF to execute; the actions of the cNF in the above steps S1201 to S1208 The processor 401 in the communication apparatus 400 shown in FIG. 4 may call the application code stored in the memory 403 to instruct the cNF to execute, which is not limited in this embodiment.

Optionally, in addition to using the NF profile to inform the cNF whether it supports the enhanced client credential assertion mechanism, there are other ways. For example, if the cNF is a functional network element of a new version (eg Rel17 version cNF), the cNF can adopt an enhanced client credential declaration mechanism and send version information to the pNF. The pNF uses this version information to determine whether to use the enhanced client credential assertion mechanism. If the version information indicates a new version, the pNF uses an enhanced client credential assertion mechanism for verification. If the version information indicates a traditional version, the pNF uses the traditional client credential assertion mechanism for verification. This version information can indicate a new version or a legacy version. Further, the version information may indicate a specific version, such as Rel16, Rel17 or Rel18. The pNF can determine which new parameters are included in the enhanced client credential declaration mechanism according to the received specific version information, and then perform corresponding verification. Optionally, the cNF may also determine whether to adopt the enhanced client credential declaration mechanism according to whether it supports the new version, the traditional version or the specific version of the client credential declaration mechanism, which is not specifically limited in this embodiment of the present application.

Optionally, the NF profile of pNF includes a specific version, such as Rel16, Rel17, or Rel18. Different versions here may introduce different parameters for the calculation of client credential claims. The cNF can determine which new parameters are included in the enhanced client credential assertion mechanism based on the specific version information received. These new parameters are introduced by cNF when computing the enhanced client credential assertion mechanism. Optionally, the cNF may also consider whether it supports the enhanced client credential assertion mechanism of the corresponding version. For example, if the cNF determines that both the cNF and the NF profile support the highest version, the cNF can use the highest version to calculate the client credential assertion. At the same time, the cNF sends the specifically adopted version information to the pNF, so that the pNF can verify the corresponding security credentials according to the adopted version information.

It can be understood that, in this embodiment of the present application, the network function set parameter may also exist independently in the client credential statement.

It can be understood that the concept of the above network function set is used to indicate the set where the network function is located, and is used to limit the scope of the network function, so other parameters that limit the scope of the network function are still applicable, such as slice identification, or slice selection auxiliary parameters. Wait. In other words, in the first client credential declaration or the second client credential declaration, the network function set can be described as a network function restriction parameter, such as a slice identifier, or a slice selection auxiliary parameter, which is used to restrict the first client credential declaration or the second client credential declaration The declaration is only used for the network element function entities within the scope of the network function limitation parameters, and is described in a unified manner here, and will not be repeated below.

It can be understood that, in the embodiments shown in FIG. 5 to FIG. 12 , the methods and/or steps implemented by the first network functional entity may also be implemented by components (such as chips or circuits) that can be used in the first network functional entity ; The methods and/or steps implemented by the second network functional entity can also be implemented by components (such as chips or circuits) that can be used in the second network functional entity; The methods and/or steps implemented by the first security edge protection proxy entity can also be implemented by a component (such as a chip or circuit) that can be used for the first security edge protection proxy entity; the methods and/or steps implemented by the second security edge protection proxy entity can also be implemented by the second security edge protection proxy entity. A physical component (eg, a chip or circuit) is implemented.

The foregoing mainly introduces the solutions provided by the embodiments of the present application from the perspective of interaction between various network elements. Correspondingly, an embodiment of the present application further provides a communication apparatus, and the communication apparatus may be the first network functional entity in the above method embodiments, or a device including the above-mentioned first network functional entity, or may be used for the first network functional entity or, the communication device may be the second network function entity in the above method embodiment, or a device including the second network function entity, or a component that can be used for the second network function entity; or, the communication device It may be the first security edge protection proxy entity in the above method embodiments, or a device including the first security edge protection proxy entity, or a component that can be used for the first security edge protection proxy entity; or, the communication device may be The second security edge protection proxy entity in the above method embodiment, or a device including the second security edge protection proxy entity, or a component that can be used for the second security edge protection proxy entity. It can be understood that, in order to realize the above-mentioned functions, the communication apparatus includes corresponding hardware structures and/or software modules for executing each function. Those skilled in the art should easily realize that the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

FIG. 13 shows a schematic structural diagram of a communication device 130 . The communication device 130 includes a transceiver module 1301 and a processing module 1302 . The communication apparatus 130 may be the first network function entity, the second network function entity, the first security edge protection proxy entity or the second security edge protection proxy entity in the foregoing method embodiments. The transceiver module 1301, which may also be referred to as a transceiver unit, is used to implement any of the above method embodiments to be executed by the first network function entity, the second network function entity, or the first security edge protection proxy entity or the second security edge protection proxy entity. send and/or receive functions. The transceiver module 1301 may be composed of a transceiver circuit, a transceiver, a transceiver or a communication interface. In some possible implementations, the transceiver module 1301 includes a sending module and a receiving module, respectively configured to implement the protection of the proxy entity or the first network function entity or the first network function entity or the first network function entity in any of the foregoing method embodiments. 2. The sending and receiving functions performed by the security edge protection proxy entity. The processing module 1302 may be configured to implement the processing functions performed by the first network function entity, the second network function entity, the first security edge protection proxy entity or the second security edge protection proxy entity in any of the foregoing method embodiments. The processing module 1302 can be, for example, a processor.

In this embodiment, the communication apparatus 130 is presented in the form of dividing each functional module in an integrated manner. "Module" herein may refer to a specific ASIC, circuit, processor and memory executing one or more software or firmware programs, integrated logic circuit, and/or other device that may provide the functions described above. In a simple embodiment, those skilled in the art can imagine that the communication device 130 may take the form of the communication device 400 shown in FIG. 4 .

For example, the processor 401 in the communication apparatus 400 shown in FIG. 4 may execute the instructions by calling the computer stored in the memory 403, so that the communication apparatus 400 executes the communication method in the above method embodiment.

Specifically, the functions/implementation process of the transceiver module 1301 and the processing module 1302 in FIG. 13 can be implemented by the processor 401 in the communication apparatus 400 shown in FIG. 4 calling the computer execution instructions stored in the memory 403 . Alternatively, the function/implementation process of the processing module 1302 in FIG. 13 can be implemented by the processor 401 in the communication device 400 shown in FIG. 4 calling the computer execution instructions stored in the memory 403, and the function of the transceiver module 1301 in FIG. 13 can be implemented. The implementation process can be implemented through the communication interface 404 in the communication device 400 shown in FIG. 4 .

Since the communication apparatus 130 provided in this embodiment can perform the above communication method, the technical effects that can be obtained by the communication apparatus 130 may refer to the above method embodiments, which will not be repeated here.

Optionally, an embodiment of the present application provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium runs on a computer, the computer can execute any of the above method embodiments from the first method. A method performed by a network function entity, a second network function entity, a first security edge protection proxy entity, or a second security edge protection proxy entity.

Optionally, the embodiment of the present application provides a computer program product containing instructions, when it runs on a computer, the computer can execute any of the above method embodiments by the first network function entity and the second network function entity. , A method performed by a first security edge protection proxy entity or a second security edge protection proxy entity.

It should be noted that, one or more of the above modules or units may be implemented by software, hardware or a combination of both. When any of the above modules or units are implemented in software, the software exists in the form of computer program instructions and is stored in the memory, and the processor can be used to execute the program instructions and implement the above method flow. The processor can be built into a SoC (system on chip) or an ASIC, or it can be an independent semiconductor chip. In addition to the core for executing software instructions for operation or processing, the internal processing of the processor may further include necessary hardware accelerators, such as field programmable gate array (FPGA), PLD (Programmable Logic Device) , or a logic circuit that implements dedicated logic operations.

When the above modules or units are implemented in hardware, the hardware can be CPU, microprocessor, digital signal processing (DSP) chip, microcontroller unit (MCU), artificial intelligence processor, ASIC, Any or any combination of SoCs, FPGAs, PLDs, dedicated digital circuits, hardware accelerators, or non-integrated discrete devices that may or may not run the necessary software to perform the above method flows.

Optionally, an embodiment of the present application further provides a communication apparatus (for example, the communication apparatus may be a chip or a chip system), where the communication apparatus includes a processor for implementing the method in any of the foregoing method embodiments. In a possible implementation, the communication device further includes a memory. The memory is used to store necessary program instructions and data, and the processor can call the program code stored in the memory to instruct the communication apparatus to execute the method in any of the above method embodiments. Of course, the memory may also not be in the communication device. When the communication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in this embodiment of the present application.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or data storage devices including one or more servers, data centers, etc. that can be integrated with the medium. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Although the application is described herein in conjunction with the various embodiments, those skilled in the art will understand and understand from a review of the drawings, the disclosure, and the appended claims in practicing the claimed application. Other variations of the disclosed embodiments are implemented. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that these measures cannot be combined to advantage.

Although the application has been described in conjunction with specific features and embodiments thereof, it will be apparent that various modifications and combinations can be made therein without departing from the spirit and scope of the application. Accordingly, this specification and drawings are merely exemplary illustrations of the application as defined by the appended claims, and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of this application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (36)

1. A communication method, characterized in that the method comprises:

   The first network function entity receives a first client credential statement from the second network function entity, the first client credential statement includes a network identifier of the network where the network function entity of the intended recipient of the first client credential statement is located, the The first network function entity belongs to the first network, the second network function entity belongs to the second network, and the first network and the second network are different networks;

   The first network function entity verifies whether the network identity of the network where the network function entity of the expected recipient of the first client credential statement is located is the network identity of the first network.
2. The method of claim 1, wherein the first network function entity receives the first client credential assertion from the second network function entity, comprising:

   The first network function entity receives, through a first security edge protection proxy entity, a first message including the first client credential assertion from the second network function entity.
3. The method according to claim 2, wherein the first message further includes a first root certificate, and the first root certificate is a root certificate of the second network; the method further comprises:

   The first network function entity verifies whether the certificate information declared by the first client certificate is correct according to the first root certificate.
4. The method according to claim 2 or 3, wherein the first message further comprises a first authorization token used by the second network function entity to request services of the first network function entity, the The first authorization token includes the network identifier of the second network; the method further includes:

   The first network function entity verifies whether the network identity of the second network is the network identity in the certificate information of the first client credential assertion.
5. The method according to any one of claims 2-4, wherein the first message further includes an identifier of the network function set to which the expected recipient network function entity declared by the first client credential belongs; the method further comprises: include:

   The first network function entity verifies whether the identity of the network function set to which the intended recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs.
6. The method according to any one of claims 1-5, wherein the first client credential statement further comprises an identifier of a network function set where a network function entity of a desired recipient of the first client credential statement is located; the Methods also include:

   The first network function entity verifies whether the identity of the network function set to which the expected recipient network function entity of the first client credential statement belongs is the identity of the network function set to which the first network function entity belongs.
7. The method according to any one of claims 1-6, wherein the signed content of the first client credential statement includes the network identifier of the network where the network function entity of the originator of the first client credential statement is located; The method also includes:

   The first network function entity verifies whether the network identity of the network where the originator network function entity of the first client credential assertion is located is the network identity in the certificate information of the first client credential assertion.
8. The method according to any one of claims 1-7, wherein the network identity of the network where the network function entity of the expected recipient of the first client credential statement is verified by the first network function entity is the first network function entity. After the network identification of a network, the method further includes:

   The first network function entity sends a second client credential statement to the second network function entity, where the second client credential statement includes the network identifier of the network where the network function entity of the intended recipient of the second client credential statement is located .
9. The method of claim 8, wherein the second client credential claim includes at least one of the following parameters:

   the identity of the intended recipient network function entity of the second client credential assertion;

   The identifier of the network function set to which the intended recipient network function entity of the second client credential statement belongs;

   the type of intended recipient network function entity of the second client credential assertion;

   the first client credential assertion, or a hash of the first client credential assertion;

   Data of the first service request, or a hash value of the data of the first service request, where the first service request is a service request bearing the first client credential statement;

   the identity of the originator network function entity of the second client credential assertion;

   The identifier of the network function set to which the originator network function entity of the second client credential statement belongs;

   Or, the network identifier of the network where the network function entity of the originator of the second client credential statement is located.
10. The method according to any one of claims 1-9, wherein the first client credential statement is included in a second service request, wherein the data of the second service request is included in the first client In the credential declaration, the method further includes:

    The first network function entity verifies the correctness of the data requested by the second service.
11. A communication method, characterized in that the method comprises:

    The second network function entity obtains a first client credential statement, where the first client credential statement includes the network identifier of the network where the network function entity of the intended recipient of the first client credential statement is located;

    The second network function entity sends the first client credential statement to the first network function entity, and the network identifier of the network where the network function entity of the first client credential statement is intended to be received The network identifiers are the same, wherein the first network function entity belongs to the first network, the second network function entity belongs to the second network, and the first network and the second network are different networks.
12. The method according to claim 11, wherein the method further comprises:

    The second network function entity sends, to the first network function entity, a first authorization token used by the second network function entity to request services of the first network function entity, where the first authorization token contains A network identifier of the second network is included, and the identifier of the second network is used to verify whether it is the same as the network identifier in the certificate information in the first client credential statement.
13. The method according to claim 11 or 12, wherein the method further comprises:

    The second network function entity sends, to the first network function entity, the identifier of the network function set to which the network function entity of the intended recipient of the first client credential statement belongs, the network function of the intended recipient of the first client credential statement The identity of the network function set to which the entity belongs is used to verify whether it is the same as the identity of the network function set to which the first network function entity belongs.
14. The method according to claim 11 or 12, wherein the first client credential statement further comprises an identifier of a network function set to which the intended recipient network function entity of the first client credential statement belongs, and the first client credential statement belongs to a network function set. The identity of the network function set to which the expected recipient network function entity of the credential declaration belongs is used to verify whether it is the same as the identity of the network function set to which the first network function entity belongs.
15. The method according to any one of claims 11-14, wherein the method further comprises:

    the second network function entity receives a second client credential assertion from the first network function entity, the second client credential assertion includes a network of the network where the network function entity of the intended recipient of the second client credential assertion is located identification;

    The second network function entity verifies whether the network identity of the network where the network function entity of the intended recipient of the second client credential statement is located is the network identity of the second network.
16. The method of claim 15, wherein the second client credential statement further comprises at least one of the following parameters:

    the identity of the intended recipient network function entity of the second client credential assertion;

    The identifier of the network function set to which the intended recipient network function entity of the second client credential statement belongs;

    the type of intended recipient network function entity of the second client credential assertion;

    the first client credential assertion, or a hash of the first client credential assertion;

    Data of the first service request, or a hash value of the data of the first service request, where the first service request is a service request bearing the first client credential statement;

    the identity of the originator network function entity of the second client credential assertion;

    The identifier of the network function set to which the originator network function entity of the second client credential statement belongs;

    Or, the network identifier of the network where the network function entity of the originator of the second client credential statement is located.
17. 17. The method of claim 16, wherein the second client credential assertion includes an identification of a desired recipient network function entity of the second client credential assertion; the method further comprising:

    the second network function entity verifies whether the identity of the expected recipient network function entity of the second client credential assertion is the identity of the second network function entity;

    Alternatively, the second client credential statement includes an identifier of a network function set where the intended recipient network function entity of the second client credential statement is located; the method further includes:

    The second network function entity verifies whether the identity of the network function set to which the intended recipient network function entity of the second client credential statement belongs is the identity of the network function set to which the second network function entity belongs

    Alternatively, the second client credential assertion includes a desired recipient network function entity type of the second client credential assertion; the method further includes:

    the second network function entity verifies whether the type of the intended recipient network function entity declared by the second client credential is the type of the second network function entity;

    Alternatively, the second client credential assertion includes the first client credential assertion; the method further includes:

    the second network function entity verifies that the first client credential assertion is included in the second client credential assertion;

    Alternatively, the second client credential assertion includes a hash value of the first client credential assertion; the method further includes:

    The second network function entity verifies that the second client credential assertion includes a hash value of the first client credential assertion; or, the second client credential assertion includes data of the first service request; the Methods also include:

    The second network function entity verifies that the second client credential statement includes the data of the first service request;

    Alternatively, the second client credential statement includes a hash value of the data of the first service request; the method further includes:

    The second network function entity verifies that the second client credential statement includes a hash value of the data of the first service request;

    Or, the second client credential statement includes the identity of the originator network function entity of the second client credential statement, including: the signed content in the second client credential statement includes the second client credential statement the identity of the initiator network function entity; the method further includes:

    The second network function entity verifies whether the identity of the originator network function entity of the second client credential statement included in the signed content in the second client credential statement is the certificate information in the second client credential statement The identification of the network functional entity in ;

    Alternatively, the first client credential declaration is included in a second service request sent by the second network function entity to the first network function entity; the second service request further includes the first client credential declaration The network identity of the network where the network function entity of the expected recipient is located; the second client credential statement includes the identity of the network function set to which the originator network function entity of the second client credential statement belongs; the method further includes:

    The second network function entity verifies whether the identity of the network function set to which the originator network function entity of the second client credential assertion belongs is the intended recipient network of the first client credential assertion included in the second service request The network identifier of the network where the functional entity is located;

    Or, the second client credential statement includes the network identifier of the network where the network function entity of the originator of the second client credential statement is located, including: the signed content in the second client credential statement includes the second client The network identifier of the network where the network function entity of the originator of the credential declaration is located; the method further includes:

    The second network function entity verifies whether the network identity of the network where the network function entity of the originator of the second client certificate statement included in the signed content of the second client certificate statement is the second client certificate statement The network identity in the certificate information in .
18. A first network function entity, characterized in that the first network function entity comprises: a transceiver module and a processing module;

    The transceiver module is configured to receive a first client credential statement from a second network function entity, where the first client credential statement includes a network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located, the first network function entity belongs to a first network, the second network function entity belongs to a second network, and the first network and the second network are different networks;

    The processing module is configured to verify whether the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is the network identifier of the first network.
19. The first network function entity according to claim 18, wherein the transceiver module is specifically configured to:

    A first message is received by a first security edge protection proxy entity, the first message including the first client credential assertion from the second network function entity.
20. The first network function entity according to claim 19, wherein the first message further includes a first root certificate, and the first root certificate is a root certificate of the second network;

    The processing module is further configured to verify, according to the first root certificate, whether the certificate information declared by the first client certificate is correct.
21. The first network function entity according to claim 19 or 20, wherein the first message further comprises a first authorization order used by the second network function entity to request the service of the first network function entity The first authorization token includes the network identifier of the second network;

    The processing module is further configured to verify whether the network identifier of the second network is the network identifier in the certificate information declared by the first client certificate.
22. The first network function entity according to any one of claims 19-21, wherein the first message further includes an identifier of a network function set to which the network function entity of the expected recipient of the first client credential declaration belongs;

    The processing module is further configured to verify whether the identifier of the network function set to which the intended recipient network function entity of the first client credential statement belongs is the identifier of the network function set to which the first network function entity belongs.
23. The first network function entity according to any one of claims 18-22, wherein the first client credential statement further comprises a network function set of a network function set where a network function entity of a desired recipient of the first client credential statement is located. identification;

    The processing module is further configured to verify whether the identifier of the network function set to which the intended recipient network function entity declared by the first client credential belongs is the identifier of the network function set to which the first network function entity belongs.
24. The first network function entity according to any one of claims 18 to 23, wherein the signed content of the first client credential statement includes the network where the originator network function entity of the first client credential statement is located. 's network identity;

    The processing module is further configured to verify whether the network identifier of the network where the originator network function entity of the first client credential statement is located is the network identifier in the certificate information of the first client credential statement.
25. The first network function entity according to any one of claims 18 to 24, wherein the first network function entity verifies the network identity of the network where the network function entity of the expected recipient of the first client credential statement is located After being the network identifier of the first network,

    The transceiver module is further configured to send a second client credential statement to the second network function entity, where the second client credential statement includes the network of the network where the network functional entity of the intended recipient of the second client credential statement is located logo.
26. The first network function entity of claim 25, wherein the second client credential assertion includes at least one of the following parameters:

    the identity of the intended recipient network function entity of the second client credential assertion;

    The identifier of the network function set to which the intended recipient network function entity of the second client credential statement belongs;

    the type of intended recipient network function entity of the second client credential assertion;

    the first client credential assertion, or a hash of the first client credential assertion;

    Data of the first service request, or a hash value of the data of the first service request, where the first service request is a service request bearing the first client credential statement;

    the identity of the originator network function entity of the second client credential assertion;

    The identifier of the network function set to which the originator network function entity of the second client credential statement belongs;

    Or, the network identifier of the network where the network function entity of the originator of the second client credential statement is located.
27. The first network function entity according to any one of claims 18-26, wherein the first client credential declaration is included in a second service request, wherein the data of the second service request is included in the In the first client credential statement mentioned above,

    The transceiver module is further configured to verify the correctness of the data requested by the second service.
28. A second network function entity, characterized in that the second network function entity comprises: a transceiver module and a processing module;

    The processing module is configured to obtain a first client credential statement, where the first client credential statement includes the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located;

    The transceiver module is configured to send the first client credential statement to the first network function entity, and the network identifier of the network where the network function entity of the expected recipient of the first client credential statement is located is used to verify whether it is compatible with the first network. The network identifiers are the same, wherein the first network function entity belongs to the first network, the second network function entity belongs to the second network, and the first network and the second network are different networks.
29. The second network functional entity according to claim 28, wherein:

    The transceiver module is further configured to send, to the first network function entity, a first authorization token used by the second network function entity to request services of the first network function entity, the first authorization token includes the network identification of the second network, and the identification of the second network is used to verify whether it is the same as the network identification in the certificate information in the first client credential statement.
30. The second network functional entity according to claim 28 or 29, characterized in that:

    The transceiver module is further configured to send, to the first network function entity, the identifier of the network function set to which the network function entity of the intended recipient of the first client credential statement belongs, the network of the intended recipient of the first client credential statement The identification of the network function set to which the functional entity belongs is used to verify whether it is the same as the identification of the network function set to which the first network function entity belongs.
31. The second network function entity according to claim 28 or 29, wherein the first client credential statement further comprises an identifier of the network function set to which the network function entity of the expected recipient of the first client credential statement belongs, and the The identity of the network function set to which the intended recipient network function entity of the first client credential statement belongs is used to verify whether it is the same as the identity of the network function set to which the first network function entity belongs.
32. The second network functional entity according to any one of claims 28-31, wherein,

    The transceiver module is further configured to receive a second client credential statement from the first network function entity, where the second client credential statement includes the network function entity of the network where the intended recipient of the second client credential statement is located. network identification;

    The processing module is further configured to verify whether the network identifier of the network where the network function entity of the expected recipient of the second client credential statement is located is the network identifier of the second network.
33. The second network function entity of claim 32, wherein the second client credential statement further comprises at least one of the following parameters:

    the identity of the intended recipient network function entity of the second client credential assertion;

    The identifier of the network function set to which the intended recipient network function entity of the second client credential statement belongs;

    the type of intended recipient network function entity of the second client credential assertion;

    the first client credential assertion, or a hash of the first client credential assertion;

    Data of the first service request, or a hash value of the data of the first service request, where the first service request is a service request bearing the first client credential statement;

    the identity of the originator network function entity of the second client credential assertion;

    The identifier of the network function set to which the originator network function entity of the second client credential statement belongs;

    Or, the network identifier of the network where the network function entity of the originator of the second client credential statement is located.
34. The second network function entity according to claim 33, wherein the second client credential statement includes an identification of a desired recipient network function entity of the second client credential statement; and the processing module is further configured to: verifying whether the identity of the intended recipient network function entity of the second client credential assertion is the identity of the second network function entity;

    Alternatively, the second client credential statement includes an identifier of the network function set where the network function entity of the expected recipient of the second client credential statement is located; the processing module is further configured to verify the expected reception of the second client credential statement Whether the identity of the network function set to which the second network function entity belongs is the identity of the network function set to which the second network function entity belongs

    Alternatively, the second client credential assertion includes the type of the intended recipient network function entity of the second client credential assertion; the processing module is further configured to verify the intended recipient NFE of the second client credential assertion Whether the type is the type of the second network function entity;

    Alternatively, the second client credential statement includes the first client credential statement; the processing module is further configured to verify that the second client credential statement includes the first client credential statement;

    Alternatively, the second client credential claim includes a hash value of the first client credential claim; the processing module is further configured to verify that the second client credential claim includes the hash value of the first client credential claim value;

    Alternatively, the second client credential statement includes the data of the first service request; the processing module is further configured to verify that the second client credential statement includes the data of the first service request;

    Or, the second client credential statement includes a hash value of the data requested by the first service; the processing module is further configured to verify that the second client credential statement includes the data of the first service request. hash value;

    Or, the second client credential statement includes the identity of the originator network function entity of the second client credential statement, including: the signed content in the second client credential statement includes the second client credential statement The identity of the originator network function entity; the processing module is further configured to verify whether the identity of the originator network function entity of the second client credential statement included in the signed content of the second client credential statement is the Describe the identity of the network function entity in the certificate information in the second client certificate statement;

    Alternatively, the first client credential declaration is included in a second service request sent by the second network function entity to the first network function entity; the second service request further includes the first client credential declaration The network identifier of the network where the network function entity of the expected recipient is located; the second client credential statement includes the identifier of the network function set to which the network function entity of the originator of the second client credential statement belongs; the processing module is further configured to verify all Whether the identity of the network function set to which the originator network function entity of the second client credential statement belongs is the network identity of the network where the network function entity of the expected recipient of the first client credential statement included in the second service request is located;

    Or, the second client credential statement includes the network identifier of the network where the network function entity of the originator of the second client credential statement is located, including: the signed content in the second client credential statement includes the second client the network identifier of the network where the network function entity of the originator of the credential statement is located; the processing module is further configured to verify the originator network function of the second client credential statement included in the signed content of the second client credential statement Whether the network identifier of the network where the entity is located is the network identifier in the certificate information in the second client credential statement.
35. A communication system, characterized in that the communication system includes a first network function entity and a second network function entity, the first network function entity belongs to the first network, and the second network function entity belongs to the second network, the first network and the second network are different networks;

    the second network function entity is configured to send a first client credential statement to the first network function entity, where the first client credential statement includes the network where the network function entity of the expected recipient of the first client credential statement is located 's network identity;

    The first network function entity is configured to receive the first client credential statement from the second network function entity, and verify whether the network identity of the network where the network function entity of the intended recipient of the first client credential statement is located is located is the network identifier of the first network.
36. A computer-readable storage medium, characterized in that, the computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is made to execute the method described in any one of rights 1 to 17.

Images